Sanata una vulnerabilità con gravità “critica” in Grafana MCP Server, componente utilizzato per l'integrazione tra sistemi di intelligenza artificiale e piattaforme Grafana. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato l'elusione dei meccanismi di sicurezza e l'accesso ad informazioni sensibili sui sistemi interessati.

via RSS Csirt Italia https://ift.tt/QdbRVZT

Aggiornamenti di sicurezza Zoho sanano una vulnerabilità con gravità "alta", presente nei prodotti M365 Manager Plus e M365 Security Plus

via RSS Csirt Italia https://ift.tt/SwZa7Be

Enterprise defenses are tuned to catch the attacks that make noise. This year's data shows attackers winning by making none.According to Picus Labs' new Blue Report 2026, which measured more than 338 million real attack simulations across actual client production environments in the first half of 2026, defenses are having one of their strongest years yet. Average prevention effectiveness

via The Hacker News https://ift.tt/noSLsvA

A newly disclosed flaw in the way OpenAI, Anthropic, and Google carried hidden AI reasoning between API calls let researchers recover internal reasoning and secrets from session logs, including API keys and passwords.The weakness affected encrypted reasoning objects used by the providers' reasoning APIs, where a block created in one session could be replayed into another and, during testing,

via The Hacker News https://ift.tt/BrMV8s4

SonicWall ha rilasciato aggiornamenti di sicurezza per sanare 8 vulnerabilità, di cui 2 con gravità “critica” e 4 con gravità "alta", che interessano i prodotti Email Security e GMS.

via RSS Csirt Italia https://ift.tt/cZbsMqi

A couple of days ago, Xavier posted about Atuin to gain more insight into the command history. Atuin does a great job of better organizing what is usually handled by "bash_history" and collecting meaningful additional data. Our reader David commented that this can also be done quite well with Linux's kernel process accounting feature, and I think he is very right. I really like Linux process accounting for a number of reasons, so here is a quick introduction.Process accounting is a kernel feature. You will not see a specific process responsible for it. Instead, the "accton" command signals the kernel to start logging process data to a specific location (usually /var/log/account/pacct). Once a process terminates, the kernel will log respective details to the binary log file.1 - InstallationI don't think process accounting is enabled by default on any Linux system. It does add a little additional overhead, but some users may shy away from it because it requires additional disk writes to collect the information. Memory and other CPUs should not be significantly impacted by process accounting. On my not very busy Proxmox system, it uses about 50 MB/day of disk space. So nothing that should be noticeable for most systems.Installation usually comes down to installing the respective package for your distribution. On Debian based distributions, it is justapt install acctThis will typically also configure the startup scripts, but it can't hurt to runsystemctl enable --now acctThat is it. Wait a little bit, and you will see the log. 2 - How to read the logsLogs are saved in a binary format. The "lastcomm" command can be used to display the log in a readable format. For example:ip6tables-save   S     root     __         0.00 secs Wed Aug 12 06:25
iptables-restor  S     root     __         0.00 secs Wed Aug 12 06:25
iptables-save    S     root     __         0.00 secs Wed Aug 12 06:25
check_ssh              100107   __         0.00 secs Wed Aug 12 06:25
cron              F    100000   __         0.00 secs Wed Aug 12 06:25
sh               S     100000   __         0.00 secs Wed Aug 12 06:25
debian-sa1             100000   __         0.00 secs Wed Aug 12 06:25These are a few lines from my Proxmox server. It logs the process name, Flags (S=super user, F=forked process, D=generated core dump, X=terminated by signal), User name (or ID), CPU execution time, and finally the timestamp at which the process was started. The output may be modified slightly depending on the command-line arguments used.3 - Remote LoggingUnlike most Linux logs, these logs are not created by syslog. However, you may still read them with syslog to forward them to a central log collector/SIEM. Syslog-ng for example include a "s_pacct" processor for process accounting logs. You enable it with this configuration:source s_pacct {
    pacct(file("/var/log/account/pacct"));
};4 - Other useful toolsThe "sa" command can be used to easily extract summaries from accounting data. For example, a breakdown by CPU time used by different processes# sa -c | head -10
  329063  100.00%  259245.37re  100.00%      70.29cp  100.00%         0avio     24320k
     469    0.14%      55.38re    0.02%      52.65cp   74.90%         0avio    124752k   ffmpeg
     488    0.15%       5.43re    0.00%       4.57cp    6.51%         0avio      5338k   apt-get
    2820    0.86%       3.60re    0.00%       3.34cp    4.74%         0avio     13295k   ceph
    1231    0.37%       1.96re    0.00%       1.92cp    2.73%         0avio      1974k   ps
     312    0.09%    1907.83re    0.74%       1.36cp    1.93%         0avio     88176k   named
       7    0.00%   39483.07re   15.23%       0.76cp    1.08%         0avio      6348k   systemd-journal
     123    0.04%   34804.71re   13.43%       0.34cp    0.48%         0avio     20367k   ***other*
       8    0.00%       0.68re    0.00%       0.27cp    0.38%         0avio      3926k   store
     366    0.11%       0.58re    0.00%       0.26cp    0.36%         0avio      2235k   dpkg-deb*5 - ContainersProcess accounting…

