A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud. Kaspersky researchers analyzed the malware and attributed the operation to the MoYu group, a threat actor previously associated with the BadBox malware botnet. The researchers note that this is the first documented case of a malware infection chain specifically created for the targeted car head unit. MoYu's operation targets systems from DoFun, a Chinese automotive software and hardware provider owned by Shenzhen Driving Control Technology Co., Ltd. DoFun is an automotive software, cloud services, and hardware provider that sells generic Android-based head units, which act as the command center for a car's infotainment, navigation, and settings systems.
Windows named pipes provide fast interprocess communication, but weak access controls can expose privileged services to untrusted processes. ThreatLocker explains how endpoint verification, command authorization, strict input validation, and narrowly scoped privileges can help secure named-pipe communication.
Malware is abusing car infotainment updates to install proxy software, turning Android head units into nodes for the BADBOX network. Kaspersky researchers found something in June 2026 that made them stop and look twice: an Android app with no interface at all, installed like any ordinary app but making zero effort to disguise itself as legitimate. Their report documents the first known malware infection targeting car head units, the Android-based infotainment and control systems built into many modern vehicles, spread through the vehicle’s own official update mechanism. Head units run Android for practical reasons, since manufacturers can build on existing source code and add their own custom system apps during production. That flexibility cuts both ways. Because head units are just Android devices under the hood, most apps built for smartphones can technically run on them too, including malware, even though something like a banking trojan would be wasted effort on a device nobody uses for mobile banking. Kaspersky researchers found something unusual in June 2026: an Android app with no visible interface that was installed like a normal app but did not try to look legitimate. Their report describes what they say is the first known malware infection targeting car head units, Android-based systems used for infotainment and vehicle controls, delivered through the car’s official update system. “We identified new Android malware: a multi-stage downloader whose ultimate purpose is ad fraud and creation of a proxy botnet.” reads the report published by Kaspersky. “The malware spread through the built-in updaters of Android-based automotive head unit firmware. This is the first documented case of malware found on a car head unit with an infection chain specific to that type of device.” Car head units often use Android because it is flexible and lets manufacturers add their own software. But this also creates a security risk. Since these systems are basically Android devices, many apps designed for smartphones can also run on them, including malware. The infection chain here starts inside TWCore, a completely legitimate system app responsible for analytics and firmware updates on DoFun head units. An MQTT message broker sends TWCore instructions about which APK files to download and install, and a specific configuration flag called installNotExists controls whether the app checks if something is already installed before pushing it. “TWCore only checks whether an app is already installed on the device when installNotExists = false The APK file is downloaded to <TWCore external cache dir>/push/apk/ for installation.” which means setting that flag the other way turns a routine update channel into a silent installation pipeline for anything the attackers want to push. What gets installed through that channel is a small dropper called JarService, carrying zero user interface and doing nothing but decrypting and loading the next stage. That stage is a loader that phones home to a command server, reports basic device details, and receives a download link for the actual payload, a third-stage module researchers found could be pulled in at least seven different versions simply by trying different version numbers in the download URL. That third stage turns out to be a clicker and reverse proxy component, checking in with its server every 90 minutes by default and waiting for new instructions. “In this stage, the malware sends a POST request to /cpc/api/task every 90 minutes by default, containing information about the infected device (display resolution, device model, the SSID of the connected Wi-Fi network, MAC address, and so on) along with the Trojan’s configuration version.” continues the report. “If the configuration is outdated, the C2 server returns an updated configuration containing new C2 addresses and new paths for sending HTTP requests.” The command system behind the malware is more powerful than you might expect from something running silently on a car’s dashboard. Researchers found nine commands, including ones that can change the clipboard, send HTTP requests, load web pages, and run JavaScript. In practice, attackers mainly used two: one to download and run new code, and another to send web requests. The extra module they deployed, called “zhima,” was a reverse proxy. This means the main goal was not to attack or control the car. Instead, the attackers wanted to use infected cars’ internet connections as part of a larger proxy network. Tracing the malware’s naming conventions and infrastructure led researchers to attribute the campaign, with high confidence, to MoYu