Blahalla

Active Exploits Target Magento and Adobe Commerce RCE, Attackers Inject Webshells

gbhackers.com · 9 months ago

There is a critical improper input validation vulnerability tracked as CVE-2025-54236 and dubbed SessionReaper that affects Adobe Commerce and Magento and can enable unauthenticated remote code execution and customer account takeover. Security researchers report active exploitation, with automated scans delivering PHP webshells and reconnaissance probes and dozens to hundreds of attack attempts blocked while a majority of stores remain unpatched. Adobe released an emergency patch on September 9, 2025 and cloud customers receive temporary WAF protection, but leaked hotfixes and public proof of concept code have increased the urgency for administrators to apply fixes immediately.
UK cyber law delays 'deeply concerning,' say MPs

therecord.media · 9 months ago

Opposition MPs warn that continued delays in introducing new cybersecurity laws are deeply concerning and are widening gaps that fuel greater threats to national security and businesses. The Cyber Security and Resilience Bill has been delayed again and separate proposals to overhaul the government response to ransomware have stalled after earlier election related pauses, while ministers say they are still consulting and expect to introduce the bill shortly. Government proposals include a ban on ransom payments by public sector and critical national infrastructure organisations, mandatory notifications to government including intent to make extortion payments, and a proposed turnover threshold of 25 million pounds that critics say could create loopholes, with MPs citing recent incidents affecting Marks and Spencer, the Co op, Harrods and Jaguar Land Rover as reasons to act urgently.
Jira Vulnerability Lets Attackers Alter Files Accessible to the Jira JVM Process

gbhackers.com · 9 months ago

There is a critical path traversal vulnerability in Jira Software Data Center and Server that can allow authenticated attackers to modify files accessible to the Jira Java Virtual Machine process, tracked as CVE-2025-22167. The issue carries a CVSS score of 8.7 and affects releases introduced in versions 9.12.0, 10.3.0, and 11.0.0, allowing arbitrary writes to any filesystem path writable by the Jira JVM. Administrators are advised to upgrade to fixed releases such as 9.12.28 or later, 10.3.12 or later, or 11.1.0 or later to mitigate the risk.
TransparentTribe Targets Linux Systems in Indian Military to Deploy DeskRAT

gbhackers.com · 9 months ago

In July 2025 cybersecurity firm CYFIRMA uncovered an active phishing campaign by TransparentTribe, also known as APT36, targeting Indian government and military systems running BOSS Linux. Attackers used spear phishing ZIP attachments containing weaponized.desktop shortcut files that open a decoy document while silently downloading and executing ELF payloads to enable reconnaissance, persistence, credential harvesting, and data exfiltration. The operation delivered remote access tooling including DeskRAT and relied on staged servers and credential harvesting techniques, prompting urgent recommendations to strengthen email defenses, enforce file extension visibility, and deploy behavior based detection and proactive threat hunting.
ThreatsDay Bulletin: $176M Crypto Fine, Hacking Formula 1, Chromium Vulns, AI Hijack & More

thehackernews.com · 9 months ago

Financial regulators in Canada issued a 176 million dollar fine against a digital payments platform for failing to file suspicious transaction reports tied to darknet markets, child sexual abuse material trafficking, ransomware, fraud, and sanctions evasion. Researchers reported multiple supply chain and persistence threats including a malicious npm package that delivered the AdaptixC2 post exploitation framework, a decline in Lumma stealer activity after a doxxing campaign while Vidar Stealer 2.0 resurfaces with a C based multi threaded architecture and memory injection techniques, and demonstrations of persistent backdoors created via malicious OAuth applications. Critical vulnerabilities include MCP session ID predictability tracked as CVE-2025-6515 which enables prompt hijacking of AI conversations and an unsafe deserialization flaw in python socketio tracked as CVE-2025-61765 that can lead to remote code execution through malicious pickle payloads. Outdated Electron cores in AI development environments exposed more than 1.8 million developers to dozens of known Chromium and V8 flaws, prompting recommendations to patch, isolate, and verify systems quickly.
Jingle Thief Hackers Exploit the Festive Season with Weaponized Gift Card Scams

gbhackers.com · 9 months ago

There is a sophisticated campaign called Jingle Thief tracked as cluster CL-CRI-1032 that targets global retail and consumer services during festive seasons to conduct large scale gift card fraud. The actors harvest Microsoft 365 credentials via tailored phishing and smishing, then operate entirely in cloud environments to mine SharePoint and OneDrive for gift card issuance workflows, maintaining persistent access for months and compromising dozens of accounts. They register rogue devices and authenticator applications to bypass multi factor protections, create inbox rules to hide activity, issue high value gift cards and monetize them on gray market forums, making identity abuse the primary attack vector.
Vibe Coding’s Real Problem Isn’t Bugs—It’s Judgment

