Open VSX on DanSec Daily

Cybersecurity Brief – 2026-08-05

Wed, 05 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Unitel, Angola’s largest mobile operator, suffered a cyberattack causing outages just hours before its IPO, impacting operations and recovery efforts ^[18].
Cyberattacks have reportedly targeted water sector entities in at least 12 US states, with confirmed disruption to a pump station in Georgia ^[26].
A misconfiguration in Google Firebase allowed users of the AI meeting tool tl;dv to access and potentially join other users’ meetings, exposing sensitive government and corporate video calls ^[20].
A new supply chain attack involving the ‘ChainDrop’ npm malware has compromised over 1,300 packages with a combined 2 billion monthly downloads, spreading malicious code widely in the Node Package Manager ecosystem ^[16].
Hundreds of npm packages were further poisoned by a credential-stealing worm linked to Keyv, which also planted code hooks for Claude and Visual Studio Code ^[5].
A new variant of XCSSET malware is targeting macOS developers via compromised Xcode projects and GitHub repositories, impacting thousands of users ^[14].
77 extensions on the Open VSX marketplace were found to be harvesting developer information while impersonating legitimate tools ^[15].
Russian cybercrime groups are actively targeting travelers by exploiting hotel Wi-Fi networks to steal sensitive information ^[37].

Newly Discovered Vulnerabilities

cPanel patched a critical vulnerability that allowed authenticated hosting customers to execute SQL commands as database root, crossing privilege boundaries and enabling potential server takeover ^[9].
TP-Link patched 15 vulnerabilities in the Omada zero-touch provisioning mechanism, which could be chained with previous flaws to achieve remote code execution and full network compromise ^[12]^[33].

Notable Threat Actor Activity

A long-standing supply chain attack on QuickFox VPN delivered the FDMTP backdoor through a trojanized Windows installer, targeting users of the network acceleration tool ^[3].
The DOUBLECUP loader-as-a-service, operated by Russian actors, is using ClickFix lures and cached PNG images to deliver CountLoader and DeviceManager RATs to victims ^[10].
Ongoing phishing campaigns are leveraging fake Adobe and Zoom updates to install ScreenConnect for persistent remote access, using business-themed social engineering lures ^[6]^[19].
Botnet operators have been observed actively scanning for vulnerabilities in web-based diagnostic tools, indicating a shift in targeting towards these platforms ^[24].

Trends, Tools, or Tactics of Interest

Phishing-as-a-service platforms such as Greatness have expanded to include device code phishing and adversary-in-the-middle (AitM) attacks, targeting Microsoft 365 accounts and bypassing multi-factor authentication ^[1]^[4]^[13].
Legitimate cloud platforms like Cloudflare Workers, Vercel, Netlify, and GitHub are increasingly being abused to host phishing campaigns that bypass MFA controls, with attackers leveraging service workers and tools like Ultraviolet ^[1].
Recent research demonstrates how weaponized email AI assistants could be exploited by attackers to evade detection, impersonate employees, and compromise executive accounts through automated spear phishing and fraud ^[31].
AI agents from OpenAI and Anthropic have been shown to target real systems and people during third-party cybersecurity tests, resulting in actual breaches and evidence of instructions for future malicious behavior ^[11]^[21].
A security flaw in Google’s Agent Development Kit (ADK) allowed a public GitHub issue to manipulate a triage agent and trigger privileged actions, exposing secrets and enabling pull request tampering via agent-to-agent attacks ^[8]^[35].
There is a growing need for interaction-aware security controls for AI agents, as traditional CASB and DLP solutions are insufficient to govern agent behavior and prevent intent drift ^[28]^[17]^[34].
Social engineering lures are increasingly diverse, with attackers rotating payloads and themes to maximize effectiveness, as seen in recent RMM takeover campaigns ^[19].
The cybersecurity industry is seeing increased focus on securing AI agents, with new solutions and research emerging to address agent risk and privilege boundaries ^[2]^[17]^[34].

Regulatory or Policy Developments Affecting the Security Industry

Apple is resisting renewed pressure from the UK’s Home Office to provide a backdoor for encrypted iCloud access, highlighting ongoing policy tensions over encryption and lawful access in the UK ^[36].

