Cert-IX, 54 Avenue de la Motte Picquet, Paris (2026)

28/09/2026

🚨 The system issuing access tokens can itself become the entry point.

CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP APM that can allow unauthenticated remote code ex*****on. CERT-EU reports confirmed exploitation and a CVSS score of 9.8.

The warning:
⚠️ Exposure depends on the OAuth authorisation-server configuration.
⚠️ Affected virtual servers have an APM access policy and OAuth profile.
⚠️ Engineering hotfixes are available for affected releases.

Security teams should:
✅ Inventory APM versions and relevant virtual-server configurations.
✅ Preserve forensic evidence before making changes.
✅ Apply the appropriate F5 engineering hotfix promptly.
✅ Review OAuth failures, suspicious audit commands and TMM crashes together.
✅ Obtain F5’s supported mitigation if immediate patching is impossible.

A crash alone does not establish compromise, and a patch does not remove an existing foothold. Escalate suspicious combinations through incident response and verify the deployed fix.

Explore Cert‑IX’s approach to discovering, prioritising and remediating exposures.

🚀 Join Cert‑IX Early Access : https://cert-ix.com/early-access

🔎 Read the complete analysis : https://blog.cert-ix.com/articles/critical-zero-day-in-f5-big-ip-apm-risks-unauthenticated-rce-mudxo2da

27/09/2026

More assets. More vulnerabilities. More alerts. More risk.

Security gets harder every quarter. Cert-IX breaks the cycle.

One dashboard for continuous threat exposure management (CTEM) and compliance. AI agents discover, prioritize and remediate across your attack surface, from code to cloud, on European soil.

→ Six stages, one loop: discover, assess, prioritize, simulate, remediate, verify
→ Built in the EU, with EU data residency
→ Post-quantum by design (ML-KEM-768)
→ Evidence mapped automatically to NIS2, DORA, ISO 27001 and GDPR

The early-access waitlist is open. We onboard in waves: join with your work email and we'll email you when your wave opens.

Join the waitlist: https://cert-ix.com/early-access

27/09/2026

🚨 A convincing job offer can become a route into your systems.

A joint government advisory describes North Korea’s WaterPlum campaign targeting IT professionals through fake recruitment and malicious coding assignments. It also documents Japan’s first identified and dismantled domestic laptop farm supporting North Korean IT workers.

The warning:
⚠️ Interview tasks can deliver malware from developer platforms.
⚠️ Laptop farms conceal where remote workers actually operate.
⚠️ Stolen identities and device access can support further intrusion.

Hiring and security teams should:
✅ Verify recruiters through independently obtained contact details.
✅ Review coding assignments before executing unfamiliar software.
✅ Use isolated evaluation environments without corporate secrets.
✅ Validate worker identity and device custody consistently.
✅ Investigate unapproved remote-access tools and unusual sessions.

The takedown was Japan’s first; it does not mean the worldwide scheme has ended. Apply verification fairly to every candidate and contractor rather than relying on nationality or appearance.

Explore Cert‑IX’s approach to discovering, prioritising and remediating exposures.

🚀 Join Cert‑IX Early Access : https://cert-ix.com/early-access

🔎 Read the complete analysis : https://blog.cert-ix.com/articles/unveiling-north-koreas-cyber-tactics-the-first-laptop-farm-dismantled-mucic9xj

27/09/2026

⚠️ An AI agent can finish the task and exhaust the budget.

Forcepoint’s analysis of unbounded consumption explains how legitimate-looking AI requests can generate excessive compute and tool costs. Recursive exploration, repeated reasoning and growing conversation history can make a small task unexpectedly expensive.

The warning:
⚠️ One request can trigger many downstream tool calls.
⚠️ Normal-looking traffic can still accumulate abnormal costs.
⚠️ Misconfigured automation can overspend without an attacker.

Engineering and security teams should:
✅ Enforce budgets per agent, run, API key and tenant.
✅ Cap steps, retries, recursion depth and parallel calls.
✅ Check remaining budget before authorising paid operations.
✅ Attribute token and tool costs to accountable owners.
✅ Test circuit breakers and safe-stop behaviour.