www.securityweek.com · 9 months ago

There is growing use of AI generated code called vibe coding that produces functional but flawed software, with a similar vulnerability density to human code yet produced at much greater scale and speed. Researchers at OX Research identify two core problems: vulnerabilities reach production faster than traditional review can catch, and AI lacks the experienced judgment that prevents anti patterns. Common anti patterns include excessive commenting, single use over specification, reimplementing standard libraries, and deployment unaware code, and these patterns tend to be repeated across many outputs from the same system. Recommended mitigations are to embed security guidelines directly into AI workflows, improve AI and prompting practices, and adopt organizational best practices so non professional programmers follow secure development patterns.
Serious F5 Breach

www.schneier.com · 9 months ago

There has been a serious breach at F5 in which a sophisticated nation-state affiliated threat group maintained long term persistent access to parts of the company network. During that time the attackers took control of the network segment used to create and distribute BIG-IP updates and downloaded proprietary BIG-IP source code, documentation about unpatched vulnerabilities, and some customer configuration settings. Control of the build system combined with stolen source code and configurations raises the risk of widespread supply chain attacks and credential abuse against thousands of networks.
Exploitation of Critical Adobe Commerce Flaw Puts Many eCommerce Sites at Risk

www.securityweek.com · 9 months ago

There is a critical severity vulnerability in Adobe Commerce and Magento Open Source called SessionReaper, tracked as CVE-2025-54236 with a CVSS score of 9.1, that stems from improper input validation and can be exploited without authentication to bypass a security feature. Adobe released hotfixes on September 9 but only 38 percent of stores have applied the update, leaving roughly 62 percent of Magento deployments at risk and enabling potential customer account takeover via the Commerce REST API. Security firms report active exploitation with about 250 observed attacks delivering PHP webshells and phpinfo probes, and published technical details are expected to drive rapid mass exploitation.
Why Organizations Are Abandoning Static Secrets for Managed Identities

thehackernews.com · 9 months ago

There is a shift away from static secrets such as API keys, passwords, and tokens toward managed identities that issue short lived, automatically rotated credentials to reduce manual lifecycle management and leakage risk. Enterprises report dramatic productivity gains, including a ninety five percent reduction in time spent managing credentials per application component and a seventy five percent reduction in time spent learning platform specific authentication mechanisms, with many organizations cutting their secret footprint by seventy to eighty percent. Major cloud providers now offer platform native identity solutions, including IAM roles in Amazon Web Services, Managed Identities in Microsoft Azure, and service accounts in Google Cloud Platform, while development platforms like GitHub and GitLab automate pipeline authentication to avoid storing cloud access credentials. Legacy systems, third party APIs, and cross organizational authentication still often require static secrets, making discovery and inventory tools for non human identities essential to plan safe migrations.
Unseeable prompt injections in screenshots: more vulnerabilities in Comet and other AI browsers | Brave

www.reddit.com · 9 months ago

There are prompt injection attacks that hide nearly invisible text in web content so that user-initiated screenshots extract that text and pass it to an assistant LLM, enabling the assistant to execute malicious browser actions on the user’s behalf. There are also navigation based injections where instructing an agentic browser to visit a webpage causes the browser to send the page content to the LLM and allows visible page text to override or modify user intent. These vulnerabilities demonstrate a systemic failure to separate trusted user input from untrusted web content, put authenticated accounts at risk, and were responsibly disclosed to affected projects with discovery and disclosure activity reported in August and October 2025, while one additional issue is being withheld pending further disclosure.
Warlock Ransomware Exploits SharePoint ToolShell Zero-Day in New Attack Campaign

gbhackers.com · 9 months ago

Chinese linked threat actors behind the Warlock ransomware have launched a new campaign exploiting a critical Microsoft SharePoint ToolShell zero day. Their operations use sophisticated attack infrastructure and trace back to espionage activity observed as early as 2019, suggesting a blurring between criminal and state sponsored activity. The campaign underscores elevated risk to organizations using SharePoint and the need for immediate review of defenses and mitigations.
OpenAI Faces DHS Request to Disclose User’s ChatGPT Prompts in Investigation

gbhackers.com · 9 months ago

Federal agents used a suspect's admission that they had used ChatGPT during undercover conversations to obtain a first known federal search warrant compelling OpenAI to produce the user's prompts, account identifiers, and related data. The warrant sought the user name, address, payment information, and records of other conversations, and court filings indicate OpenAI supplied investigators with a spreadsheet of account data. Investigators nevertheless confirmed the suspect's identity through traditional leads tied to service at Ramstein Air Force Base and charged a man identified as Drew Hoehner with conspiracy to advertise child sexual abuse material. Privacy observers say this establishes a new investigative technique of reverse AI prompt searches, showing generative AI interactions can be compelled in criminal probes.
BIND Updates Address High-Severity Cache Poisoning Flaws

