https://sandboxdesk.com/Threats, vulnerabilities and fixes — firstenSun, 18 Oct 2026 22:18:31 +0000https://sandboxdesk.com/c/cyber-attacks/organisations-face-persistent-threat-from/https://sandboxdesk.com/c/cyber-attacks/organisations-face-persistent-threat-from/Sun, 18 Oct 2026 16:01:36 +0000Cyber AttacksThe malicious imgdecode package downloads encrypted payloads from GitHub and injects them into a new process on Windows systems.https://sandboxdesk.com/c/vulnerabilities/organisations-at-risk-vanus-0-8-0-0-9-0-critical/https://sandboxdesk.com/c/vulnerabilities/organisations-at-risk-vanus-0-8-0-0-9-0-critical/Sun, 18 Oct 2026 14:43:38 +0000VulnerabilitiesA critical flaw in Vanus versions 0.8.0 through 0.9.0 allows attackers to use a fixed Bearer token to gain full administrative control over event streaming clusters.https://sandboxdesk.com/c/vulnerabilities/dev-teams-must-upgrade-aws-amplify-codegen-ui-to/https://sandboxdesk.com/c/vulnerabilities/dev-teams-must-upgrade-aws-amplify-codegen-ui-to/Sun, 18 Oct 2026 03:26:21 +0000VulnerabilitiesDevelopers using the @aws-amplify/codegen-ui-react library must upgrade to version 2.20.6 to fix a code injection flaw allowing authenticated users to run arbitrary JavaScript.https://sandboxdesk.com/c/vulnerabilities/riot-os-users-face-critical-rce-risk-from-nearby/https://sandboxdesk.com/c/vulnerabilities/riot-os-users-face-critical-rce-risk-from-nearby/Fri, 16 Oct 2026 17:25:46 +0000VulnerabilitiesA critical buffer overflow in the RIOT OS ATWINC15x0 driver allows nearby attackers to trigger remote code execution through oversized network names.https://sandboxdesk.com/c/threat-intel/physical-drone-strikes-on-yandex-data-centers/https://sandboxdesk.com/c/threat-intel/physical-drone-strikes-on-yandex-data-centers/Fri, 16 Oct 2026 13:52:39 +0000Threat IntelligenceUkrainian drone attacks on three Yandex facilities force emergency mode and raise concerns about data loss and AI training delays.https://sandboxdesk.com/c/vulnerabilities/compensating-controls-explained-how-to-secure/https://sandboxdesk.com/c/vulnerabilities/compensating-controls-explained-how-to-secure/Fri, 16 Oct 2026 00:10:29 +0000VulnerabilitiesCompensating controls provide equivalent protection when direct security fixes are technically impossible or operationally disruptive.https://sandboxdesk.com/c/vulnerabilities/broken-object-level-authorization-risks-and-low/https://sandboxdesk.com/c/vulnerabilities/broken-object-level-authorization-risks-and-low/Thu, 15 Oct 2026 23:47:12 +0000VulnerabilitiesBroken object level authorization allows attackers to access data by simply changing an ID number in a URL, bypassing most standard perimeter defenses.https://sandboxdesk.com/c/vulnerabilities/null-pointer-dereference-immediate-response-and/https://sandboxdesk.com/c/vulnerabilities/null-pointer-dereference-immediate-response-and/Thu, 15 Oct 2026 23:10:25 +0000VulnerabilitiesA null pointer dereference often indicates deeper memory corruption that can allow remote attackers to execute arbitrary code on your servers.https://sandboxdesk.com/c/vulnerabilities/websocket-vulnerabilities-definition-attack/https://sandboxdesk.com/c/vulnerabilities/websocket-vulnerabilities-definition-attack/Thu, 15 Oct 2026 22:33:08 +0000VulnerabilitiesWebSocket vulnerabilities often bypass traditional web security controls because the persistent connection treats data as binary streams rather than discrete HTTP requests.https://sandboxdesk.com/c/vulnerabilities/how-cors-misconfigurations-work-step-by-step/https://sandboxdesk.com/c/vulnerabilities/how-cors-misconfigurations-work-step-by-step/Thu, 15 Oct 2026 21:58:10 +0000VulnerabilitiesBrowsers enforce CORS rules before sending the request, allowing attackers to extract