Blahalla

U.S. Congressional Budget Office hit by suspected foreign cyberattack

www.bleepingcomputer.com · 9 months ago

The U.S. Congressional Budget Office confirmed it suffered a cybersecurity incident after a suspected foreign hacker breached its network and said it acted quickly to contain the incident and implemented additional monitoring and security controls. Emails and exchanges between congressional offices and CBO analysts may have been exposed, and some congressional offices temporarily halted email communications with the CBO while the incident is investigated. The intrusion is connected to a broader campaign that also targeted the Committee on Foreign Investment in the United States and has been attributed to the Chinese state sponsored group known as Silk Typhoon, which previously exploited the ProxyLogon zero day flaws in Microsoft Exchange Server.
Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Unauthorized Access Vulnerability

sec.cloudapps.cisco.com · 9 months ago

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication. Cisco has released software updates that address this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW For more information on the vulnerability that is described in this advisory, see Cisco Event Response: Continued Attacks Against Cisco Firewall Platforms. <br/Security Impact Rating: Medium <br/CVE: CVE-2025-20362
Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Remote Code Execution Vulnerability

sec.cloudapps.cisco.com · 9 months ago

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device. Cisco has released software updates that address this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB For more information on the vulnerability that is described in this advisory, see Cisco Event Response: Continued Attacks Against Cisco Firewall Platforms. <br/Security Impact Rating: Critical <br/CVE: CVE-2025-20333
Cisco Secure Firewall Adaptive Security Appliance Software, Secure Firewall Threat Defense Software, IOS Software, IOS XE Software, and IOS XR Software Web Services Remote Code Execution Vulnerability

sec.cloudapps.cisco.com · 9 months ago

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details section of this advisory. Cisco has released software updates that address this vulnerability and strongly recommends that customers upgrade to a fixed software release. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O For more information on the vulnerability that is described in this advisory, see Cisco Event Response: Continued Attacks Against Cisco Firewall Platforms. <br/Security Impact Rating: Critical <br/CVE: CVE-2025-20363
AI-Slop ransomware test sneaks on to VS Code marketplace

www.bleepingcomputer.com · 9 months ago

There is a malicious extension named susvsex published by suspublisher18 on the VS Code marketplace that openly advertises file theft and AES-256-CBC encryption and appears to be the product of vibe coding and likely AI generated code according to Secure Annex researcher John Tuckner. On activation the extension runs extension.js with hardcoded variables including an IP address, encryption keys and a command and control address, creates a ZIP archive of targeted files, exfiltrates them to the hardcoded C2 and replaces the originals with encrypted versions while also polling a private GitHub repository for commands using a hardcoded personal access token. The researcher was able to access the repository and identify a likely owner location in Azerbaijan, Microsoft initially ignored the report and did not remove the extension but it was no longer available by the time the report was published.
Sora 2 Makes Videos So Believable, Reality Checks Are Required

www.darkreading.com · 9 months ago

OpenAI launched Sora 2 in September as an update to its audio and video generation model that can create eerily realistic videos from text prompts and images and is now broadly available, raising deepfake risks. The model produces more believable facial and voice mechanics including pregnant pauses and emotional components, making generated videos increasingly indistinguishable from reality and enabling threat actors to enhance social engineering for identity and financial fraud. OpenAI added a watermark but experts warn it can be worked around, leaving little reliable evidence to prove authenticity, so organizations are urged to adopt multi-prong defenses such as randomized likeness checks, multifactor authentication, device and location verification, and scrutiny of virtual backgrounds. Legal and healthcare sectors are highlighted as particularly vulnerable, and industry experts say regulations lag behind the technology with expectations that initial rules may begin to appear within the next twelve to eighteen months.
Edtech company fined $5.1 million for poor data security practices leading to hack

therecord.media · 9 months ago

State attorneys general announced on November 6, 2025 that Illuminate Education will pay a 5.1 million dollar fine and accept changes to settle allegations that poor security practices led to a 2021 data breach. The breach exposed student names, races, coded medical conditions, and whether students received special education accommodations, impacting students in 49 states and about three million in California. Officials said failures included retaining former employee login credentials, failing to monitor systems for suspicious activity, and storing backup and active databases on the same network so backups were also compromised. The company agreed to bolster access controls and account management, implement real time monitoring for suspicious activity, and stop storing backup databases in the same network as active databases; the case was brought by California Attorney General Rob Bonta alongside Connecticut and New York attorneys general.
SonicWall Firewall Backups Stolen by Nation-State Actor

www.darkreading.com · 9 months ago

Attackers stole SonicWall firewall configuration backup files from the MySonicWall cloud backup service, and a Mandiant investigation found the intrusion was carried out by a state sponsored threat actor and accessed backups for all customers who used the service despite earlier estimates of fewer than five percent. SonicWall said the unauthorized access was isolated to an API call against a specific cloud bucket and that there was no impact to products, firmware, source code, production networks, or other customer data, but the company did not specify which API or how it was abused. SonicWall and Mandiant said the attack vector was immediately mitigated, there is no evidence the stolen backup data has been used, and SonicWall has implemented remediation actions along with Secure by Design and zero trust initiatives. The incident is separate from ongoing Akira ransomware attacks targeting SonicWall devices and underscores the growing threat of API abuse and exposed secrets such as API keys.
How a ransomware gang encrypted Nevada government's systems

www.bleepingcomputer.com · 9 months ago

An after action report explains that initial access occurred on May 14 when a state employee followed a malicious search advertisement to a fake site and downloaded a trojanized system administration tool that installed a persistent backdoor. Attackers later used commercial remote monitoring software, a custom encrypted tunnel and Remote Desktop Protocol sessions to move laterally, stole credentials from the password vault for 26 accounts, wiped logs, deleted backup volumes on August 24 and deployed ransomware to servers hosting virtual machines at 08:30:18 UTC, impacting more than 60 state agencies. Nevada declined to pay a ransom and recovered about 90 percent of required data within 28 days, incurred approximately two hundred fifty nine thousand dollars in overtime and over one point three million dollars in external vendor costs, and has since tightened access, removed outdated accounts and certificates, and limited sensitive system privileges.
The rising tide of cyber attacks against the UK water sector

www.fortra.com · 9 months ago

Several UK water suppliers reported cybersecurity incidents over a two year period, with the Drinking Water Inspectorate receiving 15 notifications between January 2023 and late October 2024 and five confirmed as cybersecurity related. Those five incidents were described as affecting systems outside NIS scope, indicating they did not impact water treatment or supply but did affect business systems such as administration. Authorities have warned of persistent gaps across the water sector, including an EPA alert that more than seventy percent of inspected systems did not meet basic cybersecurity requirements, a GAO report highlighting long standing weaknesses, and CISA advisories that threat actors are targeting industrial control systems through unsecured remote access and default passwords. Experts say the most immediate risks are established threats such as ransomware and recommend robust network segmentation, monitoring for unusual lateral movement between IT and OT environments, and strict control of remote access to prevent business networks becoming pathways to operational systems.
EU Parliament committee votes to advance controversial Europol data sharing proposal

therecord.media · 9 months ago

Lawmakers in the European Parliament Civil Liberties Committee voted to advance a proposal that would expand data sharing between national governments and Europol and allow more extensive processing of biometric data to combat human trafficking and migrant smuggling. The committee will send the package to a full plenary vote later this month. Privacy and civil liberties advocates warn the changes could facilitate mass surveillance and large scale data privacy violations and say the move risks turning Europe toward a digital police state.
“Pay up or we share the tapes”: Hackers target massage parlour clients in blackmail scheme

www.bitdefender.com · 9 months ago

South Korean police uncovered a hacking operation that tricked massage parlour owners into installing malicious apps that siphoned customers' names, phone numbers, call logs and text messages, then blackmailed male clients by threatening to release alleged video footage. Police say 15 people were involved, the scheme began collecting customer details in January 2022 across Seoul, Gyeonggi and Daegu after nine business owners were tricked, and the gang set up an office in Nam District in Busan to exfiltrate data, pressure victims and launder proceeds. Thirty six victims paid between 1.5 million and 47 million Korean Won each and the gang attempted to extort nearly 200 million Korean Won in total, while arrests began in August 2023 and remaining suspects were later captured.
Italian communications executive reveals he was targeted with Paragon spyware

therecord.media · 9 months ago

A prominent Italian communications executive and political adviser was targeted with Paragon spyware, becoming the fifth Italian to come forward in a scandal that has shaken the Italian government. He was among about ninety people who received WhatsApp notifications that evidence indicated targeting with Paragon Graphite spyware. His firm worked on thirteen election campaigns in 2024 and he has a long history advising political candidates on communications. Italian authorities acknowledged using Paragon to attempt to spy on some of the five known Italian victims but denied involvement in the targeting of two journalists who reported infections.
Researchers Hack ChatGPT Memories and Web Search Features

www.securityweek.com · 9 months ago

Tenable researchers discovered seven vulnerabilities and attack techniques that allow attackers to steal data and manipulate ChatGPT features including memories openurl and urlsafe. SearchGPT which the model uses for browsing can execute prompts found on websites enabling prompt injection through blog comments malicious sites specially crafted query links and hidden content placed in code blocks. Threat actors can exploit a urlsafe bypass because bing.com is treated as a safe domain and use long Bing click tracking intermediary URLs to phish users or exfiltrate memories chat history and other user data. OpenAI has been informed and patched some issues but Tenable reports that some of these attack methods still work against the latest GPT 5 model.
Trojanized ESET Installers Drop Kalambur Backdoor in Phishing Attacks on Ukraine

