Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Evooo1Bot Hijacks Linux Routers for Proxying, Credential Theft and DDoS Attacks

A new Linux botnet named Evooo1Bot is turning internet-facing routers and other gateway devices into SOCKS5 traffic relay nodes, giving atta...

All the recent news you need to know
Vulnerabilities and Exploits
Arbitrary code execution Commerce Cloud SAP Flaw Vulnerabilities and Exploits

SAP Commerce Cloud Vulnerability Targeted After Patch

 

A maximum-severity vulnerability in SAP Commerce Cloud is reportedly facing exploitation attempts only days after SAP released a security update. Tracked as CVE-2026-58231, the flaw carries a CVSS score of 10.0 and affects the platform’s Data Hub Adapter component. Its rapid targeting highlights the risks organizations face when internet-facing enterprise software remains unpatched. 

The vulnerability stems from insufficient authorization checks and inadequate input validation. According to the vulnerability description, an unauthenticated attacker can abuse a default authentication client and submit specially crafted input to functions that do not properly validate requests. Successful exploitation could allow arbitrary code execution and enable attackers to compromise internal components, potentially affecting the confidentiality, integrity, and availability of affected Commerce Cloud environments. 

Threat intelligence company Defused Cyber reportedly observed exploitation attempts against its honeypot systems approximately three days after the patch was released. However, the company stated that the activity did not include a publicly available proof-of-concept and that confirmed exploitation in customer environments had not been established at the time of reporting. Even so, the short gap between patch availability and attack activity demonstrates how quickly threat actors can reverse-engineer or operationalize information about critical enterprise vulnerabilities. 

SAP security specialists have urged customers to treat the issue as an emergency. Organizations using the affected Commerce Cloud release should apply the fixed version identified in SAP’s security guidance, rebuild the updated application, and redeploy it. Simply installing a component update may not be sufficient if the deployment process requires rebuilding and publishing a refreshed Commerce Cloud version. Administrators should also review logs, authentication activity, unusual requests, and unexpected changes to internal services for possible indicators of compromise. 

If immediate patching is not possible, organizations can temporarily reduce exposure by configuring an IP Filter Set to restrict access to the vulnerable endpoint. Network controls should be considered only as a short-term mitigation, not a replacement for the official update. Security teams should identify all internet-facing SAP Commerce Cloud instances, confirm their versions, limit unnecessary access, and increase monitoring around the Data Hub Adapter. Previous attacks against critical SAP products, including NetWeaver, show that criminal and espionage groups have targeted SAP flaws for code execution, persistence, and data theft.
Read more »
Vulnerability Discovery
Agentic Security AI Security AI Vulnerability Testing Claude Mythos Payment Network Security Visa Cybersecurity Vulnerabilities and Exploits Vulnerability Discovery

Visa Deploys Mythos to Uncover Vulnerabilities in Its Payment Network

During Anthropic’s Project Glasswing initiative, Visa evaluated Claude Mythos Preview against its global payment processing network. Operating across 200 countries and processing transactions across 160 currencies, Visa’s network connects 5 billion payment identifiers with more than 175 million merchant locations. 

Initial findings across participating critical infrastructure entities surfaced over 10,000 high- or critical-severity vulnerabilities within the initiative's first month. Beyond simple static scans, static flaw detection, the Mythos framework demonstrated the capacity to connect separate, minor flaws into across distinct network sectors into complex, composite attack chains. 

In response, Visa’s zero-trust architecture, network segmentation, and defense-in-depth controls successfully contained these hidden attack paths" or "potential entry points , keeping attackers from reaching them from the outside. After the Glasswing evaluation, Visa open-sourced its internal framework, the Visa Vulnerability Agentic Harness (VVAH). This system is meant to connect automated checks with reviews. 

VVAH has an 11-step process divided into four parts.

Contextual Threat Modeling
Using wide-ranging scans VVAH uses STRIDE/OWASP methods, in Phase 1 (Discovery & Modeling) to map the active attack surface before scanning. 

Noise Reduction & Consensus

Results are checked using paths where agents vote, which helps filter out false positives before alerting security teams. 

Model Agnosticism & Remediation Limits

Built on a vendor-neutral architecture VVAH works with Anthropic Claude and OpenAI-compatible tools during the checking steps. However full automatic code changes (Stage 10) and testing against attacks (Stage 11) still need models that can edit files directly. 

Visa’s adoption of these agentic security tools is part of a larger trend in enterprise measurement evolving past Mean Time to Detect (MTTD) and towards Mean Time to Adapt (MTTA), or how quickly an enterprise can validate, patch, and verify an exposure in their systems. To secure its software supply chain, Visa has required continuous software composition analysis and SBOM validation throughout their vendors. Visa is also involved with Project Lightwell, a collaboration between IBM, Red Hat, and Visa to help secure open-source components through AI-powered validation and patching processes. 

Visa ran Mythos against itself to prove that as offensive technologies become more automated in their reasoning, defensive systems need to be just as quick and sophisticated. “We open sourced VVAH to provide the community with a governed reference implementation and shift cybersecurity, so teams can patch flaws as fast as automated tools find them,” said Visa.
Read more »
macOS Security
Apple Critical Vulnerability cryptocurrency cryptocurrency mining CVSS Cyber Security iOS macOS flaw macOS macOS Security

Apple macOS Flaw Exploited in the Wild to Install Monero Cryptominers

 

A critical vulnerability in the recently updated Apple macOS has been weaponized by threat actors to mine Monero cryptocurrency, according to the Netherlands National Cyber Security Centre (NCSC-NL). The security flaw under identifier CVE-2026-65400 with a CVSS score of 9.8/10 impacts the macOS Screen Sharing component and is described as allowing ‘remote code execution via crafted network packets’. Apple released emergency security updates for macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9 this month to address the flaw. 

The tech giant explained the changes were related to an authentication issue, ‘fixing state management to ensure credentials are properly validated.’ The vulnerability was discovered by security researcher Alfredo Pesoli of Bynario. According to the NCSC-NL, there are currently reports of bad actors actively using this exploit. ‘Multiple systems with port 5900 open to the internet,’ the Netherlands-based watchdog stated in a report this week, ‘were compromised using this vulnerability.’ 

In all cases of exploitation detected so far, the attackers gained root access to the targeted systems and deployed a Monero cryptocurrency miner. It remains unclear how long the threat landscape had been targeting macOS Screen Sharing, how many systems had been impacted, and whether the mining activity was the sole motive behind the attacks. Several other flaws impacting the macOS Screen Sharing component have also been detected. 

They include CVE-2026-43760 which can lead to the disclosure of sensitive information, arbitrary file creation, and remote code execution under specific conditions; CVE-2026-43777, which may result in a denial-of-service scenario; and CVE-2026-43779 with a logic flaw that can cause applications to hijack connections from other processes. According to Pesoli’s research, there are additional privilege escalation possibilities in an older authentication method used by Screen Sharing, including VNC passwords. 

A threat actor with the VNC password could potentially access protected files or create new files with root permissions, resulting in remote code execution. The researcher also highlighted a pre-authentication vulnerability in the Screen Sharing daemon which, if successfully exploited, would allow an attacker to compromise a Mac with Screen Sharing enabled and without requiring a VNC password. ‘All the attacker needed was a target IP address,’ he added. 

His findings suggest that tens of thousands of Screen Sharing services were exposed to the internet, putting residential users, educational institutions, and corporations at risk. Researchers advise that Screen Sharing should not be exposed to the internet and recommend that such services be placed behind an IPsec or other secure access gateway. It is unclear how many macOS users had their systems compromised via the Screen Sharing flaw. 

However, cybersecurity analysts warn that AI-powered tools are facilitating faster threat modeling and detection, enabling attackers to exploit vulnerabilities almost immediately after they become publicly known. ‘We had an AI agent that helped us develop working exploits for two of the Screen Sharing vulnerabilities within hours of their disclosure,’ Calif, a security company, noted in a report. macOS users must install the latest software updates released by Apple to ensure their systems are protected against the newly discovered flaws. 

Customers who cannot immediately install the critical security patches should disable Screen Sharing in their Mac’s Sharing preferences until the updates are deployed.
Read more »
Trezor
Cryptocurrency Wallet Security customer data breach Data Breach Metabase vulnerability ShipMonk cyberattack Trezor

Trezor Data Breach Exposes Personal Information of Nearly 14,000 Customers

 

Hardware cryptocurrency wallet maker Trezor has disclosed a data breach involving the personal information of nearly 14,000 customers, after an unauthorized party gained access to data held by its third-party fulfillment provider, ShipMonk.

Trezor said its own infrastructure was not compromised and that the incident was discovered after the company was informed of the attack on August 10. The affected customers are located in the US, UK, Sweden, Colombia, Brazil, Italy and Portugal and placed orders between May 10 and August 8.

According to Trezor, the breach exposed the names, phone numbers, email addresses and shipping addresses of 11,742 customers. Information belonging to another 1,947 customers included their names, cities and email addresses. The data had been provided to ShipMonk solely to facilitate order fulfillment and delivery.

“We’re extremely sorry to inform our community that customer personal information, including full names, phone numbers, email addresses, and shipping addresses, has been accessed by an unauthorized actor during this breach,” Trezor said in its security notice.

The company attributed the limited scope of the exposure to its 90-day data retention policy, which it said is also followed by its fulfillment partners. However, Trezor warned that older orders may have been accessible for some of the customers whose information was partially exposed.