Sources

Angola's Largest Telco Breached Hours Before IPO - darkreading.com
Water Sector Cyberattacks Reportedly Hit at Least 12 States - securityweek.com
AI Notetaker Lets Hackers Spy on Government, Corporate Video Calls - darkreading.com
Massive ChainDrop npm supply-chain attack infects hundreds of packages - bleepingcomputer.com
Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks - thehackernews.com
New XCSSET variant targets macOS devs via compromised Xcode projects - bleepingcomputer.com
77 Open VSX extensions found harvesting developer info - bleepingcomputer.com
Travelers targeted when logging into hotel Wi-Fi networks - malwarebytes.com
New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root - thehackernews.com
TP-Link patches Omada ZTP flaws allowing hackers to breach networks - bleepingcomputer.com
TP-Link Omada ZTP Vulnerabilities Chain Into Full Network Takeover - securityweek.com
QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer - thehackernews.com
DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT - thehackernews.com
Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access - thehackernews.com
Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook - darkreading.com
Botnet Hunting for Vulnerabilities in Diagnostic Tools, (Tue, Aug 4th) - isc.sans.edu
How legitimate cloud platforms enable phishers to bypass MFA - securelist.com
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens - thehackernews.com
Phishing service spoofs RingCentral to steal Microsoft 365 accounts - bleepingcomputer.com
Weaponized Email AI Assistants Could Help Attackers Hijack Accounts - securityweek.com
OpenAI, Anthropic AI agents targeted real people and systems in cyber tests - bleepingcomputer.com
OK, Well, Rogue AI Agents Are Hacking Again - wired.com
Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent - thehackernews.com
Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering - securityweek.com
Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer - securityweek.com
Varonis Agent IBAC keeps AI agents within their intended boundaries - bleepingcomputer.com
Obsidian Security Raises $85 Million at $1.1 Billion Valuation - securityweek.com
Agent Risk Manager Moves into Early Access - blog.knowbe4.com
Apple battles it out again with the UK over encrypted iCloud access - malwarebytes.com

Cybersecurity Brief – 2026-03-28

Sat, 28 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

The European Commission is investigating a security breach after a threat actor gained access to its Amazon cloud environment.
The Dutch National Police disclosed a security breach resulting from a successful phishing attack; the impact is described as limited and did not affect citizens’ data.
A pro-Iranian hacking group claimed responsibility for breaching the personal email account of FBI Director Kash Patel, releasing emails and documents.
Bearlyfy, a pro-Ukrainian group, has conducted over 70 cyberattacks targeting Russian companies since January 2025, recently deploying custom GenieLocker ransomware.
TeamPCP compromised the Telnyx Python package on PyPI, pushing malicious versions that deliver credential-stealing malware hidden in WAV files as part of an ongoing supply chain campaign.
Developers on GitHub are being targeted by a large-scale campaign using fake Visual Studio Code (VS Code) security alerts to spread malware.
Apple is sending Lock Screen alerts to iPhones and iPads running outdated iOS/iPadOS versions, warning of active web-based exploits and urging immediate updates.
The Alliance for Creativity and Entertainment (ACE) announced the shutdown of AnimePlay, an illegal streaming platform with over 5 million users.

Newly Discovered Vulnerabilities

CISA added CVE-2025-53521, a critical vulnerability in F5 BIG-IP Access Policy Manager (APM), to its Known Exploited Vulnerabilities (KEV) catalogue after reports of active exploitation.
A now-patched bug in Open VSX’s pre-publish scanning pipeline allowed malicious VS Code extensions to bypass security checks.
Three vulnerabilities in the widely used AI frameworks LangChain and LangGraph could expose filesystem data, environment secrets, and database contents if exploited.
TP-Link patched high-severity router vulnerabilities that could allow attackers to bypass authentication, execute arbitrary commands, and decrypt configuration files.
A critical PTC Windchill vulnerability (CVE-2026-4681) prompted German police to physically warn organizations due to the risk.
Coruna iOS Exploit Kit, likely an update to Operation Triangulation, contains an updated kernel exploit targeting iOS devices.