www.securityweek.com · 9 months ago

Internet Systems Consortium released BIND 9 updates to fix three high severity vulnerabilities that could enable DNS cache poisoning, forged record injection, and denial of service against recursive resolvers. A weakness in the pseudo random number generator could allow attackers to predict source ports and query IDs and is tracked as CVE-2025-40780 with a CVSS score of 8.6; excessive leniency when accepting records is tracked as CVE-2025-40778 with a CVSS score of 8.6 and can enable injected cached records; and a DoS triggered by malformed DNSKEY records is tracked as CVE-2025-8677 with a CVSS score of 7.5. All three issues affect resolvers but not authoritative servers, have no available workaround, were not reported to be exploited in the wild, and were addressed in BIND versions 9.18.41, 9.20.15, and 9.21.14 and supported preview editions.
The Smishing Deluge: China-Based Campaign Flooding Global Text Messages

unit42.paloaltonetworks.com · 9 months ago

A China based smishing operation known as the Smishing Triad has carried out a global campaign targeting U.S. residents since April 2024 and impersonates services across banking, cryptocurrency, e commerce, healthcare, law enforcement and social media. Researchers have identified more than 194,000 malicious fully qualified domain names across 136,933 root domains registered since January first 2024, with the majority registered through a Hong Kong registrar using Chinese nameservers while hosting is concentrated on popular U.S. cloud services. The campaign is powered by a decentralized phishing as a service ecosystem coordinated on Telegram that provides disposable domains, phishing kits, data brokers, liveness scanners and SMS and RCS message delivery, with many messages sent from Philippines phone numbers and an increasing number from U.S. numbers. Attackers use urgent, tailored SMS messages linking to short lived phishing pages that most frequently impersonate toll services and postal delivery to harvest national identifiers, home addresses, payment details and login credentials.
Lanscope Endpoint Manager Zero-Day Exploited in the Wild

www.securityweek.com · 9 months ago

A critical zero day in Lanscope Endpoint Manager has been exploited in the wild and urgent patches were released by Motex, a Kyocera Communications subsidiary. The flaw, tracked as CVE 2025 61932 with a CVSS score of 9.8, is an improper verification of the source of a communication channel that allows remote attackers to send crafted packets and achieve arbitrary code execution. The vulnerability affects on premises Lanscope Endpoint Manager versions 9.4.7.1 and earlier and was resolved in client patch releases including versions 9.3.2.7 through 9.4.7.3, and all client systems should be updated while manager version upgrades are not required. The US Cybersecurity and Infrastructure Security Agency added CVE 2025 61932 to its Known Exploited Vulnerabilities catalog and under Binding Operational Directive 22 01 federal agencies were instructed to patch vulnerable deployments within three weeks, by November 12, 2025.
New Python-Based RAT Disguised as Minecraft App Steals Sensitive User Data

gbhackers.com · 9 months ago

Threat researchers at Netskope uncovered a sophisticated Python remote access trojan that masquerades as Nursultan Client, a Minecraft application popular in Eastern European and Russian gaming communities. The malware uses the Telegram Bot API as its command and control channel to exfiltrate data and receive commands, and it includes capabilities for screenshot and webcam capture, theft of Discord authentication tokens, and opening arbitrary URLs on victim machines. The sample is a PyInstaller compiled executable that includes PYD and DLL files and reuses open source RAT code, attempts Windows persistence by creating a NursultanClient registry key but contains flaws that can break that persistence, and its core communication and some surveillance features rely on cross platform libraries enabling operation on Windows, Linux and Darwin.
Mobile Security: Verizon Says Attacks Soar, AI-Powered Threats Raise Alarm

www.securityweek.com · 9 months ago

Verizon's 2025 Mobile Security Index, based on a survey of nearly eight hundred mobile procurement and security professionals, found that eighty five percent of organizations report a surge in mobile device attacks regardless of size, location, or industry. More than three quarters of respondents say AI assisted threats such as SMS phishing and deepfakes are likely to succeed, thirty four percent worry AI sophistication will greatly increase exposure, yet only seventeen percent have specific controls for AI assisted attacks and only twelve percent have protections against deepfakes. Most organizations report employees regularly use generative AI on mobile devices and two thirds fear employees could disclose sensitive data to chatbots, while those that experienced mobile incidents reported downtime, data loss, financial penalties, and reputational harm. To reduce exposure and improve resilience, organizations are advised to deploy mobile device management, evaluate protections against industry standards, adopt zero touch mobile security solutions, and maintain continuous training and testing to combat phishing.
SideWinder Leverages ClickOnce Installer to Deliver StealerBot Malware

