Blahalla

Patch Tuesday 2025 roundup: The biggest Microsoft vulnerabilities of the year

www.csoonline.com · 7 months ago

Microsoft’s Patch Tuesday in 2025 included 1,246 CVEs, with 158 rated critical and 41 being zero days. Security experts highlight the increasing threat of attacks leveraging AI and new tactics, urging organizations to prioritize patching based on immediate risk rather than solely relying on CVSS scores. Several vulnerabilities are particularly concerning, including ToolShell (CVE-2025-53770) allowing remote code execution, CVE-2025-24993 enabling local code execution, and CVE-2025-53779 facilitating domain-level compromise. Experts also caution against vulnerabilities like CVE-2025-33053, exploited by APT Stealth Falcon, and CVE-2025-30377, impacting Microsoft Office’s Preview Pane feature.

CISA Alerts on Active Exploitation of MongoDB Vulnerability CVE-2025-14847

gbhackers.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has issued a critical warning regarding the active exploitation of a vulnerability in MongoDB and MongoDB Server. This vulnerability, CVE-2025-14847, allows unauthenticated attackers to remotely access sensitive data stored in server memory. Threat actors are actively targeting this flaw, and organizations are urged to apply security patches immediately. Federal agencies must implement mitigations by January 19, 2026, according to Binding Operational Directive 22-01.

Hackers Abuse Copilot Studio’s New Connected Agents Feature to Plant Backdoors

gbhackers.com · 7 months ago

Microsoft's new Connected Agents feature in Copilot Studio, designed to simplify AI agent development, presents significant security risks. The feature allows agents to share functionality, but is enabled by default with no administrator visibility or audit logs. This lack of oversight enables attackers to impersonate organizations, send fraudulent emails, and potentially trigger domain blocklisting. Experts recommend immediate audits, disabling the feature for critical agents, and implementing third-party monitoring solutions.

Chinese Hackers Deploy Rootkit to Stealthily Mask ToneShell Malware

gbhackers.com · 7 months ago

A Chinese-nexus cyberespionage group, HoneyMyte, is conducting a sophisticated campaign targeting government organizations in Southeast and East Asia. The attackers are deploying a kernel-mode rootkit to stealthily install the ToneShell backdoor, marking a significant advancement in their tactics. The rootkit employs techniques to evade detection, including intercepting file operations, manipulating the registry, and interfering with Microsoft Defender, while the ToneShell payload has evolved with new identification and communication methods. Memory forensics and behavioral detection are crucial for identifying this threat.

EmEditor Website Breach Used to Spread Infostealer Malware

gbhackers.com · 7 months ago

A sophisticated supply chain attack compromised the website of the popular text editor EmEditor between December 19th and 22nd, 2025. Malicious MSI installers were distributed with fraudulent digital signatures, designed to deploy an infostealer that harvests sensitive data, including VPN configurations, browser data, and credentials from platforms like Slack and Zoom. The malware includes a persistent browser extension disguised as “Google Drive Caching” that uses Domain Generation Algorithm logic to maintain communication, and it incorporates geographic restrictions. Qianxin’s Tianqing “Liuhe” engine is available to detect and block the malicious installers.

70,000+ MongoDB Servers Exposed After MongoBleed PoC Released

gbhackers.com · 7 months ago

Over seventy-four thousand MongoDB database servers remain vulnerable due to a critical security flaw known as MongoBleed. This vulnerability, identified as CVE-2025-14847, allows attackers to read sensitive data from server memory without authentication. The flaw impacts versions 3.6 through 8.2.x, and MongoDB has released patches, recommending immediate upgrades or disabling zlib compression as a temporary measure. The Shadowserver Foundation is tracking vulnerable instances and sharing data in their Open MongoDB Report.

