InfoSec (@infosec.skyfleet.blue) Bsky

Lovable denies data leak, cites 'intentional behavior' : A lesson in how not to respond to vulnerability reports

Vibe coding upstart Lovable denies data leak, cites 'intentional behavior,' then throws HackerOne under the bus

2 hours ago 0 0 0 0

KelpDAO suffers $290 million heist tied to Lazarus hackers State-sponsored North Korean hackers are likely behind the $290 million crypto-heist that impacted the KelpDAO DeFi project on Saturday.

KelpDAO suffers $290 million heist tied to Lazarus hackers

3 hours ago 1 0 0 0

China's Apple App Store infiltrated by crypto-stealing wallet apps A set of 26 malicious apps on Apple App Store impersonate popular wallets, such as Metamask, Coinbase, Trust Wallet, and OneKey, to steal recovery or seed phrases and drain them of cryptocurrency assets.

China's Apple App Store infiltrated by crypto-stealing wallet apps

4 hours ago 1 1 0 0

Vuln in Google’s Antigravity AI agent manager could escape sandbox, give attackers remote code execution Google’s highest security setting for its agents runs command operations through a sandbox and throttles network access, but is still vulnerable to prompt injection.

Vuln in Google’s Antigravity AI agent manager could escape sandbox, give attackers remote code execution

4 hours ago 0 0 0 0

Vercel Employee's AI Tool Access Led to Data Breach Stolen OAuth tokens, which are at the root of these breaches, "are the new attack surface, the new lateral movement," a researcher noted.

Vercel Employee's AI Tool Access Led to Data Breach

4 hours ago 0 0 0 0

The FTC’s AI portfolio is about to get bigger The FTC is preparing to enforce key parts of a new law against sexual deepfakes and searching for ways to block AI-driven scamming using voice clones.