A massive set of 737 free VPN and proxy extensions have been found to mainly target Russian-speaking users seeking access to blocked services with an aim to intercept browser traffic and route them through a proxy infrastructure.The extensions, published across at least 40 Chrome Web Store developer accounts, racked up 75,486 installs. Of those identified, 274 have been found to impersonate 66

via The Hacker News https://ift.tt/v7Is6qL

The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India.The activity, per Check Point Research, is part of Operation Dream Job, a long-running cyber espionage and

via The Hacker News https://ift.tt/j6VqT0w

In the past few weeks, I have been using Gemma4 as a Large Language Model (LLM) to see how useful it can be to analyze some of the malware hashes uploaded to the DShield sensor over the past 30 days and figure out how its recommendation can be considered useful about the activity my DShield sensor is collecting and tracking. The model I use for this testing is gemma4:e4b [2] using two sites to compare the data against VirusTotal and CyberGordon. The following questions were submitted to Gemma for information:Instructions:1. Determine if we should be concerned with the volumes or suspicious volumes match indicators of compromise (IoC) or tactics mentioned on the two external websites.
2. Provide a concise comparative analysis and recommendations for action to prevent actors/bots to successfully compromise the sensor.
3. Identify what type of malware family (Popular threat label) the top 3 files are associated with.
4. Highlight potential issues with the top 3 inbound hashes (files) downloaded by actors/bots logged in the sensor and which sites have the most information about this activity.Result from the LLM AnalysisComparative analysis from Gemma 4 :
 As a cybersecurity analyst, I have analyzed the provided data stream concerning files downloaded by actors/bots to the Cowrie sensors.Analysis of Downloaded Hashes (Top 10 IoCs)MediaFindings and Analysis1. Volume vs. IoCs vs. Tactics
The sheer volume of these hashes (126, 110 events) is a major concern. High volumes do not automatically confirm malicious intent, but when coupled with the fact that they are *downloaded* from an interactive sensor like Cowrie, it indicates successful actor persistence and data exfiltration attempts.Indicators/TacticsIndicator of Compromise (IoC): The hashes themselves act as IoCs if they resolve to known malware families or C2 infrastructure components. Since the external sites provided no results, the focus must be on the *behavior*—the repeated transfer of these files.
Tactics (MITRE ATT&CK): This activity strongly suggests **Persistence**, **Command and Control (C2)** communication, and potentially **Lateral Movement/Exfiltration**. The actors are not merely querying the system; they are downloading specific files repeatedly.2. Comparative Analysis & Recommendations| Aspect | VirusTotal (VT) | CyberGordon (CG) | Conclusion / Action Recommendation |
| :--- | :--- | :--- | :--- |
| Data Depth | High-fidelity, integrated threat intelligence from multiple sources (AV engines). Best for direct identification. | Academic/Historical analysis engine. Useful for deep source tracking and niche observations. | VT is superior for immediate threat context; CG offers supporting research. |
| Reliability | Generally reliable, though sometimes slow or requires paid access for full fidelity. | Utility appears high but the provided output is generic (focusing on JS compatibility rather than results). | **Rely primarily on VT/Commercial Threat Feeds.** Do not treat lack of a result as "safe." |
| Missing Data | The provided snippet was boilerplate ("Please enable JavaScript"), meaning we missed vital IoC intelligence. | The provided snippet was generic browser/engine advice, offering no actionable threat intel. | **Critical Action:** Develop a structured workflow to *ensure* the results page is fully processed and captured for all 10 hashes. |Recommendations for Action (Preventing Compromise):1.  Immediate Containment: Treat any machine connected through this sensor as compromised. Isolate the host and initiate forensic imaging immediately.
2.  Mitigation at Sensor Level: Update Cowrie's logging and alerting capabilities to track file *execution* attempts, not just downloads. Implement stricter egress filtering on the network hosting the sensors.
3.  Threat Hunting (Proactive): Utilize the Top 10 hashes to query internal Endpoint Detection and Response (EDR) solutions across the entire enterprise, searching for the hash signatures or file names appearing on any system *outside* of the sensor environment.
4. …