thehackernews.com · 9 months ago

A previously unknown threat cluster impersonating Slovak cybersecurity vendor ESET has sent spear phishing emails and Signal messages to Ukrainian organizations since May 2025, delivering trojanized installers in a campaign attributed to a Russia aligned actor tracked as InedibleOchotense. The installers deploy the legitimate ESET AV Remover alongside a C sharp backdoor called Kalambur also known as SUMBUR that uses the Tor network for command and control and can drop OpenSSH and enable Remote Desktop Protocol on port 3389. Researchers say the activity overlaps with Sandworm sub clusters and other campaigns that deployed backdoors and wipers, and a separate Russia aligned actor named RomCom exploited a WinRAR vulnerability tracked as CVE-2025-8088 with a CVSS score of 8.8 to deliver additional backdoors.
How A.I. and Social Media Contribute to ‘Brain Rot’

www.nytimes.com · 9 months ago

Studies find that using A.I. search tools, chatbots, and heavy social media consumption is associated with lower cognitive performance, including reduced attention, memory, creativity, and executive control. An MIT study using EEG compared ChatGPT users, Google search users, and people working without tools and reported that ChatGPT users showed the weakest neural engagement, lower executive control, and poorer essay quality and retention. Controlled experiments that trained language models on high-engagement or low-quality social media text produced measurable declines in reasoning, long-context understanding, and ethical alignment, prompting calls for stricter data curation and routine cognitive health monitoring for A.I. systems.
LeakyInjector and LeakyStealer Duo Hunts For Crypto and Browser History

www.reddit.com · 9 months ago

A new two stage malware named LeakyInjector and LeakyStealer targets cryptocurrency wallets and browser history across multiple browsers and wallet extensions. The injector decrypts a ChaCha20 encrypted stealer and injects it into explorer.exe to establish persistence via a Run registry entry, while the stealer uses a polymorphic engine to collect system identifiers, harvest browser history and wallet files including Electrum, Exodus, MetaMask and Ledger Live, and beacon to a hard coded command and control server at 45.151.62.120. Samples were signed with a valid Extended Validation code signing certificate tied to Hefei Nudan Jukuang Network Technology, multiple samples shared the same certificate thumbprint, and the certificate was later revoked.
Continuous Purple Teaming: Turning Red-Blue Rivalry into Real Defense

www.bleepingcomputer.com · 9 months ago

Red and blue teams often operate in silos, producing unvalidated findings and noise while attackers evolve faster than defenses can coordinate. Purple teaming aligns offensive and defensive work into a continuous loop of attack, observation, fix, and validation, and Breach and Attack Simulation platforms automate that loop by safely emulating real adversary tactics, techniques, and procedures mapped to the MITRE ATT&CK framework and instantly scoring prevention, detection, and response. That evidence driven approach lets teams prioritize remediation based on impact, detectability, and business context, deprioritizing vulnerabilities already mitigated by controls and measuring improvements with metrics such as time to detect and percentage of TTPs detected. AI can speed threat mapping and plan generation but payloads must be curated and human reviewed, and sustained BAS powered purple teaming yields continuous confidence, validated mitigations, and fewer hypothetical debates.
Cisco Warns of New Firewall Attack Exploiting CVE-2025-20333 and CVE-2025-20362

thehackernews.com · 9 months ago

There is a new attack variant that targets Cisco Secure Firewall ASA and FTD devices vulnerable to CVE-2025-20333 and CVE-2025-20362 and can cause unpatched systems to unexpectedly reload, producing denial of service. Both vulnerabilities were disclosed in late September 2025 and were previously exploited as zero days in malware campaigns including RayInitiator and LINE VIPER, with CVE-2025-20333 enabling arbitrary code execution as root via crafted HTTP requests and CVE-2025-20362 allowing access to a restricted URL without authentication. Cisco also issued patches for related critical and high severity flaws identified as CVE-2025-20354, CVE-2025-20358 and CVE-2025-20343 and urged customers to apply updates immediately.
Nikkei-Daten über Slack-Konto eines Mitarbeiters geleakt

