Blahalla

Data Stolen in Eurofiber France Hack

www.securityweek.com · 8 months ago

A threat actor exploited a vulnerability in Eurofiber France systems on November 13, exfiltrated data from the ticket management platform and the ATE customer portal, and attempted to extort the company. Eurofiber says the breach affected only customers of Eurofiber France and its regional brands, services remained operational, sensitive banking data and critical data in other systems were not affected, and the company secured the platforms, patched the vulnerability, and reported the incident to authorities. Investigators and SOCRadar say the attacker exploited an SQL injection in a web accessible GLPI interface to extract support tickets, internal messages, configuration files, VPN configurations, credentials, API keys, tokens, SQL backups, source code and other documents, with roughly ten thousand customers reportedly affected and a threat actor calling itself ByteToBreach claiming responsibility.
Princeton University Data Breach: Donor Information Exposed in Compromised Database

gbhackers.com · 8 months ago

Princeton University confirmed on November 15, 2025 that an Advancement database was compromised by outside actors on November 10, 2025, and that the unauthorized access lasted less than 24 hours before the attackers were removed. The compromised database included names, email addresses, telephone numbers, home and business addresses, and records of fundraising activities and donations, while it generally did not contain Social Security numbers, passwords, credit card or bank account numbers, detailed student records covered by federal privacy laws, or most employment information. The university is working with external cybersecurity specialists and law enforcement to determine the scope of the incident, has urged potentially affected individuals to monitor for phishing and fraud, and will provide updates as the investigation progresses.
DoorDash Confirms Data Breach Compromised User Data

gbhackers.com · 8 months ago

An unauthorized third party gained access to specific user information after a targeted social engineering attack against a DoorDash employee. The access was limited in scope and potentially included first and last names, phone numbers, email addresses, and physical addresses, while Social Security numbers, government identification, driver license information, and payment card or financial data were not compromised. DoorDash identified and shut down the unauthorized access, launched a formal investigation, engaged external security specialists, expanded employee social engineering training, referred the matter to law enforcement, and established a dedicated support line for affected users.
Fortinet’s silent patch sparks alarm as a critical FortiWeb flaw is exploited in the wild

www.csoonline.com · 8 months ago

There are two critical vulnerabilities in Fortinet FortiWeb appliances tracked as CVE-2025-64446 that are being actively exploited in the wild. One flaw uses relative path traversal to reach internal CGI endpoints while the other lets unauthenticated actors impersonate any administrator by spoofing the HTTPCGIINFO header, and combined these allow full administrative access and remote code execution. Fortinet applied silent fixes in certain releases including 8.0.2 before issuing an advisory on November 14, 2025, and the US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog with a federal patch deadline of November 21, 2025. Affected versions include 7.0.0 through 7.0.11, 7.2.0 through 7.2.11, 7.4.0 through 7.4.9, 7.6.0 through 7.6.4, and 8.0.0 through 8.0.1, with fixes in 7.0.12, 7.2.12, 7.4.10, 7.6.5, and 8.0.2, and customers are urged to disable internet facing HTTP and HTTPS management interfaces until they can upgrade.
WhatsApp Screen-Sharing Scam: How Attackers Are Deceiving Users to Expose Sensitive Information

gbhackers.com · 8 months ago

There is a growing WhatsApp screen sharing scam that leverages the app feature added in 2023 to trick users during video calls by impersonating bank representatives, WhatsApp support, or acquaintances and spoofing local numbers. Attackers create urgency, convince victims to share their screens or install remote access apps such as AnyDesk and TeamViewer, intercept SMS and WhatsApp verification codes, capture passwords and one time codes, and sometimes install keyloggers. Incidents have been reported globally, including a Hong Kong case where a victim lost HK 5.5 million, and compromised credentials are used to drain bank accounts and hijack social media to defraud contacts. Recommended defenses are to never share your screen with unknown callers, refuse to disclose passwords or verification codes, avoid installing remote access tools at strangers request, independently verify alarming claims, and enable WhatsApp two step verification.
Azure blocks record 15 Tbps DDoS attack as IoT botnets gain new firepower

www.csoonline.com · 8 months ago

Azure blocked its largest recorded DDoS attack, a 15.72 terabit per second strike linked to the Aisuru IoT botnet that also peaked at about 3.64 billion packets per second and targeted a single cloud endpoint in Australia. The attack was an extremely high rate UDP flood launched from more than 500,000 source IP addresses across various regions, featuring minimal source spoofing and random source ports, and Azure DDoS Protection automatically detected and mitigated the traffic without disrupting customer workloads. Security experts warned that systemic weaknesses in consumer Internet of Things devices combined with faster residential broadband are increasing per device attack capacity and urged organizations to validate always on, multi provider DDoS defenses, stress test control planes for tens of terabits per second, and deploy layered measures such as scrubbing services, content delivery networks, edge rate limiting, ISP level filtering, and greater OEM responsibility.
Seven npm Packages Use Adspect Cloaking to Trick Victims Into Crypto Scam Pages