Sieben Anzeichen dafür, dass Ihr Cybersecurity-Framework überarbeitet werden muss

www.csoonline.com · 7 months ago

false

Chinese state hackers use rootkit to hide ToneShell malware activity

www.bleepingcomputer.com · 7 months ago

Chinese state-sponsored hackers, specifically the Mustang Panda group, have deployed a new variant of the ToneShell backdoor using a sophisticated kernel-mode rootkit. The rootkit, delivered through a mini-filter driver named ProjectConfiguration.sys, hides the malware's activity by intercepting file operations, protecting registry keys, and interfering with Microsoft Defender. This new technique marks the first time ToneShell has been delivered through a kernel-mode loader, enhancing its stealth capabilities and making user-mode monitoring difficult. The backdoor also includes changes like a new host identification scheme and network traffic obfuscation, supporting commands for file management and remote shell access.

Louis V. Gerstner, Who Revived a Faltering IBM in the ’90s, Dies at 83

www.nytimes.com · 7 months ago

false

The New Billionaires of the A.I. Boom

www.nytimes.com · 7 months ago

false

Coupang to split $1.17 billion among 33.7 million data breach victims

www.bleepingcomputer.com · 7 months ago

South Korean retailer Coupang will provide over one point one seven billion dollars in compensation to thirty-three point seven million customers affected by a recent data breach. The breach, discovered in November, exposed personal information and prompted a national police investigation. The suspect, a former employee from China, has been identified and authorities recovered data from his devices, including a laptop retrieved from a river. Coupang is working with cybersecurity firms Mandiant, Palo Alto Networks, and Ernst & Young to address the incident and restore customer trust.

Mitigating npm supply chain attacks using local Levenshtein distance and metadata analysis

pchavali09.github.io · 7 months ago

Supply chain attacks are becoming more accessible due to the increasing reliance on AI code generation, a practice referred to as "Vibe Coding." This process can lead developers to inadvertently install malicious packages from the npm registry if an attacker registers a package with a similar name just before installation. A new tool, npm-guard, is being developed to address this vulnerability by acting as a middleware between the shell and the Node package manager to verify package existence and maturity before installation, rather than relying on post-installation scanning for vulnerabilities. The tool prioritizes privacy and operates without backend data collection, intercepting commands and performing lightweight checks against the npm registry.

US, Australia say ‘MongoBleed’ bug being exploited

therecord.media · 7 months ago

U.S. and Australian cyber agencies are reporting that hackers are actively exploiting a vulnerability in MongoDB data storage systems. The flaw, identified as CVE-2025-14847, allows attackers to potentially steal sensitive information such as database passwords and AWS secret keys. Estimates indicate tens of thousands of internet-exposed MongoDB instances are vulnerable worldwide, and federal agencies have been ordered to patch the vulnerability by January 19. Experts warn that opportunistic actors are likely to exploit the vulnerability, which bypasses authentication controls.

Bugs that survive the heat of continuous fuzzing

github.blog · 7 months ago

Software projects utilizing continuous fuzzing can still encounter vulnerabilities despite employing tools like OSS-Fuzz. Three factors contributing to this include insufficient human oversight, a false sense of security among developers, and overlooked dependencies and encoding logic. Advanced techniques, such as fault injection, context-sensitive coverage, and value coverage, can improve vulnerability detection by exploring a broader range of error conditions and variable values. To increase effectiveness, a five-step workflow emphasizing thorough preparation and advanced methods is recommended.

ChatGPT’s year-end review knows way too much. How to fix your privacy settings.

www.washingtonpost.com · 7 months ago

false

Happy 16th Birthday, KrebsOnSecurity.com!

krebsonsecurity.com · 7 months ago

false

Aflac Data Breach Exposes 22M People in Major Cyber Breach

www.techrepublic.com · 7 months ago

A data breach at Aflac has impacted over 22 million affiliated individuals, primarily in the United States. The breach, detected in June 2025, involved an advanced cybercrime group and exposed personally identifiable information, including social security numbers, dates of birth, and medical insurance data. Aflac has reset passwords, begun notifying affected individuals, and is offering two years of free credit and identity theft protection. A class action lawsuit alleging negligence and breach of contract has been filed against Aflac.

