View Ridge Security
Back to Cyber Hose

Compromised GitHub Actions Re-Enabled, Resumed Mini Shai-Hulud

Compromised GitHub Actions resumed malware execution, Samsung MagicINFO exploited for cryptomining, Zimbra CVSS 9.8 RCE, and SolarWinds ARM RCE detailed.

๐Ÿšจ ACTIVE EXPLOITATION

  • UPDATE: Compromised actions-cool GitHub Actions Re-Enabled and Resumed Executing Mini Shai-Hulud Malware
    Two compromised GitHub Actions repositories were re-enabled by GitHub and resumed executing malicious Mini Shai-Hulud payloads because their release tags still pointed to the malicious code.

    • Affects users of actions-cool/issues-helper and actions-cool/maintain-one-comment GitHub Actions; "actions-cool/issues-helper@v2.2.1" is treated as affected.
    • The repos, compromised May 18, 2026, to harvest CI/CD credentials and exfiltrate them to t.m-kosche[.]com (linked to the Mini Shai-Hulud cluster), were re-enabled September 16, 2026 with malicious release tags intact.
    • Workflows referencing the actions by version tag resumed downloading and executing the payload on their next run, typically within a day, with no action needed from the attacker.
    • Workflows pinned to a full commit SHA predating May 18, 2026 are not impacted.
    Sources ๐Ÿ“„ Source: socket.dev ยท ๐Ÿ“Ž Coverage: thehackernews.com ยท ๐Ÿ‘ via The Hacker News

  • Attackers exploit Samsung MagicINFO flaw CVE-2025-4632 to compile Monero miner on victim systems
    Attackers exploited a Samsung MagicINFO vulnerability to install AnyDesk, disable Defender, and compile a Monero cryptominer on a compromised Windows endpoint.

    • Affects organizations running Samsung MagicINFO Premium digital signage software on internet-facing Windows systems.
    • Entry point is CVE-2025-4632, a MagicINFO file-write vulnerability allowing system-privilege file writes, fixed by Samsung in May 2025 after an incomplete fix for CVE-2024-7399.
    • Attackers downloaded AnyDesk (after two Defender-blocked attempts via certutil and PowerShell), created a local admin account 'oldadministrator' with password F@x2020!@#, and disabled Microsoft Defender via SystemSettingsAdminFlows.exe.
    • A Silent XMR Miner Builder (x.exe, SHA-256 0d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1) was compiled on the victim using gcc, tcc, csc.exe and donut.exe, then mined Monero via auto.c3pool.org:19999.
    • IOCs include IP 194.87.89[.]30, URL http://194.87.89.30:8899/anydesk.exe, and the tomcat9.exe MagicINFO service process in the attack chain; Huntress observed the activity on a single managed endpoint in early September 2026.
    Sources ๐Ÿ“„ Source: huntress.com ยท ๐Ÿ“Ž Coverage: cybersecuritynews.com ยท ๐Ÿ‘ via Cyber Security News, cryptika.com (discovered)

๐Ÿ”“ CVEs & KEV

  • CVE-2026-93643 โ€” Zimbra Collaboration Suite (ZCS) โ€” CVSS 9.8 โ€” Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to R...

  • CVE-2026-93647 โ€” Zimbra Collaboration Suite (ZCS) โ€” CVSS 9.3 โ€” Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via...

  • CVE-2026-93642 โ€” Zimbra Collaboration Suite (ZCS) โ€” CVSS 9.3 โ€” Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via ...

  • CVE-2026-93641 โ€” Zimbra Collaboration Suite (ZCS) โ€” CVSS 9.3 โ€” Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via...

  • CVE-2026-85542 โ€” IBM Guardium Data Protection โ€” CVSS 8.8 โ€” IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guar...

  • CVE-2026-93834 โ€” Red Hat Enterprise Linux 10 โ€” CVSS 8.8 โ€” Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escapeA...

  • CVE-2026-84893 โ€” IBM Guardium Data Protection โ€” CVSS 7.6 โ€” IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guar...

  • CVE-2026-84884 โ€” IBM Guardium Data Protection โ€” CVSS 7.5 โ€” IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guar...

  • CVE-2026-85029 โ€” IBM Guardium Data Protection โ€” CVSS 7.5 โ€” IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guar...

  • CVE-2026-85750 โ€” Piwigo โ€” CVSS 7.2 โ€” Piwigo arbitrary file read and remote code execution via insecure image proce...

  • CVE-2026-97865 โ€” VulDB Open-Web-Analytics โ€” CVSS 6.9 โ€” Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deseri...

๐Ÿ•ต๏ธ RESEARCH & DEEP DIVES

  • SolarWinds ARM CVE-2026-28326: hardcoded key enables unauthenticated SYSTEM RCE CVE-2026-28326
    SolarWinds Access Rights Manager contains a hardcoded authentication secret enabling unauthenticated remote code execution as SYSTEM.