thehackernews.com · 8 months ago

Seven npm packages published by a single threat actor named dinoreborn between September and November 2025 used a cloaking service called Adspect to fingerprint visitors and gate malicious content. Six of the packages delivered a 39 kilobyte JavaScript payload that executes immediately via an IIFE, captures system fingerprints, and takes steps to block developer tools and sidestep analysis. The captured data is sent to a proxy to decide whether to show a fake CAPTCHA and, if a victim interacts, redirect them to bogus cryptocurrency-themed pages impersonating services like StandX with the apparent goal of stealing digital assets, while flagged researchers see a benign decoy page. The npm account has been removed and this campaign is a rare example of merging traffic cloaking, anti-research controls, and open source distribution to automate traffic gating of real payloads.
Google fixes new Chrome zero-day flaw exploited in attacks

www.bleepingcomputer.com · 8 months ago

Google released an emergency security update to fix the seventh Chrome zero day vulnerability exploited in attacks this year. The high severity flaw is CVE-2025-13223, a type confusion bug in the V8 JavaScript engine that was reported by Clement Lecigne of Google Threat Analysis Group and which Google confirmed is being exploited in the wild. Google issued Chrome versions 142.0.7444.175 and 142.0.7444.176 for Windows, 142.0.7444.176 for Mac, and 142.0.7444.175 for Linux and urged users to update or relaunch the browser to install the patch immediately. This is the seventh actively exploited Chrome zero day this year and prior fixes included CVE-2025-10585, CVE-2025-6558, CVE-2025-4664, CVE-2025-5419, and CVE-2025-2783.
Gotchas in Email Parsing - Lessons from Jakarta Mail

www.reddit.com · 8 months ago

There are inconsistent parsing behaviors in Jakarta Mail's InternetAddress class where the single argument constructor validates input but the two and three argument constructors assign the address directly without parsing, allowing invalid or unexpected address strings to be accepted. There are parsing differentials where encoded strings and overloaded address formats cause mail to be delivered to one address while applications may record a different string, enabling privilege escalation or account takeover when applications perform naive domain checks. There are MIME header decoding behaviors where encoded personal name and subject fields are decoded and can contain embedded email addresses, enabling phishing if applications display the decoded personal name as the sender. There are also issues with group and newsgroup parsing that split and concatenate headers without strict validation, producing multiple addresses, parsing differentials, or potential performance problems depending on how applications use the parsed values.
A miracle: A company says sorry after a cyber attack – and donates the ransom to cybersecurity research

www.bitdefender.com · 8 months ago

There was a data breach at Checkout.com attributed to the ShinyHunters group that accessed a legacy third party cloud storage system used for internal operational documents and merchant onboarding materials and affected less than 25 percent of the companys current merchant base, while the live payment platform and payment card information were not compromised. The attackers exfiltrated data and issued a ransom demand, and Checkout.com publicly apologized, refused to pay, and pledged to donate the ransom amount to Carnegie Mellon University and the University of Oxford Security Center to support cybercrime research. The breach was caused by a legacy system that had not been fully decommissioned, illustrating how forgotten, unmonitored, misconfigured, or unpatched legacy systems become liabilities. Organizations are advised to perform pre mortem exercises to discover forgotten systems, remove stale credentials, and bring all platforms into security monitoring to prevent similar incidents.
Google Play Store to Show Warning for Power-Hungry Apps

gbhackers.com · 8 months ago

Starting March 1, 2026, Google will display warnings on Play Store listings and reduce visibility for apps that fail to meet new battery efficiency standards. A new core vitals metric called excessive partial wake locks is now available in Android Vitals and was developed with Samsung to identify apps that hold more than two cumulative hours of non exempt wake locks within 24 hours, and an app is deemed to cross the bad behavior threshold when five percent of its user sessions over the past 28 days are excessive. Google has added a Wake Lock Names table to Android Vitals to show tags and durations, recommends investigating wake locks with 90th or 99th percentile durations exceeding 60 minutes, and warns that apps failing the threshold may be excluded from prominent discovery surfaces and show battery drain warnings on their store listings.
Authorities Dismantle Thousands of Servers from Illicit Hosting Company Linked to Cyberattacks

gbhackers.com · 8 months ago

Law enforcement in the East Netherlands conducted a coordinated takedown of a rogue hosting company, seizing about 250 physical servers in data centers across The Hague and Zoetermeer and effectively dismantling thousands of virtual servers. The provider marketed itself as a bulletproof host promising anonymity and noncooperation with authorities while operating as a dedicated criminal enterprise. Investigators linked the infrastructure to more than 80 criminal investigations since 2022 and found it supporting ransomware operations, botnets, phishing campaigns, and the distribution of child sexual abuse material. Authorities prioritized disrupting active operations, preserving evidence for prosecutions, and launching extensive forensic analysis to map connected networks and identify additional targets.
Microsoft Mitigates Record 15.72 Tbps DDoS Attack Driven by AISURU Botnet

