Article URL: https://blog.cr.yp.to/20260814-update.html Comments URL: https://news.ycombinator.com/item?id=49306432 Points: 14 # Comments: 2
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
A critical authentication bypass vulnerability, CVE-2026-65400, has been discovered in macOS Screen Sharing, affecting macOS Tahoe before 26.6.1, Sequoia before 15.7.9, and Sonoma before 14.8.9. Attackers can connect remotely via TCP port 5900 and exploit an authentication state management flaw to establish a session without valid credentials, requiring no user interaction. In multiple incidents reported to NCSC-NL, threat actors leveraged this access to gain root privileges and install a Monero cryptocurrency miner. Apple has released patched versions of all three affected macOS branches to address the vulnerability. Users and administrators are advised to apply updates immediately, disable unnecessary Screen Sharing, and block TCP/5900 from public internet access.
A critical SQL injection vulnerability in GeoServer's jsonArrayContains filter was publicly disclosed on August 14, 2026, allowing attackers to inject malicious arguments into backend database queries on PostGIS, Oracle JDBC, and H2 data stores. Security firm WatchTowr observed hundreds of exploit attempts from a small number of source IPs within hours of the public disclosure. The flaw can potentially escalate to remote code execution depending on the server's database configuration, though RCE has not been confirmed across all affected deployments. No patches were available at the time of publication, and no successful compromises have been publicly confirmed despite the volume of probing activity. Administrators are advised to isolate GeoServer from public internet access, apply WAF rules to block malformed filter inputs, and enforce database least-privilege principles until an official fix is released.
Jamf Threat Labs has identified AmnesiaStealer, a multi-stage Rust-based infostealer targeting macOS users, published in a report dated August 13, 2026. The malware spreads through a fake GitHub ClickFix page that tricks users into pasting a Terminal command, which downloads and executes a malicious shell script. Once installed, it steals login passwords, Keychain data, Apple Notes, Telegram content, Chromium browser profiles, and cryptocurrency wallet information, sending it all to a remote command-and-control server. A secondary module called stream_module uses Chrome DevTools Protocol to silently take over live browser sessions, enabling remote control of tabs, cookies, mouse, and keyboard input. The malware also attempts to establish persistence by creating a root LaunchDaemon, though its exploit of CVE-2020-9771 for TCC bypass was found to fail on current macOS 26 without Full Disk Access.
A critical unauthenticated remote code execution vulnerability, CVE-2026-58231, affecting SAP Commerce Cloud's Data Hub Adapter was patched by SAP on August 14, 2026. Attackers began attempting to exploit the flaw just three days after the patch was released, with activity detected by the Defused honeypot. The vulnerability allows external attackers to abuse a default authentication client and bypass input validation in the Data Hub Adapter, potentially enabling arbitrary code execution without any user interaction. SAP has issued Security Note 3771065 with a fix, and administrators are urged to update, restrict Data Hub Adapter access to trusted IPs, and isolate the component from the internet. Over 4,200 IPs flagged by Shadowserver represent product fingerprints rather than confirmed compromised or unpatched systems.
Discussion (0)
Log in to join the discussion and vote.
Log in