sensitive data from misconfigured endpoints without triggering server-side authentication checks.https://sandboxdesk.com/c/vulnerabilities/openssl-vulnerabilities-how-crypto-bugs-spread/https://sandboxdesk.com/c/vulnerabilities/openssl-vulnerabilities-how-crypto-bugs-spread/Thu, 15 Oct 2026 21:20:44 +0000VulnerabilitiesOpenSSL flaws often hide in memory handling code, allowing attackers to bypass encryption without breaking the cryptographic math itself.https://sandboxdesk.com/c/cyber-attacks/healthcare-ransomware-frequency-surges-in-q3-2026/https://sandboxdesk.com/c/cyber-attacks/healthcare-ransomware-frequency-surges-in-q3-2026/Thu, 15 Oct 2026 21:05:16 +0000Cyber AttacksAttack volume against medical organizations more than doubled compared to the same period last year, averaging over three incidents daily.https://sandboxdesk.com/c/vulnerabilities/apache-struts-vulnerability-prevention-checklist/https://sandboxdesk.com/c/vulnerabilities/apache-struts-vulnerability-prevention-checklist/Thu, 15 Oct 2026 20:41:57 +0000VulnerabilitiesDefault configuration choices in Apache Struts often expose remote code execution paths that standard scanning tools miss without manual verification of interceptor stacks.https://sandboxdesk.com/c/vulnerabilities/implementing-vulnerability-remediation-slas-a/https://sandboxdesk.com/c/vulnerabilities/implementing-vulnerability-remediation-slas-a/Thu, 15 Oct 2026 20:04:58 +0000VulnerabilitiesStatic time limits fail because they ignore code complexity, causing teams to patch low-risk noise while critical logic flaws remain exposed for dangerous periods.https://sandboxdesk.com/c/vulnerabilities/how-to-interpret-cisa-kev-due-dates-without/https://sandboxdesk.com/c/vulnerabilities/how-to-interpret-cisa-kev-due-dates-without/Thu, 15 Oct 2026 19:28:18 +0000VulnerabilitiesThe CISA Known Exploited Vulnerabilities catalog defines a deadline for patching, not a trigger for immediate system shutdown or automatic compliance failure.https://sandboxdesk.com/c/vulnerabilities/php-application-vulnerabilities-prevention/https://sandboxdesk.com/c/vulnerabilities/php-application-vulnerabilities-prevention/Thu, 15 Oct 2026 14:55:11 +0000VulnerabilitiesMost PHP application failures stem from configuration defaults and implicit type handling rather than complex logic errors in custom code.https://sandboxdesk.com/c/malware/usaf-afghanistan-ops-risked-classified-data-via/https://sandboxdesk.com/c/malware/usaf-afghanistan-ops-risked-classified-data-via/Thu, 15 Oct 2026 10:46:52 +0000Malware & RansomwarePilots bought flash drives from local vendors and used them on classified systems, creating a risk of malware transfer between network environments.https://sandboxdesk.com/c/vulnerabilities/eclipse-vert-x-critical-rce-in-db2-client/https://sandboxdesk.com/c/vulnerabilities/eclipse-vert-x-critical-rce-in-db2-client/Thu, 15 Oct 2026 08:51:57 +0000VulnerabilitiesA critical vulnerability in Eclipse Vert.x allows attackers to execute code via crafted database responses, affecting multiple major versions of the client.https://sandboxdesk.com/c/cyber-attacks/android-deploys-ai-to-block-scams-in-messages/https://sandboxdesk.com/c/cyber-attacks/android-deploys-ai-to-block-scams-in-messages/Thu, 15 Oct 2026 07:28:08 +0000Cyber AttacksNew Android features use artificial intelligence to detect fraud in texts and calls, while masking login data during screen sharing sessions.https://sandboxdesk.com/c/vulnerabilities/orgs-at-risk-cronicle-stored-xss-lets-attackers/https://sandboxdesk.com/c/vulnerabilities/orgs-at-risk-cronicle-stored-xss-lets-attackers/Thu, 15 Oct 2026 03:55:38 +0000VulnerabilitiesA critical stored cross-site scripting vulnerability in the Cronicle task scheduler allows attackers to hijack