Detecteam

Our REFLEX platform automates the detection lifecycle—building, testing, validating and deploying detections in minutes, not months.

[Cyber Security News @The_Cyber_News]

🚨 New 7-Zip Flaws Let Attackers Execute Arbitrary Code and Compromise Systems

Source: https://t.co/WqnpW3mfn2

A critical heap buffer overflow vulnerability has been disclosed in 7-Zip version 26.00, enabling attackers to achieve arbitrary code execution via a vtable hijack by exploiting a defect in the tool's NTFS archive handler.

Tracked as CVE-2026-48095 and assigned advisory GHSL-2026-140, the flaw resides in the CInStream::GetCuSize() function inside NtfsHandler.cpp. The function computes the NTFS compression-unit buffer size using a 32-bit shift operation: (UInt32)1 << (BlockSizeLog + CompressionUnit).

Users are strongly advised to update 7-Zip to a patched version v26.01 immediately and avoid opening untrusted archive files or disk images of any extension until a fix is applied.

#cybersecuritynews

[Prasenjit @Star_Knight12]

hackers are now hiding malicious code inside .cursorrules and CLAUDE.md files.

invisible Unicode characters, your AI reads them, you don't.

→ 34 malicious packages across npm, PyPI and Crates .io
→ 384 versions designed to steal SSH keys, crypto wallets, and API tokens
→ attackers opened real PRs to LangChain, LlamaIndex, and MetaGPT to sneak these files in
→ your AI runs a fake "security scan" that silently exfiltrates everything

Socket detected it in under 6 minutes.

check your repos.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Defender detected and protected customers against a new software supply chain compromise affecting the "pytorch-lightning" package and immediately reported the issue to the repository maintainers for takedown: https://t.co/yZsFqek0Cr.

At the time the compromised packages were identified and distributed, Microsoft Defender had proactive detections that blocked the malicious files as Trojan:JS/ShaiWorm.DQ!MTB. For protected environments, Microsoft Defender for Endpoint raised the alert "ShaiWorm malware was prevented".

Our assessment indicates that Microsoft continues to provide strong protection coverage and has prevented observed activity indicating attempts to install the modified packages. Microsoft Defender continues to monitor for potential follow-on activity, including suspicious use of potentially exposed cloud credentials across major cloud platforms.

Observed activity remains limited to a small number of devices and appear contained to a narrow set of environments. We are also investigating container-based telemetry and registry-related signals that may indicate potential compromise in some scenarios.

Microsoft continues to monitor and investigate the issue, with layered protections, broad prevention coverage, and ongoing hunting efforts in place. We will share updates as more information becomes available.

[Cyber Security News @The_Cyber_News]

⚠️ Critical Wireshark Flaws Let Attackers Execute Arbitrary Code Via Malformed Packets

Source: https://t.co/6dBCOkuhxB

Wireshark, the world's most widely used open-source network protocol analyzer, has released a major security update addressing over 40 vulnerabilities, several of which enable arbitrary code execution through malformed packet injection or malicious capture files.

Organizations and individuals relying on Wireshark for network monitoring, forensics, and traffic analysis should update immediately to Wireshark 4.6.5. The most severe vulnerabilities in this release carry the potential for remote code execution (RCE), moving beyond simple denial-of-service impact.

#cybersecuritynews #wireshark

[Cyber Security News @The_Cyber_News]

🛡️ Trellix Source Code Breach - Hackers Gain Unauthorized Access to Repository

Source: https://t.co/oKUr7fUdWh

Cybersecurity giant Trellix has disclosed a significant security incident involving unauthorized access to a portion of its source code repository.

The company confirmed the breach in an official statement published on its website, stating it immediately engaged leading forensic experts upon discovering the intrusion.

Source code repositories are prime targets for attackers seeking to identify exploitable vulnerabilities, embed backdoors, or conduct supply chain attacks against downstream customers.

