Vercel, one of the most widely used frontend cloud platforms powering millions of developer deployments, confirmed the breach in an official security bulletin published on April 18–19, 2026.

The company stated it is actively investigating the incident with the help of cybersecurity firm Mandiant and has notified law enforcement authorities.

The intrusion traces back to a compromise of Context.ai, a third-party AI tool used by a Vercel employee. Attackers leveraged a malicious or compromised Google Workspace OAuth app associated with Context.ai to hijack the employee’s Google Workspace account.

Once inside, the threat actors pivoted to access select Vercel environments and read non-sensitive environment variables from a limited number of customer configurations.

Vercel confirmed that environment variables explicitly marked as “sensitive,” which are stored in a manner that prevents them from being read, showed no evidence of being accessed.

However, any variables not marked sensitive and containing secrets such as API keys, tokens, database credentials, or signing keys should be treated as potentially exposed and rotated immediately.

The compromised OAuth app has been publicly identified as an indicator of compromise (IOC): 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com. Vercel is urging all Google Workspace administrators to immediately audit their environments for usage of this app.

ShinyHunters Claims $2 Million Sale

The incident escalated after a threat actor claiming to be ShinyHunters posted on BreachForums, offering Vercel’s alleged internal database, access keys, source code, employee accounts, API keys, NPM tokens, and GitHub tokens for $2 million.

The attacker shared a text file containing 580 Vercel employee data records, including names, email addresses, account status, and activity timestamps, along with a screenshot of an alleged internal Vercel Enterprise dashboard as proof of access.

In messages circulated on Telegram, the threat actor also claimed to have been in direct communication with Vercel regarding a ransom demand, though Vercel has not publicly confirmed any ransom negotiations.

CEO Flags Highly Sophisticated Attackers

Vercel CEO Guillermo Rauch characterized the threat actor as “highly sophisticated,” citing their operational velocity and detailed understanding of Vercel’s internal systems.

Rauch noted the attackers may have leveraged AI capabilities to accelerate their intrusion efforts, and strongly urged all customers to rotate API keys and tokens as a precautionary measure.

Vercel has confirmed that Next.js and its broader supply chain remain unaffected by the incident. All services are fully operational, and the company has deployed extensive protection and monitoring measures.

Customers who have not been directly notified by Vercel have no current evidence of credential or personal data compromise, though the investigation remains ongoing.

• Review activity logs in the Vercel dashboard or CLI for any suspicious behavior
• Rotate all environment variables containing secrets that were not marked as sensitive
• Enable the sensitive environment variables feature for all future secrets
• Inspect recent deployments for unexpected or unauthorized changes
• Ensure Deployment Protection is set to Standard or higher
• Rotate Deployment Protection bypass tokens if previously configured
• Audit Google Workspace for the identified malicious OAuth app IOC immediately

Vercel is providing ongoing updates to its security bulletin as the investigation progresses.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Vercel Confirms Data Breach — Hackers Claim Access to Internal Systems appeared first on Cyber Security News.

Users across organizations began reporting on April 14, 2026, that the Paste option in the Teams desktop client’s right-click context menu was greyed out, preventing them from pasting URLs, text snippets, and images copied from tools like Snipping Tool, Outlook, Word, and Microsoft Edge.

Keyboard shortcuts Ctrl+V and Cmd+V on Mac continue to function normally, and the Windows clipboard (accessible via Windows Key + V) also behaves as expected — isolating the issue exclusively to the right-click dropdown method.

One of the earliest reporters noted a curious partial workaround: removing a single character from a URL (e.g., changing https:// to ttps://) allowed the broken link to be pasted as plain text. Full, valid URLs, however, remained blocked from the right-click paste option.

Edge Browser Regression

Microsoft confirmed in a service health notification posted on April 16, 2026, at 7:24 AM PDT that a recent update to the Microsoft Edge browser, which the Teams desktop client leverages for rendering, introduced a code regression that directly caused this paste behavior to break.

The Teams desktop application is built on an Electron-based framework that embeds the Edge WebView2 runtime, making it vulnerable to regressions in underlying browser engine updates.