www.csoonline.com · 9 months ago

There was unauthorized access to Nikkei s Slack platform that may have exposed data for more than 17,000 employees and business partners, including names, email addresses and chat logs, and there is no confirmation that sources or journalistic activities were affected. Attackers gained access after infecting an employee s computer with malware and stealing Slack credentials, which were then used to access staff accounts. The incident was discovered in September and prompted the company to require password changes and take further remediation steps. This marks the third major cyber incident for Nikkei in six years, following a May 2022 ransomware attack on a Singapore branch and a September 2019 fraud that led to about 29 million dollars being transferred to a fraudulent account.
HTTP/2 ‘MadeYouReset’ Vulnerability Enable Denial-of-Service (DoS) Attacks

gbhackers.com · 9 months ago

There is a critical protocol level vulnerability in many HTTP slash two implementations tracked as CVE two zero two five dash eight six seven one and nicknamed MadeYouReset. It enables attackers to mount powerful denial of service and distributed denial of service attacks by exploiting a fundamental mismatch between the HTTP slash two specification and real world server implementations. Security researchers in Tel Aviv disclosed the issue and warned that numerous servers remain exposed until vendors patch their HTTP slash two stacks.
AI Browsers That Beat Paywalls by Imitating Humans

gbhackers.com · 9 months ago

AI browsers including OpenAI Atlas and Perplexity Comet can be prompted to retrieve and reproduce paywalled articles by imitating human browsing actions. They accomplish this by running agentic crawlers that interact with webpages like a real user, bypassing client side overlays and robots exclusions to access text that is visually hidden but present in the page. This capability poses an economic and legal threat to publishers and raises security and ethical concerns because the same automation can expose sensitive content or be manipulated into taking actions on behalf of users. Vendors have shown mixed results in testing and are making changes to agent behavior, but the phenomenon has already prompted calls for technical fixes and policy responses.
Truffle Security Raises $25 Million for Secret Scanning Engine

www.securityweek.com · 9 months ago

Truffle Security raised 25 million dollars in a Series B round, bringing total funding to more than 40 million dollars, with the round led by Intel Capital and a16z and supported by other investors. The investment will fund development of TruffleHog Enterprise and the launch of TruffleHog GCP Analyze, an enterprise grade secrets detection, verification, and remediation platform that scans for API keys, passwords, tokens, and non human identities across chat systems, support tickets, source code repositories, hidden content, deleted code, and version history. The GCP add on is designed to provide visibility into leaked Google Cloud service accounts, help prioritize and remediate the riskiest secrets, reduce mean time to response, and support scaling of go to market and customer success efforts.
ClickFix malware attacks evolve with multi-OS support, video tutorials

www.bleepingcomputer.com · 9 months ago

ClickFix campaigns have evolved to include embedded video tutorials that guide victims through pasting and executing malicious commands, a one minute countdown timer to pressure quick action, and automatic operating system detection that delivers OS specific instructions. Attackers present a fake Cloudflare CAPTCHA, use JavaScript to hide commands and copy them to the clipboard, and promote malicious pages via malvertising, compromised WordPress plugins, or SEO poisoning to deliver information stealer payloads that vary by operating system, including MSHTA and PowerShell based loaders. Researchers warn future ClickFix variants could run entirely in the browser to evade endpoint detection and advise never to execute copied terminal commands from a web page or online verification prompt unless you fully understand what they do.
Critical Bug in Midnight Ransomware Tool Unlocks File Recovery

gbhackers.com · 9 months ago

A new ransomware strain named Midnight has emerged using tactics similar to the Babuk family while introducing modified cryptographic routines. Security researchers first detected Midnight and found that some of its novel cryptographic changes contain a critical bug that can unintentionally allow victims to recover encrypted files. This flaw offers a rare opportunity for victims to reclaim data without paying ransom, though recovery will depend on the specifics of each infection and available backups.
Critical Cisco UCCX flaw lets attackers run commands as root

www.bleepingcomputer.com · 9 months ago

There are security updates for Cisco Unified Contact Center Express to fix a critical Java RMI vulnerability tracked as CVE-2025-20354 that allows unauthenticated attackers to execute arbitrary commands with root privileges. There are findings that the flaw stems from improper authentication which enables an attacker to upload a crafted file via Java RMI to run arbitrary operating system commands and gain root, and administrators are advised to upgrade to fixed releases including 12.5 SU3 ES07 and 15.0 ES01. There are additional related fixes and warnings covering a critical CCX Editor authentication bypass and other Cisco vulnerabilities such as CVE-2025-20343, CVE-2025-20374, CVE-2025-20375, CVE-2025-20376, CVE-2025-20377, CVE-2025-20333, and CVE-2025-20362, and there is no evidence so far of public exploit code or in-the-wild exploitation.
Iranian Hackers Exploit RMM Tools to Target Academics and Foreign-Policy Experts

