GeoServer on DanSec Daily

Cybersecurity Brief – 2026-08-14

Fri, 14 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Trezor disclosed a data breach affecting nearly 14,000 customers after its shipping and logistics provider, ShipMonk, was compromised. Exposed data includes names, addresses, email addresses, and phone numbers, increasing the risk of targeted phishing attacks against Trezor users ^[12]^[20].
A former data analyst contractor for Brightly Software was sentenced to two years in prison after stealing company data and attempting to extort $2.5 million from his employer ^[4].
Apple sent new “Threat Notification” alerts to users who were targeted by mercenary spyware attacks, indicating ongoing campaigns leveraging sophisticated surveillance tools against high-risk individuals ^[5].
The Jewelbug hacker group has been observed breaching government webmail accounts for espionage purposes while simultaneously conducting cryptocurrency fraud operations ^[8]^[17].
Ukrainian authorities shut down 94 fraudulent call centers involved in investment scams and bank account access fraud, seizing millions in cash ^[6].

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being actively exploited to deploy reverse SSH tools, providing attackers persistence and remote access. The vulnerability is the subject of a global threat campaign, and patching alone may not fully mitigate the threat ^[11]^[16]^[29].
An unpatched SQL injection vulnerability in GeoServer is being exploited in the wild, allowing attackers to achieve remote code execution ^[21].
WordPress 7.0.4 patched a remote code execution vulnerability that could be exploited by users with Author-level or higher permissions via malicious Postscript files ^[25].
Adobe Commerce released a patch for CVE-2026-71362, a vulnerability that saw exploitation attempts immediately after disclosure ^[24].
Fortinet released patches for authentication flaws in FortiWeb and FortiManager that could allow attackers to log in with arbitrary credentials or impersonate FortiGate appliances ^[27].
Microsoft patched the LegacyHive Windows zero-day vulnerability, which was disclosed after the July 2026 Patch Tuesday ^[9].

Notable Threat Actor Activity

The Iran-linked APT42 group is conducting AI-assisted spear phishing campaigns targeting US organizations, leveraging artificial intelligence to enhance the effectiveness of their attacks ^[3].
Akira ransomware affiliates have been observed disabling endpoint detection and response (EDR) by rebooting compromised systems into Safe Mode with Networking, enabling data theft even when encryption fails ^[7].
Initial access brokers are using vishing (voice phishing) attacks through Microsoft Teams to gain entry for ransomware gangs ^[2].
The Jewelbug group is simultaneously engaged in state espionage and financially motivated cybercrime, including cryptocurrency theft ^[8]^[17].

Trends, Tools, or Tactics of Interest

The rise of “Shadow AI” is being identified as a new dimension of Shadow IT, with employees using unapproved AI tools and services in the workplace, increasing organizational risk ^[1].
AI coding tools are introducing unvetted or hallucinated open source dependencies at a pace that exceeds current security review capabilities, raising supply chain risks ^[13].
Multiple “AI watermark remover” tools have appeared online following the introduction of watermarking in Anthropic’s Claude model, though most cannot reliably remove watermarks, highlighting rapid attempts to circumvent AI content authenticity measures ^[10].
AmnesiaStealer, a Rust-based macOS infostealer, is capable of harvesting passwords, keychain data, browser information, and cookies, expanding the threat landscape for macOS users ^[22].
New Android malware combines social engineering, a remote access trojan, and NFC relay capabilities to enable real-time fraudulent use of victims’ bank cards ^[31].
WhatsApp has rolled out a “Scam Alert” feature using a local machine learning model to flag potential scam messages for users ^[15].

Regulatory or Policy Developments Affecting the Security Industry

The White House issued a memo instructing the National Coordination Center to establish a program allowing private security companies to apply for approval to conduct offensive hack-back operations against foreign cybercrime gangs. Contracts may require a $1 million bond to ensure compliance with operational requirements ^[14]^[28].
Over 3,000 lawsuits have been filed by parents against Meta, TikTok, Google, and Snap, challenging the design of social media platforms and their impact on youth safety ^[32].