The FTC’s AI portfolio is about to get bigger

5 hours ago 0 0 0 0

Hackers Use AppDomain Hijacking to Turn Trusted Intel Utility Into Malware Launcher Security researchers have uncovered a highly sophisticated attack campaign that weaponizes a legitimate, digitally signed Intel utility to secretly deploy malware, all without touching a single line of the original program’s code. The campaign, dubbed Operation PhantomCLR, represents a serious evolution in how advanced attackers hide inside trusted systems to avoid detection. The attack exploits a feature built into Microsoft’s .NET runtime called the AppDomainManager mechanism. When a .NET application starts up, the runtime automatically looks for a configuration file in the same folder as the executable. Attackers have figured out how to abuse this behavior by placing a weaponized configuration file next to a legitimate Intel binary called IAStorHelp.exe, a real, signed Intel storage utility. By doing so, the malicious code runs first, before the Intel program even begins its normal operations, making it almost invisible to traditional security tools. Organizations in the Middle East and EMEA financial sectors are the primary targets of this operation. Attackers gain initial access through spear-phishing emails carrying a malicious ZIP archive. Inside the archive is what appears to be a work-from-home policy PDF document from a Saudi government Ministry. The file is actually a disguised shortcut (.pdf.lnk) that, once clicked, silently launches the Intel binary and triggers the entire attack chain in the background, while the decoy document opens on screen to avoid suspicion. Cyfirma researchers identified and analyzed this framework following continuous monitoring of evolving threats targeting enterprise environments. Their investigation revealed a multi-stage post-exploitation framework with capabilities comparable to mature offensive toolkits such as Cobalt Strike and Brute Ratel C4, yet without clear direct attribution to a known threat actor. The level of design discipline, modular architecture, and anti-forensic techniques observed indicate the work of a well-resourced and operationally experienced group. Once the attacker gains control, they have full remote access to the compromised system, including the ability to steal credentials, financial records, and intellectual property. The broader risk to organizations is severe. Because the malware runs entirely inside a trusted, signed process, most endpoint detection and antivirus tools will not flag it. Command-and-control communications are routed through Amazon CloudFront CDN infrastructure using a technique called domain fronting, which makes the malicious traffic look like normal cloud service activity. Any system where this framework is active should be treated as fully compromised, with the strong likelihood that the attacker has already moved laterally through the network and may have domain-level access. How the Infection Works The infection follows six well-engineered stages, each designed to bypass a specific layer of enterprise security. ZIP Archive Contents (Source – Cyfirma) It starts with the spear-phishing ZIP delivery, then moves to the victim executing the disguised shortcut file. Directory Listing – Victim Perspective (Source – Cyfirma) From there, the AppDomainManager hijack takes over via the malicious configuration file, loading a rogue .NET DLL named IAStorHelpMosquitoproof.dll before legitimate program logic runs. Weaponized .exe.config showing decoy appSettings and runtime CLR hijack (Source – Cyfirma) To avoid triggering automated sandbox environments, the malware uses a clever two-part delay strategy. First, it runs a CPU-intensive prime number calculation that burns a full 60 seconds of processing time without making any suspicious system calls. The 60-second sandbox evasion timing gate (Source – Cyfirma) Second, it cycles through 892,007 iterations of a constrained AES key derivation loop, performing trial decryptions using SHA-256 hashed integer seeds until it finds the correct key at iteration 41,410. Together, these phases exhaust most sandbox analysis windows before any malicious behavior appears. Once the payload is decrypted and active, it uses a JIT trampoline technique to run shellcode entirely inside memory, bypassing the standard Windows memory allocation functions that most security tools monitor. The malware also performs a “DLL injection storm,” loading 16 legitimate-looking Windows libraries in random order to flood security monitoring systems with noise and hide its real activity. After execution completes, it cleans up all memory traces in two phases using NtProtectVirtualMemory and NtFreeVirtualMemory, making forensic recovery extremely difficult. Security teams should take the following actions in response to this threat:- Strategic actions: Deploy updated detection signatures across all endpoints immediately, as the framework bypasses conventional EDR and antivirus controls without them. Invest in SSL/TLS inspection for traffic bound to CDN platforms like CloudFront, since IP-based blocking alone will not stop domain fronting. Launch a .NET security hardening initiative focused specifically on restricting AppDomainManager usage, as this technique is being adopted by multiple threat actors. Tactical actions: Block the identified C2 domains at the DNS and firewall level: dp8519iqiftub[.]cloudfront[.]net and the associated AWS ELB backend. Review DNS logs to identify any systems that have already resolved these malicious domains . Conduct endpoint sweeps to detect suspicious binaries running from non-standard paths. Operational actions: Enforce AppDomainManager restrictions through application whitelisting and policy controls to prevent execution flow hijacking. Implement SSL/TLS inspection specifically for non-browser processes communicating with CDN endpoints. Enable constrained execution environments to limit abuse of .NET runtime components and scripting engines. Follow us on Google News , LinkedIn , and X to Get More Instant Updates , Set CSN as a Preferred Source in Google . The post Hackers Use AppDomain Hijacking to Turn Trusted Intel Utility Into Malware Launcher appeared first on Cyber Security News .

Hackers Use AppDomain Hijacking to Turn Trusted Intel Utility Into Malware Launcher

5 hours ago 0 0 0 0

Claude Desktop changes software permissions without consent : Installation and pre-approval without consent looks dubious under EU law

Claude Desktop changes app access settings for browsers you don't even have installed yet

5 hours ago 1 0 0 0

The Gentlemen ransomware now uses SystemBC for bot-powered attacks A SystemBC proxy malware botnet of more than 1,570 hosts, believed to be corporate victims, has been discovered following an investigation into a Gentlemen ransomware attack carried out by a gang affiliate.

The Gentlemen ransomware now uses SystemBC for bot-powered attacks

5 hours ago 1 0 0 0

Serial-to-IP Devices Hide Thousands of Old and New Bugs The OT devices that translate machine talk into Internet-speak are riddled with vulnerabilities and more frequently targeted for attacks, researchers say.

Serial-to-IP Devices Hide Thousands of Old and New Bugs

6 hours ago 0 0 0 0

oss-sec: Fwd: [CVE-2026-3219] pip doesn't reject concatenated ZIP and tar archives Posted by Alan Coopersmith on Apr 20 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-3219] pip doesn't reject concatenated ZIP and tar archives Date: Mon, 20 Apr 2026 15:02:13 +0000 From: Seth Larson <seth () python org> Reply-To: security-sig () python org To: security-announce () python org There is a MEDIUM severity vulnerability affecting pip. pip handles concatenated tar and ZIP files as ZIP files regardless of...