Group, an actor connected to the BADBOX botnet that’s been documented previously by other researchers. A thread inside the second-stage loader carried the internal name “mosdk-host-loader,” which pointed toward malware previously found on TV set-top boxes tied to the same group, and overlapping network infrastructure independently spotted by a separate research team around the same time backed up the connection. The command system behind the malware is more powerful than you might expect from something running silently on a car’s dashboard. Researchers found nine commands, including ones that can change the clipboard, send HTTP requests, load web pages, and run JavaScript. In practice, attackers mainly used two: one to download and run new code, and another to send web requests. The extra module they deployed, called “zhima,” was a reverse proxy. This means the main goal was not to attack or control the car. Instead, the attackers wanted to use infected cars’ internet connections as part of a larger proxy network. There is also a strange detail in the network’s infrastructure. The proxy service’s admin panel allows people to create accounts if they have a valid invite code. Its copyright text and login page also look similar to those used by at least two commercial residential-proxy services. This suggests the network may be linked to a business-like proxy service, while also using infected cars to provide internet connections. BADBOX has survived several takedown attempts by researchers and law enforcement. This campaign shows why: the people behind it keep changing how they spread the malware and are moving into new types of devices. Cars are now joining smart TVs and set-top boxes as devices that can be quietly added to a botnet. As cars become more like computers, they also need the same kind of security protection. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Android Car)
A critical flaw (CVSS 9.4) in NASA/JPL’s AIT-GUI let anyone send unauthenticated commands to spacecraft instruments. Cycode researchers found that AIT-GUI, the browser-based operator console in NASA/JPL open-source AMMOS Instrument Toolkit, shipped with no authentication, no session checks, and no CSRF protection on any of its state-changing endpoints. “AIT-GUI, the web front end of NASA/JPL’s open-source AMMOS Instrument Toolkit, starts an HTTP server with no authentication, no authorization, and no CSRF protection on any of its state-changing endpoints.” reads the report published by Cycode. “Anyone who can reach the port, or any website an operator merely visits in a browser, can: Issue arbitrary commands via POST /cmd Run server-side scripts via POST /script/run Execute command sequences via POST /seq“ The vulnerability is tracked as GHSA-p9r8-2q67-fp86, rated Critical (CVSS score of 9.4), and fixed in AIT-GUI 2.5.2. AMMOS (Advanced Multi-Mission Operations System) is an open-source framework used by NASA/JPL and other missions to control spacecraft and instruments, send commands, and process the data they send back. AIT-GUI is the web interface operators use to do this in real time. Sending a command through this software is not like filling out a simple online form. The vulnerability isn’t one thing. It’s four ordinary web weaknesses that compose into something with unusual consequences. The first is that the server reads its configured host setting into a variable and then ignores it, binding instead to 0.0.0.0, which means all network interfaces. An operator who sets host: localhost to keep the console on the loopback gets a server exposed to the entire reachable network anyway. The second and third weaknesses follow from the first. There’s no login requirement, no session gate, no CSRF token, and no cross-origin restriction on any route. POST /cmd takes whatever arrives in the command field, parses it, and hands it directly to the command bus: no check, no validation, nothing between the network and the hardware. The fourth weakness lives on POST /seq and POST /script/run, which build filesystem paths by joining raw user input onto a root directory with no confinement. A seqfile value of ../../../../something resolves outside the intended sequence directory. The researchers note that the correct confinement check already exists in the same codebase, on a sibling route called /scripts/load; the safe pattern was already written, just not applied consistently. The CSRF risk is especially serious because a firewall does not stop it. Browsers can send certain form requests from another website without first checking with the target site. So, if an operator opens a malicious page in the same browser they use for the console, it could send commands such as POST /cmd, POST /seq, or POST /script/run. The attacker does not need direct access to the system or its network port—they only need the operator to open a malicious link. Cycode’s research team used a combination of AI-assisted code analysis and human validation to find and confirm the issues. The AI handled the initial codebase review, flagging recognizable patterns: state-changing routes with no auth anywhere in their call path, user input flowing from a request parameter into a subprocess call without sanitization, and a configuration value that was read and then silently discarded. The human researcher then confirmed each pattern was exploitable and reduced each to a working proof-of-concept, including a self-contained CSRF demonstration that drove a real headless browser and recorded zero network preflights. That second step matters. A pattern match points to a candidate; a reproduced exploit confirms the finding is real. Cycode says explicitly