An alert is useful, but it does not stop spending. This is an architectural risk analysis with illustrative scenarios, not evidence that every AI deployment is compromised.

Explore Cert‑IX’s approach to discovering, prioritising and remediating exposures.

🚀 Join Cert‑IX Early Access : https://cert-ix.com/early-access

🔎 Read the complete analysis : https://blog.cert-ix.com/articles/ai-driven-costs-managing-runaway-enterprise-expenses-mucia77w

26/09/2026

🚨 The document looks routine. The access it grants is not.

Trellix reports SideCopy targeting academic institutions in India with spear-phishing that delivers ReverseRAT. A disguised Windows shortcut launches a multi-stage infection chain using the legitimate mshta.exe utility.

The warning:
⚠️ A document-style icon can conceal an executable shortcut.
⚠️ Registry Run keys help the malware survive restarts.
⚠️ ReverseRAT can collect credentials, screenshots and files.

Security teams should:
✅ Inspect unexpected archives and shortcut attachments.
✅ Restrict mshta.exe where business workflows permit.
✅ Investigate suspicious parent-child process chains.
✅ Hunt for unauthorised startup entries and outbound connections.
✅ Isolate affected endpoints and reset exposed credentials.

The documented chain relies on social engineering and legitimate-tool abuse. The report does not establish a Windows zero-day. Universities should include research workstations and unmanaged departmental systems in their exposure reviews.

Explore Cert‑IX’s approach to discovering, prioritising and remediating exposures.

🚀 Join Cert‑IX Early Access : https://cert-ix.com/early-access

🔎 Read the complete analysis : https://blog.cert-ix.com/articles/sidecopys-new-target-academia-under-siege-by-reverserat-muci8aan

25/09/2026

🚨 Known exploitation changes the urgency of a kernel update.

On 18 September, CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalogue: CVE-2025-39682, CVE-2026-53266 and CVE-2025-39964. Organisations should identify affected hosts and follow their distribution’s remediation guidance.

The warning:
⚠️ The flaws affect TLS receive handling, ebtables SNAT and AF_ALG socket state.
⚠️ KEV inclusion indicates evidence of exploitation.
⚠️ Applicability depends on the kernel build and vendor backports.

Security teams should:
✅ Inventory running kernels across servers and cluster nodes.
✅ Check distribution advisories for each CVE.
✅ Apply vendor-supported fixes and reboot where required.
✅ Verify the running kernel after maintenance.
✅ Review affected systems for signs of compromise and preserve evidence.

A package update alone may leave the old kernel running. These entries should not be described as three universal remote takeovers, and patching does not remove an existing compromise.

Explore Cert‑IX’s approach to discovering, prioritising and remediating exposures.

🚀 Join Cert‑IX Early Access : https://cert-ix.com/early-access

🔎 Read the complete analysis : https://blog.cert-ix.com/articles/urgent-alert-critical-linux-kernel-vulnerabilities-uncovered-mu87wh9d

25/09/2026

⚠️ AI security needs people who can turn detection into action.

Vectra AI has introduced Ascent, a global partner programme bringing together solution providers, MSSPs, integrators and technology partners. Its stated aim is to combine expertise, services and joint innovation to help customers address evolving security challenges.

The announcement:
⚠️ Four pillars: co-sell, co-market, co-deliver and co-innovate.
⚠️ Three participation levels: Basecamp, Elevate and Summit.
⚠️ The focus includes getting more value from existing security investments.
For security leaders, turn that discussion into practical

checks:
✅ Map visibility gaps across identity, network and cloud.
✅ Define who investigates and who authorises containment.
✅ Validate detections against realistic attack scenarios.
✅ Measure response time and operational coverage.
✅ Review privileged access for tools, partners and agents.

Ascent is a partner programme; its launch alone does not prove detection effectiveness against every AI-assisted attack.

Explore Cert‑IX’s approach to discovering, prioritising and remediating exposures.

🚀 Join Cert‑IX Early Access : https://cert-ix.com/early-access

🔎 Read the complete analysis : https://blog.cert-ix.com/articles/navigating-ai-driven-cyber-threats-with-vectra-ais-ascent-mu87y59h

24/09/2026

🚨 An image-upload flaw can reach far beyond the upload service.

