Threat Alerts

Threat actors compromised the update distribution infrastructure of a Linux server security tool, using stolen vendor credentials to distribute a malicious script that installed a backdoor and collected sensitive system files. The malicious updates were delivered through several consecutive tool versions, turning a trusted software update mechanism into a malware distribution channel. The vendor detected the compromise within 12 hours, secured the compromised account, rotated infrastructure credentials, and stopped further distribution.

The malicious script collected Linux account files, database configurations, root shell history, and SSH files before transmitting the data to the vendor’s licensing server for later retrieval. Preliminary findings confirmed that the attacker retrieved 32 files associated with individual customer servers, although the total number of affected systems remains unknown. Stolen password hashes could enable offline cracking, while database configurations and shell history may expose credentials and other secrets. Removing the backdoor does not invalidate credentials already stolen. Organizations should identify affected installations, rotate potentially exposed credentials and SSH keys, review database access, and investigate suspicious activity associated with the compromised updates.

SonicWall has disclosed a high-severity vulnerability (CVE-2026-19868, CVSS 7.5) affecting SonicOS firewalls configured with SAML-based SSL-VPN authentication. The flaw allows attackers possessing valid credentials for an alternative authentication method to bypass SAML authentication controls, including enforced multi-factor authentication (MFA), potentially gaining unauthorized access to internal networks.

The vulnerability has reportedly been exploited in the wild, with CISA adding it to its Known Exploited Vulnerabilities (KEV) catalog. SonicWall has released security updates addressing the vulnerability alongside six additional flaws.

No vendor workaround is provided, so systems should be treated as potentially exposed until patched and historical VPN sessions during the exposure window are reviewed.

Debian has released a security update addressing a man-in-the-middle (MitM) vulnerability in APT, the primary package manager used by Debian and several derivatives, including Ubuntu and Linux Mint. The flaw could allow attackers to execute arbitrary code with root privileges by exploiting improper handling of redirected package downloads. APT may merge separate package downloads when HTTP redirects resolve to the same URI, creating an opportunity for a MitM attacker to manipulate resumed downloads.

The vulnerability allows an attacker to replace a package after its integrity verification, causing a tampered package to be treated as legitimate and potentially executed with root-level privileges. Debian addressed the issue in its stable release. The security update also resolves several out-of-bounds access vulnerabilities. Given APT’s widespread use across Debian-based distributions, administrators should prioritize applying the security update to prevent potential package tampering and system compromise.

Google released Chrome 157 with fixes for 213 security vulnerabilities, including seven flaws rated Critical. The critical issues affect several core browser components and are primarily memory-safety vulnerabilities that may allow a remote attacker to trigger crashes or potentially achieve arbitrary code execution by convincing a user to visit a specially crafted or compromised webpage. Chrome versions prior to 157.0.8103.38 are affected.

The seven critical vulnerabilities are CVE-2026-121156 (CVSS 9.6) and CVE-2026-121247 (CVSS 8.6), both buffer overflows in Dawn; CVE-2026-121229 (CVSS 9.6), a memory-corruption vulnerability in ANGLE; CVE-2026-121246 (CVSS 9.6), a use-after-free flaw in WebGL; CVE-2026-121035 (CVSS 9.6), a use-after-free vulnerability in Prerender; CVE-2026-121203 (CVSS 8.8), a use-after-free issue in Geometry; and CVE-2026-121126 (CVSS 9.6), a use-after-free vulnerability in Core. Four of the seven critical issues affect Chrome’s graphics-processing stack, including WebGPU, ANGLE, and WebGL components that process attacker-controlled web content.

Of particular concern, CVE-2026-121229 may allow remote code execution outside the Chrome sandbox through a crafted HTML page. Google has not publicly indicated that any of the seven critical vulnerabilities are being actively exploited in the wild. Chrome 157 was released for Windows, macOS, Linux, and Android, although the update is being distributed through a staged rollout.

Threat actors are increasingly moving beyond using AI to generate malicious content or assist with individual tasks, instead deploying agentic AI frameworks capable of carrying out multiple stages of an intrusion. In activity observed since August 2026, attackers used frameworks including ARTEX to autonomously search public GitHub repositories for exposed application secrets, OAuth credentials, and API keys, then test those credentials against Microsoft Entra ID to gain access to Azure and Microsoft 365 environments. Once authenticated, the agents enumerated cloud resources, retrieved additional credentials from Azure Key Vault and Storage Accounts, and accessed SharePoint, OneDrive, and Azure DevOps. In some cases, compromised multi-tenant application credentials provided access to multiple customer environments through a single vendor-owned application. In one observed instance, an AI agent moved from identifying exposed GitHub credentials to exfiltrating data from Azure Key Vault within five minutes. The activity illustrates a shift toward AI agents being used to execute connected attack steps, rather than simply supporting attackers with research or code generation.

A data breach at Spanish travel technology provider Amadeus has exposed passenger reservation information across multiple international airlines, including Japan Airlines, Cathay Pacific, Korean Air, and Asiana Airlines. Attackers reportedly used valid system credentials to access booking records without directly compromising the airlines’ networks. Exposed information included passenger names, booking references, flight itineraries, and, in some cases, contact and travel document details, with no confirmed exposure of payment card data. The incident highlights the risks associated with shared third-party infrastructure, where a single compromise can affect multiple organizations.

A separate recent breach involving a hotel reservation platform demonstrates how this type of information can be misused. Attackers sent fraudulent emails, SMS, and WhatsApp messages containing guests’ actual names, reservation numbers, and stay dates. The messages impersonated accommodation providers, claimed that payments had failed or bookings were at risk of cancellation, and directed guests to fraudulent websites to submit payment information. Although no misuse of the Amadeus data has been confirmed, these incidents demonstrate how exposed reservation details can support convincing phishing and payment fraud, particularly ahead of the holiday travel season. Organizations should review third-party access permissions, monitor trusted integrations, and assess suppliers’ security controls to reduce the impact of potential supply-chain compromises.