Cyber Morning Call

Referências do Episódio 32 Red Hat npm packages backdoored in 72 seconds Miasma: Supply Chain Attack Targeting RedHat npm Packages Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites Critical Windows Netlogon RCE flaw now exploited in attacks Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerrame...

Referências do Episódio Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257) FSB’s matryoshka #1/3 – Gamaredon’s gifts that keeps unpacking – GammaPhish and GammaWorm Malicious npm packages abuse dependency confusion to profile developer environments Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: B...

Referências do Episódio Authenticated RCE via Argument Injection in Gogs (NOT FIXED) Typosquatted npm packages used to steal cloud and CI/CD secrets Download pumping: New npm deception technique for supply chain attacks Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch Pirates in the crosshairs: how one cybercrime gang has been infecting book, movie, and TV show fans for years Commit to Compromise: A New Threat Actor Targeting the Cryptocurrency Industry's Software Development Infrastructure GlassWorm Malware Takedown Disrupts Develop...

Referências do Episódio BTMOB: A stealthy RAT burrowing deep into Android devices Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace Microsoft SharePoint Has a New RCE Flaw. If You Haven’t Patched Yet, Go Do That. CVE-2026-45659 - Microsoft SharePoint Remote Code Execution Vulnerability Fake software on GitHub and SourceForge distribute Deno RAT  Roteiro e apresentação: Carlos...

Referências do Episódio Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages and Hundreds of Versions Across npm, PyPI, and Crates.io 2 PhaaS 2 Furious: The Evolution of Chinese-language Phishing Services Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict Tracking Iranian APT Screening Serpens’ 2026 E...

Referências do Episódio CVE-2026-41091 - Microsoft Defender Elevation of Privilege Vulnerability CVE-2026-45498 - Microsoft Defender Denial of Service Vulnerability ITW SECURITY BULLETIN: Apex One and Vision One – Standard Endpoint Protection (SEP) May 2026 Security Bulletin A New SonicWall Scanning Spike Echoes the Pattern That Preceded CVE-2026-0400 CVE-2026-40369: Twelve Bytes to Escape the Bro...

Referências do Episódio Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333) PinTheft: Another Linux Privilege Escalation, Another Working Exploit, This Time Targeting Arch Hackers bypass SonicWall VPN MFA due to incomplete patching Tracking TamperedChef Clusters via Certificate and Code Reuse A malicio...

Referências do Episódio DirtyDecrypt: Linux kernel LPE in the RxGK subsystem (CVE-2026-31635) with public PoC DirtyDecrypt / DirtyCBC Exposing Fox Tempest: A malware-signing service operation From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threat durabletask: TeamPCP's Latest PyPi Compromise Microsoft shares mitigation for YellowKey Windows zero-day Com...

Referências do Episódio Active Supply Chain Attack Compromises @antv Packages on npm Shai-Hulud Goes Open Source: Malware Creators Leak Their Own Code to GitHub How Storm-2949 turned a compromised identity into a cloud-wide breach Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento:...

Referências do Episódio CVE-2026-20182 - Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability Frequently asked questions about the continued exploitation of Cisco Catalyst SD-WAN vulnerabilities (CVE-2026-20182) CVE-2026-20209, CVE-2026-20210 e CVE-2026-20224 - Cisco Catalyst SD-WAN Manager Vulnerabilities Active Supply Chain Attack: Malicious node-ipc Versions Published to npm Pop...

Referências do Episódio NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability K000161019: NGINX ngx_http_rewrite_module vulnerability CVE-2026-42945 NGINX Rift: An 18-Year-Old Bug Lets Hackers Hijack One-Third of the Internet's Web Servers Fragnesia New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption CVE-2026-0263 PAN-OS: Remote Code Executi...

Referências do Episódio Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised ​​Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages “Shai-Hulud, Here We Go Again”: 170+ Packages Hit Across npm & PyPi May 2026 Security Updates Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities Microsoft and Adobe Patch Tuesday,...

Referências do Episódio Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio  秘密活动6年的神秘黑客组织Mr_Rot13正在利用cPanel高危漏洞部署后门木马 PamDOORa: Analyzing a New Linux PAM-Based Backdoor for Sale on the Dark Web Incident Update: Saturday, May 9, 2026 Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio Dirty Frag: Universal Linux LPE May 2026 Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (Multiple CVEs) PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution CVE-2025-68670: discovering an RCE vulnerability in xrdp When prompts become shells: RCE vul...

Referências do Episódio TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware OceanLotus suspected of using PyPI to deliver ZiChatBot malware ClickFix campaign uses fake macOS utilities lures to deliver infostealers Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento:...

Referências do Episódio CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal Critical Apache HTTP Server Flaw Exposes Millions of Servers to RCE Attacks Apache HTTP Server 2.4 vulnerabilities A rigged game: ScarCruft compromises gaming platform in a supply-chain attack CloudZ RAT potentially steals OTP messages using Pheno plugin UAT-...

Referências do Episódio Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise Hackers target governments and MSPs via critical cPanel flaw CVE-2026-41940 CISA Adds One Known Exploited Vulnerability t...

Referências do Episódio Anti-DDoS Firm Heaped Attacks on Brazilian ISPs ClickFix Removes Your Background but Leaves the Malware Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia Important Update From Trellix Critrical (sic) cPanel flaw mass-exploited in "Sorry" ransomware attacks Roteiro e apresentação: Carlos Cabral Edição de...

Referências do Episódio All supported cPanel versions hit by critical auth bug, now patched The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940) Copy Fail: 732 Bytes to Root on Every Major Linux Distribution . Official SAP npm packages compromised to steal credentials Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing...

Referências do Episódio Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854) VECT: Ransomware by design, Wiper by accident Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio WEBINAR TEMPEST: Superfície exposta, acesso concedido: como ativos esquecidos formam o caminho perfeito para o atacante Microsoft Patches Entra ID Role Flaw That Enabled Service Principal Takeover Agent ID Administrator scope overreach: Service Principal takeover in Entra ID CVE-2026-25874: Hugging Face LeRobot Unauthenticated RCE via Pickle Deserialization CVE-2026-42208:...

Referências do Episódio WEBINAR TEMPEST: Superfície exposta, acesso concedido: como ativos esquecidos formam o caminho perfeito para o atacante CVE-2026-40050 — CrowdStrike LogScale Unauthenticated Path Traversal Checkmarx Security Update: April 26 Checkmarx Security Update: April 22 Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia