The issue affects the browser’s GX Mods feature and could be exploited to leak sensitive information from websites without requiring the victim to install a traditional browser extension.

Researchers demonstrated a zero-click attack where simply visiting a malicious webpage could trigger the installation of a harmful browser mod.

How the Attack Works

GX Mods are designed to let users personalize Opera GX by adding themes, sounds, wallpapers, and CSS-based customizations.

Unlike browser extensions, GX Mods do not require special permissions or JavaScript.

Researchers discovered that malicious GX Mods packaged as .crx files can be installed automatically when downloaded through an embedded webpage, requiring little or no user interaction.

After installation, the malicious CSS is applied across every browser tab, allowing attackers to target multiple websites.

Potential Security Risks

Once the malicious CSS is active, attackers can use CSS-based XS-Leaks techniques to infer sensitive information from webpages.

Although CSS cannot directly read confidential data, it can trigger network requests based on specific webpage elements, allowing attackers to gradually leak information.

Researchers demonstrated that attackers could reconstruct data such as email addresses by analyzing small pieces of information collected from the browser.

Possible risks include:

• Cross-site data leakage
• Exposure of sensitive account information
• Privacy violations
• Universal CSS injection across browser tabs

Browser Crash Issue

Researchers also identified a separate denial-of-service (DoS) issue affecting both Opera GX and the standard Opera browser.

Triggering a malicious .crx download while browsing in Incognito Mode could cause the browser to crash and restart, resulting in the loss of the current browsing session.

Patch Available

The vulnerabilities were responsibly disclosed through Opera’s bug bounty program.

Opera has released fixes to address the reported issues, reducing the risk of automatic mod installation and improving the browser’s handling of GX Mods.

Users are encouraged to update to the latest version of Opera GX to ensure they are protected against these vulnerabilities.

The post Opera GX Flaw Allows CSS Injection appeared first on First Hackers News.

The findings were shared by The Shadowserver Foundation, which recently enhanced its scanning capabilities through domain-based fingerprinting in collaboration with Validin. Although the scan did not verify whether every exposed system is vulnerable, it highlights a large number of publicly accessible Oracle EBS deployments that could become potential targets.

Active Exploitation Detected

Researchers at DefusedCyber have observed active exploitation attempts targeting CVE-2026-46817, indicating that threat actors are already scanning for vulnerable Oracle E-Business Suite servers.

The vulnerability was addressed in Oracle’s May 2026 Critical Patch Update (CPU). While Oracle has released limited technical details, the flaw is considered serious because Oracle EBS often manages sensitive business information, including financial, HR, and operational data.

Compromising these systems could allow attackers to gain unauthorized access, steal sensitive information, or move laterally across enterprise networks.

Exposure and Security Recommendations

Shadowserver’s public dashboard provides visibility into exposed Oracle EBS systems worldwide, while its Device ID reporting service helps organizations identify internet-facing Oracle E-Business Suite instances within their environments.

To reduce the risk of compromise, organizations should:

• Apply Oracle’s latest security patches immediately.
• Restrict public access to Oracle EBS servers.
• Enable strong authentication and access controls.
• Monitor logs for suspicious activity.
• Deploy Web Application Firewall (WAF) protections.
• Segment Oracle EBS servers from critical internal networks.

With hundreds of Oracle E-Business Suite instances exposed and attackers actively exploiting CVE-2026-46817, organizations should prioritize patching and review externally accessible systems before they become targets of compromise.

The post Attackers Target Oracle E-Business Suite Flaw appeared first on First Hackers News.

The campaign highlights a growing trend in which threat actors are shifting their focus from traditional Linux servers to AI platforms that power Large Language Model (LLM) applications and Retrieval-Augmented Generation (RAG) workflows.

The vulnerability affects Langflow versions up to 1.8.2, has received a CVSS score of 9.8, and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. The issue has been addressed in Langflow version 1.9.0.