gbhackers.com · 9 months ago

There is a newly identified Iranian linked threat cluster called UNKSmudgedSerpent that targeted academics and foreign policy experts between June and August 2025 using benign conversation openers and sophisticated social engineering. The threat actors used spoofed OnlyOffice and Microsoft Teams login pages hosted on health themed domains to harvest credentials and delivered ZIP archives containing MSI installers that launched legitimate remote monitoring and management software including PDQConnect and in some cases ISL Online. Tactics overlap with multiple Iranian groups labeled TA453 TA455 and TA450, preventing high confidence attribution, and observed hands on keyboard activity plus the sequential deployment of RMM tools indicate an intelligence collection objective.
Evading Elastic EDR's call stack signatures with call gadgets

www.reddit.com · 9 months ago

There is a technique that uses call gadgets to insert an arbitrary module into the thread call stack during module load, breaking the call stack signatures that Elastic EDR relies on to detect shellcode loading network libraries. A proof of concept modifies a thread pool callback to jump into a call then ret gadget found in a non flagged DLL, placing that DLL in the stack and preventing the targeted signature from matching, with successful tests against Elastic version 9.2.0 and a specific gadget found in dsdmo dot dll that was later removed in newer Windows updates. Elastic was notified and is working on updates to detection rules, while researchers warn the approach depends on finding stable gadgets across Windows versions and will not defeat other detection rules.
Cisco Confirms Active Exploitation of Secure ASA and FTD RCE Vulnerability

gbhackers.com · 9 months ago

There is a severe remote code execution vulnerability affecting Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense software that is being actively exploited, and on November 5, 2025 Cisco warned of a new attack variant that can fully compromise unpatched devices or cause them to unexpectedly reload. The flaws are tracked as CVE-2025-20333, a critical buffer overflow enabling unauthenticated remote code execution, and CVE-2025-20362, a missing authorization vulnerability that exposes restricted VPN web endpoints. Researchers and incident responders report widespread exploitation and thousands of internet-facing Cisco firewalls remain unpatched, increasing the risk of persistent compromise and data loss. Cisco and U.S. authorities recommend immediately upgrading to the fixed software releases listed in the advisories, monitoring for indicators of compromise, and disconnecting or isolating affected systems until they are remediated.
Russia’s Sandworm hackers deploying wipers against Ukraine’s grain industry

therecord.media · 9 months ago

Sandworm has been deploying data wiper malware against Ukraine's grain industry as well as energy, logistics, and government organizations, with operations observed between June and September 2025. ESET researchers identified two wipers called Zerolot and Sting that were used in April 2025 against a Ukrainian university and in subsequent waves against grain and energy firms, and they linked initial intrusions to another group known as UAC 0099 which then passed access to Sandworm. Western intelligence links Sandworm to Russia's GRU and points to a history of destructive operations including the 2015 Ukrainian power grid blackout and the 2017 NotPetya outbreak. Ukraine's cyber authorities warn these destructive cyberattacks are often coordinated with missile and drone strikes to amplify impact, and researchers say Sandworm has continued regular wiper operations since early 2025 while other Russia aligned groups like RomCom and Gamaredon target European entities connected to Ukraine.
Threat Actors Exploit VS Code Extensions for Ransomware via GitHub C2

gbhackers.com · 9 months ago

Kimsuky, a North Korean backed threat group, is exploiting Visual Studio Code extensions to deliver multi stage malware that first compromises developer tools and then fetches additional payloads. The attackers are using GitHub repositories and pages as command and control infrastructure to host and update malware, enabling deployments that can include ransomware and espionage capabilities against government entities and think tanks. Organizations are advised to verify extension publishers, audit installed extensions and repository activity, and apply stricter supply chain controls to reduce the risk of C2 abuse and malware distribution.
Flaw in React Native CLI opens dev servers to attacks

www.csoonline.com · 9 months ago

A critical remote code execution flaw in the React Native community CLI and its cli-server-api lets attackers run arbitrary operating system commands through the Metro development server used by React Native. The issue stems from an open URL HTTP endpoint that forwards unvalidated input to the open function in a third party package and from a misconfiguration that causes the server to bind to all network interfaces instead of only localhost. Exploitation is demonstrated on Windows with full operating system command execution, the flaw is tracked as CVE-2025-11953 with a CVSS score of 9.8, and it affects versions 4.8.0 through 20.0.0-alpha.2. The vulnerability is fixed in version 20.0.0 of cli-server-api and developers are advised to update immediately or reduce exposure by explicitly setting the development server host to 127.0.0.1.
Checkpoint Analysis: Dissecting the $128M Balancer Pool Drain in Under 30 Minutes