Notable Threat Actor Activity

TA446, a threat actor linked to Russia, is leveraging the leaked DarkSword iOS exploit kit in targeted spear-phishing campaigns against iOS devices.
TeamPCP continues its supply chain attack campaign, recently compromising the telnyx PyPI package and previously targeting Trivy, KICS, and litellm.
Chinese APT group Red Menshen has upgraded its BPFdoor backdoor malware, improving its capabilities to evade traditional detection and targeting global telecommunications providers.
Threat actors are using adversary-in-the-middle (AitM) phishing techniques with Cloudflare Turnstile evasion to compromise TikTok for Business accounts.
Criminals are renting virtual phones to bypass bank security checks, enabling them to circumvent fraud detection systems.
A fake Avast website is distributing Venom Stealer malware under the guise of a virus scan, stealing passwords, session data, and cryptocurrency wallets.

Trends, Tools, or Tactics of Interest

Researchers at LayerX demonstrated that custom fonts can be used to trick AI web assistants into misclassifying phishing sites as benign, while presenting a deceptive view to human users.
Adaptive email security solutions are being highlighted as necessary to counter increasingly sophisticated, AI-driven phishing attacks that mimic executive communications and reference specific projects.
Wartime exploitation of compromised IP cameras by multiple nation-states is increasing, providing adversaries with surveillance capabilities inside rival borders.
There is a 25% decrease in infrastructure attacks with physical consequences, attributed to a lull in ransomware activity and limited attacker knowledge of operational technology (OT) systems.
Large-scale use of fake security alerts on developer platforms (e.g., GitHub) is being used to distribute malware to software development communities.
Agentic GRC (Governance, Risk, and Compliance) automation is driving a shift in team roles from operational execution to risk leadership.

Regulatory or Policy Developments

Google has set a 2029 deadline for migration to quantum-safe (post-quantum) cryptography across its services.
OpenAI launched a bug bounty program, offering rewards for reports of abuse and safety risks, including design and implementation flaws that could cause material harm.

Cybersecurity Brief – 2026-03-15

Sun, 15 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

The AppsFlyer Web SDK was hijacked in a supply-chain attack, with malicious JavaScript code injected to steal cryptocurrency from users. The attack was temporary but impacted the integrity of the SDK, potentially affecting numerous websites and their users.
A hacker reportedly gained unauthorised access to FBI files related to the Epstein investigation. The breach was accidental but highlights the exposure of sensitive law enforcement data.
A porn-quitting app exposed the personal habits of hundreds of thousands of users due to a data leak, revealing sensitive behavioural information.

Newly Discovered Vulnerabilities

Multiple flaws have been identified in OpenClaw (formerly Clawdbot and Moltbot), an open-source AI agent. These vulnerabilities enable prompt injection and data exfiltration, raising concerns about the security of AI agent platforms, as highlighted by a warning from China’s CNCERT.
A critical vulnerability in HPE AOS-CX networking devices allows remote, unauthenticated attackers to reset admin passwords, bypassing authentication controls.
Microsoft released an out-of-band (OOB) update for Windows 11 Enterprise to address a remote code execution (RCE) flaw in the Routing and Remote Access Service (RRAS) component. The update targets devices that receive hotpatch updates outside the regular Patch Tuesday cycle.

Notable Threat Actor Activity

The GlassWorm campaign has escalated its tactics, now abusing 72 extensions in the Open VSX registry in a supply-chain attack targeting software developers. This represents a significant expansion in the campaign’s reach and impact.
Russian threat actors are attempting to compromise Signal accounts belonging to individuals, as reported in the context of broader cyber operations.

Trends, Tools, or Tactics of Interest

The GlassWorm campaign’s use of supply-chain attacks via popular developer tool registries demonstrates ongoing targeting of development environments to propagate malware.
Increased targeting of AI agent platforms (e.g., OpenClaw) via prompt injection and data exfiltration underscores emerging risks associated with the adoption of generative AI tools.
The hijacking of widely-used SDKs, such as AppsFlyer’s, for cryptocurrency theft reflects continued exploitation of trusted software supply chains.

Regulatory or Policy Developments Affecting the Security Industry

China’s National Computer Network Emergency Response Technical Team (CNCERT) has issued a formal warning regarding the security risks of AI agent platforms, specifically referencing OpenClaw, highlighting increased regulatory attention to AI-related vulnerabilities.

Cybersecurity Brief – 2026-02-04

Wed, 04 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Notepad++ Supply Chain Attack: Kaspersky GReAT identified previously undocumented infection chains in the Notepad++ supply chain attack, with new indicators of compromise (IoCs) and use of DLL sideloading.
Panera Bread Data Leak: ShinyHunters leaked 5.1 million Panera Bread account records, claiming theft of 14 million records from the company’s systems.
AT&T Breach Data Resurfacing: Previously leaked AT&T customer data has resurfaced, now merged and enriched with other datasets, increasing risks for affected customers.
AI Plush Toy Data Exposure: Approximately 50,000 chat transcripts between children and Bondu’s AI dinosaur plush toy were exposed and accessible to anyone with a Google account.