Volunteer moderator Ruwim.B independently verified that the issue is also reproducible in the Teams Insider build (version 26093.408.4582.3829) when signed in with a personal/Teams Free account, confirming it is not related to organizational IT admin settings or policy configurations.

Notably, Teams for Web (teams.live.com) does not exhibit the issue, with all paste options functioning correctly in browser-based sessions.

Multiple enterprise users confirmed the bug affects pasting of all content types, not just URLs. Reported impacted scenarios include:

• Pasting images captured via Snipping Tool
• Pasting text copied from external apps such as Outlook and Word
• Pasting any content type after restarting or rebooting even on builds where paste initially appeared to work.

A critical behavioral pattern emerged from user reports: if Teams version 26072.519.4556.7438 appears to be functioning correctly, closing and reopening Teams or rebooting the system will trigger the bug upon relaunch.

Microsoft’s Response and Workarounds

Microsoft acknowledged the incident and confirmed a fix is being deployed through a staged rollout, with active telemetry monitoring underway to confirm recovery. While the fix propagates, Microsoft recommends the following temporary workarounds:

• Windows: Use Ctrl+C to copy and Ctrl+V to paste
• Mac: Use Cmd+C and Cmd+V equivalents
• Use Ctrl+Shift+V (Windows) or Cmd+Shift+V (Mac) to paste as plain text
• Submit affected feedback via Teams Settings > Feedback > Report a Problem, or escalate through Microsoft 365 Admin Center > Service Health for organizational impact.

Enterprise IT administrators managing affected fleets should advise end users to rely on keyboard shortcuts until the staged fix reaches their tenant version.

Organizations experiencing widespread impact are encouraged to file reports through the Microsoft 365 Admin Center to increase visibility with the Teams product engineering team.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Microsoft Teams Right-Click Paste Broken Following Edge Browser Update appeared first on Cyber Security News.

The program operates on a tiered trust model advanced AI cyber capabilities are made broadly available to defenders, but access scales based on validation, accountability, and demonstrated safeguards.

OpenAI positions this as a direct response to the growing asymmetry between attackers leveraging AI tools and defenders who often lack equivalent resources.

Who Has Joined the Program

OpenAI confirmed that several major enterprises and cybersecurity firms have already signed on.

Including Bank of America, BlackRock, BNY, Citi, Cisco, Cloudflare, CrowdStrike, Goldman Sachs, iVerify, JPMorgan Chase, Morgan Stanley, NVIDIA, Oracle, Palo Alto Networks, SpecterOps, and Zscaler.

These organizations will use GPT-5.4-Cyber to enhance real-world defensive operations, generate threat intelligence, and help OpenAI refine safety systems through practical deployment feedback.

OpenAI also granted access to the U.S. Center for AI Standards and Innovation (CAISI) and the UK AI Security Institute for independent testing, reinforcing its commitment to third-party oversight.

Recognizing that most software teams lack 24/7 security operations coverage, OpenAI committed $10 million in API credits through its Cybersecurity Grant Program to extend access to its frontier models to under-resourced defenders.

Initial grant recipients include:

• Socket and Semgrep: focused on software supply chain security.
• Calif and Trail of Bits:  pairing AI with expert vulnerability researchers.

OpenAI emphasized the real-world problem this addresses; not every team can respond to a critical vulnerability disclosed on a Friday night.

The grant program aims to change that by giving smaller open-source maintainers and researchers the same AI capabilities available to large enterprises.

Additional teams with proven track records in open-source and critical infrastructure security can apply directly through OpenAI’s grant portal.

The Defense-First Philosophy

OpenAI’s framing is clear: cyber defense is a collective challenge. The program is designed to generate shared learnings across participants, improve model safety through real-world use, and push the frontier of defensive research.

BNY’s Chief Information Officer, Leigh-Ann Russell, noted that the firm’s participation reflects its commitment to protecting financial system resilience as AI capabilities accelerate, building on an existing collaboration with OpenAI.

The company confirmed that Trusted Access for Cyber will continue to expand, with safeguards that increase in step with model capability, ensuring that greater power comes with proportionally stronger accountability measures.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post OpenAI Expands Cyber Defense Program With GPT-5.4-Cyber Access for Trusted Organizations appeared first on Cyber Security News.

