A recent patch for the Windows Defender zero-day vulnerability, RoguePlanet (CVE-2026-50656), which previously allowed remote administrative control of Windows 10 and 11, has introduced a new flaw enabling attackers to exhaust disk space. The researcher NightmareEclipse, who initially disclosed RoguePlanet, identified that "defense-in-depth" additions in the Microsoft Malware Protection Engine update cause mpengine.dll to leak 8 bytes of data when opening files, with new SpyNet functionality also contributing. Attackers can exploit this by configuring a custom Server Message Block (SMB) server to deliver a malicious file followed by a massive Zone.Identifier Alternative Data Stream (ADS) file. Windows Defender will attempt to cache this large ADS file locally, bypassing typical size limits, and if the SMB server maintains the connection without responding to read requests, Defender will hang, continuously writing data and consuming all available disk space, leading to system instability. This issue further escalates an ongoing dispute between NightmareEclipse and Microsoft concerning vulnerability disclosures.
An exposed Python SimpleHTTPServer instance, left open for 22 days, revealed the full operational toolkit, logs, and target lists of a financially motivated cybercrime group, now tracked as WP-SHELLSTORM. This operation targeted over 1.4 million domains, weaponized 27 CVEs, and deployed more than 5,700 active webshells. The exposed directory, located at 137.175.93[.]126, contained 800MB of webshells, exploit scripts, scan results, bash history, and C2 configurations. Attribution points to a Chinese-linked actor, evidenced by the system user "tance," the handle "chen-kk," use of FOFA (a Chinese reconnaissance tool), and Simplified Chinese in the code. Beyond WordPress, the actor also targeted Apache Nacos, XXL-Job, and Spring Boot infrastructure, exploiting vulnerabilities like CVE-2021-29441 (Nacos authentication bypass) to exfiltrate 613 configuration files from 11 victim systems in May 2026, obtaining cloud credentials, database connection strings, and Alipay RSA private keys. The primary webshell, `down.php`, is a heavily obfuscated BestShell derivative, capable of extensive post-exploitation activities, while a dropper named SNOWLIGHT deploys the VShell implant, which renames its process to `[kworker/0:2]` for stealth. Key vulnerabilities exploited include Breeze Cache (CVE-2026-3844), ThemeREX Addons (CVE-2026-1969), and Joomla JCE (CVE-2026-48907). The actor attempted to cover tracks by deleting log entries after discovery, but weak operational security, including exposed FOFA config and hardcoded webshell credentials, facilitated the investigation. Defense measures include blocking known infrastructure (137.175.93[.]126, 43.108.17[.]80, 113.196.56[.]150, xs.xxooonline[.]eu[.]cc), scanning for specific webshell filenames and hashes (e.g., `down.php` SHA256: 84F7E396A48913851A10CC78C5CC22A25634564ABD0694465236D2F365E2BDEE), monitoring for suspicious `[kworker/X:Y]` processes, upgrading Nacos to 2.2.1+ with authentication enabled, securing XXL-Job and Spring Boot endpoints, and updating or disabling targeted WordPress/Joomla plugins.
A critical Linux kernel vulnerability, tracked as CVE-2026-31694, exists within the FUSE subsystem, enabling unprivileged local users to achieve root privilege escalation. This flaw, present in the `fuse_add_dirent_to_cache()` function (fs/fuse/readdir.c), stems from a 24-byte heap overflow past the end of a page cache page. Specifically, when the `FOPEN_CACHE_DIR` flag is enabled, an attacker can craft a FUSE directory entry with a `namelen` of 4095 bytes, resulting in a 4120-byte record that exceeds the standard 4 KiB `PAGE_SIZE` on `x86_64` systems. This overflow allows for controlled corruption of the page cache, which can be exploited by strategically placing the oversized FUSE directory entry page immediately before the `.init` section of a cached SUID binary, such as `/usr/bin/su` on Ubuntu 26.04 with a vulnerable 7.0 kernel. The injected payload, minimal `x86_64` shellcode calling `setuid(0)` and `setgid(0)`, executes with root privileges before the normal authentication flow, granting a root shell. This vulnerability affects Linux kernels from v6.16-rc1 onwards, particularly on systems with 4 KiB page sizes where unprivileged FUSE mounts are possible. The issue is resolved by commit `51a8de6c50bf947c8f534cd73da4c8f0a13e7bed`, which prevents caching directory entries larger than ``PAGE_SIZE`.` Recommended mitigations include deploying kernel updates, stripping the setuid bit from `fusermount3` if not essential, and restricting or disabling unprivileged user namespaces to reduce the attack surface.