Two more banks notifying thousands of victims about Marquis Software ransomware attack

therecord.media · 7 months ago

Two U.S. banks, Artisans’ Bank and VeraBank, have recently notified customers about a data breach stemming from a ransomware attack on Marquis Software. The software company, which provides services to numerous financial institutions, experienced the attack in August, impacting an estimated 788,000 to 1.35 million individuals. Stolen information includes names, Social Security numbers, financial account details, and dates of birth. The breach was linked to a vulnerability in a SonicWall firewall device, and it is speculated that a ransom was paid, though this has not been confirmed.

Hacker arrested for KMSAuto malware campaign with 2.8 million downloads

www.bleepingcomputer.com · 7 months ago

A Lithuanian national has been arrested and extradited to South Korea for his involvement in a malware campaign that infected 2.8 million systems. The suspect distributed malicious software disguised as the KMSAuto tool, which is used to illegally activate Windows and Office. This malware, known as clipper malware, stole approximately 1.2 million dollars in cryptocurrency from over 3,000 virtual asset addresses. Investigators traced the stolen funds and confiscated digital devices during a raid, leading to the arrest.

Dark Reading Confidential: Stop Secrets Creep Across Developer Platforms

www.darkreading.com · 7 months ago

There is widespread secret sprawl across developer platforms with tens of millions of exposed secrets discovered in code repositories, CI CD pipelines, Docker images, Postman workspaces, issue trackers, chat systems, and mobile apps. The main causes are human error and convenience, friction in internal processes, mixing personal and corporate accounts, proliferation of secrets from microservices and agents, and accelerating use of AI assisted tools that can commit sensitive data. Attackers routinely find and exploit exposed credentials within minutes to days, so organizations should assume compromise and respond by rotating keys and revoking tokens quickly. Effective mitigations include continuous secret scanning with contextual detection, pre commit hooks and platform guardrails, honey tokens to detect misuse, centralized secret management and automation, moving toward secretless architectures, and developer training to reduce risky shortcuts.

Coupang to Pay $1.1 Billion in Compensation to Users After Data Breach

www.techrepublic.com · 7 months ago

Coupang, a large online retailer in South Korea, will pay 1.1 billion dollars to compensate approximately 33.7 million users affected by a recent data breach. The company is issuing purchase vouchers to both current and former customers as part of a trust-restoration effort. This incident led to public criticism, regulatory review, and a change in leadership for Coupang. The company claims the leaked data has been recovered and not distributed externally.

39C3: Multiple vulnerabilities in GnuPG and other cryptographic tools

www.heise.de · 7 months ago

Security researchers have identified fourteen vulnerabilities across four cryptographic tools, including GnuPG, Sequoia-PGP, Minisign, and age. The vulnerabilities are implementation errors that can lead to signature forgery, data modification without detection, and the injection of malicious instructions through ANSI sequences. In age, a flaw allows arbitrary program execution via the plugin system. While some issues have been addressed, many remain unpatched, and users are advised to be cautious of error messages and cleartext signatures.

Google to Finally Let Users Change Their Gmail Address. Here’s How It Works

www.techrepublic.com · 7 months ago

false

French software company fined $2 million for cyber failings leading to data breach

therecord.media · 7 months ago

French software company Nexpublica France has been fined $2 million by the country’s data protection regulator. The fine stems from inadequate cybersecurity practices that led to a data breach reported in November 2022, where users could access third-party documents. The regulator found the company’s data security program was inadequate and violated Europe’s General Data Protection Regulation. The fine was based on the company’s financial standing, lack of security knowledge, and the sensitivity of the data involved.

Trust Wallet says 2,596 wallets drained in $7 million crypto theft attack

www.bleepingcomputer.com · 7 months ago

Attackers compromised Trust Wallet's browser extension, resulting in approximately $7 million in cryptocurrency being stolen from nearly 3,000 wallets. The malicious version 2.68 of the Chrome extension was likely released through a leaked Chrome Web Store API key, bypassing standard security checks. Trust Wallet has expired release APIs, suspended a malicious domain, and launched a reimbursement program for affected users, while also warning of phishing scams impersonating support accounts. Users are advised to only use official communication channels and never share their recovery phrases.