Fwd: [CVE-2026-3219] pip doesn't reject concatenated ZIP and tar archives

6 hours ago 0 0 0 0

North Korea-Linked UNC1069 Uses Fake Zoom and Teams Meetings to Hack Crypto Professionals A North Korean threat group known as UNC1069 has been running a sophisticated campaign that tricks cryptocurrency and Web3 professionals into joining fake online meetings, only to infect their computers with malware designed to steal digital assets. The group pretends to be venture capital firms looking for investment partnerships, building trust with targets over time before delivering malicious payloads through counterfeit video conferencing platforms. This operation is financially motivated and is believed to directly support North Korea’s missile, nuclear, and espionage programs. The attackers make first contact through LinkedIn and Telegram, sometimes using previously compromised accounts to appear more legitimate. They then share scheduling links via Calendly to set up meetings on fake platforms that closely copy the look and feel of Zoom, Google Meet, and Microsoft Teams. The fake meeting environments are convincing enough to include live participation from the attackers themselves, and in some cases, deepfake video footage of real executives is used to build trust before delivering the attack. Once a victim joins the fake meeting , they are told their microphone or camera is not working. The attacker creates a sense of urgency, pressuring the victim to fix the issue quickly. When the victim tries to enable their audio or video, a ClickFix-style prompt appears on the screen, instructing them to copy and run a piece of code. This is the moment the malware enters the system, and from this point, the attacker has a foothold on the victim’s device. Validin researchers identified and analyzed the full attack chain in April 2026, revealing the scale and technical complexity of the campaign’s supporting infrastructure. They found that payloads are built specifically for the victim’s operating system, whether Windows, macOS, or Linux, and that the malware used appears to be updated variants of Cabbage RAT, also known as CageyChameleon. In addition, the research linked UNC1069 to the recent Axios NPM package compromise and noted overlaps with the Bluenoroff threat cluster previously reported by Mandiant. The campaign’s impact extends beyond simple system compromise. The fake meeting platforms also capture victims’ audio and video in real time through the browser’s navigator.mediaDevices.getUserMedia API, streaming the data to attacker-controlled servers via WebRTC and WebSocket channels. This recorded footage is then reused in later social engineering campaigns to impersonate real people, making future attacks even harder to detect. How the Infection Takes Hold on Windows Systems On Windows machines, the ClickFix prompt instructs victims to press Win + X followed by “A” to open a terminal with administrator privileges, then paste and run a set of commands. PowerShell snippet from a ClickFix lure for Windows-based victims (Source – Validin) These commands pull down two separate PowerShell scripts from attacker-controlled servers. The first script downloads a VBScript file, writes it to the temporary directory, and executes it twice using wscript.exe, while also adding the C:\Users directory to Windows Defender’s exclusion list and restarting the WinDefend service to suppress any alerts. Content of the first PowerShell payload for Windows-based victims (Source – Validin) The VBScript payload is an updated variant of Cabbage RAT that begins by collecting system details including the current username, hostname, operating system version, and installed browser extensions. Content of the VBS payload revealing collection of system and user details (Source – Validin) The addition of Google Chrome extension collection is a new capability clearly aimed at identifying installed cryptocurrency wallet extensions. A notable change in this version is the introduction of a .lnk shortcut file placed in the Windows Startup folder, ensuring the malware runs every time the user logs in. The RAT communicates with its command-and-control server, sending host data and awaiting coded responses: code “20” triggers a secondary encrypted payload, code “21” terminates execution, and code “22” serves as a keep-alive signal. Security teams are advised to treat unexpected requests to run terminal commands during video calls as a serious red flag. Organizations working in the cryptocurrency and Web3 space should verify the identity of meeting organizers through trusted, out-of-band channels before joining any session, and should monitor for unsigned scripts executing from temporary directories, unexpected Windows Defender exclusions, and outbound connections to domains mimicking Zoom or Google Meet naming patterns. Follow us on Google News , LinkedIn , and X to Get More Instant Updates , Set CSN as a Preferred Source in Google . The post North Korea-Linked UNC1069 Uses Fake Zoom and Teams Meetings to Hack Crypto Professionals appeared first on Cyber Security News .