According to a recent report by The Register, Cupertino’s software engineers are scrambling to patch a keyboard interface flaw that inadvertently removed a specific special character necessary for unlocking devices configured with custom alphanumeric passcodes.

The issue first gained public attention when a 21-year-old university student, Connor Byrne, shared his predicament on Reddit.

As The Register reported, Byrne opted not to use the standard four- or six-digit PIN on his iPhone 13. Instead, he enhanced his device security by setting a complex, custom alphanumeric string as his primary passcode.

While cybersecurity professionals highly recommend complex passcodes to thwart brute-force attacks, Byrne’s specific password combination triggered an unexpected software trap.

He utilized the caron or háček (ˇ) symbol from the iPhone’s Czech keyboard layout. When Apple released iOS 26 to the general public in September 2025, the company unknowingly removed this specific character from the lock screen keyboard.

Without the ability to type the required symbol, Byrne was permanently locked out of his smartphone. The only native solution provided by the device was a full factory reset.

However, a reset would permanently erase months of valuable photographs and personal files stored locally on the device. Choosing to preserve his data, the user has remained locked out while waiting for a potential software patch.

Following the viral social media post, Apple’s internal engineering team reportedly began investigating the issue. The Register notes that Apple is now working on a targeted fix to restore the missing character, which is expected to roll out in an upcoming major iOS 26 release.

Interestingly, despite Apple’s engineers responding within 9 days after the issue surfaced online, the extended lockout has permanently damaged the user’s trust.

According to The Register, Byrne has decided to migrate to an Android device, specifically eyeing the Samsung Galaxy S26 Ultra.

He cited both the software quality assurance oversight, noting that the current keyboard’s flaws duplicate characters side-by-side, and a preference for alternative camera hardware. Apple has not yet issued an official public comment on the fix’s timeline.

• Backup Data Regularly: Always maintain up-to-date iCloud or physical backups. If a critical lock screen glitch occurs after an update, you can safely perform a factory reset without losing your data.
• Review Custom Passcodes: If you use a custom alphanumeric passcode, ensure it relies on standard characters that are universally available across different keyboard layouts to avoid getting locked out.
• Monitor Software Updates: Be cautious when adopting major operating system upgrades immediately upon release. As this incident highlights, unexpected interface bugs can temporarily sever device access.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Apple Works on Fix for iPhone Passcode Bug Linked to Missing Czech Keyboard Character appeared first on Cyber Security News.

Moving beyond theoretical warnings, the researcher successfully utilized Claude Opus to construct a fully functional exploit chain targeting Google Chrome’s complex V8 JavaScript engine.

The experiment highlights a persistent vulnerability in the modern software ecosystem: the patch gap. Many popular desktop applications built on the Electron framework, such as Discord, Notion, and Slack, bundle their own Chromium builds.

These bundled versions often lag weeks or months behind the upstream Chrome releases, leaving known vulnerabilities unpatched and exposing users to n-day exploits.

For this test, the researcher targeted the Discord desktop application, which was running on the outdated Chrome 138 engine.

Because Discord operates without a sandbox on its main window, the exploit required only two vulnerabilities to achieve a full chain, circumventing the need for a third dedicated sandbox escape.

Chaining the Vulnerabilities

Through a series of guided interactions, Claude Opus was tasked with developing an exploit using specific unpatched flaws. The AI successfully chained together two complex vulnerabilities to achieve Remote Code Execution (RCE):

• CVE-2026-5873: An out-of-bounds (OOB) read and write vulnerability in V8’s Turboshaft compiler for WebAssembly. Fixed in Chrome 147, this bug allowed the attacker to bypass bounds checks after tier-up compilation, enabling arbitrary memory manipulation within the V8 heap.
• V8 Sandbox Bypass: A Use-After-Free (UAF) flaw in the WebAssembly Code Pointer Table (WasmCPT). By corrupting the import dispatch table and exploiting type confusion, the exploit escaped the V8 sandbox entirely, granting full read and write access to the entire virtual address space.