gbhackers.com · 9 months ago

There are targeted SideWinder campaigns that used PDF lures paired with ClickOnce installers and geofenced spear-phishing to deliver StealerBot to diplomatic and government targets across South Asia during 2025. The attacks weaponized legacy Microsoft Office remote code execution vulnerabilities tracked as CVE-2017-0199 and CVE-2017-11882, using malicious documents, shellcode-based loaders, and DLL sideloading to install a.NET StealerBot implant. StealerBot operates as a modular in-memory.NET espionage implant that harvests browser passwords, keystrokes, screenshots, files, and RDP credentials, can deploy additional malware and provide reverse shells, and the campaigns relied on server-side polymorphism and geofencing to reduce detection.
'Jingle Thief' Hackers Exploit Cloud Infrastructure to Steal Millions in Gift Cards

thehackernews.com · 9 months ago

A cybercriminal group called Jingle Thief targets cloud environments used by retailers and consumer services to issue unauthorized high value gift cards that are likely resold on gray markets. Palo Alto Networks Unit 42 found the actors use phishing and smishing to harvest Microsoft 365 credentials, then map SharePoint and OneDrive for gift card issuance workflows, create inbox rules and internal phishing to expand access, register rogue authenticator apps and enroll devices in Entra ID to bypass multi factor protections and maintain long term persistence while minimizing logs. The cluster is attributed with moderate confidence to criminal groups known as Atlas Lion and Storm 0539, is believed active since at least late 2021 and was observed conducting coordinated campaigns in April and May 2025 that included cases of roughly ten months of access and dozens of compromised accounts in single organizations.
BIND 9 Vulnerabilities Expose DNS Servers to Cache Poisoning and DoS

gbhackers.com · 9 months ago

Three critical vulnerabilities in BIND 9 were publicly disclosed on October 22, 2025, affecting widely deployed DNS resolvers and potentially impacting millions of users worldwide. CVE-2025-8677 can cause resource exhaustion via malformed DNSKEY handling leading to denial of service, CVE-2025-40778 allows cache poisoning through acceptance of unsolicited resource records, and CVE-2025-40780 enables cache poisoning by making the pseudo random number generator used for source port and query ID predictable. Operators are urged to apply supplied patches or upgrade to fixed BIND 9 releases immediately to prevent exploitation.
Cyberangriff auf Jaguar ist teuerster in britischer Geschichte

www.csoonline.com · 9 months ago

A cyberattack on Jaguar Land Rover in late August forced the company to shut down IT systems and halt global production for weeks. The stoppage and related losses to suppliers and dealers are estimated at 1.9 billion pounds, roughly 2.2 billion euros, and more than 5,000 organizations were affected. The British government guaranteed a bank loan of up to 1.5 billion pounds to protect the companys supply chain and production has since been restarted gradually.
TARmageddon Security Flaw in Rust Library Could Lead to Config Tampering and RCE

gbhackers.com · 9 months ago

A critical boundary parsing bug was discovered in the async-tar Rust library and many forks including tokio-tar, assigned CVE-2025-62518 and rated CVSS 8.1 high. The flaw lets attackers smuggle inner tar entries by exploiting inconsistent PAX and ustar header handling, allowing overwriting of configuration files and remote code execution that can hijack developer machines continuous integration and build backends. Major downstream projects such as uv testcontainers wasmCloud and numerous tokio-tar forks are impacted and while some forks have been patched, widely used tokio-tar remains unpatched in many environments so urgent upgrades or migration to maintained forks like astral-tokio-tar version 0.5.6 are recommended. There are no reliable workarounds so organizations should prioritize patching auditing dependency trees and sandboxing extraction to mitigate exploitation risk.
New Malware Toolkit from MuddyWater Delivers Phoenix Backdoor to Global Targets

gbhackers.com · 9 months ago

MuddyWater executed a global phishing campaign using a compromised mailbox accessed via NordVPN to send weaponized Word documents that urged recipients to enable macros. Enabling macros ran Visual Basic droppers that decoded and wrote a FakeUpdate loader to disk which decrypts an AES encrypted payload and launches version four of the Phoenix backdoor. Phoenix version four gathers system information, creates a mutex, copies itself to ProgramData as sysprocupdate.exe, modifies registry keys to persist, communicates with command and control over WinHTTP, and operators also deployed remote monitoring and management tools and a custom Chromium based credential stealer disguised as a calculator. The operation began on August 19 2025, targeted more than 100 government and diplomatic organizations across the Middle East and North Africa and beyond, and researchers observed the attackers taking down the server on August 24 2025.
PhantomCaptcha RAT Uses Weaponized PDFs and “ClickFix” Cloudflare CAPTCHA Pages to Deliver Malware