Top US Accounting Firm Sax Discloses 2024 Data Breach Impacting 220,000

www.securityweek.com · 7 months ago

A major US accounting firm, Sax LLP, has disclosed a data breach impacting over 220,000 individuals. The company detected a network intrusion in August 2024, but it took over a year to investigate and notify those affected. Hackers likely gained access in late July 2024 and obtained files containing sensitive personal information, such as Social Security numbers and passport numbers. Sax is offering affected individuals free credit monitoring and related services, although the delay in notification diminishes their effectiveness.

The Real-World Attacks Behind OWASP Agentic AI Top 10

www.bleepingcomputer.com · 7 months ago

The OWASP Agentic AI Top 10 framework has been released to address security risks specific to autonomous AI systems. Recent attacks highlight concerns such as agent goal hijacking through injected instructions, tool misuse, and unexpected code execution. Several real-world incidents involved malicious npm packages designed to deceive AI security tools, inject code into AI assistants, and compromise MCP servers, often through techniques like slopsquatting and hidden dependencies. Security teams are urged to inventory agent tools, verify their provenance, and monitor agent behavior to mitigate these emerging threats. CVEs 8.9 were assigned to three RCE vulnerabilities found in Claude Desktop extensions.

ChatGPT finally rolls out Thinking time toggle on mobile

www.bleepingcomputer.com · 7 months ago

false

SBOMs in 2026: Some Love, Some Hate, Much Ambivalence

www.darkreading.com · 7 months ago

false

Romanian energy provider hit by Gentlemen ransomware attack

www.bleepingcomputer.com · 7 months ago

A ransomware attack has impacted Oltenia Energy Complex, a large Romanian energy provider, disrupting IT infrastructure and temporarily disabling critical systems like email and ERP. The company is working to restore systems from backups and assess if data was stolen. The Gentlemen ransomware group, known for exploiting compromised credentials, is responsible for the attack, and authorities are investigating. This incident is part of a concerning trend of ransomware attacks targeting Romanian organizations.

Detecting unknown MCPs in local dev environments

example.com · 7 months ago

false

Former Coinbase support agent arrested for helping hackers

www.bleepingcomputer.com · 7 months ago

A former Coinbase customer service agent has been arrested in India for assisting hackers in stealing sensitive customer data. The breach, which occurred in May 2025, impacted approximately 69,500 customers, exposing personal information like names, addresses, and Social Security numbers. Hackers demanded a $20 million ransom, and the incident was facilitated through TaskUs, a customer support outsourcing firm. Separately, a scammer in Brooklyn was charged for impersonating Coinbase and stealing over $16 million from victims.

5 Threats That Defined Security in 2025

www.darkreading.com · 7 months ago

Cybersecurity in 2025 was defined by several significant events. A Chinese state-sponsored threat actor, Salt Typhoon, continued targeting telecom companies and was discovered to have hacked the US National Guard. CISA faced budget cuts and layoffs, impacting state and local cybersecurity defenses. A critical vulnerability, CVE-2025-55182, dubbed React2Shell, emerged in React, resembling the impact of Log4Shell. Additionally, a self-replicating malware called Shai-Hulud infected open-source software, and threat campaigns targeted Salesforce customers, highlighting the risks within integrated SaaS ecosystems. These incidents underscored the evolving landscape of cyber threats and supply chain vulnerabilities.

⚡ Weekly Recap: MongoDB Attacks, Wallet Breaches, Android Spyware, Insider Crime & More

thehackernews.com · 7 months ago

There is active exploitation of a newly disclosed MongoDB vulnerability CVE-2025-14847, nicknamed MongoBleed, which can leak server memory and affects more than 87,000 potentially vulnerable instances worldwide, and users are urged to update to fixed MongoDB versions. A compromised Trust Wallet Chrome extension led to an estimated seven million dollars in losses after a malicious version was published using a leaked Chrome Web Store API key, and users were asked to update to version 2.69 for remediation. Additional incidents included renewed abuse of Fortinet CVE-2020-12812 enabling multifactor authentication bypass, DNS poisoning campaigns delivering the MgBot backdoor, LastPass related cryptocurrency thefts totaling about thirty five million dollars, a malicious npm package that hijacked WhatsApp accounts, and a set of trending vulnerabilities including CVE-2025-14847, CVE-2025-68664, CVE-2023-52163, CVE-2025-68613, CVE-2025-13836, CVE-2025-26794, CVE-2025-68615, CVE-2025-44016, and CVE-2025-13008.