How the Attack Works

The vulnerability exists in Langflow’s public workflow execution endpoint, where insufficient input validation allows attackers to inject and execute malicious Python code without authentication. Researchers also noted that AUTO_LOGIN is enabled by default, allowing unauthenticated users to obtain a superuser token and create public workflows, making exploitation significantly easier on exposed servers.

The attack begins with automated reconnaissance. Threat actors rapidly scan internet-facing Langflow instances using multiple browser user-agent strings while probing endpoints such as /health, /api/v1/version, and /manifest.json. This approach helps identify vulnerable systems while reducing the likelihood of detection.

Once a vulnerable server is identified, attackers exploit the flaw by sending a specially crafted request that downloads and executes a malicious shell script. Researchers observed the same workflow identifier being reused across multiple attacks, suggesting the campaign is highly automated.

The shell script acts as a dropper, creating hidden directories, downloading the primary malware, and launching it in the background. It also searches for SSH keys, known hosts, and active SSH agent sessions in an attempt to spread laterally to additional Linux systems.

Cryptominer Deployment and Persistence

The primary payload is a UPX-packed Go binary designed to establish persistence while preparing the system for cryptocurrency mining.

Researchers observed the malware performing several actions after execution:

• Downloading a customized XMRig-based Monero miner.
• Terminating dozens of competing cryptomining processes already running on the system.
• Removing backdoor accounts left behind by previous malware campaigns.
• Increasing system resource limits to improve mining performance.

To avoid detection, the malware disables several Linux security controls, including AppArmor, SELinux, UFW, iptables, the Linux NMI watchdog, and Alibaba Cloud’s Aliyun security agent. It also clears system logs, removes file protection attributes, and modifies system settings to make forensic analysis more difficult.

For long-term persistence, the malware creates scheduled cron jobs and watchdog processes that automatically restore the miner if it is removed. It also locks critical files and directories, making cleanup significantly more challenging.

The customized Monero miner is installed inside a hidden directory and connects to attacker-controlled mining infrastructure over TCP port 3333. Researchers also observed regular heartbeat communications with command-and-control servers, allowing attackers to monitor infected systems and maintain control of the campaign.

Why AI Servers Are Being Targeted

Langflow is commonly integrated with cloud platforms, AI models, databases, and external APIs. As a result, compromised servers often contain valuable API keys, cloud credentials, database passwords, and SSH keys.

During the attacks, researchers observed threat actors searching for environment files and sensitive credentials that could enable lateral movement or provide access to additional enterprise resources. This makes the impact far greater than unauthorized cryptocurrency mining alone.

Security Recommendations

Organizations using Langflow should immediately upgrade to version 1.9.0 or later and ensure that vulnerable instances are not directly accessible from the internet.

Security teams should also:

• Restrict public access to Langflow deployments.
• Monitor for unusual API requests and unexpected Python execution.
• Review systems for unauthorized cron jobs, background processes, and persistence mechanisms.
• Rotate exposed API keys, SSH credentials, and cloud secrets if compromise is suspected.
• Investigate unusual outbound connections and signs of cryptocurrency mining activity.

The rapid exploitation of CVE-2026-33017 demonstrates how quickly attackers weaponize vulnerabilities in AI platforms. As organizations continue adopting AI technologies, securing AI infrastructure should become a core part of enterprise cybersecurity strategies, alongside continuous monitoring, timely patch management, and strong access controls.

IoCs

File Hashes (SHA-256)

Network Indicators

The post Langflow Vulnerability Deploys Monero Miner appeared first on First Hackers News.

Because Langflow is commonly integrated with AI services, databases, and cloud platforms, successful exploitation could expose sensitive data and provide attackers with extensive control over affected environments.

How the Vulnerability Is Exploited

The vulnerability exists in a publicly accessible API endpoint responsible for building workflow components. Due to insufficient input validation, attackers can inject malicious Python code into specially crafted requests. The injected code is then executed on the server, enabling full remote code execution.

Security researchers observed exploitation attempts within hours of the vulnerability becoming public. Rather than relying on publicly available proof-of-concept exploits, attackers quickly developed their own techniques based on details released in the security advisory.