gbhackers.com · 9 months ago

There was a sophisticated spearphishing campaign named PhantomCaptcha that began on October 8, 2025, targeting humanitarian organizations and regional Ukrainian administrations by sending weaponized PDF attachments that redirected recipients to fake Cloudflare captcha pages and Zoom-like sites and tricked them into pasting and running PowerShell commands via a ClickFix style token and the Windows Run dialog. The multi stage chain executed several PowerShell stages and ultimately deployed a WebSocket remote access trojan that provided arbitrary command execution and data exfiltration, and researchers also observed an associated Android spyware component distributed as a malicious app. Attack infrastructure had been prepared months earlier but was active for roughly a single day, showing deliberate operational security while focusing lures on groups including the International Committee of the Red Cross, UNICEF Ukraine, the Norwegian Refugee Council, and multiple regional administrations.
Critical Argument Injection Flaw in AI Agents Enables Remote Code Execution

gbhackers.com · 9 months ago

AI powered agents contain an argument injection flaw that can be abused to achieve remote code execution while performing tasks such as code analysis, file management, and automating workflows. Attackers can craft inputs that inject arguments into agent operations and bypass some safeguards to trigger command execution remotely. The vulnerability list includes CVE-2025-54795, a command injection issue affecting Claude Code.
Mideast, African Hackers Target Gov'ts, Banks, Small Retailers

www.darkreading.com · 9 months ago

There are findings from the SOCRadar MEA Threat Landscape Report showing retail is one of the most frequently targeted sectors in the Middle East and North Africa, with phishing, data extortion, and stolen order records appearing for sale on the Dark Web. Between September 2024 and September 2025 the public sector was the most targeted industry, followed by finance and IT, while retail remained in the top five though activity was down from 2024. Pakistan accounted for more than a third of ransomware attacks in the region, with Saudi Arabia experiencing roughly half as many, and 71.4 percent of 2025 MENA ransomware incidents were attributed to small or unknown groups. Small and medium retailers are especially attractive because they process many credit cards, often lack robust defenses, and are likely to pay ransoms quickly to resume operations.
Over 250 Magento Stores Hit Overnight as Hackers Exploit New Adobe Commerce Flaw

thehackernews.com · 9 months ago

E-commerce security firm Sansec reports more than 250 attack attempts in the past 24 hours exploiting a recently disclosed Adobe Commerce and Magento Open Source vulnerability that can be abused to take over customer accounts via the Commerce REST API. The flaw is tracked as CVE-2025-54236 with a CVSS score of 9.1 and is known as SessionReaper, with threat actors observed dropping PHP webshells and probing PHP configuration information. Security analysis describes the issue as a nested deserialization vulnerability that enables remote code execution, and Sansec warns that 62 percent of Magento stores remained vulnerable six weeks after public disclosure, urging immediate patching. This incident follows a similar deserialization flaw exploited in 2024 tracked as CVE-2024-34102, and proof of concept exploits and detailed technical data are now public, increasing the urgency to apply available fixes.
Critical MCP Server Flaw Exposes Over 3,000 Servers and Thousands of API Keys

gbhackers.com · 9 months ago

A critical vulnerability in Smithery.ai, a Model Context Protocol server hosting service, exposed more than three thousand AI servers and thousands of API keys to potential attackers. Security researchers discovered a simple path traversal flaw that allowed unauthorized access to sensitive infrastructure files and administrative credentials. The issue put entire AI ecosystems at risk by exposing credentials and server configurations and required urgent remediation to prevent further compromise.
Critical Lanscope Endpoint Manager Bug Exploited in Ongoing Cyberattacks, CISA Confirms

thehackernews.com · 9 months ago

There is a critical vulnerability in Motex Lanscope Endpoint Manager that CISA added to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The flaw is tracked as CVE-2025-61932, rated CVSS v4 9.3, and can allow attackers to execute arbitrary code in on premises Lanscope Endpoint Manager Client and Detection Agent. The issue impacts versions 9.4.7.1 and earlier, has been addressed in multiple patched versions, and Federal Civilian Executive Branch agencies are advised to remediate by November 12, 2025.
Lazarus Group Hunts European Drone Manufacturing Data

www.darkreading.com · 9 months ago

North Korea's Lazarus Group targeted European drone manufacturers to steal proprietary unmanned aerial vehicle design and manufacturing data, striking at least three organizations in Central and Southeastern Europe. The campaign used job themed decoy documents under Operation DreamJob to deliver the ScoringMathTea remote access Trojan, which gives attackers interactive control and supports roughly 40 commands for file and process manipulation, system reconnaissance, and downloading and executing additional payloads. ScoringMathTea has been observed since at least 2022 and remains largely unchanged, while operators have incorporated DLL proxying libraries and modified lesser known open source plug ins such as those for Notepad plus plus and WinMerge to evade detection, and researchers say the intrusions are intended to help Pyongyang scale domestic drone capabilities even though private companies are not always required to report such incidents.
Serious vulnerability found in Rust library