thehackernews.com · 8 months ago

Microsoft automatically detected and neutralized a distributed denial of service attack against a single public IP in Australia that reached 5.72 terabits per second and nearly 3.64 billion packets per second, making it the largest cloud DDoS observed to date. The attack used extremely high rate UDP floods launched from over 500,000 source IPs with minimal source spoofing and random source ports, which aided traceback and provider enforcement. Traffic was attributed to an AISURU TurboMirai class IoT botnet powered by roughly 300,000 infected routers, security cameras, and DVR systems that also supports residential proxy services and other illicit functions including credential stuffing and AI driven web scraping. Although some command and control infrastructure appears rendered inoperable, compromised devices remain vulnerable and attackers can scale attacks as home internet speeds and IoT device capabilities increase.
W3 Total Cache Security Vulnerability Exposes One Million WordPress Sites to RCE

gbhackers.com · 8 months ago

A critical unauthenticated command injection vulnerability in the W3 Total Cache WordPress plugin can allow attackers to execute arbitrary PHP and take full control of affected sites, exposing more than one million installs. The flaw is tracked as CVE-2025-9501, has a CVSS score of 9.0, affects versions before 2.8.13 and is fixed in version 2.8.13 and later. Attackers can exploit the vulnerability by posting malicious code inside a comment to abuse the parsedynamicmfunc function, requiring no authentication and enabling remote code execution. Site owners should update to W3 Total Cache version 2.8.13 or newer immediately, review logs and comments for suspicious activity, and ensure backups and other security measures are in place.
Threat Actors Use Compromised RDP to Deploy Lynx Ransomware After Deleting Backups

gbhackers.com · 8 months ago

A threat actor executed a nine day multi stage ransomware campaign after logging in via compromised Remote Desktop Protocol credentials to infiltrate a corporate network, escalate privileges, create persistent privileged accounts, and conduct hands on reconnaissance. Over several days the actor used SoftPerfect Network Scanner and NetExec to enumerate domain controllers, hypervisors, file servers and shares, compressed sensitive data with 7 Zip and exfiltrated large archives via a temporary file sharing service. On day nine the actor deleted Veeam backup jobs and removed backups from the configuration database before deploying Lynx ransomware executable w.exe across backup and file servers, targeting E drives, using a fast encryption mode that affected approximately five percent of files and suppressing printer ransom notes. Activity originated from IP addresses hosted on Railnet LLC infrastructure linked to a Russia based bulletproof hosting provider, and defenders are urged to enforce multi factor authentication on RDP, maintain offline backup redundancy, and implement strong credential hygiene to mitigate similar attacks.
Chrome 142 Update Patches Exploited Zero-Day

www.securityweek.com · 8 months ago

Google rolled out an emergency Chrome 142 update to address a zero day tracked as CVE-2025-13223, a high severity type confusion flaw in the V8 JavaScript and WebAssembly engine with a CVSS score of 8.8 that Google says is being exploited in the wild. The vulnerability was reported to Google by Clément Lecigne of the Threat Analysis Group on November 12 and is believed to have been targeted by a commercial spyware vendor, with type confusion bugs in V8 potentially enabling crashes, remote code execution, or read and write primitives via crafted HTML. The update also resolves CVE-2025-13224, another V8 type confusion reported by the Big Sleep AI agent that Google did not say was exploited, and Chrome 142 is rolling out as versions 142.0.7444.175 and 142.0.7444.176 across Linux, macOS, and Windows.
Imunify AI-Bolit Flaw Allows Arbitrary Code Execution and Root Privilege Escalation

gbhackers.com · 8 months ago

A critical flaw in the AI-Bolit malware scanner used by Imunify360, ImunifyAV+, and ImunifyAV allowed crafted files or database entries to trick the deobfuscation logic into executing attacker controlled PHP code, enabling arbitrary code execution and potential root privilege escalation. Imunify released a patch on October 23, 2025 that implements a strict allowlist and versions 32.7.4-1 and later resolve the issue, with a CentOS 6 backport identified as 32.1.10-2.32.7.4, and most servers were automatically updated by November 17, 2025; administrators are advised to upgrade immediately or disable file and database scans until the fix is applied. The vulnerability was reported through responsible disclosure by researcher Aleksejs Popovs, no evidence of exploitation has been observed in the wild to date, and a CVE identifier is pending.
Rethinking identity for the AI era: CISOs must build trust at machine speed

www.csoonline.com · 8 months ago

CISOs are facing a burgeoning identity crisis as stolen credentials and compromised identities now drive a large share of intrusions, with research showing stolen credentials triggered 22 percent of intrusions and 88 percent of basic web application attacks, and 57 percent of cyberattacks in 2024 began with compromised identities. Traditional human centric identity models were built for people, not thousands of autonomous AI agents or rapid machine to machine API interactions, creating a machine identity problem that will overwhelm static username and role approaches and require cryptographically provable identities, dynamic fine grained authorization, explicit delegation, revocation, and just in time access. An AI Trust Fabric is proposed to unify siloed identity systems and mitigate AI specific risks including CI CD pipeline poisoning, prompt injection, AI takeover, data poisoning, model and training data disclosure, and model extraction, with prompt injection flagged as the most imminent risk, and organizations are advised to fix basic security hygiene and governance first and then automate identity controls and decision making.
Mapping Remcos RAT C2 Activity and Associated Communication Ports

