InfoSecBulletin Cybersecurity for mankind
Trend Micro’s Deep Security Agent for Linux has a design flaw. This issue lets a local attacker, who does not have special access, create short “blind spots.” During these moments, endpoint protections are not working temporarily.
The issue stems from how the agent unloads and reloads its bmhook and tmhook kernel modules under heavy local event load, creating a repeatable protection gap rather than a one‑off stability glitch.
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Independent research on Trend Micro Deep Security Agent (DSA) found that a regular process can create a large number of harmless events in the file system and processes, putting pressure on the agent’s behavior-monitoring system.
In tests, a C‑based proof‑of‑concept hammered file create/write/truncate/rename operations, symlink creation/removal, and fork/exit loops against a Linux host protected by DSA.
Rather than simply throttling telemetry, the agent’s ds_am.init component responded by invoking rmmod on the bmhook and tmhook kernel modules, fully unloading and subsequently reloading the syscall‑hooking and behavior‑monitoring stack. Click here to read the full report.
Affected components and current status
The issue has been seen in Ubuntu Linux systems using Trend Micro Deep Security Agent with the tmhook and bmhook kernel modules from the Linux support pack.
The study focuses on how the Linux agent tracks behavior, not on the Deep Security Manager. This is different from previous Deep Security CVEs about privilege escalation, code injection, and access control problems.
Currently, the reload issue caused by event storms is not listed as a CVE in public Deep Security vulnerability records. This may mean it is being carefully shared or has not been officially tracked yet.
Cisco has announced a serious security flaw in its Catalyst SD-WAN Manager. This flaw is being used by attackers to run any commands as if they had full control of the systems.
The flaw, noted as CVE-2026-20245, has a CVSS score of 7.8. It happens due to bad input checks (CWE-116) in the command-line interface of Cisco Catalyst SD-WAN Manager, which was called vManage before.
Cisco’s security alert (cisco-sa-sdwan-privesc-4uxFrdzx) says that a weak point lets logged-in attackers with netadmin rights upload a special file and run any commands, giving them total control of the system.
Cisco SD-WAN Security Flaw
Cisco’s security team (PSIRT) said that the weakness has already been used by attackers in some real situations. In the cases seen, attackers took advantage of the flaw to make unauthorized changes to SD-WAN devices, showing possible follow-up actions for staying in the system or changing the network.
The weakness comes from not checking user input properly when files are uploaded and processed. This lets attackers add harmful commands that run with root access.
Cisco has shared signs of compromise (IOCs) to help organizations find possible attacks. Security teams should check the scripts.log file in /var/log/ for strange entries related to unexpected file uploads or command runs, especially those mentioning scripts like vconfd_script_upload_tenant_list.sh.
Administrators need to keep logs, check edge device settings for any unauthorized changes, and reach out to Cisco TAC if they think there has been a breach. Cisco also says that future updates will not fix systems that are already compromised, so extra response actions will be needed.
Mandiant reported the problem, showing how threat intelligence teams help find flaws that are being used. Since SD-WAN management platforms are important for business networks, this issue highlights the need to protect management interfaces, apply strict access rules, and watch for unusual activity.
Ransomware Crisis Deepens: 4,089 Victims Hit Across 121 Countries in 2026