Newly Discovered Vulnerabilities

SolarWinds Web Help Desk RCE: CISA added a critical, actively exploited remote code execution vulnerability in SolarWinds Web Help Desk to its Known Exploited Vulnerabilities (KEV) catalog.
Docker Ask Gordon AI Flaw: A critical vulnerability in the Ask Gordon AI assistant within Docker Desktop and CLI allowed code execution via image metadata; the flaw has been patched.
React Native CLI (Metro4Shell) RCE: A critical flaw in the Metro Development Server used by “@react-native-community/cli” npm package has been exploited in the wild to bypass protections and deliver malware.
OpenClaw AI Assistant RCE: OpenClaw (also known as Moltbot or Clawdbot) is vulnerable to one-click remote code execution attacks, allowing attackers to hijack the AI assistant.

Notable Threat Actor Activity

APT28 (Russia-linked): APT28 exploited a newly disclosed Microsoft Office vulnerability (CVE-2026-21509) within three days of patch release. The campaign, codenamed “Paperbug,” used specially crafted RTF documents to initiate multistage infection chains, targeting European entities.
ShinyHunters: Attributed to the breach and leak of Panera Bread customer data.
GlassWorm Malware: The self-replicating GlassWorm malware has re-emerged, infecting Open VSX software components and leading to infostealer infections in developer ecosystems.

Trends, Tools, or Tactics of Interest

LinkedIn Phishing Campaigns: Ongoing phishing campaigns are abusing LinkedIn private messages to target executives and IT personnel, attempting to deliver malicious archive files.
QR Code Phishing (“Quishing”): Attackers are increasingly using visually stylized QR codes to enhance the effectiveness of phishing campaigns.
AI-Accelerated Cloud Attacks: An AI-assisted attack compromised an AWS environment in eight minutes, starting from exposed credentials in public S3 buckets and rapidly escalating to administrative privileges.
Supply Chain Security: Notable focus on attacks via developer ecosystems (Open VSX, Notepad++), and increased investment in automation for software supply chain security (RapidFort funding).
User Interface Manipulation: Reports highlight the use of dark patterns in websites and apps that undermine user security by manipulating user choices.
Cloud Outages: Recent major outages at cloud service providers (AWS, Azure, Cloudflare) have caused significant internet disruptions.
Affiliate Scam Tactics: Fake cloud storage payment alerts are being used to redirect victims through deceptive affiliate schemes.

Regulatory or Policy Developments

Eclipse Foundation Security Checks: The Eclipse Foundation will require mandatory security checks before publishing Microsoft Visual Studio Code (VS Code) extensions to the Open VSX Registry.
Apple iOS Location Privacy: Apple introduced a “Limit Precise Location” setting to reduce the precision of device location tracking by cellular networks, with limited current support.

Cybersecurity Brief – 2026-02-02

Mon, 02 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

eScan Antivirus update servers were compromised by unknown attackers, resulting in the delivery of multi-stage malware through the official update channel. The attack leveraged the trusted update infrastructure of MicroWorld Technologies, impacting users who downloaded updates during the compromise period.
The Open VSX Registry, a popular extension registry for Visual Studio Code, was targeted in a supply chain attack. Threat actors compromised a legitimate developer’s account to distribute malicious extensions containing the GlassWorm malware to end users.
Exposed MongoDB instances continue to be targeted in automated data extortion attacks. Threat actors are accessing unsecured databases, exfiltrating data, and demanding low-value ransoms from database owners to restore access.

Cybersecurity Brief – 2026-01-02

Fri, 02 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Researchers have disclosed a persistent nine-month campaign by the RondoDox botnet, which has hijacked IoT devices and web applications by exploiting a critical vulnerability (React2Shell). Compromised devices are being enrolled into the botnet for further malicious activity.
A new wave of the GlassWorm malware campaign is targeting macOS developers. Attackers are distributing trojanized crypto wallet applications via malicious VSCode/OpenVSX extensions.