    • Affects SolarWinds Access Rights Manager; fixed in version 2026.2.1, released September 17, 2026.
    • CVE-2026-28326 stems from a hardcoded static client-authentication key identical on every install, rated 8.8 High (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
    • Reaching TCP port 55555 is enough to authenticate and hit a .NET deserialization sink; Bishop Fox confirmed code execution as NT AUTHORITY\SYSTEM.
    • Original vulnerability reported by Kai Huang of Armadin; Bishop Fox published a detection tool that checks vulnerability with two safe requests.
    • The CVSS vector assumes adjacent-network reach, so exposure of port 55555 determines real-world risk.
    Sources ๐Ÿ“Ž Coverage: bishopfox.com ยท ๐Ÿ‘ via Bishop Fox Blog

  • PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence
    A new PamStealer macOS variant requires a live C2 key exchange to decrypt its payload, hindering static analysis.

    • Targets macOS users lured via a fake cryptocurrency wallet site ("wavel[.app") delivering a "Wavel.dmg" disk image with a compiled AppleScript file.
    • Opening the file runs a JXA dropper that pipes a decoded zsh script into /bin/zsh, replacing the earlier embedded RC4 decryption approach.
    • The zsh dropper downloads a "pkgunpack" decryption utility from "wavel.apple03cloudstore[.]com" and performs an X25519 key exchange; without the server's private key the payload cannot be decrypted, and ephemeral keypairs prevent DEK replay.
    • Installs four persistence methods including a LaunchAgent, a repair zsh script, notification suppression, and a Git hook via "git config --global core.hooksPath" pointing to ~/.zshrc-triggered repair scripts.
    • The Swift stealer captures the system password via a fake crash dialog with PAM validation, steals keychain items and credentials from Chromium- and Firefox-based browsers (including Arc, Zen, Brave, LibreWolf, Cแป‘c Cแป‘c), and collects shell history, .gitconfig, and system fingerprints.
    Sources ๐Ÿ“Ž Coverage: thehackernews.com ยท ๐Ÿ‘ via The Hacker News

  • SecurityWeek roundup: Clop leak site seized, BragJack AI assistant flaws, water utility credential exposure
    SecurityWeek's weekly roundup covers ShinyHunters' takeover of Clop's leak site, flaws in browser AI assistants, malicious npm/PyPI packages, AI relay networks, and infostealer exposure across US water utilities.

    • ShinyHunters defaced the Cl0p ransomware gang's Tor leak site, claiming theft of server logs, source code and onion service private keys, demanding an eight-figure payment and apology
    • BragJack flaws let a malicious browser extension hijack built-in AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet and Claude in Chrome, enabling email reading, file access, screenshots and camera/mic activation
    • Malicious MemTensor MemOS packages on npm and PyPI carry a Go implant named sckit that hunts for npm, PyPI, GitHub, AWS and Hugging Face secrets, with worm-spread templates but no confirmed propagation
    • Team Cymru found nearly 11,000 servers running Claude Relay Service or sub2api, with over 4,000 China/Hong Kong IPs connecting to 304 relays reaching OpenAI, Anthropic, xAI and Google endpoints
    • SpyCloud found active infostealer exposure at 1,787 of 10,000 US water/wastewater utilities and vendors, with OT or remote-access credentials at 258 organizations
    Sources ๐Ÿ“Ž Coverage: securityweek.com ยท ๐Ÿ‘ via SecurityWeek

  • CVE-2025-13032: Avast Antivirus sandbox escape via double-fetch kernel pool overflow CVE-2025-13032
    SAFA researchers detailed full exploitation of a double-fetch vulnerability in Avast Antivirus's kernel driver to escape the sandbox and escalate privileges to SYSTEM on Windows 11.

    • Affects Avast Antivirus's kernel driver (CVE-2025-13032), a double-fetch bug in handling of user-supplied _UNICODE_STRING structures
    • The Length field is fetched multiple times: once to allocate a paged pool buffer and again for the memmove copy, allowing a controlled pool overflow
    • Exploitation uses a second thread racing to toggle Length between small and large values while the main thread loops the vulnerable IOCTL
    • On up-to-date Windows 11, the overflow was turned into arbitrary kernel read/write by corrupting the RegBuffers array of an IORing object, using heap spray and MDL-based address leaks, ending in SYSTEM via token theft
    • Windows kernel user-mode accessors (a newer mitigation) would prevent this exploitation technique
    Sources ๐Ÿ“Ž Coverage: safateam.com ยท ๐Ÿ‘ via <https://www.reddit.com/r/netsec/comments/1

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check