FONTES SINCRONIZADASAtualizado em 23 de out. de 2026, 16:30 · 5/5 fontes · janela de 15 min · TLP:CLEAR
CYBERBOX // THREAT PULSEVISÃO GLOBAL DE AMEAÇAS
LIVE
PRIORIDADE CRÍTICA04na janela atual
KEVs MONITORADAS18exploração confirmada
SINAIS EDITORIAIS14fontes abertas
CVE-2026-21589Atlassian · Multiple Products84
CVE-2026-105134Ahsay · AhsayCBS81
CVE-2015-5477ISC · BIND81
CVE-2026-104935Ivanti · Connect Secure80
FONTES ATIVAS5/5
RANSOMWARE00 sinais
JANELA DE ATUALIZAÇÃO15 minutos
CLASSIFICAÇÃOTLP:CLEAR
RADAR CYBERBOX
O que está acontecendo agora.
14 notícias e 18 vulnerabilidades no filtro Todos.
INTELIGÊNCIA ABERTA
Sinais que merecem contexto.
14 registros
VulnerabilidadesThe Hacker News
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target. The findings were
CONTEXTO CYBERBOXAvalie se a tecnologia afetada existe no ambiente e priorize correções com base em exposição e exploração ativa.
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. "In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor
CONTEXTO CYBERBOXAvalie se a tecnologia afetada existe no ambiente e priorize correções com base em exposição e exploração ativa.
AI coding agents hijacked using AGENTS.md file in Downloads folder
Researchers found a malicious AGENTS markdown instruction file in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package. [...]
CONTEXTO CYBERBOXVerifique exposição de dados, permissões e controles de uso de IA antes de ampliar a adoção corporativa.
OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication
OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models. "Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no
CONTEXTO CYBERBOXVerifique exposição de dados, permissões e controles de uso de IA antes de ampliar a adoção corporativa.
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. [...]
CONTEXTO CYBERBOXAvalie se a tecnologia afetada existe no ambiente e priorize correções com base em exposição e exploração ativa.
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially
CONTEXTO CYBERBOXAvalie se a tecnologia afetada existe no ambiente e priorize correções com base em exposição e exploração ativa.
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of
CONTEXTO CYBERBOXVerifique exposição de dados, permissões e controles de uso de IA antes de ampliar a adoção corporativa.
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. "You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use,
CONTEXTO CYBERBOXVerifique exposição de dados, permissões e controles de uso de IA antes de ampliar a adoção corporativa.
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent. Popcorn Time was
CONTEXTO CYBERBOXCorrelacione os indicadores divulgados com sua telemetria e reavalie os controles preventivos associados.
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating
CONTEXTO CYBERBOXAvalie se a tecnologia afetada existe no ambiente e priorize correções com base em exposição e exploração ativa.
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. [...]
CONTEXTO CYBERBOXAvalie se a tecnologia afetada existe no ambiente e priorize correções com base em exposição e exploração ativa.
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report
CONTEXTO CYBERBOXAvalie se a tecnologia afetada existe no ambiente e priorize correções com base em exposição e exploração ativa.
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any
CONTEXTO CYBERBOXAvalie se a tecnologia afetada existe no ambiente e priorize correções com base em exposição e exploração ativa.
Este produto usa dados da API do NVD, mas não é endossado ou certificado pelo NVD. As pontuações Cyberbox são orientativas e devem ser correlacionadas com o contexto de cada ambiente.
PRÓXIMA CAMADA
Leve o radar para dentro do seu ambiente.
Conecte inteligência externa ao inventário e às vulnerabilidades identificadas pelo Cyberbox GV.