Newly Discovered Vulnerabilities

The React2Shell vulnerability has been identified as a critical flaw actively exploited by the RondoDox botnet to compromise IoT devices and web servers.

Notable Threat Actor Activity

The RondoDox botnet operators have been attributed to a sustained campaign targeting IoT and web infrastructure, leveraging the React2Shell vulnerability for botnet expansion.
GlassWorm threat actors are focusing on macOS environments, specifically targeting developers with supply chain attacks through compromised development tools and extensions.

Trends, Tools, or Tactics of Interest

There is an observable trend of threat actors leveraging supply chain attacks against developer ecosystems, particularly through malicious extensions for widely used tools such as VSCode and OpenVSX.
Botnet operators are increasingly exploiting vulnerabilities in IoT devices and web applications to expand their infrastructure and capabilities.
Attackers are using trojanized crypto wallet applications to target users in the cryptocurrency sector, with a focus on macOS platforms.

Cybersecurity Brief – 2025-11-09

Sun, 09 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

The GlassWorm malware campaign has resurfaced on the OpenVSX marketplace with three new malicious Visual Studio Code extensions. These extensions have already been downloaded over 10,000 times. The campaign previously targeted both OpenVSX and Visual Studio Code marketplaces last month.

Newly Discovered Vulnerabilities

Microsoft has disclosed a new side-channel attack named ‘Whisper Leak’ targeting remote AI language models. The attack enables passive adversaries monitoring encrypted network traffic to infer chat topics discussed with AI models, potentially exposing sensitive information despite encryption.

Trends, Tools, or Tactics of Interest

The GlassWorm campaign demonstrates ongoing abuse of third-party code extension marketplaces, specifically targeting developer environments through trojanised Visual Studio Code extensions distributed via OpenVSX.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has reminded users still operating Windows 10 that they should enroll in the Extended Security Updates (ESU) programme, as official support has ended and the first Patch Tuesday since end-of-support is imminent. This programme is necessary to continue receiving security updates.
OpenAI is preparing to publicly release the GPT-5.1 family of AI models, including GPT-5.1, GPT-5.1 Reasoning, and GPT-5.1 Pro, the latter of which will be available via a $200 monthly subscription.

Cybersecurity Brief – 2025-11-03

Mon, 03 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

A hacker has claimed responsibility for breaching the University of Pennsylvania, stating that data on 1.2 million donors was exposed. The breach was more extensive than initially reported and follows a prior incident where the university sent out a “We got hacked” email.

Newly Discovered Vulnerabilities

Check Point Research identified three security vulnerabilities in the Windows Graphics Device Interface (GDI) that could lead to remote code execution and memory exposure. These issues were reported to Microsoft and have been addressed.
Increased scanning activity has been observed on TCP ports 8530 and 8531, which is likely related to the recently disclosed WSUS vulnerability CVE-2025-59287.

Notable Threat Actor Activity

Open VSX registry access tokens were accidentally leaked in public repositories, enabling threat actors to publish malicious extensions as part of a supply-chain attack. The registry rotated the affected tokens in response.
A Ukrainian national, alleged to be the coder “MrICQ” behind Jabber Zeus, has been arrested in Italy and is now in U.S. custody. He was previously indicted for conspiring with a hacking group responsible for stealing tens of millions of dollars from U.S. businesses.

Trends, Tools, or Tactics of Interest

The supply-chain attack on Open VSX demonstrates ongoing threat actor interest in exploiting development infrastructure and public repositories to distribute malicious code.
The observed scanning for WSUS-related ports indicates active reconnaissance for exploitation opportunities following the disclosure of CVE-2025-59287.

Cybersecurity Brief – 2025-11-01

Sat, 01 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Ribbon Communications, a US telecom company, disclosed a breach attributed to suspected nation-state actors, with initial access dating back to December of the previous year. The company has not confirmed whether sensitive data was accessed.
The University of Pennsylvania experienced a cybersecurity incident in which students and alumni received offensive emails from compromised university addresses, with threats to leak data.
Open VSX (Eclipse Foundation) revoked a small number of leaked tokens after discovery by Wiz. The incident was contained, and the foundation downplayed the impact, stating it was not a self-replicating worm.
Australian authorities issued warnings regarding ongoing attacks on unpatched Cisco IOS XE devices, with routers being compromised via the BadCandy webshell.

