https://blog.dansec.red/vendors/horde/Recent content in Horde on DanSec DailyHugoen-gbThu, 15 May 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-05-15-cybersecurity-news/Thu, 15 May 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-05-15-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li> <p><strong>Coinbase Data Breach and Extortion Attempt</strong></p> <ul> <li>Coinbase disclosed a data breach affecting approximately 1% of its users after cybercriminals bribed customer support agents. Attackers accessed sensitive customer information, including government IDs, and attempted to extort $20 million. The extortion attempt failed, but the incident highlights ongoing risks to cryptocurrency platforms from both insider and external threats.</li> </ul> </li> <li> <p><strong>Nova Scotia Power Data Breach</strong></p> <ul> <li>Nova Scotia Power confirmed a cyberattack resulting in the theft of sensitive customer data. The breach was discovered last month and underscores the persistent targeting of critical infrastructure and utility providers.</li> </ul> </li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li> <p><strong>SAP NetWeaver (CVE-2025-31324)</strong></p> <ul> <li>A critical vulnerability in SAP NetWeaver is being actively exploited by multiple threat actors, including ransomware groups BianLian and RansomExx. The flaw allows remote code execution and has led to a surge in attacks against unpatched systems. Immediate patching is strongly advised.</li> </ul> </li> <li> <p><strong>Samsung MagicINFO 9 Server (CVE-2025-4632)</strong></p> <ul> <li>Samsung patched a critical vulnerability (CVSS 9.8) in MagicINFO 9 Server that was actively exploited to deploy Mirai botnet variants. Organizations using this software should update immediately.</li> </ul> </li> <li> <p><strong>Google Chrome High-Severity Flaw</strong></p> <ul> <li>Google released emergency updates addressing a high-severity Chrome vulnerability that has a public exploit and is being used in the wild for cross-origin data leaks via the Loader Referrer Policy. All users are advised to update promptly.</li> </ul> </li> <li> <p><strong>Ivanti Endpoint Manager Mobile (EPMM) Zero-Day Flaws</strong></p> <ul> <li>Ivanti confirmed exploitation in the wild of zero-day vulnerabilities in EPMM, affecting a limited number of customers. The flaws stem from open source library issues and are being used in chained attacks.</li> </ul> </li> </ul>