EUVD-2026-101721

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes...

CVE-2026-110838

The FreeRDP shadow server versions 3.0.0 before 3.32.0 is vulnerable to a pre-authentication input injection flaw. The vulnerability occurs because the server dispatches input Protocol Data Units (PDUs) during the Confirm Active state before authentication is complete. An unauthenticated attacker...

CVE-2026-109246

A flaw was found in FreeRDP. An authenticated client can trigger a Denial of Service DoS by sending a specially crafted frame acknowledgment message to the shadow server. Due to missing input validation on the frame identifier, an arithmetic error causes a divide-by-zero condition. This terminate...

EUVD-2026-97690

FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadowencoderinflightframes can underflow. An authenticated client can acknowled...

Spammer's Arrest Puts End to Kelihos Botnet

The alleged Russian botmaster behind the Kelihos botnet was arrested while on vacation in Spain, putting an end to a seven-year cybercrime operation that foisted hundreds of millions of spam messages on consumers, as well as a dangerous array of banking malware and ransomware. Pyotr Levashov, als...

Researchers Tracking Emerging Darkness Botnet

Researchers are tracking a new botnet that has become one of the more active DDoS networks on the Internet since its emergence early last month. The botnet, dubbed “Darkness,” is being controlled by several domains hosted in Russia and its operators are boasting that it can take down large sites...