Red Hat Satellite flaw exposes host root passwords via Foreman

🚨 ACTIVE EXPLOITATION

• New CloudSyncD macOS Backdoor Delivered via Fake Zoom Installer
  Jamf Threat Labs has discovered CloudSyncD, a new macOS backdoor distributed via a fake Zoom installer that has moved from development to live C2 infrastructure.
  • Affects macOS users on both Apple silicon and Intel Macs; no confirmed infections reported yet.
  • CloudSyncD is a two-stage backdoor, not an infostealer — it lacks browser data, Keychain and crypto-wallet theft, and the phished password is never exfiltrated.
  • Delivered as a disk image mounting as a 'Zoom' volume; on-screen instructions walk victims through bypassing Gatekeeper via System Settings.
  • Stage 1 (app_installer) phishes the login password via a fake authorization prompt, validates it with dscl, then hides it base64-encoded in ~/.config/zoom/data.json with zero-width Unicode characters (U+200B, U+200C) in the version field marking its location.
  • The ~756 KB universal Mach-O second stage attempts fileless execution via /dev/fd (usually blocked by SIP), falls back to mkstemp and sudo, then beacons to C2 every 8-16 seconds using URIs disguised as jQuery script fetches; C2 domains are 2011 registrations behind Cloudflare.
  Sources 📄 Source: jamf.com · 📎 Coverage: securityweek.com · 👁 via SecurityWeek

💥 BREACHES & INCIDENTS

• (No items)

🔓 CVEs & KEV

• CVE-2026-94422 — redhat xdg-dbus-proxy — CVSS 8.7 — xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox esca...

• CVE-2026-63772 — Apache Software Foundation Apache Thrift — CVSS 8.7 — Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via t...

• CVE-2026-66055 — Apache Software Foundation Apache Thrift — CVSS 8.2 — Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Ap...

• CVE-2026-102504 — CPANSec Imager — CVSS 7.5 — Imager versions before 1.037 for Perl exit the process reading a raw image wi...

• CVE-2026-61374 — Apache Software Foundation Apache Thrift — CVSS 7.1 — Apache Thrift: Java TSaslTransport post-auth data-frame missing size limitAll...

• CVE-2026-66054 — Apache Software Foundation Apache Thrift — CVSS 6.9 — Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSizeA...

• CVE-2026-102505 — CPANSec Imager — CVSS 6.3 — Imager versions before 1.037 for Perl overflow a heap buffer fetching float s...

🕵️ RESEARCH & DEEP DIVES

• Rapid7 details BPFDoor and AVERAT Linux implants targeting telecom mail-security appliances
  Rapid7 has uncovered a Linux malware ecosystem including new BPFDoor variants, BPF Rekoobe, and six AVERAT builds targeting telecom and mail-security appliances.

  • Targets include South Korean SpamSniper anti-spam appliances (BPFDoor/Rekoobe), Taiwanese appliances (six AVERAT builds), and ShareTech devices (dropper), all in telecom and network-edge environments.
  • Implants sit on mail-security gateways inline in front of mail servers, giving visibility into inbound and outbound traffic and using port 25 SMTP to blend into normal traffic.
  • A dropper stages payloads into /sbin as ntpdate and udevds, deletes the files ten seconds later, and runs fileless as a resident watchdog; its encryption key derives from the string 'ShareTech'.
  • BPFDoor variants impersonate SpamSniper PID files, wait for a magic packet wrapped in HTTPS POST requests (e.g., POST /admin/login.aspx?id=99990 with '9999' at TCP payload offset 26) to evade static signatures.
  • Relay infrastructure includes compromised consumer/SMB devices in Taiwan's Chunghwa Telecom HiNet space (NAS units, DVRs, an ADSL appliance) with PPTP for dual-purpose C2 relay and VPN access; AVERAT uses RC4-encrypted configuration.
  Sources 📎 Coverage: rapid7.com · 👁 via rapid7.com (discovered)

• Linux Backdoors Mimic Asian Mail Security Appliances in Two Espionage Campaigns
  Rapid7 researchers uncovered two overlapping campaigns deploying Linux backdoors that mimic legitimate Asian email security appliances.

