Overview On October 12, 2026, AI security firm AIR Security disclosed a network isolation bypass technique for the Vercel Sandbox, dubbed "VerCellBreak." An AI agent controlled by an attacker can smuggle private keys out of the sandbox by leveraging a standard feature in the TLS certificate chain validation process, without...
Categoria: Blog
PHP Remote Code Execution Vulnerability (CVE-2026-109618 / CVE-2026-109619) Advisory
Overview Recently, NSFOCUS CERT monitored the public disclosure of PHP Remote Code Execution (RCE) vulnerabilities (CVE-2026-109618 / CVE-2026-109619). Due to memory management flaws in PHP Core—where longjmp() handles Out-Of-Memory (OOM) errors leading to failed memory allocations, as well as various global state handling operations—a Use-After-Free (UAF) condition can occur. Unauthenticated...
NSFOCUS Monthly APT Insights – August 2026
Regional APT Threat Landscape In August 2026, the global threat hunting system of the FUYING Lab detected a total of 20 APT attack activities. These activities were primarily concentrated in regions including East Asia, Eastern Europe, Middle East, and South Asia as shown in the figure below. Regarding the activity...
GitLab Remote Code Execution Vulnerability (CVE-2026-97229) Notice
Overview Recently, NSFOCUS CERT monitored that GitLab released a security update to fix the GitLab Remote Code Execution Vulnerability (CVE-2026-97229). Due to insufficient validation of regular expressions in GitLab's CI/CD configuration, unauthenticated attackers can construct special regular expressions within the CI/CD configuration to trigger an integer overflow during compilation, thereby...
NSFOCUS SecLLM Model on CyberGym Technical Report
Overview SecLLM-3.6-27B is a specialized cybersecurity model developed by NSFOCUS for complex security tasks. In the CyberGym Level 1 evaluation, SecLLM-3.6-27B achieved a 91.31% task success rate under a fixed task-interaction and tool-execution framework, representing an absolute improvement of 36.80 percentage points over the 54.51% base model. ModelSuccess RateAbsolute ImprovementQwen3.8-27B...
AI Security Incident Case: Fake Claude Installation Page Delivered Malware via ClickFix
Overview On October 9, 2026, Push Security disclosed a malvertising campaign targeting Claude users. Attackers set the landing domain of a Google search ad to bing.com, leveraging Bing's own click redirects and multi-layer cloaking to guide users to a counterfeit Claude download page and execute ClickFix-style attacks. Ad platform reviewers...