www.csoonline.com · 9 months ago

A critical boundary parsing bug named TARmageddon, tracked as CVE-2025-62518, was found in the async-tar Rust library and in many forks including tokio-tar. The flaw allows an attacker to smuggle extra archive entries when extracting nested TAR files, enabling file overwrite attacks and potential remote code execution, and it carries a severity rating of 8.1 out of 10. Because tokio-tar appears unmaintained and remains unpatched, the issue affects many projects and could enable supply chain attacks, so maintainers are urged to patch affected forks, migrate to patched forks such as astral-tokio-tar version 0.5.6 or later, and scan and sandbox TAR processing in CI pipelines and containers.
Smashing Security podcast #440: How to hack a prison, and the hidden threat of online checkouts

grahamcluley.com · 9 months ago

In a Romanian prison, inmates exploited self service web kiosks to run wild online, exposing an insider threat caused by poorly controlled kiosk systems. JavaScript on payment pages has become a widespread vector for skimming attacks, and new PCI DSS rules are tightening controls to curb Magecart style skimmers. Practical tools such as Keyboard Maestro for automation and Screen Studio for creating polished how to videos are also highlighted.
Pwn2Own Underscores Secure Development Concerns

www.darkreading.com · 9 months ago

There are concerns that secure development practices are lacking after Pwn2Own Ireland, held October 21 to October 24, where researchers from 15 countries targeted devices and applications from vendors including Samsung, QNAP, and Meta. There is a high profile claim of a WhatsApp zero click exploit that could win a one million dollar prize, but questions remain about the exploit's authenticity as the researcher had not yet demonstrated it in person. Trend Micro's Zero Day Initiative reported stack based and heap based buffer overflows and injection flaws as the top vulnerability categories, noting these long known and avoidable bugs persist in devices such as printers, NAS devices, and WiFi routers and underscoring the need for better secure coding and testing practices.
Prompt hijacking puts MCP-based AI workflows at risk

www.csoonline.com · 9 months ago

Model Context Protocol, MCP, provides a standardized way to connect large language models to external tools and data sources for AI workflows. Researchers warn that some MCP servers generate predictable session IDs, enabling prompt hijacking where an attacker reuses session IDs to inject malicious prompts into responses. JFrog demonstrated this issue in oatpp-mcp, tracked as CVE-2025-6515, showing attackers can open many connections to force session ID reuse and cause clients to receive poisoned responses. Mitigations include generating unique session IDs with cryptographically secure randomness of at least 128 bits and having clients require unpredictable event identifiers and validate that responses match those identifiers.
Iranian hackers targeted over 100 govt orgs with Phoenix backdoor

www.bleepingcomputer.com · 9 months ago

State-sponsored Iranian hacker group MuddyWater targeted more than 100 government entities across the Middle East and North Africa with a phishing campaign that began on August 19 using a compromised account accessed via NordVPN. The attackers sent macro‑enabled Word documents that dropped a FakeUpdate loader which decrypted and installed Phoenix backdoor version four as C:\ProgramData\sysprocupdate.exe, established persistence via registry changes and a new COM based mechanism, and connected to command and control over WinHTTP. Phoenix v4 supports commands including sleep, upload file, download file, start shell, and update sleep interval, and operators also used a custom infostealer to extract browser databases, credentials, and master keys while PDQ and Action1 tooling were observed on the C2 infrastructure. Group‑IB attributes the campaign to MuddyWater with high confidence based on reused malware families, macro techniques, and targeting patterns, and notes the attackers took down the server side C2 on August 24, indicating a possible shift to other tools and data collection methods.
Cyber incidents in Texas, Tennessee and Indiana impacting critical government services

therecord.media · 9 months ago

There were multiple cyber incidents across U.S. local governments, including a cyberattack in Kaufman County, Texas, that was discovered on Monday and took down several county systems while leaving the sheriff s office and emergency services operational. The Tennessee city of La Vergne suffered a network incident that disrupted systems used by government officials and disabled the online payment system for water bills and property taxes, forcing residents to pay by check or money order with no late fees and a promise that water services will not be shut off. Dekalb County, Indiana, and the Chester County, Pennsylvania library system also reported outages in the last month. Federal support for local cybersecurity response has been strained by the government shutdown, which ended a partnership with the Center for Internet Security and allowed a key cyber threat intelligence sharing law to lapse on September 30, hampering assistance.
SpaceX disables more than 2,000 Starlink devices used in Myanmar scam compounds

therecord.media · 9 months ago

SpaceX disabled over 2,500 Starlink kits in the vicinity of suspected scam centers in Myanmar after proactively identifying devices it said violated its policies and said it works with law enforcement. Advocates say Starlink equipment was used by scam compounds following local cuts to power and internet, and investigations found the technology present at multiple compounds near the Thai border. Myanmar authorities reported raids that seized dozens of Starlink devices and detained more than 2,000 people in operations against sites such as KK Park.
It Takes Only 250 Documents to Poison Any AI Model