Sources

Trezor discloses data breach affecting nearly 14,000 customers - bleepingcomputer.com
14,000 Trezor Customers Impacted by Data Breach at ShipMonk - securityweek.com
Data analyst sent to prison for stealing data, extorting employer - bleepingcomputer.com
Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks - bleepingcomputer.com
Hackers breach govt webmail while running parallel crypto fraud - bleepingcomputer.com
'Jewelbug' APT Balances State Espionage & Cryptocurrency Theft - darkreading.com
Ukraine shuts down 94 fraudulent call centers, seize millions in cash - bleepingcomputer.com
Critical VMware vCenter RCE flaw exploited for reverse SSH access - bleepingcomputer.com
Global Threat Campaign Hits Critical VMware vCenter Flaw - darkreading.com
Critical VMware vCenter Vulnerability in Attackers’ Crosshairs - securityweek.com
Hackers Exploiting Unpatched GeoServer Zero-Day - securityweek.com
WordPress 7.0.4 Patches Remote Code Execution Vulnerability - securityweek.com
Adobe Commerce Bug Targeted Immediately After Disclosure - securityweek.com
Fortinet Patches Authentication Flaws in FortiWeb and FortiManager - securityweek.com
Microsoft patches LegacyHive Windows zero-day vulnerability - bleepingcomputer.com
Iranian APT Launches AI-Assisted Spear Phishing Attacks - blog.knowbe4.com
Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt - bleepingcomputer.com
Warning: Vishing Attacks Open the Door to Ransomware Gangs - blog.knowbe4.com
Shadow AI: The New Frontier of Shadow IT - blog.knowbe4.com
Who Vets AI’s Code? The Scale Challenge Facing Open Source Ingestion - bleepingcomputer.com
AI 'watermark removers' flood the web. Almost none can prove they work. - bleepingcomputer.com
AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions - securityweek.com
New Android malware lets criminals use your bank card in real time - malwarebytes.com
WhatsApp rolls out new feature that flags potential scam messages - bleepingcomputer.com
White House taps security firms for offensive hack-back operations - bleepingcomputer.com
White House Mobilizes Security Firms for Operations Against Foreign Cybercrime Gangs - securityweek.com
Parents take on Meta, TikTok, Google, and Snap in 3,000 youth safety lawsuits - malwarebytes.com

Cybersecurity Brief – 2025-12-13

Sat, 13 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang suffered a data breach affecting 33.7 million customers, traced to a former employee who retained internal system access after departure.
Fieldtex Products experienced a data breach impacting 238,000 individuals, with the Akira ransomware group claiming responsibility for stealing 14 GB of data.
At least nine organizations were compromised through exploitation of a recently patched Gladinet CentreStack vulnerability.
A fake torrent for “One Battle After Another” was used to distribute Agent Tesla RAT malware via malicious subtitle files.
Google ads are being abused to direct Mac users to malicious AI chat sites, resulting in the distribution of the Atomic macOS Stealer (AMOS).
The US government’s policy of publishing H-1B applicant social accounts has raised significant privacy concerns, exposing personal data to potential targeting, impersonation, and extortion.

Newly Discovered Vulnerabilities

Apple released emergency security updates to patch two zero-day WebKit vulnerabilities, both exploited in sophisticated attacks targeting specific individuals.
Two new types of vulnerabilities in React Server Components (RSC) were patched by the React team; these could lead to denial-of-service or source code exposure.
The React2Shell vulnerability (CVE-2025-55182) is under widespread exploitation, prompting emergency mitigation efforts and a CISA directive for federal agencies to patch by 12 December 2025. Some proof-of-concept exploits can bypass web application firewall (WAF) rules.
A new Windows zero-day vulnerability affecting the Remote Access Connection Manager (RasMan) service has been disclosed, with unofficial patches made available.
A critical GeoServer vulnerability is being actively exploited in XML External Entity (XXE) injection attacks, with CISA ordering immediate patching.
Notepad++ patched a vulnerability in its updater mechanism that allowed for update file authentication bypass and potential traffic hijacking.
Kali Linux 2025.4 released with three new hacking tools and desktop environment updates.
Zigbee protocol security assessment revealed two application-level attack vectors that can be exploited to remotely turn Zigbee endpoints on or off.