Early attacks focused on identifying vulnerable servers and executing basic system commands. As the campaign evolved, attackers expanded their activity to collect sensitive information, inspect server environments, and download additional malicious payloads.

Active Exploitation Raises Security Concerns

Researchers found that attackers attempted to access configuration files, database information, API keys, cloud credentials, and other sensitive resources stored on compromised systems. Since Langflow environments often connect to external AI services and cloud infrastructure, stolen credentials could enable further attacks beyond the initially compromised server.

The investigation also revealed coordinated attack infrastructure, with multiple threat actors using similar command-and-control servers and data exfiltration techniques. Temporary callback domains were frequently used to verify successful exploitation while avoiding detection.

Recommended Actions

• Update Langflow to the latest patched version immediately.
• Restrict public access to Langflow instances whenever possible.
• Monitor systems for unusual API requests and unexpected command execution.
• Review cloud credentials, API keys, and environment files for potential exposure.

The rapid exploitation of CVE-2026-33017 demonstrates how quickly threat actors weaponize newly disclosed vulnerabilities. Organizations operating internet-facing AI applications should prioritize timely patching, continuous monitoring, and network segmentation to reduce the risk of compromise.

Ioc

Source IPs

C2 and Staging Infrastructure

Malicious Dropper URLs

Interactsh Callback Domains (Samples)

The post Langflow RCE Vulnerability: Unauthenticated Code Execution Risk appeared first on First Hackers News.

The vulnerability affects ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus when they are integrated with AD360 through SSO.

ManageEngine AD360 Vulnerability

The issue is caused by weaknesses in the way AD360 generates SSO authentication tickets. Researchers found that these authentication tokens could be predicted, making it possible for an unauthenticated attacker to create a valid SSO ticket and bypass the normal login process.

If successfully exploited, an attacker could impersonate legitimate users, access their accounts, and inherit the permissions associated with those accounts. In environments where privileged administrators are targeted, the vulnerability could lead to complete account compromise, unauthorized access to sensitive data, and further movement across the network.

The following product versions are affected:

• ADSelfService Plus 6528 and earlier
• RecoveryManager Plus 6320 and earlier
• M365 Manager Plus 4816 and earlier
• ADAudit Plus 8702 and earlier

ManageEngine has released security updates for all affected products to eliminate the predictable SSO ticket generation issue.

Recommended Actions

Organizations using AD360 should apply the latest product updates as soon as possible to reduce the risk of exploitation. Since the vulnerability can be exploited before authentication, delaying patches may expose enterprise environments to account takeover attacks.

Security teams should also:

• Install the latest available builds for all affected products.
• Review authentication logs for unusual SSO activity.
• Monitor privileged accounts for unexpected login attempts.

The vulnerability was responsibly reported through the Zoho Bug Bounty Program by security researcher 0xmanhnv. ManageEngine has credited the researcher and strengthened its SSO token generation process to prevent similar attacks in future releases.

As identity management platforms are often central to enterprise security, organizations should prioritize patching this vulnerability and continue monitoring authentication activity for any signs of compromise.

The post ManageEngine AD360 Vulnerability Discovered appeared first on First Hackers News.

What Happened?

Security researchers at Manifold discovered that ClawHub’s registry was not consistently enforcing ownership verification for plugin namespaces.

During their review, they identified 23 code-executing plugins published under the @openclaw and @clawhub namespaces by accounts that had no verified connection to either organization.

Because these namespaces are commonly associated with official software publishers, many users could easily assume the plugins were legitimate first-party integrations.

Why Namespace Verification Matters

Modern package registries use namespace prefixes such as @owner/ to indicate who published a package. This system helps users determine whether a package originates from a trusted source.

For example, developers generally trust packages published under Microsoft’s verified namespace because registry controls prevent unauthorized users from publishing under that name.

ClawHub adopted a similar namespace model for OpenClaw-compatible plugins. Official integrations such as @openclaw/whatsapp and @openclaw/codex are published under the OpenClaw namespace, reinforcing user trust.