Using these chained primitives, the model generated a payload capable of redirecting execution flows to the system’s dyld cache, ultimately launching arbitrary system commands on a macOS target.

Despite the impressive outcome, the process was far from fully autonomous. The researcher noted that Claude Opus required extensive human oversight, scaffolding, and operational management.

The AI frequently suffered from context collapse during long conversations, speculated on memory offsets instead of verifying them, and struggled to recover independently when stuck in logical loops.

Over the course of a week, the experiment consumed roughly 2.3 billion tokens across 1,765 requests, costing approximately $2,283 and requiring 20 hours of hands-on guidance.

The researcher had to continually feed the debugger (LLDB) back into the model to keep it on track, as reported by Hacktron AI.

Economic Reality and Future Threats

While the process was labor-intensive, the economics of AI-assisted exploitation are striking. Spending around $2,300 and a few days of effort to generate a reliable Chrome exploit is highly profitable when compared to commercial bug bounties, which frequently pay upwards of $10,000 for similar submissions, or the highly lucrative underground exploit market.

This experiment serves as a stark warning for the cybersecurity industry. While current models like Claude Opus still require expert babysitting to weaponize vulnerabilities, the technological trajectory is clear.

As next-generation models like Anthropic’s Mythos emerge with enhanced reasoning and coding capabilities, the barrier to generating sophisticated exploits will drop drastically.

Ultimately, the shrinking gap between automated exploit generation and slow vendor patching cycles threatens to empower less sophisticated threat actors to compromise vulnerable software at an unprecedented scale.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Researcher Uses Claude Opus to Build a Working Chrome Exploit Chain appeared first on Cyber Security News.

According to a recent disclosure on Hacker News, an insecure file-hosting configuration has exposed personal identifiable information (PII), including completed tax forms, that were exchanged between freelancers and clients.

The Cloudinary Misconfiguration

The root of the data exposure lies in how Fiverr handles file sharing within its internal messaging system.

The platform relies on a third-party service called Cloudinary to process and host images and PDF documents, including final work products delivered to clients.

While Cloudinary operates similarly to an Amazon S3 digital storage bucket and supports secure, expiring web links, Fiverr reportedly configured the service incorrectly.

Instead of requiring authentication, Fiverr opted to generate fully public URLs for these sensitive attachments. Because these files were left open to the public, search engines like Google were able to crawl and index them.

This suggests that the public file links may have been exposed through unprotected HTML pages somewhere on Fiverr’s network.

The impact of this oversight is severe, as anyone can allegedly use specific Google search queries to surface private documents.

For example, running a site-specific search for “form 1040” on Fiverr’s Cloudinary domain instantly reveals private tax documents containing highly sensitive financial and personal data.

Interestingly, the researcher highlighted a troubling contradiction. Fiverr actively purchases Google Ads for tax preparation services, yet the platform fails to secure the resulting financial work products.

This exposure raises immediate regulatory concerns. By failing to lock down financial documents properly, the platform and its tax preparation freelancers could be in direct violation of the FTC Safeguards Rule and the Gramm-Leach-Bliley Act (GLBA), which mandate strict protections for consumer financial data.

The researcher who discovered the issue claims to have followed standard responsible disclosure protocols. A detailed vulnerability report was sent to Fiverr’s designated security team 40 days before the public release.

After receiving no response or remediation efforts from the company, the researcher opted to publish the findings on Hacker News to warn affected users.

Key Takeaways and Mitigations

Until Fiverr resolves this public exposure, users are at risk of identity theft and financial fraud. Both freelancers and clients should take immediate precautions:

• Halt sensitive transfers: Users should temporarily stop sending sensitive documents, such as tax forms or medical records, through Fiverr’s messaging system.
• Implement signed URLs: Fiverr must urgently update its Cloudinary integration to utilize signed, time-limited URLs for all user-to-user file transfers to ensure files expire after being downloaded.
• Request search de-indexing: The company needs to issue urgent takedown requests to Google to remove the exposed domain directories from public search results.
• Monitor for identity theft: Clients who purchased financial or tax preparation gigs on Fiverr should monitor their credit reports for unauthorized activity.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Fiverr Allegedly Leaks User Information to Google Indexing, Researchers Say appeared first on Cyber Security News.