Notable Threat Actor Activity

North Korean threat actors are conducting job invitation scams via social media platforms such as Threads, going beyond typical fake employer scams.
Fake OSINT and GPT utility repositories on GitHub are being used to distribute a new, previously undocumented JavaScript-based remote access trojan (PyStoreRAT).
Supply chain attacks targeting GitHub Actions have increased in 2025, with researchers urging adoption of a shared responsibility model for open source security.
At least nine organizations were compromised by threat actors exploiting the Gladinet CentreStack vulnerability.
Criminals are leveraging malicious subtitle files in torrents and poisoned AI chat sites via Google ads to spread Agent Tesla RAT and Atomic macOS Stealer, respectively.

Trends, Tools, or Tactics of Interest

Advanced phishing kits (BlackForce, GhostFrame, InboxPrime AI, Spiderman) are using AI and multi-factor authentication (MFA) bypass techniques to facilitate large-scale credential theft.
Email-based phishing kits now leverage Telegram bots and custom administration panels for managing stolen data.
There is an observed increase in attacks exploiting React2Shell, including the use of WAF bypass techniques in proof-of-concept exploits.
Shadow IT in the form of “shadow spreadsheets” is exposing sensitive data outside official controls.
The browser is increasingly the main interface for generative AI tools within enterprises, raising concerns about policy, isolation, and data controls.
$320,000 was awarded at Zeroday.Cloud for exploits against open source projects such as Grafana, Linux Kernel, Redis, MariaDB, and PostgreSQL.
The Akira ransomware group continues to claim responsibility for significant breaches.
A new Android in-the-wild exploit (DNG) has been identified through suspicious image files uploaded to VirusTotal.
Vibe coding and unmanaged code practices are highlighted as introducing significant security risks.

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated that US federal agencies patch the actively exploited GeoServer vulnerability immediately.
MITRE released its 2025 list of the top 25 most dangerous software weaknesses, with XSS, SQL injection, and CSRF at the top.
Microsoft has expanded its bug bounty program to include critical vulnerabilities in third-party and open source code that impact Microsoft services.
Microsoft will bundle Security Copilot with M365 Enterprise licenses, alongside the launch of 12 new security agents.
The US government’s publication of H-1B applicants’ social media accounts has sparked privacy concerns due to increased exposure to cyber threats.
The Pentagon has ordered an accelerated transition to post-quantum cryptography (PQC) for its systems.
The Trump administration reportedly dropped sanctions against Chinese actors for the Salt Typhoon attacks on US telecoms, raising concerns about prioritising trade over cybersecurity enforcement.

Cybersecurity Brief – 2025-09-25

Thu, 25 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Boyd Gaming reported a data breach affecting employees and other individuals, as disclosed to the SEC.
A US Federal Civilian Executive Branch (FCEB) agency was breached via exploitation of a critical GeoServer vulnerability (CVE-2024-36401); attackers deployed China Chopper and remote access scripts and remained undetected for three weeks.
European airports experienced widespread disruptions due to a ransomware attack linked to the RTX group; the UK National Crime Agency arrested a suspect in connection with the incident. The attack on Collins Aerospace is believed to have involved HardBit ransomware.
Interpol-led law enforcement seized over $439 million in cash and cryptocurrency from cybercrime rings worldwide during a five-month joint operation.
A record-breaking DDoS attack peaked at 22 Tbps and 10 billion packets per second (Bpps), targeting a European network infrastructure company and linked to the Aisuru botnet.
The Python Package Index (PyPI) urged users to reset credentials following a new wave of phishing attacks using a fake PyPI website.
GitHub users were targeted in a large-scale phishing campaign impersonating Y Combinator via GitHub notifications, delivering cryptocurrency drainers.
KNP Logistics Group, a 158-year-old business, collapsed following a cyber incident attributed to poor password security.