The Scope Squatting Problem

The issue arose because unaffiliated publishers were able to create plugins using trusted namespaces without proper ownership verification.

Examples included plugins such as:

• @openclaw/security-gate
• @openclaw/fiat-wallet
• @clawhub/aisa-twitter-api

Although these plugins were not created by OpenClaw or ClawHub, their names made them appear official.

Installation commands and registry listings further increased the risk of confusion, potentially leading users to install plugins they believed were endorsed by the organizations.

Why This Is a Security Concern

Manifold’s investigation found that many plugins within the registry used scoped namespaces, but not all of them were ownership verified.

Importantly, researchers did not find obvious malware in the reviewed plugins. However, the primary concern is not the current content of these packages—it is the trust they inherit from misleading namespaces.

Many ClawHub plugins can:

• Execute code inside AI agents
• Access external APIs
• Export agent configurations
• Run Git and GitHub commands
• Perform automated actions on behalf of users

When users mistakenly trust a plugin because of its namespace, attackers gain a powerful opportunity for future abuse.

How ClawHub Responded

Manifold reported the issue to ClawHub through GitHub’s security advisory process on June 17 and later followed up via email.

Within days, ClawHub introduced several remediation measures, including:

• A namespace ownership dispute process
• Removal of misleading plugins from public listings
• Updated documentation explaining how legitimate owners can claim namespaces
• Additional review procedures for namespace ownership requests

These actions helped reduce the immediate risk and improve transparency within the registry.

Lessons for Plugin Registries

This incident highlights the importance of strong provenance controls in software ecosystems.

Any registry that introduces organizational namespaces must ensure:

• Namespace ownership verification
• Automated enforcement during publishing
• Continuous monitoring for impersonation attempts
• Fast dispute resolution and takedown processes

Without these safeguards, trusted namespaces can become an avenue for supply chain attacks and software impersonation.

Looking Ahead

As AI agents and plugin ecosystems continue to grow, so does the importance of software provenance and supply chain security.

Organizations must not only verify who publishes a plugin but also maintain visibility into what those plugins are capable of doing after installation.

The ClawHub scope squatting incident serves as a reminder that trust signals are only effective when they are backed by strong verification and enforcement mechanisms.

The post Scope Squatting Vulnerability Exposed in ClawHub Plugin Registry appeared first on First Hackers News.

Tracked as CVE-2026-20266, the vulnerability affects AI Toolkit versions prior to 5.7.4. Due to its potential impact, the flaw has received a critical severity rating and should be addressed immediately by affected organizations.

Command Injection Flaw Creates Serious Security Risk

The vulnerability is linked to improper handling of system commands within a configuration helper component. An attacker with Splunk administrator privileges could exploit the weakness to execute arbitrary commands directly on the host system.

Successful exploitation could result in:

• Unauthorized command execution
• Full system compromise
• Manipulation or deletion of security logs
• Service disruption and operational impact
• Potential lateral movement across connected environments

Because the flaw affects administrative functions, malicious activity may appear similar to legitimate system operations, making detection more difficult in some cases.

Additional Vulnerability and Recommended Actions

Alongside the critical issue, Splunk also addressed a medium-severity vulnerability that could allow low-privileged users to initiate outbound connections to untrusted external domains. This behavior may increase the risk of data exposure in environments where network traffic is not tightly restricted.

To reduce risk, organizations should:

• Upgrade the Splunk AI Toolkit to version 5.7.4 or later
• Review administrative account access and permissions
• Restrict unnecessary outbound communications
• Verify domain validation settings are properly configured
• Remove or disable the AI Toolkit if immediate patching is not possible

The disclosure highlights the growing security challenges associated with AI-enabled enterprise applications. As AI capabilities become more integrated into business platforms, maintaining strong security controls, validating inputs, and monitoring external communications remain essential for protecting critical systems.

The post Critical Splunk AI Toolkit Vulnerability Discovered appeared first on First Hackers News.