Korean Air data breach exposes data of thousands of employees

www.bleepingcomputer.com · 7 months ago

Korean Air confirmed a data breach affecting thousands of employees following a cyberattack on Korean Air Catering & Duty-Free, a former subsidiary. Sensitive employee information, including bank account numbers, was compromised from the company's ERP system. The Clop ransomware gang has claimed responsibility, publishing data on the dark web and is linked to attacks against GlobalLogic, Logitech, and others. Korean Air is urging employees to be cautious of potential phishing attempts and has reported the incident to authorities.

Hacker Dumped MacBook in River in Attempt to Destroy Digital Evidence

gbhackers.com · 7 months ago

A former Coupang employee attempted to destroy a MacBook Air containing evidence of a data theft by throwing it into a river, but investigators recovered the device. The employee stole a security key to access customer records, including order histories and delivery access codes, impacting approximately 3,000 customers. Forensic investigations by Mandiant, Palo Alto Networks, and Ernst & Young revealed the perpetrator used personal devices to access the data. Coupang will provide compensation vouchers to over 33 million affected customers and faces a government inquiry.

Coupang recovers smashed laptop that alleged data leaker threw into river

therecord.media · 7 months ago

South Korean online retailer Coupang is facing criticism following a data breach impacting 33.7 million customer accounts. The company has recovered a smashed laptop, thrown into a river by a former employee attempting to destroy evidence. Coupang is offering a voucher scheme worth over one billion dollars to compensate affected individuals and claims the leaker confessed to accessing and retaining data from approximately 3,000 accounts. Forensic teams from Mandiant, Palo Alto Networks, and Ernst & Young were able to retrieve data from the damaged laptop before it was handed over to investigators.

Hackers Launch 2.5 Million+ Malicious Requests Targeting Adobe ColdFusion Servers

gbhackers.com · 7 months ago

A large-scale cyber campaign targeted vulnerable systems over the Christmas 2025 holiday, launching over 2.5 million malicious requests. Threat actors exploited numerous vulnerabilities across 800 systems, with a significant focus on Adobe ColdFusion servers and 46 other technology stacks. The attackers utilized ProjectDiscovery Interactsh infrastructure and timed their attacks to coincide with reduced security team capacity. Key vulnerabilities targeted include CVE-2023-26359, CVE-2023-38205, CVE-2023-44353, CVE-2022-26134, and CVE-2014-6271.

Fortinet Warns of New Attacks Exploiting Old Vulnerability

www.securityweek.com · 7 months ago

A flaw in FortiOS, identified as CVE-2020-12812, is being exploited by attackers to bypass two-factor authentication. The vulnerability exists when local users with 2FA enabled authenticate through LDAP, and the case-sensitivity of usernames differs between FortiGate and the LDAP directory. Hackers can manipulate usernames to avoid the 2FA prompt, potentially compromising system configurations and credentials. Fortinet recommends updating to FortiOS versions 6.0.10 or later and disabling username sensitivity to mitigate the risk.

Microsoft Copilot is rolling out GPT 5.2 as "Smart Plus" mode

www.bleepingcomputer.com · 7 months ago

false

Critical Zero-Day RCE Flaw in Networking Devices Exposes Over 70,000 Hosts

gbhackers.com · 7 months ago

A critical, unauthenticated remote code execution vulnerability, tracked as CVE-2025-54322, has been identified in XSpeeder networking devices. The flaw allows attackers to gain root-level access without authentication by exploiting an unsafe eval function. Researchers estimate over 70,000 XSpeeder-based systems are exposed online, particularly in industrial and branch office settings. The vendor has not responded to vulnerability disclosures, prompting public release of the information.