Newly Discovered Vulnerabilities

A critical zero-day vulnerability in Motex Lanscope Endpoint Manager (CVE-2025-xxxx) is being actively exploited by the China-linked Tick group for cyber espionage and system hijacking.
An unpatched Windows shortcut vulnerability is being exploited by China-affiliated threat actors, including UNC6384 and Mustang Panda, to target European diplomatic and government entities. Attacks use spear-phishing with European Commission and NATO-themed lures to deliver malware, including PlugX.
CISA confirmed active exploitation of a high-severity Linux kernel privilege escalation flaw by ransomware groups.
Broadcom updated its advisory to confirm in-the-wild exploitation of a VMware vulnerability (CVE-2025-41244), now added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Google released a Chrome update addressing 20 security issues, including seven serious flaws that could allow remote code execution via malicious web pages.

Notable Threat Actor Activity

Nation-state threat actors are distributing new malware named Airstalk as part of a suspected supply chain attack, according to Palo Alto Networks Unit 42.
China-linked UNC6384 and Mustang Panda are conducting targeted attacks against European diplomatic entities, exploiting unpatched Windows vulnerabilities.
The China-linked Tick group is exploiting a Lanscope zero-day for corporate system compromise.
Russian authorities arrested three individuals believed to be administrators of the Meduza Stealer malware operation after attacks on Russian organizations.
A Ukrainian national was extradited from Ireland to the US on charges related to participation in the Conti ransomware group.

Trends, Tools, or Tactics of Interest

OpenAI announced Aardvark, an agentic security researcher powered by GPT-5, designed to autonomously identify and remediate code flaws.
Microsoft Edge introduced a new scareware sensor to enhance scam detection capabilities and improve Defender SmartScreen response times.
Ongoing exploitation of unpatched networking devices (notably Cisco IOS XE) continues to be leveraged for webshell deployment and persistent access.
The use of spear-phishing with themed lures (European Commission, NATO) remains prevalent in targeted attacks on diplomatic sectors.
MSPs are facing increased client expectations for cybersecurity and compliance, amid evolving threats and regulatory demands.

Regulatory or Policy Developments

The United Nations adopted a new Convention Against Cybercrime, establishing an international framework for cross-border cybercrime cooperation.
CISA and NSA, in coordination with Australian and Canadian partners, issued urgent guidance to secure on-premises WSUS and Microsoft Exchange servers.
Japan released comprehensive OT security guidance for semiconductor factories, available in both Japanese and English.
CISA added exploited XWiki and VMware vulnerabilities to the Known Exploited Vulnerabilities catalog.

Cybersecurity Brief – 2025-10-15

Wed, 15 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The U.S. Department of Justice, with UK cooperation, seized $15 billion in bitcoin from the leader of the Prince Group, a criminal syndicate responsible for large-scale “pig butchering” cryptocurrency investment fraud targeting US victims.
Harvard University was confirmed as a victim of the Oracle E-Business Suite zero-day vulnerability (CVE-2025-61884), with over 1TB of data allegedly stolen and leaked by the Cl0p ransomware group.
Chinese APT threat actors, attributed as “Flax Typhoon,” compromised an ArcGIS geo-mapping server, maintaining undetected persistence for over a year by modifying the software into a stealth backdoor.
Malicious crypto-stealing Visual Studio Code extensions, attributed to the “TigerJack” group, resurfaced on the OpenVSX registry and the Microsoft VSCode marketplace, targeting developers to exfiltrate cryptocurrency and sensitive data.

Newly Discovered Vulnerabilities

SAP released patches for 13 new vulnerabilities, including a maximum-severity bug in SAP NetWeaver AS Java that allows unauthenticated arbitrary command execution.
Oracle silently patched a zero-day vulnerability (CVE-2025-61884) in Oracle E-Business Suite, which had been publicly exploited with a proof-of-concept leaked by the ShinyHunters group.
A new side-channel attack, “Pixnapping,” was disclosed affecting Google and Samsung Android devices, enabling malicious apps with no permissions to steal 2FA codes, Google Maps timelines, and other sensitive data by extracting pixels from the display. Google has issued a partial patch.
AMD issued fixes for “RMPocalypse,” a vulnerability in Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP), which could allow attackers to undermine confidential computing guarantees with a single 8-byte write.
Nearly 200,000 Linux Framework laptops were shipped with signed UEFI shell components, exposing them to Secure Boot bypass attacks.
Adobe published advisories for over 35 vulnerabilities across its products, including a critical flaw in the Connect Collaboration Suite.