Newly Discovered Vulnerabilities

Cisco disclosed a high-severity, actively exploited SNMP vulnerability in IOS and IOS XE Software allowing remote code execution or denial-of-service; patches have been released.
Two critical vulnerabilities were identified in Wondershare RepairIt, exposing private user data and enabling potential tampering with AI models.
Supermicro hardware was found to have two firmware vulnerabilities in its Baseboard Management Controller (BMC), which could allow attackers to create persistent backdoors by updating systems with malicious images.
A flaw in multiple OnePlus OxygenOS versions allows installed apps to access SMS data and metadata without permissions or user interaction; the issue remains unpatched.
Ongoing exploit attempts have been observed against an older Hikvision camera vulnerability.
SonicWall SMA devices were targeted with the ‘OVERSTEP’ backdoor; SonicWall released updates for SMA 100 appliances to remove the malware and improve file checks.

Notable Threat Actor Activity

Suspected Chinese threat actors (RedNovember) have been targeting global government and private sector organizations using Pantegana and Cobalt Strike.
UNC5221, believed to be China-nexus, used the BRICKSTORM backdoor to infiltrate US legal, SaaS, BPO, and technology sectors; Google reports the malware has been used for over a year for data theft and persistent espionage.
UNC6148 deployed the OVERSTEP backdoor in ongoing attacks against SonicWall SMA devices, enabling system control, credential theft, and evasion.
A new malware family, YiBackdoor, was discovered with significant code overlap with IcedID and Latrodectus, suggesting shared development or tool reuse.
A new ransomware variant, Obscura, was observed spreading from a victim’s domain controller.
Scattered Spider: A core member surrendered to authorities amid claims of the group’s shutdown; US prosecutors charged a UK national, linking the group to $115 million in ransomware payments.
Russian threat actors conducted a disinformation campaign targeting the upcoming Moldovan elections, linked to previous 2022 operations.
An npm package was found to use steganography (QR codes) to hide a credential-stealing malware, posing a supply chain risk.

Trends, Tools, or Tactics of Interest

Attackers are exploiting payment iframe security weaknesses to deploy malicious overlays on checkout pages, facilitating credit card data theft.
Burp Suite introduced Burp AI, providing on-demand AI assistance for penetration testing workflows.
AI pentesting is emerging, with new agentic capabilities being integrated into security tools.
Kali Linux 2025.3 was released, featuring ten new tools, Nexmon support, and NetHunter improvements.
OpenAI is internally testing a new GPT-5-based AI agent, “GPT-Alpha”.
Police forces are increasingly using drones equipped with license plate recognition technology.
GitHub is implementing enhanced security measures for npm supply chain protection, including mandatory 2FA, short-lived granular tokens, and trusted publishing workflows.

Regulatory or Policy Developments Affecting the Security Industry

GitHub announced new security requirements for npm package publishing, including mandatory two-factor authentication, expiring granular tokens, and trusted publishing, in response to recent supply chain attacks.

Cybersecurity Brief – 2025-09-24

Wed, 24 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Boyd Gaming Corporation disclosed a data breach following a cyberattack, resulting in the theft of employee and customer data.
Jaguar Land Rover extended its production shutdown due to a cyberattack, with operations paused until at least October 1 as investigations continue.
The American Archive of Public Broadcasting exposed restricted and copyrighted media for years due to inadequate access controls, allowing unauthorised downloads.
CISA reported that attackers breached a US federal agency’s network by exploiting an unpatched GeoServer instance.
The US Secret Service dismantled a major telecom threat in New York, seizing over 300 servers and 100,000 SIM cards used to threaten US officials and potentially disrupt critical infrastructure near the UN.
Eurojust coordinated the arrest of five suspects in a cryptocurrency investment fraud scheme, responsible for over €100 million in losses across 23 countries.
Fake versions of Malwarebytes, LastPass, and other software are being distributed via GitHub pages in a campaign targeting Mac users.
Scammers are impersonating the FBI using fake IC3 websites to steal personal data.