According to recent threat research published by Fortinet’s FortiGuard Labs, threat actors are exploiting a known command injection vulnerability to hijack TBK DVR systems and construct a large-scale Distributed Denial-of-Service (DDoS) botnet.

Fortinet researchers report that the campaign specifically targets TBK DVR-4104 and DVR-4216 models by exploiting CVE-2024-3721. This OS command injection flaw allows attackers to deliver a downloader script by manipulating arguments within the device system.

During the exploitation phase, network traffic reveals a custom HTTP header reading “X-Hacked-By: Nexus Team – Exploited By Erratic,” leading FortiGuard Labs to attribute the campaign to a relatively unknown threat actor identified as the “Nexus Team“.

Once the downloader script executes, it fetches multi-architecture payloads supporting ARM, MIPS, and x86-64 environments, subsequently displaying a console message stating “nexuscorp has taken control”.

Technical Capabilities and Infection Mechanisms

Fortinet’s analysis reveals that Nexcorium shares fundamental architecture with traditional Mirai variants, utilizing XOR-encoded configurations and modular components. The technical operation relies on several core mechanisms:

• Modular Architecture: The malware deploys standard Mirai features, including a watchdog module to distinguish sub-processes, a scanner for network propagation, and an attacker module for DDoS execution.
• Legacy Exploit Integration: To maximize its infection radius, Nexcorium incorporates the older CVE-2017-17215 vulnerability, which targets Huawei router devices.
• Aggressive Brute-Forcing: The malware launches Telnet-based brute-force attacks against other networked hardware using a hardcoded list of common and default credentials.
• Self-Preservation: Nexcorium verifies its own integrity using FNV-1a hashing algorithms; if the binary is altered or unreadable, it dynamically duplicates itself under a new filename to evade detection.

To maintain long-term access to compromised systems, the malware establishes persistence through four distinct mechanisms rather than relying on a single configuration file. The botnet secures its foothold by:

• Modifying /etc/inittab to ensure automatic process restarts if the malware is terminated.
• Updating /etc/rc.local to guarantee execution during the device’s system startup sequence.
• Creating a dedicated systemd service named persist.service for persistent background operation.
• Planting scheduled tasks via crontab for reliable post-reboot execution.

Following this extensive setup, Fortinet notes that Nexcorium deletes its original binary from the execution path to thwart security analysts.

The primary objective of the Nexus Team campaign is launching devastating DDoS attacks. Based on FortiGuard Labs’ decryption of the malware’s configuration table, Nexcorium communicates with a centralized command-and-control (C2) server to receive attack directives.

Instead of a narrow attack scope, the botnet is equipped with a versatile arsenal of flood techniques. These include standard UDP, TCP ACK, TCP SYN, SMTP, and TCP PSH floods, alongside specialized attack vectors like VSE query floods and UDP blast attacks.

The discovery of Nexcorium highlights the continuous weaponization of legacy IoT devices. Security experts strongly advise organizations to immediately patch CVE-2024-3721, replace default manufacturer credentials, and isolate critical infrastructure from vulnerable IoT endpoints using network segmentation.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Nexcorium-Associated Mirai Variant Uses TBK DVR Exploit to Scale Botnet Operations appeared first on Cyber Security News.

While this marks a significant 40% decline from the 10.1 million servers observed in 2024, the presence of this decades-old protocol continues to pose an exposure risk due to widespread insecure default configurations.

The Censys report highlights that the dominant story of FTP exposure in 2026 is not purpose-built file transfer infrastructure, but rather an accumulation of platform defaults on shared hosting networks and broadband providers.

The State of Encryption and Regional Risks

When it comes to securing these servers, the data reveals a mixed landscape. Censys found that roughly 58.9% of observed FTP hosts completed a Transport Layer Security (TLS) handshake, meaning they support encrypted connections.

However, this leaves approximately 2.45 million hosts without observed evidence of encryption, potentially allowing them to transmit files and credentials in cleartext.

The lack of encryption adoption varies significantly by region. According to Censys data, mainland China and South Korea have the lowest TLS adoption rates among the top 10 hosting countries, at 17.9% and 14.5%, respectively.