gbhackers.com · 8 months ago

Remcos is a commercial remote access tool marketed as remote administration software that is routinely weaponized for unauthorized access and data theft, and Censys tracking between October 14 and November 14, 2025 identified over 150 active Remcos command and control servers distributed across the United States, the Netherlands, Germany and other countries. Remcos communicates primarily over HTTP and HTTPS with default port 2404 most commonly used while operators also employ ports 5000, 5060, 5061, 8268, 8080 and standard ports 80 and 443 to blend with legitimate traffic, and network defenders can detect beacons by spotting characteristic encoded POST bodies and atypical TLS settings. Operators establish persistence via Scheduled Tasks and Run registry entries, often reuse SSL certificates across multiple IPs and expose services such as SMB and RDP, and recommended mitigations include application allowlisting, restricting Scheduled Task creation, monitoring HKCU Software Microsoft Windows CurrentVersion Run registry modifications, and prioritizing monitoring for HTTP and HTTPS beacons on ports 2404, 5000, 5060, 5061, 8268 and 8080.
Chrome Zero-Day Type Confusion Flaw Actively Exploited in the Wild

gbhackers.com · 8 months ago

There is a critical zero day type confusion vulnerability in Chrome's V8 JavaScript engine tracked as CVE-2025-13223 that is being actively exploited, prompting Google to release an urgent security update. A second V8 type confusion issue CVE-2025-13224 was also fixed in the release though it has not been observed exploited, with fixes shipped in Chrome versions 142.0.7444.175 and 142.0.7444.176 for Windows Mac and Linux. CVE-2025-13223 was discovered by Clément Lecigne of Google’s Threat Analysis Group on November 12, 2025 and users and organizations are strongly urged to update immediately to mitigate risks of arbitrary code execution and memory corruption.
Lazarus APT Group’s New ScoringMathTea RAT Enhances Remote Command Execution and More

gbhackers.com · 8 months ago

There is a new Remote Access Trojan called ScoringMathTea deployed by the Lazarus APT group as part of Operation DreamJob, targeting uncrewed aerial vehicle manufacturers and drone technology suppliers supporting Ukraine. ScoringMathTea is a modular DLL that initializes a thread on execution and implements API hashing, custom string deobfuscation, reflective DLL injection, PEB walking, and a three layer plugin loader that maps and executes plugins in memory via an exported function named exportfun to avoid writing to disk. Its C2 communications blend with legitimate HTTPS traffic by spoofing User Agent strings, using Base64 plus TEA and XTEA encryption in CBC mode with optional compression, stripping HTTP headers, sending pseudo random beacon payloads with a 60 second heartbeat, and employing CRC32 checks and anti debugging measures. Organizations in aerospace, defense, and critical infrastructure are advised to increase behavioral monitoring, threat hunting, and inspection of unusual HTTP and HTTPS traffic patterns to detect this evasion focused malware.
Massive 15 Tbps DDoS Attack From 500K Devices Slams Azure Network

gbhackers.com · 8 months ago

Microsoft Azure defended against a record breaking distributed denial of service attack that peaked at 15.72 terabits per second on October 24, 2025, targeting a single endpoint in Australia. The multi vector assault originated from the Aisuru botnet, involved more than 500,000 compromised devices and generated nearly 3.64 billion packets per second using high rate UDP floods from home routers and cameras. Attackers used random source ports and minimal source spoofing which simplified traceback, while Azure's globally distributed DDoS Protection automatically detected, filtered, and redirected the malicious traffic to maintain uninterrupted service availability. Security experts warn that faster consumer internet and increasingly powerful but poorly secured IoT devices will likely raise the baseline for attack sizes and advise organizations to implement and regularly test automated DDoS protections.
UNC1549 Hackers With Custom Tools Attacking Aerospace and Defense Systems to Steal Logins

gbhackers.com · 8 months ago

There are findings that the Iran nexus cyber espionage group UNC1549 has significantly expanded custom tools and sophisticated techniques since mid 2024 to target aerospace aviation and defense industries, with overlaps to Tortoiseshell and suspected links to the Islamic Revolutionary Guard Corps. UNC1549 combines highly targeted spear phishing with exploitation of trusted third party relationships by abusing Citrix VMWare and Azure Virtual Desktop services to compromise suppliers and pivot to protected defense contractors. The group uses a bespoke toolkit including TWOSTROKE LIGHTRAIL DEEPROOT GHOSTLINE POLLBLEND and credential theft tools such as DCSYNCER.SLICK CRASHPAD SIGHTGRAB and TRUSTTRAP while leveraging DLL search order hijacking signed binaries Azure Web Apps SSH reverse tunnels ZEROTIER and NGROK for resilient command and control and long term persistence.
Google Issues Security Fix for Actively Exploited Chrome V8 Zero-Day Vulnerability