it only reports the second kind. “More broadly: operational and ground-system software inherits the same web weaknesses as everything else, but with a far higher cost of failure. Auth, CSRF defense, and input confinement are not optional extras on a panel that commands hardware.” concludes the report. The fix is in AIT-GUI 2.5.2. Operators should upgrade immediately and verify the console port is not reachable from untrusted networks. Anyone who ran an exposed instance before the patch should treat it as a reason to audit command and sequence history, since an unauthenticated POST leaves no user-level trace by design. Maintainers hardening deployments should add authentication and CSRF protection to the command, script, and sequence routes; bind the server to the configured host instead of 0.0.0.0; and apply the existing path-confinement logic from /scripts/load to /seq and /script/run. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, NASA/JPL)
Cisco patched nine critical flaws, including six rated CVSS 10.0, found during internal testing. None are known to be exploited. Cisco released another batch of security fixes for its Crosswork platforms and Secure Workload software, part of what it’s calling an ongoing internal security review, and the CVSS scores in this round are unusually severe. “As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.” reads the advisory. “These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and to streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class – Common Weakness Enumeration (CWE) – and assigned a single Common Vulnerabilities and Exposures Identifier (CVE ID) to each CWE grouping.” Four vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning, all impacting these products regardless of how they’re configured: CVE-2026-20030 (CVSS score: 10.0) – an SQL injection vulnerability that lets an attacker manipulate database queries directly. CVE-2026-20357 (CVSS score: 10.0) – a missing authentication for critical function vulnerability, meaning a sensitive operation can be triggered without ever proving who you are. CVE-2026-20358 (CVSS score: 10.0) – an external control of file system vulnerability, letting an outside actor influence which files the system reads or writes. CVE-2026-20359 (CVSS score: 9.9) – an insufficiently protected credentials vulnerability, where stored login material isn’t locked down the way it should be. Seeing three CVSS 10.0 vulnerabilities in a single Cisco advisory is unusual. The four flaws affect Crosswork 7.2.1 and earlier, and Cisco fixed them in version 7.2.1-SP. Five more vulnerabilities got patched in Cisco Secure Workload, spanning both its cloud SaaS and on-premises deployments: CVE-2026-20231 (CVSS score: 9.9) – a set of improper neutralization of special elements vulnerabilities covering command, operating system, and argument injection, essentially several different ways to smuggle unintended commands into the system. CVE-2026-20315 (CVSS score: 10.0) – a set of improper access control vulnerabilities spanning authorization, authentication, privileges, and bypasses, a broad category that generally means the system doesn’t reliably enforce who’s allowed to do what. CVE-2026-20317 (CVSS score: 10.0) – a set of improper authentication vulnerabilities covering missing authentication, authentication bypass, and reliance on untrusted inputs, another maximum-severity cluster centered on identity verification failing outright. CVE-2026-20318 (CVSS score: 9.6) – a set of improper input validation vulnerabilities spanning input validation, path traversal, and external path control, the kind of flaw that lets crafted input reach files or directories it was never meant to touch. CVE-2026-20319 (CVSS score: 7.5) – a set of improper restriction of operations within the bounds of a memory buffer vulnerabilities spanning buffer overflows and out-of-bounds writes, lower severity than the rest but still a genuine memory-safety problem. The networking giant addressed five vulnerabilities in Secure Workload Release 3.10.9.1 for the 3.10 branch and earlier, and 4.0.4.16 for the 4.0 branch. The company found these vulnerabilities during internal testing; it is not aware of attacks in the wild exploiting this issue. “The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.” conctinues the advisory. “Cisco says it found the vulnerabilities through internal security testing that also used advanced AI models.” Nobody’s reported active attacks against any of these nine flaws yet, and Cisco’s own review process caught them before an outside researcher or attacker did. If your organization runs Crosswork or Secure Workload in any configuration, this isn’t a patch to schedule for next month’s maintenance window. Perfect CVSS scores tend to attract attention fast once a vulnerability’s technical details start circulating, and Cisco’s internal discovery only buys you a head start if you actually use it. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Cisco)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform. TrueConf Server is designed for secure corporate messaging and video conferencing and, unlike cloud-based software like Zoom or Microsoft Teams, it operates inside an organization's local network (LAN). The most severe is a critical missing authentication security flaw (tracked as CVE-2026-72529) that allows attackers without privileges to remotely execute arbitrary scripts on unpatched servers. "A remote unauthenticated attacker connecting to TrueConf Server over 4307/TCP can invoke an undocumented critical function and execute an arbitrary script on the server," the TrueConf security team explains.
