News

24 reviewed Egret articles

News

Egret

Android TV backdoor preloaded by manufacturer reinstalls itself after users remove it

Videostrong preloaded an Android TV backdoor in device firmware that automatically reinstalls itself after users uninstall it, researchers at Google T…

News

Crafted cookie lets attackers bypass Xen Orchestra login and take over virtualization hosts
A specially crafted authentication cookie can let remote attackers log into Xen Orchestra as an administrator and seize XCP-ng virtualization hosts, V

News12.11.2026New
Underground eBPF rootkit tutorials show how Linux implants hide from routine checks
Flare researchers found underground forum posts sharing eBPF rootkit code that hides running processes and activates when it receives a specially craf

News12.11.2026New
Check-then-open race lets MCP filesystem server read outside allowed directories
A local attacker can make the MCP filesystem server leak files outside its allowed directories: it checks a path, then reopens it by name, allowing a

News12.11.2026New
mcp-server-fetch SSRF guard classifies internal IPv6 site-local address as public
The address guard in mcp-server-fetch wrongly classifies an internal IPv6 site-local address as public, letting a fetch bypass the SSRF check meant to

News12.11.2026
Read-only Git status call runs attacker commands hidden in a repository's config
A read-only request for Git repository status can run a program chosen by the repository itself. The advisory reports that mcp-server-git lets an untr

News12.11.2026
Defender exclusion for all of Windows stays behind after Armorsteal is cleaned up
Seqrite Labs reports that Armorsteal can leave a Windows Defender exclusion covering all of C:\Windows even after the malware kit itself has been clea

News11.11.2026
SonicWall SSL-VPN flaw lets alternate credentials bypass SAML and MFA
SonicWall says attackers can bypass SAML authentication—and any SAML-enforced MFA—on SSL-VPN by logging in with valid credentials for another authenti

News11.11.2026
Flawed OpenSSH lets attackers log into password-locked accounts with long passwords
An OpenSSH flaw called SSHole lets attackers log into password-locked accounts—those whose /etc/shadow field is literally an asterisk—by sending an ov

News11.11.2026
FBI agent stole nearly $2.5 million in crypto from investigations he was handling
A former FBI agent pleaded guilty to stealing nearly $2.5 million in cryptocurrency from fraud victims and nation-state hackers in investigations he w

News11.11.2026
Malicious Ruby gem steals credentials at install and may wipe files after a GitHub token is revoked
Installing a seemingly small Ruby string-helper gem runs a credential-stealing worm during setup, Socket Research reports; a separate token monitor ca

News11.11.2026
Compromised Qubole credentials let attackers steal secrets and S3 data across customers' AWS accounts
A threat actor used compromised Qubole IAM credentials to reach into tens of customers' AWS environments, stealing secrets and downloading S3 data bet

News11.11.2026
Turla's Cereal toolkit turned compromised Exchange servers into covert command posts
ESET researchers found that Turla's Cereal toolkit turned two national governments' own Microsoft Exchange servers into covert command posts, leaving

News11.11.2026
Shared Aspire CLI temp files expose configuration to local users
A local user on shared Linux or macOS hardware can read sensitive Aspire CLI configuration because the tool writes diagnostics to a fixed temporary-fi

News11.11.2026
Beget wiper attack leaves half of VPS customers with unrecoverable data
A data-wiping intruder has left Russian cloud provider Beget rebuilding from scratch, with data loss irreversible for roughly half of VPS customers af

News10.11.2026
Paginated file-read tool lets attackers escape the project folder and read any server file
A file-read tool in an AI code assistant can be tricked into reading any file on the server, not just files inside the project folder. GitHub's adviso

News10.11.2026
Spoofed X-Forwarded-For header bypasses ezBookkeeping IP allowlist and forges audit logs
A single forged X-Forwarded-For header lets any remote caller defeat ezBookkeeping’s configured IP allowlist and have actions logged under a trusted a

News10.11.2026
Telepresence traffic manager lets any cluster pod steal intercepted services' environment secrets
Telepresence's Traffic Manager gRPC API on port 8081 requires no authentication, so any pod with cluster-network access can register in a managed name

News10.11.2026
MCP filesystem directory-size listing follows symlinks and leaks outside-file sizes
The MCP filesystem tool `list_directory_with_sizes` follows symlinks when listing children, so an inside symlink to an outside file leaks that file's

News10.11.2026
Elo AST injection lets attackers run code through generated JavaScript, Ruby, Python or SQL output
Attackers can force @enspirit/elo to emit executable JavaScript, Ruby, Python or SQL code by supplying malicious values to its programmatic AST API, r

News10.11.2026
Telegram uploads let any default sender overwrite praktor agent instruction files
A remote Telegram user who can message praktor by default can write files outside the uploads directory into the agent's persistent workspace, private

News10.11.2026
Malicious tool definitions let attackers run arbitrary code in banks despite Jinja sandbox fix
A malicious prompt can make the banks LLM template library run arbitrary code through its tool-handling path, GitHub's advisory warns. The flaw surviv

News10.11.2026
Crafted PKCS#12 files pass node-forge password checks with any password
An attacker who does not know a password can alter a PKCS#12 file and still make node-forge accept it as valid under that password, GitHub’s advisory

News10.11.2026
Compromised credentials fed to ARTEX let agentic tools reach deep network access in hours
Google Threat Intelligence and Mandiant say attackers supplied compromised credentials to agentic pentesting frameworks such as ARTEX, letting the too

News12.11.2026

DIRECT FROM MONITORED SOURCES

Security source watch

Browse all →

300 source records from the past 30 days. These are attributed discovery links, awaiting Egret editorial review. Dates below come from the original publishers.

Default Egret cover

CVE FeedNov 12, 2026

CVE-2026-8332 - TimePictra root password hardcoded in installation files

CVE-2026-8332 TimePictra root password hardcoded in installation files Description A vulnerability in Microchip TimePictra. This issue affects TimePictra: before 12.0. INFO Published Date : Nov. 12, 2026, 6:19 a.m. Last …

CVE-2026-8332

Read the original source ↗

Default Egret cover

CVE FeedNov 12, 2026

CVE-2026-8331 - TimePictra ermote code execution via file upload

CVE-2026-8331 TimePictra ermote code execution via file upload Description An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrai…

CVE-2026-8331

Read the original source ↗

Default Egret cover

CVE FeedNov 12, 2026

CVE-2026-8333 - TimePictra Stored Cross-site Scripting

CVE-2026-8333 TimePictra Stored Cross-site Scripting Description A vulnerability in Microchip TimePictra. This issue affects TimePictra: before 12.0. INFO Published Date : Nov. 12, 2026, 6:18 a.m. Last Modified : Nov. 12…

CVE-2026-8333

Read the original source ↗

Default Egret cover

CVE FeedNov 12, 2026

CVE-2026-87772 - Unauthenticated Polkit Privilege Escalation in TÜBİTAK BİLGEM's Pardus About

CVE-2026-87772 Unauthenticated Polkit Privilege Escalation in TÜBİTAK BİLGEM's Pardus About Description Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows…

CVE-2026-87772

Read the original source ↗

Default Egret cover