Monthly summary of interesting articles, reports and tools for tech experts, covering both offensive and defensive topics.
🔴 Red Team
📝 Achieving Remote Code Execution on n8n Via Sandbox Escape – CVE-2026-1470 & CVE-2026-0863
JFrog Security found two critical n8n sandbox vulnerabilities: CVE-2026-1470 (9.9 Critical) allows arbitrary JavaScript execution via AST sanitization flaws, enabling remote code execution (RCE). CVE-2026-0863 (8.5 High) affects Python execution in “Internal” mode, allowing OS command execution and full RCE.
The sandbox can be bypassed: CVE-2026-1470 exploits improper handling of JavaScript with and constructor to run arbitrary code. CVE-2026-0863 uses format-string introspection and Python 3.10+ AttributeError.obj to access restricted builtins and execute OS commands.
Fixes are in n8n versions: CVE-2026-1470 fixed in 1.123.17, 2.4.5, 2.5.1; CVE-2026-0863 fixed in 1.123.14, 2.3.5, 2.4.2. Users should upgrade promptly to mitigate risks.
These findings stress the need for ongoing sandbox reassessment and strong defense-in-depth for untrusted code, highlighting challenges in safely sandboxing dynamic languages like JavaScript and Python.
📌 Source: https://research.jfrog.com/post/achieving-remote-code-execution-on-n8n-via-sandbox-escape
📝 Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework
VoidLink is a cloud-native malware framework for long-term Linux access, especially in cloud and container environments. Written in Zig, it has a modular design with 30+ plugins for tailored attacks, using OPSEC features like runtime code encryption, self-deletion, and adaptive behavior, plus user-mode and kernel rootkits.
It detects major cloud providers (AWS, GCP, Azure, Alibaba, Tencent) and container platforms (Kubernetes, Docker), harvesting cloud credentials and Git secrets, targeting software engineers for espionage or supply-chain attacks. Its web dashboard manages implants, plugins, and monitors compromised systems, covering reconnaissance, credential theft, lateral movement, persistence, and anti-forensics.
VoidLink highlights threats to Linux cloud infrastructure, stressing proactive defense. Its stealth, rootkits, and modularity challenge detection and response, using eBPF and LKM rootkits to hide processes and network activity, underscoring the need to monitor unusual activity, secure credentials, and harden containers.
📌 Source: https://research.checkpoint.com/2026/voidlink-the-cloud-native-malware-framework
📝 Can AI identify 0-days?
The Equixly blog details how their AI agent found CVE-2026-0773, a critical RCE vulnerability (CVSS 9.8) from unsafe deserialization via the cloudpickle library used in AI frameworks. It allows unauthenticated attackers to run arbitrary code by exploiting Python’s insecure pickle deserialization. The AI autonomously explored APIs, sequenced operations, and generated context-aware inputs, identifying an unauthenticated endpoint deserializing pickle data, unlike traditional scanners that miss such issues due to lack of context.
The post warns of risks from unsafe deserialization in AI frameworks and stresses treating all serialized data as untrusted. It recommends safer formats (safetensors, JSON, Protocol Buffers) and cryptographic signing. The CVE highlights AI-driven security testing’s role in finding critical vulnerabilities missed by conventional methods.
An example is cloudpickle’s serialization of executable lambdas, exploitable for RCE. This reflects a trend of pickle-based CVEs in AI/ML, showing ongoing risks from unsafe deserialization.
📌 Source: https://equixly.com/blog/2026/01/14/can-ai-identify-0days
📝 Task Failed Successfully – Microsoft’s “Immediate” Retirement of MDT
The SpecterOps blog reveals critical vulnerabilities in Microsoft’s Deployment Toolkit (MDT), prompting its retirement instead of patching. Vulnerabilities include locating MDT servers and bypassing security via XXE attacks in the unauthenticated MDT monitoring service, which uses System.Xml.XmlDocument in .NET Framework versions before 4.5.2.
Attackers can exploit the monitoring service’s API to register clients, inject XXE payloads, and trigger authentication coercion or leak sensitive files like CustomSettings.ini, risking privileged MDT service account credentials.
MDT’s retirement highlights the need to migrate to supported solutions, disable the monitoring service, segment servers, audit permissions, and apply least privilege. Unsupported software risks remain as vulnerabilities go unpatched.
🔵 Blue Team
📝 Synthetic Data: A New Frontier for Cyber Deception and Honeypots
The Resecurity blog discusses using synthetic data for cyber deception and honeypots. This fabricated data mimics real patterns without exposing real info, helping mislead attackers and gather threat intelligence safely.
Key points include honeytrap accounts with synthetic datasets like fake consumer records and payment transactions. Resecurity used over 28,000 fake records and 190,000 fake transactions to reveal attacker tactics, effective even against advanced threat actors.
Synthetic data offers a controlled way to study attackers, gather intelligence, and enhance defenses. It also enables decoy apps and accounts mimicking high-value targets to boost threat detection.
📝 THE KNOWNSEC LEAK: Yet Another Leak of China’s Contractor-Driven Cyber-Espionage Ecosystem
The Knownsec leak of late 2025 revealed a Chinese cybersecurity firm tied to state espionage, offering tools like GhostX (browser exploits, credential theft), Un-Mail (email surveillance), and Passive Radar (network mapping). Supported by datasets ZoomEye and TargetDB, it targets critical infrastructure in Taiwan, Japan, India, and the West.
The leak exposed Knownsec’s data lake of breached global data (LinkedIn, Yahoo, Facebook, IDs, telecom records) used for deanonymization and social engineering. This enables linking technical assets to identities for rapid intrusions. For defenders, it highlights China’s sophisticated cyber operations and the need for strong network segmentation, monitoring DNS/routing changes, and credential hygiene, especially in sensitive sectors. The integrated toolset shows how state actors use commercial firms to project cyber power, complicating attribution and defense.
📝 A closer look at a BGP anomaly in Venezuela
Cloudflare’s analysis of the BGP route leak involving Venezuela’s CANTV (AS8048) shows it was likely caused by poor routing export/import policies, not malicious intent. Since December, eleven leaks affected multiple prefixes, with AS8048 as the leaker. Routes from AS6762 (Sparkle) were redistributed to AS52320 (V.tal GlobeNet), indicating a Type 1 hairpin leak.
AS prepending repeated AS8048 in the path, making routes less attractive, suggesting misconfiguration rather than traffic interception. Route leaks are common in South America and unrelated to Nicolás Maduro’s capture.
This incident highlights the need for robust routing policies and standards like RFC9234 and ASPA to prevent leaks and secure BGP by enforcing customer-provider and peer-peer roles.
📌 Source: https://blog.cloudflare.com/bgp-route-leak-venezuela
Never trust, always check