Coupang to Issue $1.17 Billion in Vouchers Over Data Breach

www.securityweek.com · 7 months ago

South Korean ecommerce giant Coupang will issue over one point one seven billion dollars in vouchers to compensate customers affected by a recent data breach. The breach, which began June twenty-four, twenty-twenty-five, exposed the personal information of thirty-three point seven million customer accounts. A former employee is believed to be responsible for obtaining names, phone numbers, addresses, email addresses, and some order histories. Starting January fifteen, twenty-twenty-six, each affected customer will receive a fifty-thousand won voucher.

Are We Ready to Be Governed by Artificial Intelligence?

www.schneier.com · 7 months ago

false

22 Million Affected by Aflac Data Breach

www.securityweek.com · 7 months ago

Aflac is notifying approximately 22.65 million people about a data breach that occurred in June 2025. The compromised information includes names, addresses, Social Security numbers, dates of birth, and health insurance details affecting customers, beneficiaries, employees, and agents. The company contained the attack quickly, and operations were not disrupted by ransomware. Aflac is offering affected individuals two years of free credit monitoring and identity theft protection services.

Infostealer Malware Delivered in EmEditor Supply Chain Attack

www.securityweek.com · 7 months ago

A supply chain attack targeted EmEditor, a popular text and code editing software, resulting in the distribution of infostealer malware. Users who downloaded the software from the ‘Download Now’ button between specific dates may have received a malicious installer that downloaded and executed a file from a fake domain. The malware collects system information, credentials from various applications including Zoho Mail, Discord, Slack, Teams, Zoom, WinSCP, PuTTY, Telegram, and Steam, and deploys a ‘Google Drive Caching’ browser extension for persistence and data theft. The attack is believed to be the work of profit-driven cybercriminals.

Fortinet warns of 5-year-old FortiOS 2FA bypass still exploited in attacks

www.bleepingcomputer.com · 7 months ago

Threat actors are actively exploiting a flaw in Fortinet FortiOS firewalls that allows them to bypass two-factor authentication. The vulnerability, tracked as CVE-2020-12812, occurs when local users requiring 2FA are linked to Lightweight Directory Access Protocol LDAP groups. Fortinet released patches in 2020, but organizations must have specific configurations for the vulnerability to be exploitable. The FBI and CISA previously warned about state-sponsored hackers and ransomware groups exploiting this and other Fortinet vulnerabilities.

React2Shell: Anatomy of a max-severity flaw that sent shockwaves through the web

www.csoonline.com · 7 months ago

A critical remote code execution vulnerability, known as React2Shell, has impacted the React 19 library, enabling unauthenticated attackers to execute code on vulnerable servers. Exploitation began within hours of the vulnerability's public disclosure, with threat actors, including state-aligned groups like Earth Lumia and Jackpot Panda, rapidly deploying automated scanning and exploitation tools. Attackers have been observed deploying backdoors and tunneling tools, indicating the vulnerability is being used for persistent access. The flaw resides in React’s server-side rendering pipeline due to unsafe deserialization and affects default React and Next.js deployments, carrying a CVSS score of 10.0.

How Vance brokered a truce between Trump and Musk

www.washingtonpost.com · 7 months ago

false

Meet a U.S. Start-Up Trying to Break China’s Rare-Earth Monopoly

www.nytimes.com · 7 months ago

false

New Bluetooth Headphone Vulnerabilities Allow Hackers to Hijack Connected Smartphones

gbhackers.com · 7 months ago

Security researchers have identified critical vulnerabilities in Airoha-based Bluetooth headphones, affecting models from manufacturers like Sony, Marshall, Jabra, and Bose. The flaws, CVE-2025-20700, CVE-2025-20701, and CVE-2025-20702, allow attackers within Bluetooth range to connect without authentication and access device memory, potentially stealing Bluetooth Link Keys. Attackers can then impersonate headphones to a paired smartphone, enabling actions like accessing contacts, triggering voice assistants, and eavesdropping on calls. While Airoha released patches in June 2025, device manufacturers’ adoption has been inconsistent, and users are advised to update their devices and consider using wired headphones.