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

via SANS Internet Storm Center, InfoCON: green https://ift.tt/TYisvSZ

Rilevate molteplici vulnerabilità, di cui 3 con gravità “alta”, in prodotti Fortinet.

via RSS Csirt Italia https://ift.tt/17Wfncs

Threat actors have begun to exploit a newly disclosed Microsoft SharePoint vulnerability following the release of a proof-of-concept (PoC) code.The vulnerability in question is CVE-2026-55040 (CVSS score: 9.1), which refers to a critical security feature bypass that stems from weak authentication. It was patched by Microsoft as part of its July 2026 Patch Tuesday updates."The authentication

via The Hacker News https://ift.tt/f9gpQmq

Rilasciati aggiornamenti di sicurezza che risolvono 13 vulnerabilità, di cui 6 con gravità “alta”, in GitLab Community Edition (CE) ed Enterprise Edition (EE). Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato remoto di elevare i propri privilegi, accedere a informazioni sensibili e/o eludere meccanismi di sicurezza sui sistemi interessati.

via RSS Csirt Italia https://ift.tt/YnJl0FV

IBM ha pubblicato aggiornamenti di sicurezza per risolvere molteplici vulnerabilità, di cui 9 con gravità "critica" e 48 con gravità "alta", nei prodotti Db2, Security Verify Access, Verify Identity Access, WebSphere e IBM i.

via RSS Csirt Italia https://ift.tt/BD13nrQ

Rilevate cinque vulnerabilità, tra cui una con gravità “critica” e quattro con gravità “alta”, in MongoDB BI Connector ODBC Driver.

via RSS Csirt Italia https://ift.tt/GNOX072

Rilevate due vulnerabilità di sicurezza con gravità "alta", che interessano il software JupyterLab, ambiente di lavoro interattivo utilizzato per attività di programmazione, analisi dei dati, machine learning e calcolo scientifico.

via RSS Csirt Italia https://ift.tt/n8DA6jS

Aggiornamenti di sicurezza Zoho sanano una vulnerabilità con gravità “alta” in ManageEngine Password Manager Pro e PAM360.

via RSS Csirt Italia https://ift.tt/zAisa16

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

via SANS Internet Storm Center, InfoCON: green https://ift.tt/5R0CtXN

Disponibili Proof of Concept (PoC) per le vulnerabilità CVE-2026-73613, CVE-2026-73612 e CVE-2026-73611, con gravita “alta” e già sanate dal vendor, presenti in File Browser, applicazione open source e self hosted che fornisce un’interfaccia web per la gestione di file e cartelle su un server.

via RSS Csirt Italia https://ift.tt/RVAHUtg

Sanata una vulnerabilità con gravità “alta” in WordPress. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato remoto autenticato di eseguire codice arbitrario sui sistemi interessati.

via RSS Csirt Italia https://ift.tt/XeTCmRh

Rilevate 19 vulnerabilità, di cui 5 con gravità “critica” e 14 con gravità "alta", in Rsync, software open source per la sincronizzazione e il trasferimento di file tra sistemi.

via RSS Csirt Italia https://ift.tt/6yL4Zet