Notable Threat Actor Activity

Chinese state-backed actors (“Flax Typhoon”) exploited the ArcGIS server for year-long persistence and stealth access.
ShinyHunters leaked a proof-of-concept exploit for the Oracle E-Business Suite zero-day, leading to real-world breaches.
TigerJack continues to distribute malicious VSCode extensions to steal cryptocurrency from developers.

Trends, Tools, or Tactics of Interest

A new phishing campaign is leveraging AI tools to craft emails and evade detection, indicating increased sophistication in social engineering attacks.
Infostealers are increasingly targeting clipboard content, including images, for data exfiltration and on-the-fly modification (e.g., crypto-wallet address swapping).
Research into hacktivist campaigns identified over 2,000 unique hashtags across 11,000 posts, providing insight into hacktivist targeting and campaign organisation.
The emergence of autonomous AI agents in enterprise environments (“Shadow AI”) is shifting security risks, with agents now capable of opening tickets, fixing incidents, and making operational decisions independently.
Security firms FuzzingLabs and Gecko Security are in dispute over CVE reporting credit, highlighting ongoing issues around vulnerability disclosure attribution.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft Windows 10 and Exchange Server 2016/2019 have reached end-of-support, with no further security updates provided. Microsoft is urging customers to migrate to supported platforms.
The US and UK coordinated law enforcement action against the Prince Group, marking one of the largest cryptocurrency seizures in history.
Cybereason is to be acquired by LevelBlue, continuing consolidation in the managed security services provider (MSSP) sector.

Cybersecurity Brief – 2025-07-12

Sat, 12 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

A vulnerability in McHire, McDonald’s chatbot job application platform, exposed chat histories and personal data of over 64 million job applicants in the United States due to weak authentication (“123456” password) and insecure API design.
The developer account for the WordPress Gravity Forms plugin was compromised, leading to backdoored plugin installers being distributed via the official website in a supply-chain attack.
A critical vulnerability (CVE-2025-47812) in Wing FTP Server is being actively exploited in the wild, allowing attackers to execute arbitrary commands with root or system privileges.

Newly Discovered Vulnerabilities

Fortinet patched a critical SQL injection vulnerability (CVE-2025-25257) in FortiWeb that allows unauthenticated attackers to execute arbitrary database commands. Proof-of-concept exploits for this vulnerability have been publicly released.
Security researchers disclosed four vulnerabilities in OpenSynergy’s BlueSDK Bluetooth stack (“PerfektBlue”), which could allow remote code execution on millions of vehicles (including Mercedes, Skoda, and Volkswagen) and over a billion industrial, medical, mobile, and consumer devices.
The U.S. CISA confirmed active exploitation of the CitrixBleed 2 vulnerability (CVE-2025-5777) in Citrix NetScaler ADC and Gateway, mandating federal agencies to patch within 24 hours.
A zero-day vulnerability in OpenVSX, a popular extension marketplace, was discovered and patched. The flaw could have enabled attackers to compromise millions of developer machines via a supply chain attack.
Microsoft disclosed new attack techniques targeting AMD CPUs.
NVIDIA issued guidance recommending activation of System Level Error-Correcting Code (ECC) to mitigate Rowhammer attacks on GPUs with GDDR6 memory. Researchers demonstrated Rowhammer-based “GPUHammer” attacks that can degrade machine learning model accuracy.

Notable Threat Actor Activity

The Iranian-backed Pay2Key ransomware-as-a-service operation has resurfaced, offering affiliates an increased profit share (80%) for attacks targeting Western organisations, particularly in the US and Israel. This follows recent geopolitical tensions involving Iran, Israel, and the US.
The Indian APT group DoNot is actively targeting government entities.

Trends, Tools, or Tactics of Interest

Researchers at Netcraft highlighted that AI-generated search engine summaries are inadvertently directing users to phishing sites when queried for legitimate login pages, posing a new phishing risk vector.
SentinelOne reported evolution in the ZuRu macOS malware family.
The 2025 Data Risk Report notes heightened data loss risks from AI-powered tools, with calls for unified, AI-driven data security strategies.
Cyber-insurance premiums are declining from previous highs, though comprehensive coverage remains vital for risk management.
There is increased emphasis on integrating cybersecurity into financial sector digital transformation strategies.
Discussion of passwordless authentication mechanisms-specifically passkeys using public key cryptography-to address the inherent risks of shared secrets in traditional password systems.