Newly Discovered Vulnerabilities

Pandoc (CVE-2025-51591): Actively exploited security flaw in Linux utility Pandoc allowed attackers to target AWS Instance Metadata Service (IMDS) and steal EC2 IAM credentials.
Libraesva Email Security Gateway (CVE-2025-59689): Command injection vulnerability exploited by state-sponsored actors, triggered via malicious emails with crafted compressed attachments. Emergency fix released.
Supermicro BMC Firmware: Two new vulnerabilities allow attackers to bypass root of trust security, enabling malicious firmware installation. Previous patches have been bypassed.
SolarWinds Web Help Desk (CVE-2025-26399): Critical unauthenticated remote code execution vulnerability. Multiple patch attempts have been made due to previous bypasses.
Microsoft Entra: Research revealed all tenants were exposed to silent compromise via invisible actor tokens.
NPM package ‘fezbox’: Newly discovered package uses QR codes to deliver second-stage, cookie-stealing malware.
SonicWall SMA 100: Firmware update released to remove rootkit malware deployed in recent attacks.

Notable Threat Actor Activity

State-sponsored actors exploited the Libraesva Email Security Gateway vulnerability in the wild.
ShadowV2 botnet operators are exploiting misconfigured AWS Docker containers to build a DDoS-for-hire platform, enabling customers to self-manage attacks.
Chinese-speaking threat actors are conducting SEO poisoning campaigns using BadIIS malware, redirecting traffic and planting web shells on compromised servers.
Scattered Spider: A juvenile suspect associated with this group was arrested in the US on charges of computer intrusion, extortion, and identity theft.
Attackers abused Google’s AppSheet platform to send phishing emails.
Large-scale campaign distributing fake software (Malwarebytes, LastPass, etc.) via GitHub targets Mac users.

Trends, Tools, or Tactics of Interest

DDoS Attacks: Cloudflare mitigated a record-breaking DDoS attack peaking at 22.2 Tbps and 10.6 billion packets per second. ShadowV2 and other botnets are leveraging exposed cloud-native tools (Docker containers) to evade detection and facilitate for-hire DDoS services.
Supply Chain Attacks: Surge in attacks targeting the npm ecosystem, including malicious packages and weak authentication mechanisms.
Ransomware: Despite rising incident counts in 2025, ransomware payments dropped 35% in 2024, indicating changes in RaaS economics.
Phishing: Abuse of legitimate platforms (Google AppSheet) for phishing campaigns continues.
SEO Poisoning: Increased use of SEO poisoning by threat actors to distribute malware and gain financial benefits.
Identity Governance: New free tools are emerging to streamline identity governance, onboarding, and access reviews for small organisations.
AI Security: New research highlights the top 25 vulnerabilities in Model Context Protocols, with risks including prompt injection and command injection targeting AI agents.

Regulatory or Policy Developments

GitHub announced mandatory two-factor authentication and short-lived access tokens for npm publishing, aiming to strengthen supply chain security following recent attacks.
European law enforcement, coordinated by Eurojust, continues cross-border efforts against large-scale cryptocurrency fraud.
CISA announced Steve Casapulla as Executive Assistant Director for Infrastructure Security.
Reports highlight ongoing concerns about the Japanese government’s cybersecurity posture, with incident counts nearly doubling and a significant proportion of critical systems unmanaged.
New revelations show the US Department of Homeland Security collected DNA from nearly 2,000 US citizens, raising oversight and legality concerns.