North Korea-Linked UNC1069 Uses Fake Zoom and Teams Meetings to Hack Crypto Professionals

7 hours ago 0 0 0 0

Critical 9.4 CVSS Flaw Leaves Dolibarr ERP Open to RCE Dolibarr ERP faces a critical 9.4 CVSS RCE flaw (CVE-2026-23500) in its PDF conversion logic. Unsanitized commands allow full system takeover. Upgrade to 23.0!

Critical 9.4 CVSS Flaw Leaves Dolibarr ERP Open to RCE

7 hours ago 0 0 0 0

Public PoC and Technical Details Disclosed for Apache Syncope RCE Apache Syncope CVE-2025-57738 allows root RCE via unsandboxed Groovy. Technical details and PoC are now public. Upgrade to v3.0.14 or 4.0.2 immediately.

Public PoC and Technical Details Disclosed for Apache Syncope RCE

7 hours ago 0 0 0 0

Scattered Spider member Tyler Buchanan pleads guilty to major crypto theft Tyler Buchanan, linked to Scattered Spider, pleaded guilty in the US to hacking companies and stealing millions in cryptocurrency.

Scattered Spider member Tyler Buchanan pleads guilty to major crypto theft

7 hours ago 0 0 0 0

Making opportunistic cyberattacks harder by design | Microsoft Security Blog How Microsoft secures Dynamics 365 and Power Platform by removing credentials, reducing attack surfaces, and using platform engineering to block opportunistic threats.

Making opportunistic cyberattacks harder by design

7 hours ago 1 0 0 0

Seiko USA website defaced as hacker claims customer data theft The Seiko USA website was defaced over the weekend, displaying a message from attackers claiming they stole its Shopify customer database and threatening to leak it unless a ransom is paid.

Seiko USA website defaced as hacker claims customer data theft

7 hours ago 0 0 0 0

SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files A critical security vulnerability has been disclosed in SGLang that, if successfully exploited, could result in remote code execution on susceptible systems. The vulnerability, tracked as CVE-2026-5760, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of command injection leading to the execution of arbitrary code. SGLang is a high-performance, open-source serving

SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files

7 hours ago 0 0 0 0

US gets second Scattered Spider-linked guilty plea : Tyler Buchanan admits role in scheme that stole at least $8 million in virtual currency

Scot becomes second Scattered Spider-linked crook to plead guilty in US

7 hours ago 1 0 0 0

Italian regulator fines national postal service orgs $15 million for data privacy violations

Italian regulator fines national postal service orgs $15 million for data privacy violations

8 hours ago 1 0 0 0

Malicious Packages Don't Fit the Vulnerability Intelligence Model

Malicious Packages Don't Fit the Vulnerability Intelligence Model

8 hours ago 0 0 0 0

Malicious Packages Don't Fit the Vulnerability Intelligence Model

Malicious Packages Don't Fit the Vulnerability Intelligence Model

8 hours ago 0 0 0 0

Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes Posted by Demi Marie Obenour on Apr 20 I wonder if build infra needs to be updated to support automated rebuilds when a reverse dependency is updated. My understanding is that FreeBSD ports, Nix, and OBS already support this. There is a very strong trend towards static linking, and even when dynamic linking is used, ABI stability might not be guaranteed. I agree that this is extra work for distros, but I don't think distros will be able to convince upstreams to prioritize ABI...

Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes

8 hours ago 0 0 0 0

Researchers Say Iranian MOIS Uses Multiple Hacker Personas for One Coordinated Cyber Campaign Iran’s Ministry of Intelligence and Security (MOIS) has been running a long and carefully organized cyber campaign using three separate hacker identities. These identities, known as Homeland Justice, Karma/KarmaBelow80, and Handala, were widely believed to be independent hacktivist groups. However, a detailed investigation has now confirmed that all three are part of a single, state-directed operation controlled by the Iranian government. The campaign blends cyber intrusions, sensitive data theft, destructive attacks, and psychological influence operations into one fully coordinated strategy targeting governments and organizations across multiple countries. The story began in 2022 when a group calling itself “Homeland Justice” launched a series of attacks against the Government of Albania. What made this operation stand out was the level of planning involved. Iranian state actors had already gained access to Albanian government systems approximately fourteen months before going public with their attacks. They used this access to steal sensitive documents, deploy destructive tools, and make high-profile public announcements claiming credit for the damage. This combination of hacking and deliberate public messaging turned a technical attack into a carefully staged influence event with significant geopolitical effects. DomainTools analysts identified that the same threat actor later pivoted to a new persona called “Karma,” and then “KarmaBelow80,” shifting focus to Israeli organizations in late 2023. Researchers noted that the underlying tools, infrastructure, and attack methods remained fully consistent across these rebranded campaigns. Shared domain patterns, the consistent use of Telegram for command-and-control communications, and repeated technical behaviors across what appeared to be separate groups gave DomainTools high confidence to assess all of them as one connected system operating directly under MOIS authority. By 2024 and continuing into 2026, the operation evolved under the “Handala” banner. Named after the well-known Palestinian cartoon character, the Handala persona focused heavily on information operations, including curated data leaks and targeted harassment of journalists, dissidents, and Israeli-connected individuals. The Justice Department responded in March 2026, announcing the seizure of four linked domains: Handala-Hack.to, Karmabelow80.org, Justicehomeland.org, and Handala-Redwanted.to. These domains had been actively used to publish stolen data, claim responsibility for attacks, and call for violence against specific named individuals. The overall threat actor is tracked as “Void Manticore” by security researchers and also referenced as MOIST GRASSHOPPER in DomainTools reporting. The group is directly linked to Iran’s MOIS and represents one of the most active state-linked cyber influence ecosystems currently in operation. MOIS-Attributed cyber groups and persona layer (Source – DomainTools) Its methods go well beyond simple hacking, combining long-term network access with psychological pressure, data weaponization, and carefully timed public releases that are designed to shape public opinion and behavior in targeted countries. Multi-Persona Infrastructure and Deception Tactics One of the most notable aspects of this campaign is how it uses multiple branded identities to serve distinct operational goals while sharing a single backend infrastructure. Homeland Justice handles destructive operations against Albania. Karma and KarmaBelow80 targeted Israeli entities during a defined period, while Handala now serves as the primary vehicle for influence and information warfare. This structure allows Iran’s intelligence service to segment its messaging and targeting while maintaining the outward appearance of completely separate, unconnected hacktivist groups . The technical infrastructure connecting these personas includes shared hosting patterns, overlapping domain registration behaviors, and the reuse of identical malware components across operations. The group deployed wiper tools to permanently destroy data, alongside ransomware-style encryption used not for financial gain but purely to maximize operational disruption. Tools like Rhadamanthys, a commercial infostealer available on darknet forums, appeared in Handala-linked operations paired with custom wipers in phishing campaigns impersonating software updates from vendors such as F5. MOIS Connection (Source – DomainTools) Security organizations and government agencies recommend monitoring for suspicious exploitation of internet-facing services such as Microsoft SharePoint, the initial access method used in the Albania campaign. Organizations should implement strict network segmentation , regularly audit privileged account activity, and deploy endpoint detection tools capable of identifying manual intrusion behavior. Threat intelligence teams should monitor domain infrastructure associated with MOIST GRASSHOPPER and block domains flagged in the Justice Department’s March 2026 seizure to reduce ongoing exposure. Follow us on Google News , LinkedIn , and X to Get More Instant Updates , Set CSN as a Preferred Source in Google . The post Researchers Say Iranian MOIS Uses Multiple Hacker Personas for One Coordinated Cyber Campaign appeared first on Cyber Security News .

Researchers Say Iranian MOIS Uses Multiple Hacker Personas for One Coordinated Cyber Campaign

9 hours ago 1 1 0 0

Crypto infrastructure company blames $290 million theft on North Korean hackers

Crypto infrastructure company blames $290 million theft on North Korean hackers

9 hours ago 3 1 0 0

Pluralistic: Comrade Trump (20 Apr 2026)

9 hours ago 0 0 0 0

oss-sec: Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes Posted by Morten Linderud on Apr 20 We don't. I originall did this work a few years ago but it just produced a huge list of packages that would need to be worked through that carried other issues. The build infra is not there to dispatch larger rebuilds for this and all of it would be hand holding. There are 431 depending on go, and each project would need to be unpacked/scanned and then rebuilt accordingly. You could just rebuild everything, but that alone would take a few...

Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes

9 hours ago 0 0 0 0

oss-sec: Re: [ADVISORY] CVE-2026-5367: Heap over-read in OVN DHCPv6 Client ID processing Posted by Ales Musil on Apr 20 One small correction: the 24.09 release is not happening so for 24.09 please upgrade to the next available release.