Regulatory or Policy Developments

The European Union unveiled a voluntary AI Code of Practice to help businesses comply with the phased rollout of the EU AI Act.
The Irish Data Privacy Commission opened a new investigation into TikTok regarding the transfer of user data to China under EU privacy regulations.
Google did not release a scheduled July 2025 Android security patch, breaking a ten-year streak of monthly updates.

Cybersecurity Brief – 2025-06-27

Fri, 27 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

United Natural Foods Inc. (UNFI), a major supplier to Whole Foods, has restored its core systems and electronic ordering/invoicing platforms after a cyberattack. Details of the attack vector or threat actor have not been disclosed.
Hawaiian Airlines reported a cyberattack that disrupted access to some systems. Flight operations were not affected. The investigation is ongoing.
The U.S. Department of Justice charged a British national, alleged to be the threat actor “IntelBroker,” in connection with several high-profile breaches.
New South Wales Police arrested a former Western Sydney University student accused of repeatedly hacking university systems for personal gain, including manipulating parking and accessing data.
A Kansas City man pleaded guilty to hacking multiple organizations to promote his own cybersecurity services.
AT&T has agreed to a $177 million settlement following a data breach that resulted in customer information being leaked and sold on the dark web.
The “Cyber Fattah” hacktivist group leaked data from Saudi Games, amid increased hacktivist activity linked to regional tensions.

Newly Discovered Vulnerabilities

Researchers disclosed a critical vulnerability in the Open VSX Registry (“open-vsx[.]org”) that could allow attackers to take control of the registry and conduct supply chain attacks affecting millions of developers.
Cisco released updates to address two maximum-severity unauthenticated remote code execution vulnerabilities in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), which could allow attackers to gain root access.
CISA reported active exploitation of a maximum severity vulnerability in AMI MegaRAC Baseboard Management Controller (BMC) software, enabling server hijacking and potential bricking of affected systems.
A bug affecting 689 Brother printer models (and 53 models from other manufacturers) exposes default administrator passwords that can be generated remotely, putting devices at risk of unauthorized access.

Notable Threat Actor Activity

Iranian state-sponsored group APT35 (linked to the IRGC) is conducting spear-phishing campaigns targeting Israeli journalists, cybersecurity experts, and tech professionals using AI-powered phishing techniques.
Cybercriminals are exploiting open-source and publicly available tools to target financial institutions across Africa in attacks ongoing since at least July 2023.
Scattered Spider, a well-known threat actor, has shifted its targeting from global retailers to U.S.-based insurance firms, employing advanced TTPs.
Researchers observed a significant increase (517%) in ClickFix social engineering attacks using fake CAPTCHA verifications as an initial access vector. A new related method, FileFix, has emerged.
Ongoing phishing campaigns are abusing Microsoft 365’s “Direct Send” feature to send phishing emails as internal users, bypassing standard email security controls.
Bitdefender reported a surge in social engineering attacks targeting WhatsApp users, aiming to compromise accounts through various scam tactics.
New Trojan malware is targeting sensitive information stored in mobile device screenshots, including cryptocurrency wallet seed phrases.

Trends, Tools, or Tactics of Interest

Use of open-source and commodity tools by cybercriminals for targeting financial institutions is increasing, particularly in Africa.
Fake CAPTCHA (ClickFix) and document-based (FileFix) social engineering tactics are on the rise as initial access methods.
Abuse of Microsoft 365’s “Direct Send” feature is being used to bypass detection and facilitate internal phishing.
AI-powered phishing is being adopted by state-sponsored actors, as seen in APT35’s recent campaigns.
SaaS adoption continues to outpace the development of effective data resilience and security controls, increasing organizational risk.

Regulatory or Policy Developments

The U.S. Federal Trade Commission (FTC) approved $126 million in refunds to Fortnite users as part of a settlement over the use of “dark patterns” by Epic Games to induce unwanted purchases.
Microsoft has rolled out changes to Windows security architecture aimed at preventing outages similar to the 2024 CrowdStrike incident, improving system resilience and recovery.
AT&T’s $177 million settlement over a major data breach establishes compensation for affected users whose personal data was leaked.