Toronto's Hospital for Sick Children (SickKids) says a cybersecurity incident exposed the personal information of some current and former employees and job applicants, stemming from a flaw in third-party software. Clinical systems and patient records were not affected. (264)
GitLab flaw CVE-2026-19478 is now under active exploitation, allowing unauthenticated attackers to modify or delete public projects. WatchTowr researchers warn of active exploitation of critical GitLab flaw CVE-2026-19478 (CVSS score of 9.4). This week, GitLab pushed out an emergency patch to address this flaw, which could let an attacker with zero credentials remotely modify or delete public projects and user data. “GitLab has remediated an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.” reads the advisory. GitLab issued an emergency patch on August 17, five days after its regular update. The vulnerability impacts only self-managed installations, users should upgrade to versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. There’s a gap worth flagging for anyone still sitting on an older release. The available patches don’t cover the 18.2 through 18.10 branches, even though those versions technically fall inside the affected range. If you’re running anything in that window, staying put isn’t really an option; you’ll need to upgrade to a patched branch entirely rather than waiting for a fix that isn’t coming for your current one. hiimguardian reported the flaw through the company HackerOne bug bounty program. Organizations should urgently patch internet-facing GitLab servers. Until they can update, they should restrict unauthenticated access to /api/graphql, disable public repositories where possible, and check logs for requests containing @gl_introduced. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CVE-2026-19478)
CERT Polska confirmed active exploitation of CVE-2026-73570, a critical unauthenticated RCE in Zimbra Collaboration Suite patched on July 20. CERT Polska, Poland’s national computer emergency response team, confirmed this week that threat actors are actively exploiting a critical vulnerability in Zimbra Collaboration Suite tracked as CVE-2026-73570. The flaw allows unauthenticated remote code execution and was patched less than a month ago. “The CERT Polska team informs about an actively exploited OS Command Injection vulnerability in Zimbra Collaboration Suite.” reads the advisory published by CERT Polska. “The vulnerability, identified as CVE-2026-73570 , allows an unauthenticated attacker to execute arbitrary shell commands with the privileges of the zimbra user . The vulnerability affects instances that have the SNMP trap service enabled via the snmp_notify parameter and the swatchdog service running (enabled by default).” The vulnerability affects systems with SNMP trap notifications enabled and the swatchdog service running, which is enabled by default. The technical root cause is a sanitization failure in the SNMP monitoring component. Zimbra released version 10.1.20 on 20 July 2026 to address the issue. The fix came 28 days before active exploitation was confirmed, which is not a wide window, but apparently wide enough. The attack surface only exists when the optional zimbra-snmp package is installed and SNMP notifications are active, but swatchdog, the service that processes those notifications, is running by default on most installations. Below are recommendations by CERT Polska: “Due to the ongoing campaign exploiting this vulnerability, we recommend: verifying Zimbra logs /var/log/zimbra.log for the following entries: Service status change: <szkodliwy ładunek> changed from stopped to running Service status change: <szkodliwy ładunek> changed from running to stopped verification of files created by user zimbra in the last 30 days in the following directories: /opt/zimbra/jetty/webapps/ /opt/zimbra/jetty_base/webapps/ /tmp/ If you discover any signs of potential exploitation of this vulnerability, please contact our team immediately.” The exposure numbers aren’t reassuring. Shadowserver currently tracks over 12,100 Zimbra servers reachable from the Internet, split roughly between Europe (4,382) and Asia (4,492). That figure doesn’t distinguish between patched and unpatched