kyber.today

daily cyber × ai intelligence

← index

tagged

[hashicorp]

4 editions · 4 items

September 30, 2026

  • Unauthenticated-to-RCE chain in OpenBao and HashiCorp Vault, built by ControlPlane from three independent reporters' disclosures via certificate auth, URI SANs and ACME. This is only the second-ever RCE in Vault/OpenBao. OpenBao v2.6.3 / 2.7.0 are patched; IBM's HashiCorp Vault is not yet, which ControlPlane frames as a case study in what happens when forks stop coordinating on critical fixes (ControlPlane). · Vulnerabilities & Exploits

in Mandiant Names the NetScaler Post-Exploitation Kit as Patch Rates Stay Under 10%

September 24, 2026

  • Terraform providers used as a malware channel for the first time. Aikido flagged gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads) in HashiCorp's registry plus two Go modules, delivering Go malware overlapping with the DPRK-linked Graphalgo campaign. Related npm packages take orders from an Ethereum Sepolia testnet contract, keep a second channel over Slack, and inflate download counts with GitHub Actions workers (The Hacker News) (earlier coverage). · Supply Chain & CI/CD

in The Exploit Is Public, the Ubuntu Patch Isn't

September 22, 2026

  • Jade Sleet (aka TraderTraitor, UNC4899) is tied by SentinelOne to the compromise of a small India-based IT services provider, using macOS backdoors FLATROOF (aka Gaslight) and ROOFDECK — both Rust-based, ARM macOS, and previously seen in the March–April 2026 KelpDAO/LayerZero bridge attack. The lure is a job-interview coding project whose weaponised .terraform.lock.hcl points at registry.hashicorp-aws[.]com, so a developer running terraform init pulls attacker-controlled modules. The Hacker News · Supply Chain & Developer Targeting

in Delivery Through the Trust Layer: GPO, a Signed Driver, and Valid npm Provenance