thehackernews.com · 8 months ago

Google released security updates for Chrome to address two type confusion vulnerabilities in the V8 JavaScript and WebAssembly engine, including one under active exploitation identified as CVE-2025-13223 with a CVSS score of 8.8 that can enable arbitrary code execution or program crashes. The update also patches CVE-2025-13224, another V8 type confusion bug with a CVSS score of 8.8, and brings fixes for seven zero day flaws addressed this year including CVE-2025-2783, CVE-2025-4664, CVE-2025-5419, CVE-2025-6554, CVE-2025-6558, and CVE-2025-10585. Users should update Chrome to versions 142.0.7444.175 or 142.0.7444.176 on Windows, 142.0.7444.176 on macOS, or 142.0.7444.175 on Linux, and operators of other Chromium based browsers should apply vendor patches when available.
CISA Reports Active Attacks on FortiWeb WAF Vulnerability Allowing Admin Access

gbhackers.com · 8 months ago

CISA added a critical Fortinet FortiWeb vulnerability, tracked as CVE-2025-64446, to its Known Exploited Vulnerabilities catalog and warned the flaw is being actively exploited in the wild. The vulnerability is a relative path traversal categorized under CWE-23 that allows unauthenticated attackers to send crafted HTTP or HTTPS requests to gain administrative access and execute administrative commands on affected FortiWeb devices. CISA added the entry on November 14, 2025, directed federal agencies under Binding Operational Directive 22-01 to apply vendor mitigations by November 21, 2025, and advised all organizations to prioritize remediation by applying Fortinet patches, following applicable guidance, discontinuing affected products if mitigations are unavailable, reviewing access logs, and implementing network segmentation.
Microsoft fixes Windows 10 update flaw

www.csoonline.com · 8 months ago

There are reports that Windows 10 update KB5068781 for 22H2 builds 19044.6575 and 19045.6575 may fail to install on some commercial devices enrolled for Extended Security Updates, producing error 0x800f0922 CBSEINSTALLERSFAILED on devices activated via Windows subscription activation through the Microsoft 365 admin center. Microsoft said the problem was fixed on November 17 2025 by KB5072653, an Extended Security Updates Licensing Preparation Package, and that installing that package will allow the November 11 2025 security update KB5068781 to be deployed. IT administrators are advised to ensure the latest servicing stack update is installed and to run the Windows Update Troubleshooter, to perform a clean boot to disable non Microsoft services if needed, to manually install the KB5068781 MSU using wusa if installation still fails, and to verify via winver that the build reached 19045.6575 or 19044.6575.
Microsoft: Windows 10 KB5072653 OOB update fixes ESU install errors

www.bleepingcomputer.com · 8 months ago

Microsoft released an emergency out of band update KB5072653 to fix installation failures that prevented the November extended security updates from installing, resolving error 0x800f0922. KB5072653 is a preparation package that enables deployment of the November 2025 ESU update KB5068781 on Windows 10 devices running 22H2 that have the October 2025 cumulative update KB5066791 installed. After installing KB5072653 and restarting, users should rerun Windows Update to complete the ESU installation. Some administrators report WSUS and SCCM are not correctly showing compliance, and Microsoft will publish an updated Scan Cab with metadata to address those checks.
Malicious NPM packages abuse Adspect redirects to evade security

www.bleepingcomputer.com · 8 months ago

Seven packages on the Node Package Manager registry were published under the developer name dinoreborn between September and November and use the Adspect cloud service to separate researchers from potential victims and redirect qualifying visitors to fake cryptocurrency branded CAPTCHA pages that lead to scam sites. Six of the packages contain malicious JavaScript that fingerprints visitors, blocks analysis actions such as right click and DevTools, forwards real visitor IPs to Adspect for classification, and opens Adspect defined URLs in a new tab while showing a benign decoy to suspected researchers. The affected packages are signals-embed, dsidospsodlks, applicationooks21, application-phskck, integrator-filescrypt2025, integrator-2829, and integrator-2830.
RondoDox botnet malware now hacks servers using XWiki flaw

www.bleepingcomputer.com · 8 months ago

RondoDox botnet malware is exploiting a critical remote code execution flaw in XWiki Platform tracked as CVE-2025-24893, which CISA marked as actively exploited on October 30, 2025. Attackers send specially crafted HTTP GET requests that inject base64 encoded Groovy code into the XWiki SolrSearch endpoint to download and execute a first stage script named rondo..sh, which retrieves the main RondoDox payload. Researchers observed exploitation activity beginning November 3, with additional incidents including cryptocurrency miner deployments and attempts to establish bash reverse shells, alongside widespread scanning using Nuclei and Groovy injection probes. The vulnerability impacts XWiki versions before 15.10.11 and 16.4.1, and administrators are advised to apply the provided updates immediately and block known indicators of compromise associated with RondoDox.
Eurofiber France warns of breach after hacker tries to sell customer data