administrator accounts and execute commands on managed servers.https://sandboxdesk.com/c/vulnerabilities/unpatched-visual-studio-instances-face-high/https://sandboxdesk.com/c/vulnerabilities/unpatched-visual-studio-instances-face-high/Thu, 15 Oct 2026 02:06:59 +0000VulnerabilitiesA code injection flaw in Visual Studio Tools for Applications allows network-based execution, impacting versions prior to specific patch levels.https://sandboxdesk.com/c/vulnerabilities/unpatched-juniper-srx-firewalls-risk-crash-from/https://sandboxdesk.com/c/vulnerabilities/unpatched-juniper-srx-firewalls-risk-crash-from/Wed, 14 Oct 2026 18:11:30 +0000VulnerabilitiesA critical heap overflow in the SVR component allows unauthenticated attackers to disrupt services on affected Junos OS versions via crafted network traffic.https://sandboxdesk.com/c/vulnerabilities/orgs-at-risk-juniper-srx-gre-tunnel-flaw-allows/https://sandboxdesk.com/c/vulnerabilities/orgs-at-risk-juniper-srx-gre-tunnel-flaw-allows/Wed, 14 Oct 2026 17:47:11 +0000VulnerabilitiesA critical stack-based buffer overflow in Juniper SRX devices allows attackers to run code as root through crafted packets on GRE tunnels.https://sandboxdesk.com/c/vulnerabilities/node-js-library-flaw-lets-attackers-run-os/https://sandboxdesk.com/c/vulnerabilities/node-js-library-flaw-lets-attackers-run-os/Wed, 14 Oct 2026 16:13:33 +0000VulnerabilitiesAn unpatched command injection flaw in the @mborne/extract npm package allows remote attackers to execute arbitrary system commands with Node.js privileges.https://sandboxdesk.com/c/cyber-attacks/imf-warns-ai-debt-web-and-cyber-risks-threaten/https://sandboxdesk.com/c/cyber-attacks/imf-warns-ai-debt-web-and-cyber-risks-threaten/Wed, 14 Oct 2026 12:51:19 +0000Cyber AttacksThe International Monetary Fund says interconnected AI financing and cyber threats to infrastructure could destabilize markets.https://sandboxdesk.com/c/malware/seo-poisoning-mistakes-that-compromise-your-site/https://sandboxdesk.com/c/malware/seo-poisoning-mistakes-that-compromise-your-site/Wed, 14 Oct 2026 12:30:45 +0000Malware & RansomwareSearch engine optimization poisoning exploits trust signals to redirect users to malicious payloads, bypassing traditional perimeter defenses by leveraging the victim's own credibility.https://sandboxdesk.com/c/data-breaches/data-scraping-meaning-how-automated-extraction/https://sandboxdesk.com/c/data-breaches/data-scraping-meaning-how-automated-extraction/Wed, 14 Oct 2026 12:15:55 +0000Data BreachesAutomated web extraction bypasses public interfaces to harvest structured data, creating hidden liabilities for server resources and intellectual property.https://sandboxdesk.com/c/cyber-attacks/how-tabletop-exercises-work-step-by-step/https://sandboxdesk.com/c/cyber-attacks/how-tabletop-exercises-work-step-by-step/Wed, 14 Oct 2026 12:13:28 +0000Cyber AttacksTabletop exercises expose decision-making gaps in security processes by simulating attack scenarios without requiring technical execution or live system changes.https://sandboxdesk.com/c/cyber-attacks/dictionary-attacks-explained-how-credential/https://sandboxdesk.com/c/cyber-attacks/dictionary-attacks-explained-how-credential/Wed, 14 Oct 2026 12:01:58 +0000Cyber AttacksDictionary attacks exploit human predictability by testing common words against hashed credentials, bypassing complex defenses through sheer probability.https://sandboxdesk.com/c/data-breaches/log-retention-strategy-benefits-limits-and-when/https://sandboxdesk.com/c/data-breaches/log-retention-strategy-benefits-limits-and-when/Wed, 14 Oct 2026 11:03:49 +0000Data BreachesKeeping logs longer does not improve security; it increases the attack surface for data exfiltration and raises the cost of every