Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation

Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation By Adithya Chandra and Maulik Maheta · August 18, 2026 Executive Summary While attackers continuously cycle through new tooling, their underlying techniques remain remarkably consistent. Credential theft from...

RHEL 9 : redhat-ds:12 (RHSA-2026:56050)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56050 advisory. Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol...

PT-2026-77168

Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description The HTTPPasswordMgr class in the urllib.request module, including its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, fails to consider the URL scheme when matchin...

nodejs:22 security update

nodejs 1:22.23.1-3 - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 2.1.4 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 Resolves: RHEL-223914 RHEL-223798 1:22.23.1-3 - deps: update sqlite to 3.53.4 Fix: CVE-2026-11824, CVE-2026-11822 nodejs-nodemon nodejs-packag...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2058)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2058 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count CVE-2026-53392 In the Linux kernel, the following vulnerability has be...

PT-2026-77171

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...

PT-2026-77181

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named set...

Red Hat Security Advisory 2026-56047-03

Red Hat Security Advisory 2026-56047-03 - An update for the redhat-ds:11 module is now available for Red Hat Directory Server 11.7 E4S for RHEL 8. Issues addressed include buffer overflow and null pointer vulnerabilities...

PT-2026-76939

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

Red Hat Security Advisory 2026-56050-03

Red Hat Security Advisory 2026-56050-03 - An update for the redhat-ds:12 module is now available for Red Hat Directory Server 12.4 E4S for RHEL 9. Issues addressed include buffer overflow and null pointer vulnerabilities...

PT-2026-77173

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/syste...

MiracleLinux 9 : nodejs:24 (AXSA:2026-1559:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1559:01 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed...

Linux Distros Unpatched Vulnerability : CVE-2026-72306

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vduse: Fix race in vdusedevmsgsync and vdusedevreaditer There is one race case in vdusedevmsgsync and vdusedevreaditer: vdusedevreaditer: lockmsglock...

RHEL 9 : kpatch-patch-5_14_0-687_10_1 (RHSA-2026:55763)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:55763 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Linux Distros Unpatched Vulnerability : CVE-2026-72141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine...

RHEL 9 : kpatch-patch-5_14_0-570_116_1, kpatch-patch-5_14_0-570_17_1, kpatch-patch-5_14_0-570_39_1, kpatch-patch-5_14_0-570_66_1, and kpatch-patch-5_14_0-570_94_1 (RHSA-2026:56225)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56225 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Oracle Linux 9 : nodejs:22 (ELSA-2026-55601)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55601 advisory. - deps: update npm/brace-expansion to 2.1.4 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 Resolves: RHEL-223914 RHEL-223798 Tenable has extracte...

PT-2026-77174

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by get events in inc/functions calendar.p...

MiracleLinux 8 : nodejs:24 (AXSA:2026-1566:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1566:01 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash vi...

Linux Distros Unpatched Vulnerability : CVE-2026-72491

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/9p: fix race condition on rdma-state in transrdma.c The rdma-state field is modified without holding reqlock in both recvdone and p9cmeventhandler, while...