Loading story…
A high-severity vulnerability, CVE-2026-56766, was disclosed in Hydra through version 9.7, where the tool’s NTLM authentication handler can trigger a stack buffer overflow when processing a malicious NTLM Type-2 challenge from a server. The flaw affects the SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules, and occurs when an excessively long domain string causes base64-encoded response data to overflow a 500-byte stack buffer by roughly 18 to 330 bytes.
The bug can lead to remote code execution on systems that do not have stack protection enabled. The issue was fixed in commit 9cc84c2, and defenders are advised to update Hydra to a version containing that fix, apply relevant security patches, enable stack protection, and review environments where Hydra performs NTLM authentication against untrusted or potentially malicious servers.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-56766 was published on 2026-06-25 for a high-severity stack buffer overflow in Hydra through version 9.7 affecting NTLM authentication handling across several modules. The advisory states the issue can be triggered by an excessively long domain string in an NTLM Type-2 challenge.
A stack buffer overflow in Hydra's NTLM authentication handling affecting multiple protocol modules was fixed in commit 9cc84c2. The flaw could allow remote code execution on systems without stack protection when processing a crafted NTLM Type-2 challenge from a malicious server.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft patched **`CVE-2026-47291`**, a remotely exploitable flaw in **Windows `HTTP.sys`** that can cause denial of service or potentially **kernel-level remote code execution** on systems using the HTTP protocol stack behind IIS and other applications. The bug stems from an **integer overflow** while `HTTP.sys` expands a per-request buffer reference array during **HTTP/1.x header parsing over TLS**; the array's 16-bit capacity can wrap to zero, leading to a large **kernel pool heap buffer overflow** during memory movement operations. Exploitation requires a remote, unauthenticated attacker to send a specially crafted **HTTPS** request with many header lines, placing each header in a separate **TLS application data record** so each becomes a distinct buffer reference. The issue is described as reachable only on the **HTTP/1.x over TLS** path, not the HTTP/2 or HTTP/3 parser paths, and it depends on the target accepting an unusually large request; keeping the **`MaxRequestBytes`** registry setting at or below **65,535 bytes** is cited as a practical mitigation, while applying Microsoft's June 2026 patch is the recommended fix. Detection guidance includes inspecting decrypted HTTPS traffic for excessive HTTP/1.x header lines or, without decryption, looking for sustained connections carrying many small TLS application data records.
Jul 11, 2026
Microsoft released its January 2025 security updates to fix **161 vulnerabilities** across its product portfolio, including **58 remote code execution** flaws and **12 critical** issues. The update covers high-risk weaknesses in **Windows OLE**, **Windows RMCAST**, **Windows NTLM v1**, **Azure Marketplace SaaS Resources**, **Microsoft Purview**, **Microsoft Excel**, **Remote Desktop Services**, **Digest Authentication**, **NEGOEX**, and **BranchCache**, according to Microsoft’s release notes and CSIRT.SK. The most urgent issues are three **Windows Hyper-V NT Kernel Integration VSP** privilege-escalation vulnerabilities — `CVE-2025-21333`, `CVE-2025-21334`, and `CVE-2025-21335` — which were reported as **actively exploited in the wild**. Defenders were urged to deploy the January patch bundle quickly, with additional mitigations noted for some exposures, including using plaintext mode in Outlook, restricting exposed PGM ports, and disabling **NTLMv1** by setting `LmCompatibilityLevel` to `5`.
Jul 24, 2026
Microsoft disclosed and patched several spoofing vulnerabilities across Windows and Exchange Server, including **NTLM hash disclosure** issues tracked as `CVE-2025-24996`, `CVE-2025-59185`, and `CVE-2025-59244`, a **Windows NTLM spoofing** flaw `CVE-2025-21217`, a **Windows Themes spoofing** bug `CVE-2025-21308`, a **Windows Shell Link Processing spoofing** issue `CVE-2026-25185`, and an older **Microsoft Exchange Server spoofing** vulnerability `CVE-2021-24085`. The advisories indicate a broad set of weaknesses that could let attackers disguise content or trigger credential exposure through trusted Windows components and enterprise messaging infrastructure. The concentration of flaws around NTLM and user-facing file handling highlights continued risk from spoofing paths that can mislead users or disclose authentication material. For defenders, the updates underscore the need to prioritize Microsoft security patches for systems handling Windows authentication, shell link processing, themes, and Exchange workloads, especially where NTLM remains enabled and could be leveraged for credential theft or follow-on intrusion.
Jul 12, 2026