www.bleepingcomputer.com · 8 months ago

Eurofiber France disclosed a data breach discovered late last week after attackers exploited a vulnerability in its ticket management system and exfiltrated information. The incident affected only the French division, including the cloud ATE portal and regional sub brands Eurafibre, FullSave, Netiwan and Avelia. Eurofiber said banking details and other critical data on its other systems were not affected, and that the ticketing platform and the ATE portal were placed under enhanced security, the vulnerability was patched, and additional measures were implemented. A threat actor calling ByteToBreach claimed to hold data from ten thousand businesses and some government entities, alleging files included screenshots, VPN configuration files, credentials, source code, certificates, archives, email files and SQL backups, and the company notified CNIL and ANSSI and filed an extortion report.
Critical Fortinet FortiWeb WAF Bug Exploited in the Wild

www.darkreading.com · 8 months ago

A critical Fortinet FortiWeb web application firewall vulnerability allows an unauthenticated attacker to remotely execute administrative commands via crafted HTTP or HTTPS requests. The flaw is a relative path traversal in the GUI API handler that can expose a privileged CGI endpoint and be used to create accounts, modify configurations, or execute privileged API commands. The issue affects FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11 and is tracked as CVE-2025-64446 with a CVSS score of 9.1; customers are advised to upgrade to fixed versions or disable HTTP and HTTPS on Internet facing interfaces if they cannot patch immediately. The vulnerability has been observed exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities catalog.
US Citizens Plead Guilty to Aiding North Korean IT Worker Campaigns

www.darkreading.com · 8 months ago

Five individuals pleaded guilty, including four U.S. citizens, for helping North Korean IT workers obtain employment at U.S. companies by providing false identities and remote access. They hosted employer-owned laptops, installed unauthorized remote access software to mask worker locations, and in some cases impersonated employees during vetting and drug testing. The operations allowed DPRK-aligned actors to steal sensitive data and intellectual property and to generate funds for the regime, and authorities seized more than 15 million USDT linked to APT38. The defendants face charges including wire fraud conspiracy and aggravated identity theft, and experts urge tighter vetting and issuing restricted, bare bones devices to new hires.
Pennsylvania attorney general says SSNs stolen during August ransomware attack

therecord.media · 8 months ago

There are reports that a ransomware attack discovered on August 9, 2025 exposed names, Social Security numbers, and medical information from the Pennsylvania Office of the Attorney General, and the office notified individuals by email on November 14, 2025 while saying it has no evidence of misuse. The incident took down the office website, phone lines, and email systems for about a month, forcing courts to grant time extensions and staff to use alternate methods to conduct work. Researchers attributed the intrusion to internet exposed Citrix NetScaler vulnerabilities including CVE-2025-5777, the event was claimed by the INC ransomware gang, and the office has notified the Federal Bureau of Investigation.
Princeton University discloses data breach affecting donors, alumni

www.bleepingcomputer.com · 8 months ago

A Princeton University database was compromised on November 10, 2025 after attackers targeted a university employee with a phishing attack that allowed access to fundraising and alumni engagement records. The breach likely exposed names, email addresses, telephone numbers, and home and business addresses for alumni, donors, parents, current students, faculty, and staff, but did not include Social Security numbers, passwords, or financial account information. University officials say they blocked the attackers' access, believe other systems were not accessed, and are urging potentially affected individuals to verify any communications requesting sensitive information before responding.
Logitech discloses data breach after Clop claims

therecord.media · 8 months ago

There was a cybersecurity incident disclosed to the SEC in which hackers exploited a zero day vulnerability in a third party software platform and copied certain data from Logitech’s internal IT system. The data likely included limited information about employees and consumers and data related to customers and suppliers, but Logitech said sensitive personal information such as national ID numbers or credit card data was not housed in the impacted system and that products, operations, and manufacturing were not affected. The filing came after claims by the Clop extortion group that it stole information via a zero day in Oracle E Business Suite, though Logitech declined to confirm Clop or Oracle E Business Suite involvement and security firms reported the campaign used multiple Oracle E Business Suite vulnerabilities including at least one zero day added to a federal watchlist.
Dutch police seizes 250 servers used by “bulletproof hosting” service

www.bleepingcomputer.com · 8 months ago

Dutch police seized around 250 physical servers located in data centers in The Hague and Zoetermeer during an operation on November 12, 2025, taking thousands of virtual servers offline. The hosting service advertised complete anonymity, operated no KYC and no logs policies, and has been linked since 2022 to more than eighty domestic and international cybercrime investigations involving ransomware, botnets, phishing, money laundering, and child abuse content. Investigators are conducting forensic analysis of the seized infrastructure to identify operators and clients, and no arrests have been announced. Sources indicate the provider may have been CrazyRDP, and the action coincided with a phase of Operation Endgame that disrupted the Rhadamanthys, VenomRAT, and Elysium malware operations while Dutch authorities also carried out related searches that seized additional servers and domain names.
N-able N-central: From N-days to 0-days

www.reddit.com · 8 months ago

N-able N-central contained authenticated remote code execution vulnerabilities via insecure deserialization and command injection that were listed in CISA known exploited vulnerabilities as CVE-2025-8875 and CVE-2025-8876 and were patched in release 2025.3.0.14 on July 15, 2025. Further investigation uncovered critical flaws that allowed unauthenticated interaction with legacy APIs to read sensitive files and leak credentials that permitted compromise of the N-central database holding domain credentials, user API keys, integrated device and service API keys, and SSH private keys. The additional reported vulnerabilities were assigned CVE-2025-9316 for an authentication bypass via a weak authentication method and CVE-2025-11700 for an authenticated XML external entity information leak. Approximately three thousand internet-facing instances were observed, increasing risk to managed service providers and enterprise customers.
AT&T’s $177M Breach Settlement Deadline Nears — Are You Entitled to a Payout?