instances, or between production servers and honeypots, so the real attack surface is smaller, but nobody knows by how much. CERT Polska published indicators of compromise alongside the advisory and gave administrators specific places to look. The team recommends checking /var/log/zimbra.log for service status change entries where the payload transitions from stopped to running and back, which is the signature of a malicious command being executed as a service. Admins should also check whether any files were created in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, or /tmp/ by the zimbra user in the last 30 days. Web shells dropped into those directories would give persistent access after the initial command injection. CVE-2026-73570 isn’t yet in CISA’s Known Exploited Vulnerabilities catalog, which currently lists 18 Zimbra Collaboration Suite entries, four of them added this year. The absence doesn’t mean the threat is lower; it means the catalog hasn’t caught up yet. Zimbra solutions have been targeted by nation-state actors for years. Russian espionage group Winter Vivern exploited a reflected XSS flaw in February 2023 to steal emails from NATO-aligned organizations through Zimbra webmail portals. In October 2024, US and UK agencies warned that APT29, linked to Russia’s Foreign Intelligence Service, was targeting vulnerable Zimbra servers via a credential-stealing flaw. Most recently, in March 2026, Seqrite Labs researchers documented APT28, tied to Russian military intelligence, exploiting a stored XSS vulnerability against Ukrainian government Zimbra deployments. Organizations in sectors targeted by Russian or Chinese state-backed groups should treat unpatched Zimbra servers as a high priority. CVE-2026-73570 is especially risky because attackers can exploit it without authentication, the vulnerable service is enabled by default, and many Zimbra servers are exposed online. These conditions make the flaw an attractive target for rapid exploitation. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Zimbra Collaboration Suite)
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-72529 (CVSS score of 9.3) TrueConf Server Missing Authentication for Critical Function Vulnerability CVE-2026-72530 (CVSS score of 9.5) TrueConf Server Code Injection Vulnerability TrueConf Server is an on-premises video conferencing and unified communications platform developed by TrueConf. Organizations can deploy it on their own infrastructure to provide secure video meetings, voice calls, messaging and collaboration without relying entirely on a cloud service. It is typically used by businesses, government organizations and other institutions that want to keep communications and related data under their own control. CVE-2026-72529 is a remote code execution vulnerability in TrueConf Server that allows an unauthenticated remote attacker with network access to TCP port 4307 to execute arbitrary scripts by calling an undocumented function. The flaw affects TrueConf Server 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier versions. An attacker who can reach the vulnerable service could potentially compromise the server and use it as an entry point into the affected network. CVE-2026-72530 is a sandbox escape vulnerability in TrueConf Server that allows an unauthenticated remote attacker with network access to TCP port 4307 to break out of an isolated environment and execute arbitrary code on the underlying host. The flaw affects TrueConf Server 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier versions. By sending a specially crafted script, an attacker could escape the restricted environment and gain code execution on the host system, potentially leading to a full server compromise. In the context of CVE-2026-72529 and CVE-2026-72530, the concern is that vulnerable TrueConf Server installations exposed on TCP port 4307 could provide attackers with a path to execute code on the server. Vyacheslav Kopeytsev from Kaspersky ICS CERT discovered both vulnerabilities. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw CVE-2026-72529 by August 23, 2026, and CVE-2026-72530 by September 2nd. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Confirm this action.
Leaving now will discard your changes.