Meanwhile, Japan accounts for 71% of all FTP servers globally that still rely on outdated, deprecated legacy encryption protocols such as TLS 1.0 and 1.1.

The security posture of these 6 million servers is heavily influenced by the default settings of the software daemons running them.

Key technical observations from the Censys report include:

• Pure-FTPd Dominance: Operating on roughly 1.99 million services, this is the most common FTP daemon, largely driven by its inclusion as a default in cPanel hosting environments.
  
• The IIS FTP Configuration Trap: Over 150,000 Microsoft IIS FTP services return a “534” error response, indicating TLS was never configured.
  
  While IIS defaults to a policy that appears to require encryption, it does not bind a security certificate upon a fresh installation.
  
  Consequently, the server accepts cleartext credentials, even though the configuration appears to enforce TLS.
  
• Hidden Nonstandard Ports: Relying only on port 21 scans miss a significant portion of the attack surface.
  
  Tens of thousands of FTP services run on alternate ports, such as 10397 or 2121, often tied to specific telecom operations or network-attached storage devices.

Mitigation and Hardening Strategies

For enterprise defenders and infrastructure administrators, Censys strongly recommends evaluating whether FTP is truly necessary before attempting to harden it.

Organizations should consider the following mitigation strategies:

• Migrate to Secure Alternatives: Whenever possible, replace FTP with SSH File Transfer Protocol (SFTP), which encrypts credentials and data by default over port 22.
  
• Enforce Explicit TLS: If legacy FTP infrastructure must remain online, administrators should configure their daemons to enforce Explicit TLS (FTPS) and refuse cleartext connections.
  
• Fix IIS Certificate Bindings: Windows Server administrators using IIS FTP must ensure that a valid certificate is bound to the FTP site and verify that the SSL policy actively enforces encryption.

Ultimately, while the internet’s reliance on FTP is slowly shrinking, millions of instances continue to run quietly in the background.

As Censys warns, the primary risk is not advanced zero-day attacks, but the simple failure to update default configurations that leave systems unnecessarily exposed.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Nearly 6 Million Internet-Facing FTP Servers Still Exposed in 2026, Censys Warns appeared first on Cyber Security News.

The flaw allows an unauthenticated attacker to execute arbitrary operating system commands as root, the highest privilege level, without requiring any login credentials.

The vulnerability was originally discovered in November 2025 and has now been made public following Fortinet’s patch release in April 2026.

Security researchers and defenders are urged to apply the fix immediately, as a working exploit is now freely available on GitHub.

CVE-2026-39808 is an OS command injection vulnerability affecting Fortinet’s FortiSandbox, a widely used sandboxing solution designed to detect and analyze advanced threats and malware. The flaw resides in the /fortisandbox/job-detail/tracer-behavior endpoint.

How Simple Is the Attack?

An attacker can inject malicious operating system commands through the jid GET parameter by using the pipe symbol (|) a common technique used to chain commands in Unix-based systems.

Because the vulnerable endpoint fails to properly sanitize user input, the injected commands are executed directly by the underlying operating system with root-level privileges.

FortiSandbox versions 4.4.0 through 4.4.8 are confirmed to be affected by this vulnerability.

What makes CVE-2026-39808 especially alarming is how easy it is to exploit.

According to researcher samu-delucas, who published the PoC on GitHub, a single curl command is enough to achieve unauthenticated remote code execution (RCE) as root:

curl -s -k --get "http://$HOST/fortisandbox/job-detail/tracer-behavior" --data-urlencode "jid=|(id > /web/ng/out.txt)|"

In this example, the attacker redirects command output to a file stored in the web root, which can then be retrieved through a browser.

This means an attacker could read sensitive files, drop malware, or fully compromise the host system all without ever logging in.

Fortinet’s Response

Fortinet patched the vulnerability and published its official advisory under FG-IR-26-100 through its FortiGuard PSIRT portal.

The advisory confirms the severity of the flaw and outlines affected versions. Organizations running FortiSandbox 4.4.0 through 4.4.8 should upgrade to a patched version without delay.