Re: [ADVISORY] CVE-2026-5367: Heap over-read in OVN DHCPv6 Client ID processing

9 hours ago 0 0 0 0

Lovable AI App Builder Reportedly Exposes Thousands of Projects Data via API Flaw A critical Broken Object Level Authorization (BOLA) vulnerability in Lovable, the popular AI-powered app builder platform, is reportedly allowing unauthorized users to access sensitive project data, including source code, database credentials, AI chat histories, and real customer information from thousands of projects created before November 2025. The flaw, classified as a Broken Object Level Authorization issue, allows any free-tier Lovable account holder to make unauthenticated API calls to the platform’s backend and retrieve project data belonging to other users. BOLA vulnerabilities occur when an API grants access to objects without verifying whether the requesting user actually owns or has permission to view them. This class of flaw is ranked #1 in the OWASP API Security Top 10 for its prevalence and ease of exploitation. According to a researcher with the handle @weezerOSINT, the API endpoint https://api.lovable.dev/GetProjectMessagesOutputBody appears to return full project message histories, AI thinking logs, and tool-use records without enforcing proper object-level access controls. The exposed JSON responses contain user IDs, session content, and internal AI reasoning chains that were never intended to be publicly accessible. The vulnerability was reported to Lovable via HackerOne approximately 48 days before public disclosure, yet the flaw reportedly remains unpatched for projects created prior to November 2025. Lovable has a mass data breach affecting every project created before november 2025. I made a lovable account today and was able to access another users source code, database credentials, AI chat histories, and customer data are all readable by any free account. nvidia,… pic.twitter.com/QcVvz9cNZl — impulsive (@weezerOSINT) April 20, 2026 While Lovable appears to have applied a fix for newly created projects, the legacy project base remains exposed, leaving a significant risk window for users who built applications on the platform before the cutoff date. Researchers examining the vulnerability uncovered particularly alarming examples. One affected project belonged to Connected Women in AI, a nonprofit organization, and reportedly contained exposed Supabase database credentials alongside real user data. Among the data found were records linked to individuals from Accenture Denmark and Copenhagen Business School. Beyond nonprofit exposure, employees at major technology firms, including Nvidia, Microsoft, Uber, and Spotify, reportedly have Lovable accounts tied to affected projects, raising the potential that sensitive corporate development data could be at risk. The vulnerability was submitted on the HackerOne bug bounty platform and was marked as a duplicate of report #3583821, labeled “Broken Object Level Authorization on Lovable API leads to unauthorized access to user data and project source code”. The duplicate submission was flagged as Informative, suggesting the issue was already known to the platform prior to the latest disclosure on March 3, 2026, yet public evidence continues to show the flaw remains exploitable on legacy accounts. Security researchers recommend that Lovable users who created projects before November 2025 should immediately rotate any API keys, database credentials, or secrets stored within those projects. Users should assume that chat histories and source code associated with older projects may have already been accessed. The incident underscores a recurring challenge in AI-native development platforms: security controls often lag behind rapid feature deployment, leaving early adopters most exposed. Organizations building production applications on low-code AI builders should enforce secrets management practices independent of the platform, and regularly audit API exposure for any sensitive credentials embedded in project repositories or chat contexts. Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories. The post Lovable AI App Builder Reportedly Exposes Thousands of Projects Data via API Flaw appeared first on Cyber Security News .

Lovable AI App Builder Reportedly Exposes Thousands of Projects Data via API Flaw

10 hours ago 1 2 0 0

oss-sec: [ADVISORY] CVE-2026-5367: Heap over-read in OVN DHCPv6 Client ID processing Posted by Ales Musil on Apr 20 Description =========== Multiple versions of OVN (Open Virtual Network) are vulnerable to crafted DHCPv6 packets that could potentially read out-of-bounds, leaking adjacent info stored on the heap. OVN supports configuring DHCPv6 options for Logical Switch Ports. When configured we allow handling of DHCPv6 requests in a userspace thread called pinctrl. The thread accesses user-controlled packet data and copies some of it in the process of...

[ADVISORY] CVE-2026-5367: Heap over-read in OVN DHCPv6 Client ID processing

10 hours ago 0 0 0 0

Posts by InfoSec