#cybersecuritynews #Databreach

[Cyber Security News @The_Cyber_News]

🚨 cPanelSniper - PoC Exploit Disclosed for cPanel Vulnerability, 44,000 Servers Compromised

Source: https://t.co/wwsBnz5wTc

A weaponized proof-of-concept (PoC) exploit framework dubbed "cPanelSniper" has been publicly released for CVE-2026-41940, a maximum-severity authentication bypass in cPanel & WHM that has already led to the compromise of tens of thousands of servers worldwide with attack activity traced as far back as late February 2026.

The Shadowserver Foundation confirmed on April 30, 2026, that 44,000 unique IP addresses were observed scanning for victims, launching exploits, or conducting brute-force attacks against their honeypot sensors.

#cybersecuritynews #vulnerability

[Yunus Emre Öztaş @ynsmroztas]

🚨 cPanelSniper — CVE-2026-41940

cPanel & WHM'de CVSS 10.0 kritik auth bypass.

CRLF injection → session file poisoning → root WHM access.

Zero creds. ~70M domain affected.

4-stage chain:

→ preauth session mint

→ CRLF inject via Authorization header

→ do_token_denied gadget (raw→cache flush)

→ /json-api/version → PWNED

✅ Interactive WHM shell

✅ Account enum · cmd exec · backdoor admin

✅ Bulk scan · pipeline ready · stdlib only

🔗 https://t.co/gmRA0xtEsx

#BugBounty #InfoSec #WHM #RedTeam #AppSec #bugbountytip #bugbountytips #infosec #recon

[Cyber Security News @The_Cyber_News]

⚠️ Linux Kernel 0-Day "Copy Fail" Roots Every Major Distribution Since 2017

Source: https://t.co/fyfuQjBYHn

A critical zero-day vulnerability in the Linux kernel has been publicly disclosed, enabling any unprivileged local user to obtain root access on virtually every major Linux distribution shipped since 2017.

Copy Fail is a straight-line logic bug not a race condition in the Linux kernel's authencesn cryptographic template, reachable via the AF_ALG socket interface combined with the splice() system call.

A single 732-byte Python script using only standard library modules achieves deterministic root on every tested distribution and architecture.

#cybersecuritynews #linux #CopyFail

[Wiz @wiz_io]

🚨 BREAKING: Wiz Research discovered Remote Code Execution on https://t.co/SvN2lGsnbO with a single git push

The flaw in @github allowed unauthorized access to millions of repositories belonging to other users and organizations 🤯

[FalconFeeds.io @FalconFeedsio]

🚨 Ransomware Alert 🚨

Qilin Ransomware group has added 4 new victims to their dark web portal.

* A &amp; A BUILDING MATERIAL CO 🇺🇸
* Longwood Engineering Company Limited 🇬🇧
* Exclusive Networks 🇫🇷
* iSTARpal 🇲🇾

[Andy Greenberg (@agreenberg at the other places) @a_greenberg]

A newly decoded piece of sabotage malware called Fast16, created before Stuxnet, was made to silently tamper with calculations in research and engineering software. Likely created by the US or an ally, and possibly used against Iran's nuclear program. https://t.co/jE045ejq6u

[blackorbird @blackorbird]

#Lazarus C2 Control Panels &amp; About How They Use AI to Industrialize Attacks on Developers
#AiSecurity
https://t.co/JeMGdPRkcE

[Cyber Security News @The_Cyber_News]

⚠️ Windows RPC Vulnerability Lets Attackers Escalate Privileges Across All Windows Versions

Source: https://t.co/luN3UDOucJ

PhantomRPC, a newly identified architectural vulnerability in Windows Remote Procedure Call (RPC) that enables local privilege escalation to SYSTEM-level access, potentially affecting every version of Windows. PhantomRPC is not a classic memory corruption bug or a logic flaw in a single component.

Instead, it exploits an architectural design weakness in how the Windows RPC runtime (rpcrt4.dll) handles connections to unavailable RPC servers. When a highly privileged process attempts an RPC call to a server that is offline or disabled, the RPC runtime does not verify whether the responding server is legitimate.

#cybersecuritynews #Windows

[Cyber Security News @The_Cyber_News]

🚨 Hackers Abuse SS7 and Diameter Protocols to Track Mobile Users Worldwide

Source: https://t.co/kO27x4ixcV

A major investigation has revealed that sophisticated threat actors are exploiting fundamental vulnerabilities in global mobile networks to track users worldwide.