A malicious actor compromised the Jscrambler npm package, publishing trojanized versions that deployed a hidden, cross-platform credential-stealing payload. This supply chain attack targeted developers, build pipelines, and CI/CD systems, aiming to exfiltrate source code, cloud credentials, deployment tokens, and sensitive environment variables. The initial malicious release, `[email protected]`, detected on July 11, 2026, utilized an undocumented `preinstall` hook to execute `node dist/setup.js`, which then launched a hidden executable from `dist/intro.js`. Subsequent compromised versions, including `8.16.0`, `8.17.0`, `8.18.0`, and `8.20.0`, evolved their delivery methods; versions `8.18.0` and `8.20.0` injected a self-executing dropper into `dist/index.js` and `dist/bin/jscrambler.js`, activating upon dependency import or CLI execution. The Rust-based payload, using ChaCha20-Poly1305 for string concealment, extensively targeted cloud credentials (AWS, Google Cloud, Azure tokens and keys), cryptocurrency wallet data (MetaMask, Trust Wallet, Coinbase Wallet, Phantom, Exodus seed phrases and vault data), and configuration files from AI coding assistants and developer tools (Claude Desktop, Cursor, VS Code API keys). It also sought browser data, Discord, Slack, Telegram, Steam information, system keyrings, and developer secrets, exfiltrating data via TLS-based multipart POST requests. Organizations must immediately identify and remove installations of these affected versions, rotating all potentially exposed secrets, including npm tokens, cloud keys, GitHub tokens, deployment credentials, API keys, and cryptocurrency wallet credentials. Jscrambler confirmed the unauthorized publishing, revoked compromised credentials, deprecated malicious versions, and released `[email protected]` as a clean update.
Dell BIOS administrator and user passwords are stored as XOR-encrypted plaintext in the DVAR region of the SPI flash chip, not as a one-way hash, leading to a critical vulnerability tracked as CVE-2026-40639 (DSA-2026-197). This scheme encrypts a 32-byte password field with a 20-byte key, but the first character remains unencrypted. For passwords up to 12 characters, the unused null-padded tail of the field directly leaks the entire 20-byte key, allowing for instant, exact recovery from a flash dump without brute force. Longer passwords are also vulnerable because the key derivation is largely static per device (only 256 possible keys based on the unencrypted first character) and the log-structured DVAR store retains historical password records, which can leak the full key if a shorter, historically used password shared the same first character. Exploitation requires physical access to the device to read the SPI flash, either with a hardware programmer or by booting an attacker-controlled operating system. This vulnerability affects a range of Dell platforms, including the current-generation Wyse 5070 thin client, Dell Latitude E7250, Latitude 7490, and XPS 15 9560, all of which utilize the SystemPwSmm SMM driver. While newer models like the OptiPlex 3000 use a more secure SHA-256 hashing mechanism, many vulnerable systems remain unpatched, including end-of-life devices. Recovering the BIOS password grants an attacker full BIOS access, enabling changes to boot order, disabling Secure Boot, and potentially bypassing full disk encryption if the BIOS password is part of the boot chain protection. Recommendations include hashing passwords with strong algorithms (e.g., PBKDF2, bcrypt, Argon2), ensuring encryption keys are sufficiently long and not derivable from plaintext, encrypting all password components, securely wiping historical records, and for defenders, assuming BIOS passwords are recoverable with physical access, implementing Secure Boot with enrolled keys, TPM-measured boot, and robust physical security controls.