audit.https://sandboxdesk.com/c/threat-intel/scheduled-task-abuse-prevention-checklist-for/https://sandboxdesk.com/c/threat-intel/scheduled-task-abuse-prevention-checklist-for/Wed, 14 Oct 2026 10:52:18 +0000Threat IntelligenceAttackers use native system utilities to bypass security controls and maintain access, making routine task audits a primary defense strategy.https://sandboxdesk.com/c/threat-intel/pass-the-ticket-attacks-risks-and-protection-for/https://sandboxdesk.com/c/threat-intel/pass-the-ticket-attacks-risks-and-protection-for/Wed, 14 Oct 2026 10:37:58 +0000Threat IntelligenceTicket-granting tickets remain valid until expiration, allowing attackers to move laterally without passwords or local admin rights on the compromised host.https://sandboxdesk.com/c/data-breaches/prevent-misdirected-emails-7-configuration/https://sandboxdesk.com/c/data-breaches/prevent-misdirected-emails-7-configuration/Wed, 14 Oct 2026 10:23:59 +0000Data BreachesMost data leaks from misdirected emails stem from silent configuration errors that bypass standard spam filters and allow sensitive payloads to reach unintended recipients without alerting the sender.https://sandboxdesk.com/c/data-breaches/what-does-email-encryption-mean-how-it-protects/https://sandboxdesk.com/c/data-breaches/what-does-email-encryption-mean-how-it-protects/Wed, 14 Oct 2026 09:40:05 +0000Data BreachesEncryption transforms readable text into unreadable code, ensuring that only the intended recipient can reverse the process using a unique cryptographic key.https://sandboxdesk.com/c/malware/malware-droppers-and-loaders-prevention-checklist/https://sandboxdesk.com/c/malware/malware-droppers-and-loaders-prevention-checklist/Wed, 14 Oct 2026 09:12:03 +0000Malware & RansomwareDroppers hide the payload until conditions are met, while loaders execute code from memory, making traditional signature-based scans ineffective against these delivery mechanisms.https://sandboxdesk.com/c/cyber-attacks/prevent-bgp-hijacking-3-technical-controls-that/https://sandboxdesk.com/c/cyber-attacks/prevent-bgp-hijacking-3-technical-controls-that/Wed, 14 Oct 2026 08:06:04 +0000Cyber AttacksRoute origin validation stops most hijacks by rejecting false announcements, while RPKI adds cryptographic proof of ownership to your network prefixes.https://sandboxdesk.com/c/malware/microsoft-defender-misunderstandings-fix-6-common/https://sandboxdesk.com/c/malware/microsoft-defender-misunderstandings-fix-6-common/Wed, 14 Oct 2026 06:37:07 +0000Malware & RansomwareMicrosoft Defender Antivirus relies on local policy settings and network isolation more than cloud telemetry, making default configurations surprisingly vulnerable to targeted attacks.https://sandboxdesk.com/c/malware/behavior-based-detection-6-common/https://sandboxdesk.com/c/malware/behavior-based-detection-6-common/Wed, 14 Oct 2026 05:56:01 +0000Malware & RansomwareBehavior-based detection monitors runtime actions rather than static signatures, allowing it to catch polymorphic malware that changes its code structure between infections.https://sandboxdesk.com/c/malware/is-command-the-same-as-control-in-c2/https://sandboxdesk.com/c/malware/is-command-the-same-as-control-in-c2/Wed, 14 Oct 2026 05:24:43 +0000Malware & RansomwareCommand and control channels hide inside normal traffic patterns, making protocol inspection alone insufficient for detection without behavioral context.https://sandboxdesk.com/c/vulnerabilities/organisations-urged-to-patch-windows-system-info/https://sandboxdesk.com/c/vulnerabilities/organisations-urged-to-patch-windows-system-info/Wed, 14 Oct 2026 04:55:22 +0000VulnerabilitiesA heap overflow in the Windows System Information Console allows unauthorized network attackers to run code, rated critical by NVD.