gbhackers.com · 9 months ago

On November 3, 2025 a sophisticated exploit drained approximately 128.64 million dollars from Balancer V2 ComposableStablePool liquidity across multiple blockchains in under thirty minutes. The root cause was arithmetic precision loss in the upscaleArray scaling routine and FixedPoint.mulDown integer division, which an attacker amplified by executing over sixty micro swaps inside atomic batchSwap transactions to artificially suppress BPT prices. The attacker used a constructor-based exploit that credited the exploit contract with large internal Vault balances and then withdrew those balances, moving thousands of WETH, osETH and wstETH, while Balancer paused vulnerable pools and some white hat teams recovered portions of the stolen funds. The breach caused a dramatic collapse in Balancer’s total value locked and underscored that multiple prior audits failed to anticipate cumulative rounding and composability attack vectors in V2.
Why supply chains are becoming increasingly vulnerable

www.reddit.com · 9 months ago

Organizations are increasingly at risk because attackers exploit suppliers as the weak link in sprawling IT supply webs that include SaaS providers, cloud vendors, software suppliers, and specialized partners. Typical supply chain risks include limited visibility into which suppliers have access, outdated or unsecured connections such as legacy VPN tunnels and hardcoded credentials, uneven security practices among vendors, and vulnerabilities introduced by third party and open source components. To reduce exposure, organizations should enforce least privilege and temporary credentials for supplier access, apply network segmentation and supplier-specific monitoring and logging, adopt Software Bill of Materials to track components, embed security and incident response obligations in contracts, perform periodic security reviews and tabletop exercises, and treat supply chain security as a strategic and regulatory imperative under frameworks such as NIS2 and DORA.
DeFi Protocol Balancer Starts Recovering Funds Stolen in $128 Million Heist

www.securityweek.com · 9 months ago

Hackers drained more than 120 million dollars in cryptocurrency from the DeFi protocol Balancer by exploiting a rounding bug in the upscale function of EXACTOUT transactions and abusing the batch swap feature. The attack at 07:48 UTC targeted Balancer V2 composable stable pools across multiple blockchains including Ethereum, Base, Avalanche, Gnosis, Berachain, Polygon, Sonic, Arbitrum, and Optimism and mainly affected pools that could not be paused. Attackers manipulated BPT price calculations by exploiting incorrect rounding that rounded down under certain conditions and used deferred settlements in batch swaps to temporarily keep exploited funds as internal balances before withdrawing them. Balancer paused pools that could be paused and is working with partners, researchers, exchanges, and whitehat teams to recover funds, with initial estimates of roughly 128 million dollars drained and community actions reducing losses by more than 20 million dollars.
Cisco UCCX Vulnerabilities Allow Remote Attackers to Execute Arbitrary Code

gbhackers.com · 9 months ago

Multiple critical vulnerabilities in Cisco Unified Contact Center Express allow unauthenticated remote attackers to upload arbitrary files, bypass authentication, execute arbitrary commands, and elevate privileges to root via the Java Remote Method Invocation process. The advisory lists CVE-2025-20354 and CVE-2025-20358 for the most severe issues with a CVSS base score of 9.8. Additional authenticated flaws in the web based management interface permit remote code execution, path traversal, and stored cross site scripting under CVE-2025-20276, CVE-2025-20277, CVE-2025-20279, and CVE-2025-20275. Cisco has released software updates to address these vulnerabilities and reports no available workarounds, so affected organizations should apply the patches immediately.
Airstalk Malware Exploits AirWatch MDM for Covert C2 Communication

gbhackers.com · 9 months ago

Security researchers have identified a sophisticated new malware family called Airstalk that exploits VMware AirWatch API now known as Workspace ONE Unified Endpoint Management to establish covert command and control channels. Both PowerShell and.NET variants were discovered, and researchers assess with medium confidence that the activity was a nation state sponsored supply chain attack. The discovery represents a significant threat to organizations that rely on the affected mobile device management platform.
Rigged Poker Games

www.schneier.com · 9 months ago

There are 31 people indicted by the Department of Justice for running a conspiracy that rigged high stakes poker games using altered shuffling machines that read every card and transmitted the deal order to an off site member who relayed it by cellphone to a player known as the Quarterback or Driver. The Quarterback signaled co conspirators at the table to act on that information, allowing the cheating team to win large sums from unwitting victims who sometimes lost tens or hundreds of thousands of dollars at a time. Prosecutors say the defendants also used a chip tray analyzer with hidden cameras, an x ray table that read face down cards, and contact lenses or eyeglasses that read pre marked cards.
From Tabletop to Turnkey: Building Cyber Resilience in Financial Services