  • Targets: Linux secure email gateways and edge appliances, including South Korean SpamSniper anti-spam software (used by 6,000+ organizations) and Taiwanese ShareTech mail security appliances serving enterprises, governments, and schools across Asia-Pacific.
  • One campaign deploys new BPFdoor variants and a modified Rekoobe RAT disguised as SpamSniper, likely tied to Chinese-linked espionage against telecoms; BPFdoor activates via a byte code in HTTPS requests and exfiltrates via ICMP pings.
  • The second campaign uses a ShareTech-impersonating dropper to install a novel modular RAT called AVERAT, which deletes its dropped files after launch to limit forensic evidence.
  • Both malware families use TCP port 25 (SMTP) for C2, blending with normal email traffic and using SMTP conventions before switching to encrypted sessions.
  • Communications are relayed through compromised edge devices like DVRs and NAS units; the implants copy legitimate software's PID files, system services, and firewall-allowed traffic to evade detection.
  • Detection indicators include processes with '(deleted)' executable suffixes in /proc, unexpected raw packet sockets, and a /HDD/ms6x2xTo64/ dropper directory.
  Sources 📎 Coverage: darkreading.com · 👁 via Dark Reading

• Supply chain attacks poison trusted software updates to steal developer and cloud credentials
  Attackers are compromising open-source packages and update pipelines to steal developer, npm, GitHub, and cloud credentials, per a ReversingLabs report.

  • Affects developers and organizations using npm/CI/CD ecosystems — Nx, Trivy, Checkmarx, LiteLLM, and Telnyx were among affected targets.
  • Stolen npm publishing tokens and GitHub Actions flaws let attackers ship poisoned package updates via post-install hooks that harvest tokens, SSH keys, and cloud credentials.
  • S1ngularity abused local AI coding assistants (Claude, Gemini) to search file systems for credentials and exfiltrated data to public GitHub repos like 's1ngularity-repository'.
  • The Shai-Hulud worm self-propagates by stealing npm publishing tokens and publishing malicious versions of further packages; TeamPCP allegedly released Mini Shai-Hulud publicly.
  • TeamPCP operations allegedly compromised over 1,000 organizations, exposed 500,000+ credentials, and stole 300+ GB of data; IOC hashes for S1ngularity samples include d2438106211ebd12c4f0a248848bc9864c97a3c0.
  Sources 📄 Source: reversinglabs.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

• Grizzly study: 45% of credential-phishing pages missing from Google Safe Browsing at first detection
  A Grizzly Security study found 45% of credential-phishing pages weren't on Google Safe Browsing when first flagged, and 29% were still unlisted after a week.

  • Affects default-browser users relying on Google Safe Browsing warnings in Chrome, Safari, and Firefox against branded credential-phishing pages.
  • Study of 550 OpenPhish Premium feed pages first seen June 18–24, 2026: Google's list covered only 55.3% at Grizzly's detection time, reaching just 71.3% after seven days.
  • Grizzly's real-time page analysis flagged 92.9% of the same pages at ingestion, while Google's coverage plateaued after one day.
  • Grizzly detects phishing by reading page structure, branding, and infrastructure (e.g., mismatched nameservers, missing certificate details) with no prior reputation required; blocklists wait for reports.
  • Examples include an Xfinity phishing page on swipepages.net and a Coinbase crypto wallet drainer at ipsmedisalud.org, neither on Google's list at scan time.
  Sources 📎 Coverage: grizzlysec.com · 👁 via r/netsec

📋 ADVISORIES

• Red Hat Satellite flaw CVE-2026-96659 exposes host root passwords via Foreman template preview endpoints
  Red Hat has fixed a high-impact Foreman flaw in Red Hat Satellite that lets low-privileged users retrieve host root passwords and, under unsafe configurations, execute commands.

  • Applies to Red Hat Satellite 6.16 (RHEL 8/9), 6.18 and 6.19 (RHEL 9) using the Foreman component for provisioning and lifecycle management.
  • CVE-2026-96659 (CVSS 9.1, CWE-267) lets a Viewer-role authenticated user query Foreman template preview endpoints and retrieve sensitive host attributes, including root passwords.
  • If Foreman template Safemode protections are disabled or bypassed, the flaw can escalate to arbitrary command execution as the Foreman service account.
  • Exploitation requires only network access and a valid low-privileged account, with no user interaction; no exploitation or public PoC reported so far.
  • Related flaw CVE-2026-96658 (CVSS 9.9) is a Foreman Safemode sandbox escape enabling RCE; fixes shipped in advisories RHSA-2026:74503, RHSA-2026:74504 and RHSA-2026:74506, including Foreman 3.12.0.23-1 for Satellite 6.16.14.
  Sources 📄 Source: access.redhat.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

• cPanel & WHM flaws allow root command execution and admin session hijacking
  cPanel has disclosed three vulnerabilities in cPanel & WHM that can lead to root-level command execution or script execution in a WHM administrator's browser session.

  • Affects all supported cPanel & WHM versions before patched releases 11.110.0.148, 11.134.0.61, 11.136.0.45, 11.138.0.11, or WP2 11.138.1