Hacktron reports chaining AI-assisted exploitation of a Discourse image-processing dependency with an OpenAI identity-flow flaw. The researchers demonstrated account takeover and used an employee’s connected Codex account to create a proof-of-impact pull request.

The warning:
⚠️ Image-processing dependencies can expand an application’s attack surface.
⚠️ An identity flaw can cross service boundaries.
⚠️ Connected tools can increase the impact of account compromise.

Security teams should:
✅ Update image-processing libraries and rebuild affected container images.
✅ Isolate media processing with minimal privileges.
✅ Review SSO trust boundaries and account-linking flows.
✅ Minimise connector permissions and monitor their use.
✅ Revoke compromised sessions and retain investigation evidence.

Hacktron says it did not read internal source code. Potential access to other connected services should not be presented as confirmed exploitation. This was researcher-reported testing, not evidence of autonomous AI escaping a sandbox.

Explore Cert‑IX’s approach to discovering, prioritising and remediating exposures.

🚀 Join Cert‑IX Early Access : https://cert-ix.com/early-access

🔎 Read the complete analysis : https://blog.cert-ix.com/articles/ai-exploit-breach-unveiling-a-path-to-openais-core-mu8800ca

24/09/2026

🚨 One stolen credential can poison a shared web component.

Brevo says an attacker used a compromised Cloudflare API key to deploy a Worker that altered pages and embedded JavaScript at the CDN edge on 14 September. Sansec estimated the affected components could reach more than 100,000 websites.

The warning:
⚠️ Selected visitors received fake verification prompts that encouraged malware ex*****on.
⚠️ Logged-in WordPress administrators could trigger malicious plugin installation attempts.
⚠️ Brevo’s origin files remained unchanged.

Security teams should:
✅ Identify sites loading the affected Brevo components.
✅ Review unexpected WordPress plugins and installation logs.
✅ Investigate endpoints where visitors ran the fake verification command.
✅ Rotate exposed credentials from a clean device.
✅ Monitor CDN configuration changes and externally served content.

Brevo removed the malicious Worker and revoked credentials. The website figure represents estimated reach, not 100,000 confirmed infections. A clean origin does not establish that visitors received clean content.

Explore Cert‑IX’s approach to discovering, prioritising and remediating exposures.

🚀 Join Cert‑IX Early Access : https://cert-ix.com/early-access

🔎 Read the complete analysis : https://blog.cert-ix.com/articles/massive-supply-chain-breach-malware-hits-100000-websites-mu6skazz

23/09/2026

🚨 The package you install can steal the keys to your pipeline.

CrowdStrike describes PhantomRaven as a JavaScript information stealer distributed through malicious npm packages. It collects system details and CI/CD-related environment variables, potentially exposing credentials from development and build environments.

The warning:
⚠️ Researchers assess LLM-assisted authorship with high confidence.
⚠️ Malicious dependency installation can trigger code ex*****on.
⚠️ Build environments can hold secrets valuable beyond a single project.

Development and security teams should:
✅ Review package sources, maintainers and dependency changes.
✅ Restrict lifecycle scripts where your workflow permits.
✅ Isolate builds and minimise available credentials.
✅ Monitor installation-time outbound connections.
✅ Revoke exposed tokens and investigate affected runners.

The AI claim concerns how the malware was written. It does not establish autonomous adaptation, and the report does not demonstrate a vulnerability in the npm registry itself. Advisory scanning alone cannot establish that an unfamiliar package is trustworthy.

Explore Cert‑IX’s approach to discovering, prioritising and remediating exposures.

🚀 Join Cert‑IX Early Access : https://cert-ix.com/early-access

🔎 Read the complete analysis : https://blog.cert-ix.com/articles/unveiling-phantomraven-ai-driven-malware-threatens-javascript-ecosystem-mu6sgn3b

Cert-IX

28/09/2026

27/09/2026

27/09/2026

27/09/2026

26/09/2026

25/09/2026

25/09/2026

24/09/2026

24/09/2026

23/09/2026

Adresse

Site Web

Notifications

Raccourcis

Partager

Catégorie

Demande de retrait de la fiche