www.techrepublic.com · 8 months ago

There is a 177 million dollar settlement after two data breaches exposed sensitive information from tens of millions of AT and T customers, including a 2019 account file leak that revealed passcodes and identifiers tied to 7.6 million current and 65.4 million former customers and a 2022 to 2023 cloud incident that exposed call detail metadata for nearly all active subscribers. The settlement separates claimants into the older account file group and the cloud records group, allows people in both incidents to seek benefits from each fund, and covers account owners line users and end users whose phone numbers or interaction data appeared in the exposed files. Payouts include up to 5,000 dollars for documented losses or tiered cash payments for the older leak with Tier 1 for Social Security number exposure paying five times more than Tier 2, and up to 2,500 dollars in documented losses or a Tier 3 pro rata payment for the cloud records incident. Claim submissions must be filed by December 18, 2025, opt outs or objections are due November 17, 2025, and a federal judge will hold a final approval hearing on January 15, 2026 in the Northern District of Texas.
Kamel Ghali on what's 'theoretically possible' in car hacking

therecord.media · 8 months ago

Kamel Ghali, a veteran white hat vehicle hacker and penetration tester, warns that as cars become computers on wheels they inherit software vulnerabilities that can enable eavesdropping, theft of data from head units, ransomware, or in rare worst cases manipulation of safety critical functions. He says reverse engineering and the expansion of remote updates and connected services increase attack surfaces, and that he is now also focusing on vulnerabilities in electric vehicle chargers and charging infrastructure. The industry has made progress by adopting network segmentation and zero trust practices to separate infotainment from safety critical systems, and regulators in Europe and Japan now require incident response plans and long term software support for vehicles while the United States has not enacted equivalent federal requirements yet.
Kenyan gov't websites back online after hackers deface pages with white supremacist messages

therecord.media · 8 months ago

A cyberattack on November 17, 2025 temporarily defaced multiple Kenyan government ministry websites with white supremacist slogans and rendered several sites inaccessible. Attackers replaced pages on the ministries of interior health education energy labour and water and posted slogans including We will rise again White power worldwide and the numeric string 14 88 followed by Heil Hitler. Kenya's Interior Ministry said the attack is suspected to have been carried out by a group identifying as PCP at Kenya and that incident response teams including National KE CIRT were activated to contain the breach and restore access. Authorities said the situation has been contained systems are under continuous monitoring and the incident occurred one day after a separate cyberattack on Somalia's immigration systems was reported.
Princeton University says database containing donor, alumni info breached

therecord.media · 8 months ago

A database containing personal information for Princeton University donors, alumni, students, faculty, and parents was breached on November 10, 2025. The intruder was in the database for less than 24 hours and it is unclear what information was viewed. Stored fields include names, email addresses, telephone numbers, home and business addresses, and donation information, while Social Security numbers, passwords, and payment account numbers are not generally stored. No systems other than the advancement database were accessed and the incident follows other recent Ivy League data breaches.
Microsoft: Azure hit by 15 Tbps DDoS attack using 500,000 IP addresses

www.bleepingcomputer.com · 8 months ago

There was a 15.72 terabits per second DDoS attack against Microsoft Azure launched from over 500,000 IP addresses, using extremely high rate UDP floods that reached nearly 3.64 billion packets per second and targeted a public IP in Australia. The attack was attributed to the Aisuru botnet, a Turbo Mirai class IoT botnet that exploits compromised home routers and cameras and that used minimal source spoofing and random source ports, which simplified traceback and provider enforcement. Aisuru has been linked to other record DDoS incidents including a 22.2 terabits per second event that reached 10.6 billion packets per second and was previously observed controlling hundreds of thousands of bots after operators breached a TotoLink router firmware update server in April 2025 to infect roughly 100,000 devices. The botnet exploits vulnerabilities in IP cameras, DVRs, Realtek chips, and routers from vendors including T Mobile Zyxel D Link and Linksys and was also used to flood DNS queries to boost malicious domain rankings, prompting DNS providers to redact suspected domains.
The Crypto Industry’s $28 Billion in ‘Dirty Money’

www.nytimes.com · 8 months ago

As President Trump has championed cryptocurrency and the industry has moved into the mainstream, funds from scammers and other criminal groups have flowed onto major crypto exchanges.
Collaborative research by Microsoft and NVIDIA on real-time immunity

