NewsThe Hacker News
Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access
More on Persistent
Other advisories
- HighCVE-2026-110354HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
- Not ratedCVE-2026-98867dm-pcache: bound the logical key offset from persistent memory
- Not ratedCVE-2026-98057ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
- HighCVE-2026-93201dm-pcache: validate seg_id fields from persistent memory
- HighCVE-2026-84313TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI
- Not ratedosv:CVE-2026-98867dm-pcache: bound the logical key offset from persistent memory
- Not ratedosv:CVE-2026-111381FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser
- Not ratedosv:CVE-2026-111379FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3
Other news entries
- WordPress sites compromised after TeamUpdraft credential exposureNewsCSO Online
- AI Platform Cairn Abused to Hack Over 100 OrganizationsNewsSecurityWeek
- Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom HackNewsSecurityWeek
- UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM PhishingNewsThe Hacker News
- Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin ControlNewsThe Hacker News
- Persistent Denial of Service in Admin ProfileNewsFortinet PSIRT
- FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure IntrusionsNewsThe Hacker News
- AI's Third Wave: Coworkers Break the Security Model That Worked for AgentsNewsBleepingComputer
Source: https://thehackernews.com/2026/08/malware-can-abuse-windows-hello-for.html
ID