thehackernews.com · 9 months ago

Financial institutions now face regulatory mandates that make cyber resilience and crisis management exercises compulsory under frameworks such as the EU Digital Operational Resilience Act, TIBER based rules like CORIE, Australia s CPS 230, Singapore s MAS TRM guidance, the UK s FCA and PRA operational resilience rules, the US FFIEC IT handbook, and Saudi Arabia s SAMA cybersecurity framework. Organizations are moving from simple tabletop exercises toward blended simulations that combine human communications with technical red team events, threat intelligence driven injects, and integrations with SIEM and EDR to create realistic, repeatable scenarios. Platforms that synchronize participants via identity sources, automate logistics, schedule long running campaigns, and provide libraries of ransomware and threat scenarios help demonstrate continual improvement for compliance and improve SOC and incident response readiness.
Nevada Ransomware Attack Started Months Before It Was Discovered, Per Report

www.securityweek.com · 9 months ago

There was a ransomware attack against Nevada that was discovered in August but began as early as May when a state employee on May 14 accidentally downloaded a malware laced administrative tool that installed a hidden backdoor. By August the attacker had created encrypted tunnels, used remote desktop protocol to move across state systems, accessed the state password vault, and assembled a zip file containing sensitive personal information, though investigators have not confirmed data was taken or published. The incident took nearly a month to fully restore services, disrupted driver license issuance and employer background checks, placed state workers on paid administrative leave, cost at least 1.5 million dollars including about 211,000 dollars in overtime and 1.3 million dollars for contractors covered by cyber insurance, and officials say no ransom was paid. The attacker remains unidentified, the investigation is ongoing, and the state plans to implement a centrally managed security operations center and endpoint detection and response.
ThreatsDay Bulletin: AI Tools in Malware, Botnets, GDI Flaws, Election Attacks & More

thehackernews.com · 9 months ago

There are three now patched Windows Graphics Device Interface vulnerabilities that could enable remote code execution and information disclosure, tracked as CVE-2025-30388, CVE-2025-53766, and CVE-2025-47984, rooted in gdiplus.dll and gdi32full.dll and fixed across Microsoft Patch Tuesday updates in May, July, and August 2025. AI tools can dramatically speed malware triage and deobfuscation as demonstrated by using ChatGPT for static analysis and key extraction when reversing the XLoader trojan, but skilled human analysts remain necessary for complex protections and validation. Other active threats include RondoDox expanding from DVRs to enterprise with more than 15 new exploitation vectors and new command and control infrastructure, TruffleNet leveraging TruffleHog to test and probe large numbers of compromised AWS credentials, and FIN7 deploying a Windows specific SSH based backdoor for persistence and exfiltration. Cybercriminals are also mixing digital and physical extortion across Europe, abusing fake branded ChatGPT and WhatsApp apps, weaponizing trusted email accounts after breaches, and mounting election related DDoS campaigns against infrastructure such as Moldova's Central Election Commission.
Automotive IT Firm Hyundai AutoEver Discloses Data Breach

www.securityweek.com · 9 months ago

Hyundai AutoEver America confirmed a cyber intrusion that it detected on March 1, 2025, saying attackers had access to its systems from February 22 through March 2, 2025. The breach exposed personal information including names, Social Security numbers and driver license numbers, and the company has submitted data breach notices to several US states including Maine and Massachusetts. Hyundai AutoEver America is the North American arm of Hyundai AutoEver, the in house IT and software unit for Hyundai Motor Group, and it has not disclosed the total number of affected individuals. There is no public attribution to a known ransomware group and investigators could not confirm whether the compromised information was exfiltrated.
Verdacht des systematischen Missbrauchs von Zahlungsdienstleistern

www.csoonline.com · 9 months ago

There was an international law enforcement operation across three continents that included 29 searches in Germany with more than 250 officers and 18 arrest warrants executed, five of them in Germany. A total of 44 suspects are accused of using stolen credit card data from victims in 193 countries to create more than 19 million fake subscriptions via professional sham websites, affecting over four million cardholders and more than 500 shell companies, with estimated losses exceeding 300 million euros and additional planned criminal flows of about 750 million euros that were prevented. Investigators report the rings compromised four major German payment service providers, installed money laundering software at one provider, relied on phishing to harvest card data, and say the probe originated from suspicious reports to the FIU and was conducted under the name Operation Chargeback with the frauds stopped since 2021.
KI-Malware ist keine Theorie mehr