By abusing legacy 3G SS7 and 4G Diameter signaling protocols, hackers are successfully bypassing telecom firewalls to conduct silent, cross-border espionage.

By functioning as "Ghost Operators," they manipulate routing data to mask their origins while pinpointing the exact locations of high-value targets.

While the older SS7 protocol completely lacks basic authentication, the newer 4G Diameter protocol suffers from weak security implementation across the industry.

#cybersecuritynews

[Cyber Security News @The_Cyber_News]

⚠️ CrowdStrike LogScale Vulnerability Allows Remote Attackers to Read Files from Server

Source: https://t.co/ZIk1ToJCb8

An urgent security advisory for a critical unauthenticated path-traversal vulnerability (CVE-2026-40050) affecting its LogScale platform, warning that a remote attacker could exploit the flaw to read arbitrary files directly from the server’s filesystem without authentication.

The vulnerability resides in a specific cluster API endpoint within CrowdStrike LogScale. If this endpoint is exposed, a remote attacker can leverage it to traverse the server’s directory structure and access sensitive files without needing credentials.

#cybersecuritynews

[blackorbird @blackorbird]

#Sandworm group leverages nested SSH-TOR tunnels to build a double-encrypted anonymous direct elevator between victims and attackers.
This highly evasive attack enables unrestricted sensitive data theft and persistent remote control.
https://t.co/YkHn7CWCaC

[Cyber Security News @The_Cyber_News]

🚨 Gentlemen RaaS Attacking Windows, Linux With additional locker written in C for ESXi

Source: https://t.co/63TQXITj2Z

A new ransomware-as-a-service (RaaS) operation known as “The Gentlemen” has emerged as a serious threat to corporate networks worldwide.

Since appearing around mid-2025, this group has rapidly grown into a well-organized criminal platform, publicly claiming over 320 victims, with most attacks more than 240 recorded in the opening months of 2026.

The group offers lockers written in the Go programming language that work across Windows, Linux, NAS, and BSD environments, along with a separate locker written in C specifically designed to target VMware ESXi hypervisors.

#cybersecuritynews

[Cyber Security News @The_Cyber_News]

🚨 Microsoft Defender 0-Day Vulnerability “RedSun” Enables Full SYSTEM Access

Source: https://t.co/s1vfh5GLcg

A newly disclosed zero-day vulnerability in Microsoft Defender, dubbed "RedSun," allows an unprivileged user to escalate privileges to full SYSTEM-level access on fully patched Windows 10, Windows 11, and Windows Server 2019 and later systems, and as of now, remains unpatched.

RedSun is the second zero-day exploit published within a two-week span in April 2026 by the security researcher known as "Chaotic Eclipse" (also referred to as Nightmare-Eclipse on GitHub).

RedSun follows the same exploit tradition but introduces an entirely new and independent attack vector, suggesting that Defender's architectural weaknesses run far deeper than a single isolated flaw.

#cybersecuritynews #Windowsdefender

[Cyber Security News @The_Cyber_News]

🚨 Microsoft SharePoint Server 0-Day Vulnerability Actively Exploited in Attacks

Source: https://t.co/cPB7CZ2Nf7

A critical zero-day spoofing vulnerability in Microsoft SharePoint Server is being actively exploited in the wild, Microsoft confirmed on April 14, 2026, as part of its monthly security update cycle.

Tracked as CVE-2026-32201, the flaw affects multiple versions of SharePoint Server and has been assigned a CVSS base score of 6.5 (Important), with an adjusted temporal score of 6.0 reflecting the availability of an official fix.

The vulnerability stems from improper input validation (CWE-20) in Microsoft Office SharePoint, allowing an unauthenticated remote attacker to perform spoofing attacks over a network.

#cybersecuritynews

[BleepingComputer @BleepinComputer]

CISA flags Windows Task Host vulnerability as exploited in attacks
https://t.co/CJYLdK2T9S

https://t.co/CJYLdK2T9S