🕵️ RESEARCH & DEEP DIVES
ControlPlane chains 4 bugs for unauthenticated RCE in OpenBao and HashiCorp Vault
ControlPlane disclosed a four-vulnerability exploit chain giving unauthenticated attackers full RCE in OpenBao and HashiCorp Vault.- Affects OpenBao and IBM's HashiCorp Vault servers; OpenBao is patched in v2.6.3 and v2.7.0, while Vault remains unpatched.
- Only the second RCE ever found in the Vault/OpenBao codebase; requires an unauthenticated entry path and a defined Raft snapshot policy.
- Chain combines four fixed vulnerabilities: GHSA-j6wc-jpvg-xfxq (CVSS 9.4, RCE via snapshot restore), GHSA-x8fg-h69x-p28f (8.2, PKI ACME validation bypass), GHSA-mjch-vcw3-hhmf (7.7, cross-namespace policy access), and GHSA-fg5x-7whg-6c28 (7.6, ACL deny bypass via non-canonical URLs).
- Attack flow: ACME bypass yields a certificate with attacker-chosen URI SAN to impersonate a provisioner, non-canonical URL bypass grants admin role access, then a Raft snapshot restore delivers code execution.
Malicious custom ChatGPTs in Google ads push ClickFix attacks deploying RAT malware
Threat actors are abusing custom ChatGPTs promoted in sponsored Google results to direct users to ClickFix pages that deploy RAT malware.- Affects ChatGPT users who install custom GPTs; Huntress investigated at least 40 incidents, dozens of users impacted.
- A malicious GPT named 'Plus 5.6' directs users to a fake Cloudflare check on Google Sites instructing them to run a PowerShell command.
- The command installs a malicious MSI that side-loads a RAT via a modified DLL alongside a signed app (Canon- or Stardock-signed).
- The RAT supports remote desktop, audio/camera capture, file searches, reconnaissance, and additional payload execution.
- Persistence uses a Run key and scheduled task named 'Canon Configuration Reader'; payload hidden in a custom encrypted archive with 1,128 entries.
Microsoft Copilot Cowork vulnerable to file exfiltration via indirect prompt injection
PromptArmor demonstrated that Microsoft Copilot Cowork can be hijacked via indirect prompt injection to exfiltrate M365 files.- Affects Microsoft 365 Copilot Cowork users with access to sensitive files in SharePoint or OneDrive.
- A poisoned skill file containing a 5-line prompt injection hijacks the agent to retrieve pre-authenticated download links for user-accessible files.
- The agent sends the victim a Teams message embedding the links in image tags; opening the message triggers exfiltration to an attacker-controlled site.
- Sending emails/Teams messages to the active user requires no human approval, and malicious message content is not visible in Cowork's activity log.
- Attack succeeded 5/5 trials and worked on Claude Opus 4.7 and Sonnet 4.6; scheduled tasks could repeat it unattended.
🔓 CVEs & KEV
CVE-2026-76721 — Hewlett Packard Enterprise (HPE) Instant ON — CVSS 9.8 — HPE Networking Instant ON Unauthenticated Remote Code Execution via Buffer Overflow
CVE-2026-76724 — Hewlett Packard Enterprise (HPE) Instant ON — CVSS 9.6 — HPE Networking Instant ON AP CLI Command Injection: Unauthenticated Adjacent RCE
CVE-2026-76723 — Hewlett Packard Enterprise (HPE) Instant ON — CVSS 9.6 — HPE Instant ON APS Buffer Overflow Enables Unauthenticated Adjacent RCE
CVE-2026-74222 — u-boot — CVSS 8.8 — U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive CallbackU-Boot ...
CVE-2026-74221 — u-boot — CVSS 8.8 — U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINKU-Boot before 2026....
CVE-2026-74220 — u-boot — CVSS 8.8 — U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ ReplyU-Boot before 202...
CVE-2026-71971 — u-boot — CVSS 8.8 — U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment ReassemblyU-Boot...
CVE-2026-74225 — u-boot — CVSS 7.1 — U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6U-Boot before 2026.10...
CVE-2026-71972 — u-boot — CVSS 6.0 — U-Boot through 2026.10-rc5 Out-of-Bounds Write in BMP RLE8 DecoderU-Boot thro...