跳到主要内容
每日早报 · 六个领域的重点资讯阅读早报
Ariquo
开始使用联系我们

已发布刊物 · 免费预览

Security Daily News 2026-11-13: rails: 7 security advisories

发布：　摘要更新：

GitHub published 7 security advisories affecting rails. Reported issues include: Active Storage: Possible arbitrary file write and read in image analysis; Action Pack: Possible DoS vulnerability in Action Controller Live streaming; Action View: Possible XSS vulnerability in highlight helper.

本期内容预览

1. rails: 7 security advisories

GitHub published 7 security advisories affecting rails. Reported issues include: Active Storage: Possible arbitrary file write and read in image analysis; Action Pack: Possible DoS vulnerability in Action Controller Live streaming; Action View: Possible XSS vulnerability in highlight helper.

2. CVE-2026-12507 Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus ver

CVE-2026-12507 Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus ver

3. CVE-2026-12591 Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegate

CVE-2026-12591 Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegate

4. Trained to betray: How post-training supply chain attacks hijack coding agents | Microsoft Security Blog

Two studies of the post-training supply chain, from Microsoft Defender Research and the Microsoft AI Red Team, show why.

5. VU#580079 - Arbitrary file read/write vulnerability in ImageMagick-based applications with default configuration

Multiple arbitrary file read and write vulnerabilities have been identified in applications that use ImageMagick with insufficiently restrictive security policies. Collectively referred to as ImageTragick2, these issues arise when ImageMagick processes attacker-controlled SVG or PostScript content using dangerous coders or delegates permitted by its default or application-supplied configuration.

6. VU#644655 - TightVNC and UltraVNC Viewer contains a heap-based buffer overflow

A heap-based buffer overflow exists in the Tight JPEG decoding component of the TightVNC Windows Viewer version 1.3.10 and affected UltraVNC Windows Viewers. An attacker controlling a malicious VNC server can trigger memory corruption by sending a specially crafted screen update.

7. Chainguard defends its choice to break the PHP security embargo: "We own the decision." - The New Stack

Chainguard defends its choice to break the PHP security embargo: “We own the decision.”

8. Critical Red Hat Quay Vulnerability Could Expose Private Container Images - SecurityWeek

Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.

9. A vulnerability in the administration REST interface of Azul Payara allows a remote,...

A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-rejection check before the token is validated, and an invalid token falls through to password-based authentication, which succeeds without credentials on default domains configured with an empty administrative password.

10. wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories

Starting on November 10, a threat actor used stolen GitHub credentials to push a malicious workflow payload into tens of thousands of repositories. The payload steals GitHub Actions secrets and cloud credentials.

11. XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection...

XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise.

12. VU#685399 - PromZard context key code injection leads to remote code execution

The npm library `promzard`, versions 4.0.0 and earlier, is vulnerable to remote code execution due to direct string interpolation of context object keys, which allows unsanitized JavaScript code injection.

13. VU#944667 - ComfyUI-Easy-Use contains unauthenticated path traversal vulnerability

ComfyUI-Easy-Use version 1.4.1 and earlier contains a vulnerability in its `save_preview()` handler that allows an unauthenticated attacker to overwrite an installed custom node’s Python file. An attacker who can reach the affected ComfyUI instance over the network can use the overwrite to execute arbitrary code when ComfyUI restarts.

14. Agentic AI Attacks Are Here: What We’re Seeing with ARTEX, and How to Protect Your Org - Salesforce

Salesforce Threat Intelligence has observed multiple threat actors using the AI-enabled offensive framework ARTEX.

15. Rucio: Unauthenticated administrator impersonation through SSH challenge tokens

SSH challenge tokens are mistakenly accepted as valid credentials during the authentication token validation process.

16. XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated...

XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise.

17. Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors

Target selection: The target set spanning semiconductor supply-chain, U.S. defense and policy, and human-rights and civil-society organizations aligns directly with established Chinese state intelligence priorities

18. Cyberattacks Are Skyrocketing in Japan as Researchers Trace AI-Assisted Intrusions | Socket

Japan faces a record surge in cyberattacks as researchers uncover AI-assisted intrusions, widespread data breaches, and growing pressure to patch vulnerabilities.

19. 0% GPU utilization: How SANSAR hides Linux cryptomining

Elastic Security Labs analyzes SANSAR, a Linux cryptomining orchestrator that manages miners over Tor, alongside a kernel rootkit, GPU monitoring hooks and a backdoor that retrieves its C2 address from Ethereum.

20. Active ScreenConnect attacks breach MSPs, impact dozens of organizations

Update 11/11/26: Added additional information from ConnectWise and Huntress.

21. A security flaw has been discovered in Linksys EA8100 1.0.3.216940. The affected element is an...

A security flaw has been discovered in Linksys EA8100 1.0.3.216940. The affected element is an unknown function of the file etc/init.d/service_smbd.sh of the component SMB Service.

22. Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in Aspire. This advisory provides guidance on updating affected applications and components.

23. Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover

A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent changes.

24. Apache HTTP Server patches critical HTTP/2 remote code execution flaw

A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE).

25. Synology patches a critical NAS flaw that could let attackers in without logging in | TechSpot

A hot potato: Despite recent controversies over its corporate policies, Synology still holds a large slice of the increasingly popular NAS market. When its devices are hit by dangerous security flaws, customers should take note.

26. New Windows SignDrop zero-day gives hackers SYSTEM privileges

Security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) has released a new Windows zero-day exploit that can let attackers gain SYSTEM privileges.

27. Police dismantle Gootloader, CastleRAT, StealC malware infrastructure

Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations.

28. XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote...

XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization.

29. XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the...

XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device.

30. XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows...

XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application.

31. XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that...

XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter.

32. XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows...

XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system.

33. New N-able "4EverAble2Shell" zero-day exploited hours after PoC released

Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed "4EverAble2Shell" to compromise servers and deploy cryptocurrency miners, with researchers reporting at least 21 affected systems, including 19 running the company's latest security update.

34. Office of Public Affairs | Florida Missionary Indicted for Child Exploitation Crimes in Haiti | United States Department of Justice

Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division; Acting U.S. Attorney Yara Lorenzo Klukas for the Southern District of Florida; and Special Agent in Charge Brett D. Skiles of the FBI Miami Field Office made the announcement.

35. Hackers compromise 4,800 GitHub accounts to steal cloud credentials

Tens of thousands of GitHub repositories were targeted in a campaign dubbed ‘wfx-loot’ that uses malicious workflows to steal GitHub Actions secrets and cloud credentials.

36. Software Samaritan revamps borked Indian certs to block smart TV ads

eMudhra's private key exposure has been a security disaster, but it also means that you can block those annoying ads on smart TVs if you’re so inclined.

37. New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access

Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver.

38. Hackers Abuse Microsoft SQL Servers to Deploy Monero Miner and Gh0st RAT

SEO: Fortinet discovered a campaign where attackers brute-force exposed Microsoft SQL Server installations and abuse T-SQL commands to deploy a Monero miner and Gh0st RAT on Windows systems.

39. International operation dismantles malware networks, exposes 6.4 million stolen credentials | CyberScoop

Police in nine countries have dismantled large parts of the criminal infrastructure behind three malware kits that enabled ransomware attacks and data theft, seizing 235 servers and 257 domains and identifying credentials belonging to 6.4 million victims, Europol announced Thursday.

40. Attackers breached 10 organizations with an open-source AI pentest framework - Help Net Security

Chinese-speaking attackers used Cairn, an open-source AI penetration testing framework, to run 25 operations against at least 19 organizations in August and September 2026. Palo Alto Networks’ Unit 42 found that the attackers gained unauthorized access or pulled data at 10 of them, often after typing little more than a domain name and a one-line goal.

41. Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass

Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass.

42. The death of the 14-day patch: Surviving machine-speed vulnerability discovery - The New Stack

For decades, enterprise vulnerability management ran on human time: A security researcher manually dissected a binary, traced execution paths, built a proof of concept, and filed a coordinated disclosure. Engineering leads evaluated the CVSS score and prioritized the fi before working it into an upcoming sprint schedule.

43. Apify rotates API tokens, prompts 2FA resets after breach

Apify has rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal systems.

44. Hackers abuse SQL Server’s weak passwords to drop cryptominers and Gh0st RAT

An active threat campaign is combining port scanning, password guessing, and Transact-SQL (T-SQL) commands to compromise exposed Microsoft SQL servers and deliver malware. The attackers are using predefined username and password lists to brute-force into these servers and exploit their administrative capabilities to execute commands on the underlying Windows systems.

45. Operation Endgame malware takedown turns up over 6 million stolen logins - Help Net Security

Police in nine countries, working with Europol, took down servers behind the Gootloader, CastleRAT and StealC malware operations this week and recovered more than 6 million credentials stolen from infected computers. Europol announced the action as the latest round of Operation Endgame, the international campaign against the services that give ransomware gangs their way into a network.

46. Notion Customer Data Compromised in Fireworks AI Hack - SecurityWeek

All-in-one collaborative workspace and productivity platform Notion is notifying a small set of customers that their information was compromised in a data breach involving Fireworks AI.

47. Check your GitHub repos: A secret stealer hit tens of thousands of them - Help Net Security

A threat actor using stolen GitHub credentials has pushed a credential-stealing payload into tens of thousands of repositories since November 10. In more than 1,800 of them, the malware ran and shipped GitHub Actions secrets and cloud credentials to the attacker.

已展示本期 68 条中的 47 条。注册并开通相应订阅后，可在阅读页查看完整刊物。