www.csoonline.com · 9 months ago

Google Threat Intelligence Group reports that cybercriminals are increasingly integrating large language models into malware to generate commands, obfuscate code, and dynamically alter behavior during execution. Identified active strains include PROMPTSTEAL which queries LLMs via APIs to create malicious commands, PROMPTFLUX which uses an API to rewrite and store obfuscated source code to evade detection, and other variants named FRUITSHELL, PROMPTLOCK, and QUIETVAULT that enable reverse shells, LLM driven ransomware, and theft of GitHub and npm tokens respectively. Attackers are also using social engineering prompts to trick models into providing exploit guidance by posing as security researchers or students, while underground marketplaces sell turnkey AI tools for malware generation, deepfakes, automated phishing, and vulnerability discovery under freemium and subscription models. Google warns this marks a new operational phase of AI misuse that will likely increase threats by enabling less skilled actors to launch more complex and adaptive attacks.
Cisco Patches Critical Vulnerabilities in Contact Center Appliance

www.securityweek.com · 9 months ago

Cisco released patches for nearly a dozen vulnerabilities in the Unified Contact Center Express appliance, including two critical remote code execution flaws tracked as CVE-2025-20354 and CVE-2025-20358. CVE-2025-20354 stems from the Java Remote Method Invocation process and can be exploited remotely without authentication to upload files and execute commands with root privileges, while CVE-2025-20358 affects the CCX Editor and can be abused to bypass authentication and elevate privileges to an administrator. Cisco also patched a high severity Identity Services Engine denial of service bug CVE-2025-20343, updated advisories for previously exploited flaws CVE-2025-20333 and CVE-2025-20362, and released fixes in Unified CCX versions 12.5 SU3 ES07 and 15.0 ES01 with no known active exploitation.
Sandworm hackers use data wipers to disrupt Ukraine's grain sector

www.bleepingcomputer.com · 9 months ago

Russian state backed hacker group Sandworm has deployed multiple data wiping malware families in June and September 2025 against Ukrainian education, government, energy, logistics, and grain sector organizations in an apparent effort to disrupt the country’s main revenue source. Security researchers attribute the operations to APT44 and report the group used wipers including ZeroLot and Sting, with some intrusions linked to the UAC 0099 actor and attacks executed via scheduled tasks and Go based open source wiper tools. Recommended mitigations include maintaining offline backups, deploying strong endpoint detection and intrusion prevention, and keeping all software updated to reduce the impact of destructive attacks.
Multiple ChatGPT Security Bugs Allow Rampant Data Theft

www.darkreading.com · 9 months ago

There are seven vulnerabilities in ChatGPT and its helper model SearchGPT that allow attackers to inject arbitrary prompts, exfiltrate private chat history and stored memories, bypass safety mechanisms, and establish persistence. Researchers at Tenable demonstrated multiple attack methods including indirect prompt injection through trusted web pages and comments, one click prompt injection via ChatGPT query parameters, using tracking links from the Bing search domain to evade filters, conversation injection through remembered chat history, and a zero click vector where poisoned search results can trigger compromise. Tenable reported the issues to OpenAI in April, found many of the flaws in ChatGPT 4o and some valid on ChatGPT 5, and warned that chaining medium and high severity flaws can create a full critical attack path.
State-Sponsored Hackers Stole SonicWall Cloud Backups in Recent Attack

www.securityweek.com · 9 months ago

A state sponsored threat actor stole firewall configuration files stored in SonicWall cloud backups, affecting all customers who used the service. SonicWall disclosed the breach in mid September and on October 8 revised its estimate to say all firewall preference files in the cloud backup service were exfiltrated, with the files containing encrypted credentials and configuration data that could enable targeted attacks. SonicWall engaged Mandiant, said the unauthorized access was isolated to a specific cloud environment via an API call, completed its investigation, advised customers to check their MySonicWall accounts and reset passwords, and said no products, firmware, source code or customer networks were otherwise compromised.
Multiple Django Flaws Could Allow SQL Injection and Denial-of-Service Attacks

gbhackers.com · 9 months ago

There are two significant Django vulnerabilities that could expose applications to denial of service and SQL injection attacks. The Django development team released security updates for versions 5.2.8, 5.1.14, and 4.2.26 on November 5, 2025 under its standard security release policy. One vulnerability can be abused to cause denial of service and the other can lead to SQL injection, and administrators are advised to apply the patches promptly.
Digital health can’t scale if cybersecurity falls behind

www.csoonline.com · 9 months ago

Health security experts report that AI systems became indispensable during the COVID 19 pandemic while health organizations, research institutions and vaccine supply chains were simultaneously targeted by cyberattacks. AI driven public health ecosystems expand the attack surface across connected devices, training pipelines and cloud services and face unique threats such as data poisoning, model inversion and adversarial manipulation that can corrupt decisions or reidentify patients. Experts call for security by design including zero trust architectures, role based access controls, network segmentation, data provenance, strong encryption and privacy preserving techniques such as differential privacy and homomorphic encryption together with model governance, multidisciplinary drills, ethical transparency and AI based anomaly detection to build resilient, trustworthy digital health systems.