www.darkreading.com · 9 months ago

There are findings that as few as 250 malicious documents inserted into training data can reliably implant a backdoor that makes a model produce gibberish whenever a specific trigger token appears. This effect was consistent across models from 600 million to 13 billion parameters and, for the largest model tested, those 250 documents amounted to about zero point zero zero zero one six percent of the training data. The researchers observed that attack success depends on the absolute number of poisoned samples rather than their share of the corpus, that the behavior can persist through fine tuning, and that defenders should strengthen data provenance checks, automated filtering, and backdoor detection to mitigate the risk.
Reddit Accuses ‘Data Scraper’ Companies of Theft

www.nytimes.com · 9 months ago

Reddit's lawsuit reveals an ecosystem of startup intermediaries that harvest Google search results and repackage or resell aggregated web content to data hungry AI companies. Investigations and network provider research allege some of these scrapers ignore robots.txt, spoof user agents, rotate IPs, and impersonate browsers to access blocked pages and feed that content into large language models. Publishers and platforms say the practice has weakened referral traffic and subscription economics and has prompted licensing deals, tightened robots rules, blocking of offending crawlers, and litigation. Reddit is seeking court orders and damages to stop unauthorized scraping, protect user privacy, and preserve its market for licensed data.
Too Many Secrets: Attackers Pounce on Sensitive Data Sprawl

www.darkreading.com · 9 months ago

There is a growing sprawl of sensitive secrets such as hardcoded credentials, access tokens, and API keys leaking into unexpected places like customer support case systems, code repositories, extension marketplaces, and AI coding outputs. Threat actors have exploited these leaks, for example UNC6395 used stolen OAuth tokens from a third party app to access multiple Salesforce instances and Crimson Collective claimed to exfiltrate customer engagement reports and access tokens after compromising a Red Hat Consulting GitLab. Researchers found hundreds of validated secrets in Visual Studio Code extensions, including tokens tied to major AI providers and cloud platforms, raising supply chain and extension tampering risks. Security experts urge stronger secret hygiene, continuous scanning and monitoring, shortened credential lifespans, restricted token privileges, and multifactor authentication to limit exposure and downstream impact.
ToolShell bug used by Chinese attackers against governments in Africa, South America

therecord.media · 9 months ago

There are breaches at government agencies, telecoms and universities in countries across Africa and South America and elsewhere that began with the ToolShell vulnerability in Microsoft SharePoint identified in July. The issue tracked as CVE-2025-53770 was exploited by China based groups including Linen Typhoon and Violet Typhoon to deploy backdoors and persistent access tools such as Zingdoor ShadowPad and KrustyLoader while attackers appeared to mass scan for vulnerable SharePoint instances to steal credentials and maintain stealthy access. A separate Chinese linked actor deployed Warlock ransomware after exploiting CVE-2025-49706 with Warlock first observed in June 2025 and used on July 19 2025 and researchers say the ransomware shows links to earlier families and actors active since 2019.
Pwn2Own Day 2: Hackers exploit 22 zero-days for $267.500

www.bleepingcomputer.com · 9 months ago

Security researchers collected seven hundred ninety two thousand seven hundred fifty dollars after exploiting fifty six unique zero day vulnerabilities during the second day of the Pwn2Own Ireland 2025 hacking competition. A highlight was a chain of five flaws used to hack a Samsung Galaxy S25, earning fifty thousand dollars and five Master of Pwn points, while teams also broke into NAS devices, printers, smart home devices, and cameras and received cash awards. Vendors have ninety days to release patches before public disclosure by the Zero Day Initiative, and the contest expanded attack vectors to include USB port exploitation of locked phones in addition to wireless protocols like Wi Fi, Bluetooth, and NFC.
Hackers exploiting critical "SessionReaper" flaw in Adobe Magento

www.bleepingcomputer.com · 9 months ago

There are active exploitation attempts targeting Adobe Commerce's critical SessionReaper vulnerability CVE-2025-54236 that can take over customer account sessions through the Commerce REST API. E-commerce security firm Sansec reported blocking more than 250 SessionReaper exploitation attempts in a single day and warns that roughly 62 percent of Magento stores remain unpatched despite Adobe issuing an emergency patch and warning on September 8. Observed attacks include PHP webshells and phpinfo probes, most activity originated from five IP addresses, and researchers note a leaked hotfix and a detailed technical analysis may drive further exploitation, so administrators are urged to apply Adobe's patch or recommended mitigations immediately.
WhatsApp Secures Ban on NSO Group After 6-Year Legal Battle