• Patch immediately:  upgrade FortiSandbox to a version beyond 4.4.8 as specified in Fortinet’s official advisory.
  
• Audit exposed instances: check whether FortiSandbox management interfaces are exposed to untrusted networks or the public internet.
  
• Review logs:  look for unusual GET requests to the /fortisandbox/job-detail/tracer-behavior endpoint as indicators of exploitation attempts.
  
• Apply network segmentation: restrict access to FortiSandbox administrative interfaces to trusted IP ranges only.

With a working PoC now publicly available, the window for exploitation is open. Security teams should treat this as a critical-priority patch and act immediately to secure affected systems.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post PoC Exploit Released for FortiSandbox Vulnerability that Allows Attacker to Execute Commands appeared first on Cyber Security News.

The vulnerability, tracked as CVE-2023-33538, affects multiple TP-Link models that no longer receive vendor updates, leaving users with no official patch to apply.

The affected routers include the TL-WR940N (versions 2 and 4), TL-WR740N (versions 1 and 2), and TL-WR841N (versions 8 and 10).

These devices share a common weakness in their web management interfaces, where a specific parameter inside an HTTP GET request is not properly checked for harmful content.

This missing input validation gives attackers a clear opening to inject and run commands on the router without triggering any warning on the device.

The attacks work by sending malicious HTTP GET requests to the /userRpm/WlanNetworkRpm endpoint. The requests carry commands embedded in the ssid parameter, which the router’s firmware processes without filtering harmful input.

Once the router accepts the request, the commands instruct it to download an ELF binary named arm7 from a remote server at IP address 51.38.137[.]113, assign it full execution permissions, and run it immediately.

Unit 42 analysts and researchers at Palo Alto Networks identified this malicious activity after CISA added CVE-2023-33538 to its Known Exploited Vulnerabilities (KEV) catalog in June 2025.

Their telemetry systems detected large-scale, automated exploitation attempts around that same period, with multiple probes targeting the same vulnerable endpoint across numerous devices in the wild.

The downloaded arm7 binary is a variant of the Condi IoT botnet malware, a Mirai-based family tied to previous campaigns. Once running on the infected router, the malware connects to a command-and-control (C2) server and folds the device into a larger botnet.

The C2 domain cnc.vietdediserver[.]shop is directly associated with these Mirai-like botnet operations and was confirmed malicious.

Inside the Arm7 Malware Binary

After gaining access to the device, the arm7 binary carries out a structured set of tasks to maintain its presence and grow the botnet.

It waits for specific byte-pattern commands from the C2 server and responds by sending heartbeat signals, triggering self-updates, and launching internal HTTP server functions.

One particularly notable behavior is the self-update routine. The binary uses the update_bins() function to connect back to 51.38.137[.]113 on TCP port 80 and pull fresh copies of itself built for eight different CPU architectures, including arm6, mips, sh4, and x86_64.

The IP address and port are hard-coded directly inside the binary, as confirmed during disassembly.

The arm7 binary also starts an HTTP server on the infected device using a port randomly chosen between 1024 and 65535.

Once active, this server delivers fresh malware copies to other devices that connect to it, spreading the infection further without requiring any additional input from the attacker.

This allows each newly infected host to go on recruiting more victims. Despite their scale, the in-the-wild exploit attempts observed by researchers carried technical errors.

The attackers targeted the ssid parameter rather than the correct and vulnerable ssid1 parameter, and their injected commands depended on wget, a utility absent from the router’s limited BusyBox environment.

Even so, the research team confirmed that the underlying vulnerability is real and that a more accurate attacker using the correct parameter could successfully exploit it.

Regarding recommendations, TP-Link confirmed the affected devices are end-of-life and no vendor patches will be made available. The company advises users to replace these units with currently supported hardware.

Changing the default admin:admin login credentials is also strongly recommended, as exploitation of this vulnerability requires authenticated access to the router’s web interface.

Administrators should monitor outbound traffic for connections to known malicious domains and retire any affected TP-Link router models still active on their networks.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Target TP-Link Routers With Mirai Malware in CVE-2023-33538 Exploitation Attempts appeared first on Cyber Security News.