Ransomware gangs exploit TeamCity flaw

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🔓 Ransomware gangs exploit TeamCity flaw

🏦 Android trojan steals banking PINs

📧 Roundcube email flaw under active attack

🐛 Next.js flaw enables remote code execution

🥷 New trick hides malware from EDR

Plus: 💡 6 strategies & tactics, 🎁 8 other news you might like, 🧰 6 tools, and 📚 5 papers.

🔓 Ransomware gangs exploit TeamCity flaw LINK

Ransomware gangs are now exploiting a critical JetBrains TeamCity authentication bypass flaw, CISA warned federal agencies on Wednesday, adding it to its actively-exploited catalog and flagging the abuse two months after JetBrains patched it in July.

The bug (CVE-2026-63077), patched July 25 in TeamCity On-Premises versions 2025.11.7 and 2026.1.3, lets an unauthenticated attacker with HTTP(S) access abuse the agent polling protocol to skip authentication checks and run operating system commands with the TeamCity server process's privileges.

A successful attack can expose stored credentials, configurations and data, modify server state, and taint build artifacts and downstream CI/CD pipelines; Shadowserver tracks about 160 servers still unpatched, and those who cannot patch should limit access to trusted networks.

🏦 Android trojan steals banking PINs LINK

A new Android banking trojan called RemControl poses as the third-party TVTap IPTV app on fake Google Play Store pages, then takes over infected phones to steal banking PINs from customers of more than 30 banks.

The dropper starts a VPN that blocks the Google Play Store app so Google Play Protect cannot scan it, then it asks for Accessibility Service permission to overlay banking apps with fake login screens that capture PINs, mobile banking codes and card expiry dates.

RemControl is sold as malware-as-a-service, hides its C2 server address in encrypted text on two public Telegram channels, and signs each install with a unique certificate to defeat hash and certificate detection; Group-IB tracks the operator as UNKK.

📧 Roundcube email flaw under active attack LINK

A critical flaw in Roundcube Webmail is now being exploited in the wild, pushing administrators to urgently update any exposed installations before attackers reach them.

The bug (CVE-2026-48842) is a pre-authentication SQL injection in Roundcube's virtuser_query plugin, letting an attacker send crafted input to manipulate a database query without logging in, by abusing a backslash-escaping bypass in PHP's preg_replace.

Canada's Cyber Center confirmed active exploitation in advisory AV26-503 on September 21, 2026; the fix ships in Roundcube Webmail 1.6.16 and 1.7.1, with older 1.6.x and 1.7.x releases affected.

🐛 Next.js flaw enables remote code execution LINK

A critical flaw in Next.js, tracked as CVE-2026-94545, lets attackers run code on the server by feeding malicious SVG content into the Node.js ImageResponse feature of the next/og package during image generation.

The bug, rated critical under CVSS v4, can be triggered remotely over the network with no login and no user interaction whenever an application embeds attacker-controlled input from a URL parameter, form field, or API request directly inside SVG elements, attributes, or styles.

It affects Next.js versions 16.2.0 up to before 16.3.6, and developers should upgrade to 16.3.6; the Edge implementation of ImageResponse is not affected, and where patching is delayed, stop passing user-controlled input into SVG content.

🥷 New trick hides malware from EDR LINK

Researchers at Flashpoint validated "process parameter poisoning," a Windows evasion trick that hides malicious payloads inside a process's own startup structures, letting attackers inject code without triggering the memory operations endpoint detection and response tools normally watch for.

An attacker already running code on a Windows machine creates a "sacrificial process" and abuses the startup parameters Windows passes into it, avoiding the VirtualAllocEx(), WriteProcessMemory(), and MapViewOfFile2() calls that EDR products traditionally monitor to spot process injection.

Flashpoint found no public malware using it yet, but combining the technique with DLL unhooking and blocking non-Microsoft DLLs silenced an open-source EDR and its XDR component; defenders should inspect process parameters and monitor what processes actually do.

💡 Strategies & Tactics

> How One Kubernetes YAML Can Hand Over a GCP Organization: Because Google's config tool runs every cloud command through its own broadly privileged account, any developer allowed to submit files can seize the whole organization.

> GitLab Email Token Lets Attackers Push Code to Main and Execute CI/CD Jobs: A never-expiring token hidden in GitLab's project email addresses lets anyone who finds it push code and run pipelines as the account owner.

> OWASP LLM Top 10 2026: Every Move Points the Same Direction: The reordered rankings signal that AI security's biggest threats now come from live applications taking actions, not from models generating text.

> 58 hardware vulnerabilities: A guide to the threats: Catalogs 58 processor and memory hardware flaws since Meltdown and Spectre, showing why such silicon-level bugs are slow or impossible to fully patch.

> Vulnerability alert fatigue nearly swamped WHOOP. But its fix still keeps a human in charge.: WHOOP automated its security-alert triage to focus engineers on real threats and route them to the right owners, while keeping humans deciding critical fixes.

> The Visibility Gap in Phishing Detection: Where Sandboxing Makes a Difference: Detonating suspicious links in an interactive sandbox reveals the redirects and hidden login pages that appear only after a click, closing phishing's post-alert visibility gap.

Other news you might like

• There's a new way to break RSA that's faster than anything we've seen beforeLINK

• Placeholder domain used in dev docs now serves ClickFix attacksLINK

• Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google AccountsLINK

• Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK FilesLINK

• New Windows Malware Built to Survive Takedowns With a Hidden P2P Command NetworkLINK

• Australian prime minister says OpenAI agent accessed government health website, raises 'extreme concern'LINK

• MacSync under the microscope: new delivery methods and a new payloadLINK

• New Galago Ransomware Operation Emerges With Links to Panzer GroupLINK

🧰 Trending tools

Halo: detects deepfakes and synthetic media across text, image, and audio through an API, helping fraud and trust teams block attacks.LINK

Execlave: governs autonomous AI agents with tiered autonomy levels, real-time spend caps, kill switches, and audit logs mapped to SOC 2, EU AI Act, and ISO 27001.LINK

qsa.sh: scans your public IP for open ports and known vulnerabilities using naabu, nmap, and nuclei, streaming results to your terminal via one curl commandLINK

Cynative Security Research Agent: open-source AI CLI that answers plain-language security questions across code, cloud, and Kubernetes using read-only, IAM-enforced production access.LINK

Aegisora: an open-source proxy for securing LLM agents with least-privilege API access, PII masking, prompt-injection blocking, and audit logging in production.LINK

Cybermes: an autonomous framework for offensive security, bug bounty, and red teaming, using reasoning skills and multi-model LLM orchestration.LINK

📚 Trending papers & reports

Private-data chatbots can now answer questions from sensitive documents while spending their limited privacy protection only when they actually need the private data, wasting far less budget and staying accurate under strict privacy limits.LINK

Model-stealing attacks can now copy an image-recognition system's full blueprint, both its hidden design and its internal settings, without knowing anything about its structure beforehand, making proprietary vision models easier to clone.LINK

SilentLedger lets private blockchains stay confidential yet fully auditable, so regulators can uncover identities and amounts when justified without users or auditors ever interacting, matching or beating existing privacy systems on speed.LINK

Cybercrime infrastructure ads can be automatically spotted on Telegram, revealing that ~19% of over a million messages hawk criminal hosting or VPNs and that one community drives half of them, helping investigators prioritize targets.LINK

Crypto mixer laundering now has the first public dataset of 9,300 tagged transactions spanning 1.1 billion across 27 real cases, plus a detection tool that flags laundering flows better than existing methods.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!