-->
#1 Trusted Cybersecurity News Platform
Followed by 5.70+ million
The Hacker News Logo
Get the Latest News
cybersecurity

Vulnerability | Breaking Cybersecurity News | The Hacker News

Category — Vulnerability
New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables

New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables

Aug 07, 2026 Network Security / Vulnerability
Security researcher Malcolm Stagg has disclosed a new attack class called  NatJack  that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Presented at Black Hat USA 2026 , the research found affected behavior across independently developed implementations, including Windows and Linux. Two implementation-specific flaws have been assigned CVEs:  CVE-2026-56181  (CVSS score: 8.3) in Windows NAT used by Hyper-V, and  CVE-2026-63913  (CVSS score: 8.2) in Linux Netfilter conntrack. NatJack generally requires the attacker to have privileged access to a system behind the same NAT as the victim. The mitigation guidance therefore emphasizes separating untrusted workloads from trusted systems that share NAT infrastructure. There is no single patch for the broader attack class. Organizations should apply available Windows and Linux updates and encryp...
Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

Aug 07, 2026 Endpoint Security / Vulnerability
Security researcher Malcolm Stagg has disclosed a new attack class called  NatJack  that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, disclose victim IP addresses and mapped ports, and exhaust NAT tables. Presented at Black Hat USA 2026, Stagg said the techniques were demonstrated across network infrastructure devices, virtualization, containerization, and cloud infrastructure, including Windows, Linux, and macOS implementations. Two implementation-specific flaws have been assigned CVEs:  CVE-2026-56181  (CVSS score: 8.3) in Windows NAT used by Hyper-V, and  CVE-2026-63913  (CVSS score: 8.2) in Linux Netfilter conntrack. The attack model generally places an attacker-controlled system behind the same NAT infrastructure as the victim, while the exact capabilities and preconditions vary by technique and platform. The mitigation guidance therefore emphasizes separating untrusted workl...
Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets

Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets

Aug 07, 2026 Artificial Intelligence / Vulnerability
A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind Anthropic's and Google's own coding-agent repositories. On OpenAI's, it was enough to hijack the next agent run. Novee Security ran the attack against each vendor's agent in the configuration that the vendor ships by default, and presented the work at Black Hat USA on August 5. Two CVEs came out of it. Both are patched. Gemini CLI carries the worst of the two. CVE-2026-12537 (CVSS 4 score: 10.0) is an OS command injection in the container launcher, reached through a crafted .gemini/.env file, which lets an unprivileged attacker run code on the host of a headless CI platform before the sandbox starts. It is fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22. In Claude Code, CVE-2026-54316 turned Hugging Face's public download counter into an exfiltration channel that leaked an API key one character at a time, and is fixed in 2.1.163. Every ...
cyber security

AI Threat Readiness 101

websiteWizCloud Security / AI Security
Learn the four pillars of AI threat readiness and how security teams can reduce risk faster with detection, validation, and remediation built for today's threat landscape.
cyber security

The State of Shadow AI in 2026 (And How Attackers Are Taking Advantage)

websitePush SecurityShadow AI / Browser Security
AI adoption has exploded, but every new app, integration and extension introduces new threats and risks.
TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign

TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign

Aug 07, 2026 Cybercrime / Vulnerability
A new analysis has uncovered that the threat actor tracked as TeamPCP has been active on the cybercrime scene as far back as 2020, indicating the group has been compromising internet-facing infrastructure for years before training their sights on the software supply chain. "The connection is supported by overlapping domains, malware deployment paths, staging techniques, backend infrastructure, and operational tradecraft," Oligo Security researchers Avi Lumelsky and Gal Elbaz said . This includes two campaigns observed in the second half of 2025: ShadowRay 2.0 (aka IronErn), which involved hijacking artificial intelligence (AI) infrastructure into a self-propagating botnet, and TA-NATALSTATUS , which targeted exposed Redis servers to deliver cryptocurrency miners. TA-NATALSTATUS is assessed to be an evolution of a prior campaign that was detailed by Trend Micro in April 2020 that involved targeting Redis servers to deploy malware. This suggests that the threat actor h...
New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts

New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts

Aug 06, 2026 Virtualization Security / Linux
Zapscape , a new Linux kernel vulnerability, could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM isolation and execute code on the host. The risk applies when nested virtualization is exposed to untrusted guests. The flaw is tracked as  CVE-2026-64561  and affects KVM/x86's shadow memory management unit (MMU), which manages shadow page tables used for nested guest memory translation. Security researcher Hyunwoo Kim, who disclosed the bug, said the demonstrated exploit path can run commands on the host with kernel, or root, privileges. The upstream fix has been merged, and administrators running KVM hosts that expose nested virtualization to untrusted guests should update to a fixed stable kernel or a vendor package that backports the patch. The required L1 kernel privilege usually means guest root. Intel systems also require both EPT page-walk length 4 and 5 to be exposed to the L1 guest. AMD has no equivalent conditio...
⚡ Top Stories This Week
Expert Insights Articles Videos
Cybersecurity Resources