www.darkreading.com · 9 months ago

NSO Group was ordered to pay four million dollars in reduced punitive damages and is permanently barred from reverse-engineering WhatsApp, creating new accounts on the service, and must delete any WhatsApp source code it possesses after targeting users with Pegasus spyware. The company was found liable for exploiting a 2019 buffer overflow vulnerability tracked as CVE-2019-3568 to deliver Pegasus via WhatsApp servers to roughly 1,400 devices, including journalists, activists, government officials, and diplomats. A U.S. district court issued the permanent injunction and reduced the jury award on October 17, 2025 after finding that NSO reverse-engineered WhatsApp, repeatedly redesigned its software to evade security fixes, and caused direct harm to the service and its users.
Canada Fines Cybercrime Friendly Cryptomus $176M

krebsonsecurity.com · 9 months ago

There are fines totaling one hundred seventy six million nine hundred sixty thousand one hundred ninety dollars imposed by the Financial Transactions and Reports Analysis Center of Canada on Xeltox Enterprises, known as the Cryptomus digital payments platform, for violating Canada s anti money laundering laws. FINTRAC found the company failed to submit suspicious transaction reports in cases where there were reasonable grounds to suspect laundering connected to trafficking in child sexual abuse material, fraud, ransomware payments and sanctions evasion. Investigations showed Cryptomus processed payments for more than one hundred cybercrime services and at least fifty six cryptocurrency exchanges, and that its Vancouver street address and other Canadian addresses were listed for dozens of money service businesses that did not actually operate from those locations.
TARmageddon flaw in abandoned Rust library enables RCE attacks

www.bleepingcomputer.com · 9 months ago

There is a high severity vulnerability tracked as CVE-2025-62518 in the abandoned async-tar Rust library and its forks that allows unauthenticated attackers to achieve remote code execution by injecting archive entries during TAR extraction. The flaw stems from a desynchronization when processing nested TAR files with mismatched ustar and PAX extended headers, which can cause the parser to treat file content as headers and extract attacker supplied files. The issue affects popular forks including tokio-tar, which has millions of downloads, and impacts downstream projects such as Binstalk, Astral uv Python package manager, wasmCloud, liboxen and testcontainers, while some active forks have been patched but many instances remain unpatched. Researchers advise upgrading to patched versions or removing the vulnerable tokio-tar dependency and switching to maintained forks such as astral tokio tar.
Iran-Linked MuddyWater Targets 100+ Organisations in Global Espionage Campaign

thehackernews.com · 9 months ago

Iranian nation state group MuddyWater conducted a campaign that used a compromised email account to distribute a backdoor called Phoenix to more than 100 government entities and other organizations across the Middle East and North Africa with the goal of infiltrating high value targets and gathering intelligence. The attackers abused NordVPN to access the mailbox and sent weaponized Microsoft Word documents that persuade recipients to enable macros, which execute VBA code to drop a loader named FakeUpdate that decodes an AES encrypted Phoenix v4 payload, with Phoenix version 3 and version 4 variants observed. Investigators found a command and control server at IP address 159.198.36.115 hosting remote monitoring and management utilities and a custom browser credential stealer targeting Brave, Google Chrome, Microsoft Edge, and Opera, and noted the threat actors combined custom tools with legitimate RMM software like PDQ and Action1 to improve stealth and persistence.
Cybercriminals turn on each other: the story of Lumma Stealer’s collapse

www.fortra.com · 9 months ago

There has been a collapse of Lumma Stealer after rival cyber criminals publicly doxxed its developers, publishing names, passport scans, bank account details and social media profiles and compromising its Telegram channels. Known since 2022 as a malware as a service and also called Water Kurita and Storm 2477, Lumma was widely sold on forums and Telegram and used to harvest browser stored passwords, cryptocurrency wallet data and other sensitive information and was observed being deployed by ransomware groups. Activity and customer trust fell sharply, with infections dropping and displaced users moving to competing malware services that are advertising comparisons and flaws. Security analysts warn the broader threat remains and recommend multi factor authentication, password managers and layered defenses to protect against stolen credentials.
Ukraine Aid Groups Targeted Through Fake Zoom Meetings and Weaponized PDF Files

thehackernews.com · 9 months ago

There is a coordinated spear phishing campaign called PhantomCaptcha that on October 8, 2025 targeted individuals at Ukraine war relief organizations and regional administrations, including members of the International Red Cross, the Norwegian Refugee Council, the UNICEF Ukraine office, the Council of Europe Register of Damage for Ukraine, and regional governments in Donetsk, Dnipropetrovsk, Poltava, and Mikolaevsk. Attackers used booby trapped PDF attachments that redirected victims to a fake videoconferencing site and a counterfeit browser check page to trick targets into pasting and executing a malicious PowerShell command. The PowerShell downloader retrieved a second stage payload that deployed a WebSocket based remote access trojan hosted on foreign infrastructure, enabling arbitrary command execution, data exfiltration, and further malware deployment, with preparatory infrastructure first registered on March 27, 2025 and some user facing domains active only briefly on October 8. The campaign also included fake Android applications designed to harvest device data, showed overlaps with ClickFix techniques, and has not been conclusively attributed to a known threat actor.