techcommunity.microsoft.com · 8 months ago

Microsoft and NVIDIA report they developed a GPU accelerated adversarial learning pipeline that reduces end to end inference latency from about 1,239 milliseconds on CPU to as low as 7.67 milliseconds with GPU optimizations, boosting throughput from 0.81 requests per second to over 130 requests per second. The improvements came from NVIDIA Triton and TensorRT optimizations, fused custom CUDA kernels, and a domain specific tokenizer that cut tokenization latency by 3.5 times, while maintaining greater than 95 percent detection accuracy on adversarial benchmarks. The collaboration aims to deploy transformer based classifiers for real time inline adversarial detection at enterprise scale to counter AI driven threats that evolve faster than static rule based tools. Future work will explore advanced model architectures, quantization, and further acceleration techniques to broaden adversarial learning in practical cybersecurity applications.
New EVALUSION ClickFix Campaign Delivers Amatera Stealer and NetSupport RAT

thehackernews.com · 8 months ago

Security researchers observed malware campaigns using the ClickFix social engineering tactic to deliver Amatera Stealer and NetSupport RAT, an activity tracked as EVALUSION. Amatera, first seen in June 2025 and assessed as an evolution of ACR Stealer, is sold by subscription and employs advanced evasion such as WoW64 system calls to harvest crypto wallets, browsers, messaging apps, FTP clients, and email. The attacks trick victims into running commands via the Windows Run dialog that invoke mshta to launch PowerShell, download a.NET DLL from a file hosting service, execute an Amatera DLL packed with PureCrypter that is injected into MSBuild.exe to exfiltrate data, and then conditionally fetch NetSupport RAT when valuable targets are detected while related phishing kits and obfuscation techniques are used to spread additional malware.
DoorDash email spoofing vulnerability sparks messy disclosure dispute

www.bleepingcomputer.com · 8 months ago

There is a vulnerability in DoorDash for Business that allowed anyone to send fully branded emails from the company no reply address by creating a free account, adding an employee with an arbitrary email, and injecting HTML through a budget name field that was stored raw and rendered in outgoing messages. The flaw was disclosed by a pseudonymous researcher known as doublezero7, a HackerOne report on the issue was closed as informative in July 2024, the vulnerability remained exploitable for about 15 months, and DoorDash patched it in early November 2025 after the researcher escalated the report. A public dispute erupted with DoorDash saying the researcher attempted to extort payment and banning them from its bug bounty program while the researcher says the company ignored the report and silently patched the flaw, and HackerOne said it reviewed the matter and confirmed actions consistent with its policy.
Pennsylvania AG confirms data breach after INC Ransom attack

www.bleepingcomputer.com · 8 months ago

A ransomware attack discovered on August 9, 2025 encrypted systems at the Pennsylvania Office of the Attorney General, taking down the office website, employee email, and landline phones, and the office refused to pay the ransom. The office later confirmed threat actors accessed files that may have contained names, Social Security numbers, and medical information, and the INC Ransom gang claimed responsibility on September 20, 2025, alleging they stole 5.7 terabytes of files and accessed an FBI internal network. Researcher Kevin Beaumont found public facing Citrix NetScaler appliances on the agency network that were vulnerable to a critical flaw tracked as CVE-2025-5777 known as Citrix Bleed 2, which may have been exploited in the incident.
A Cracker Barrel vulnerability

www.reddit.com · 8 months ago

A vulnerability in the Cracker Barrel rewards admin portal allowed access by changing the initial isAuthenticated value to true in the compiled React JavaScript, effectively bypassing authentication. The backend API accepted requests without an authorization token, which let the researcher view and manage reward peg values while no sensitive customer data was exposed and no write actions were performed. The issue was reported to a third party vulnerability disclosure program on October 25, 2025, and Cracker Barrel had fixed the vulnerability by November 17, 2025.
Cursor Issue Paves Way for Credential-Stealing Attacks

www.darkreading.com · 8 months ago

Researchers at cybersecurity firm Knostic found a weakness in the AI powered coding environment Cursor that allows a malicious model context protocol server to hijack its embedded browser and inject JavaScript to harvest credentials. In a proof of concept, the researchers showed a malicious MCP can modify local extensions without integrity checks, overwrite the browser page via document.body.innerHTML, and cause every embedded tab to execute attacker code, enabling credential harvesting and potential workstation compromise. Cursor said the behavior is inherent to how the product works rather than a fixable flaw, so mitigations include strict vetting of MCP servers and extensions, avoiding auto run modes, and reviewing generated code before executing actions in the embedded browser.
Microsoft: Windows bug blocks Microsoft 365 desktop app installs

www.bleepingcomputer.com · 8 months ago

There is a known issue preventing installations of Microsoft 365 desktop apps on Windows caused by misconfigured authentication components, affecting Microsoft 365 desktop apps version 2508 build 19127.20358 and version 2507 build 19029.20294. Microsoft is reconfiguring the impacted authentication components and is rolling out two builds, with the fix for version 2508 validated and deploying and the fix for version 2507 expected to be validated by the next scheduled update before full deployment. The incident is tracked as OP1186186, and Microsoft is also addressing a separate issue tracked as MO1176905 that prevents some admins and users with Microsoft 365 Group SecurityEnabled set to false from accessing multiple Microsoft 365 services.