Trezor stressed that the incident did not affect its internal systems or the security of its hardware wallets. “To be clear, our systems were not compromised, and your Trezor device is secure, but the affected customers might be targeted by more sophisticated phishing attempts,” the company said.

All customers believed to be affected have been contacted directly by email. Trezor urged them to remain cautious of unexpected messages, particularly those asking for personal details, cryptocurrency information or immediate action.

The company is working with ShipMonk to establish when the compromise occurred and determine the complete extent of the incident.

Reports indicate that ShipMonk informed customers that the attackers gained access to its systems by exploiting a vulnerability in Metabase, a data analytics platform. The incident may be connected to a recently patched SQL injection zero-day affecting Metabase.

The cybercrime group ShinyHunters has also claimed responsibility for an attack on Metabase and subsequently published data it alleged was stolen from the analytics provider. However, the connection between that incident and the ShipMonk breach has not been independently established.

ShipMonk has not publicly confirmed the breach. It also remains unclear whether other organizations or individuals were affected, how much information may have been accessed, and who was ultimately responsible for the attack.

Read more »
US Department of Justice
Cyber Security GrapheneOS GrapheneOS Foundation mobile privacy Sam Tunick US Department of Justice

GrapheneOS Foundation Defends Privacy Features Amid US Case Involving User

 The US Department of Justice’s recent case against GrapheneOS user Sam Tunick has renewed discussions about mobile privacy, digital security and the limits of law enforcement access to personal devices. The GrapheneOS Foundation has responded by defending its open-source operating system and clarifying how its security mechanisms handle deleted information.

The Toronto-based non-profit organization said GrapheneOS is a lawful operating system and rejected any suggestion that the software itself is connected to illegal activity. The foundation emphasized that it has no responsibility to weaken features intended to protect users and their data.

Based on Android and currently designed for Google Pixel devices, GrapheneOS incorporates several security and privacy protections. The foundation argues that developing, distributing or using the operating system is protected under US constitutional principles and that legislation specifically targeting its security capabilities could face constitutional challenges.

One of the features at the centre of the case is GrapheneOS’s "duress password." Tunick reportedly provided the password to a US Customs and Border Protection officer. The feature is designed to trigger an immediate wipe of a device when a specific password or PIN is entered under coercion.

When activated, the process removes the phone’s stored information, including eSIM data. According to the foundation, the wipe occurs immediately, cannot be interrupted and cannot subsequently be reversed. As a result, data erased through the feature cannot be recovered from the device.

Despite the attention surrounding the duress password, the GrapheneOS Foundation has stressed that it represents only one small component of the operating system’s broader security architecture. The organization also cautioned that using such a feature could potentially have physical or legal consequences, meaning users need to consider the risks before relying on it during encounters with authorities or other coercive situations.

The legal dispute is also focused on Tunick’s treatment during the encounter. His attorney has alleged that the border officer did not provide Miranda warnings and disregarded Tunick’s requests to consult a lawyer.

Tunick’s legal team is seeking the exclusion of evidence obtained during the incident. The attorney has argued that the evidence should be dismissed because the authorities allegedly violated Tunick’s constitutional rights.

The case has consequently raised broader questions about the balance between individual privacy, device security and government authority, while putting renewed attention on how privacy-focused operating systems handle data deletion and compelled device access.

Read more »
Zero-Day
DNS Attack Drift OAuth token hack email security exchange Laundry Bear microsoft OWA Zero-Day

Russian Hackers Use Exchange Zero-Day in Email Attacks

 



Russia-aligned cyberespionage group Laundry Bear, also tracked as Void Blizzard and TA488, is exploiting a Microsoft Exchange Outlook Web Access (OWA) vulnerability to deploy a browser-based backdoor capable of maintaining access to victims' mailboxes even after credentials are changed or systems are reimaged.

Email security firm Proofpoint said it observed the campaign targeting government organizations in the US and Europe, as well as telecommunications, financial, hospitality and aerospace organizations. The activity uses OWAReaper, a sophisticated backdoor delivered through malicious emails exploiting CVE-2026-42897.

CVE-2026-42897 is a cross-site scripting vulnerability caused by inadequate HTML sanitization in OWA. A specially crafted email can contain malicious JavaScript that executes when the recipient opens the message in OWA. Proofpoint calls the technique a "half-click" exploit because opening the email can be enough to trigger the attack, without requiring the victim to click a link or open an attachment. Microsoft disclosed the vulnerability on May 14, 2026, and confirmed active exploitation.

Proofpoint found that infrastructure associated with the campaign had been established as early as March, nearly two months before Microsoft's disclosure, suggesting TA488 may have exploited the vulnerability as a zero-day. The group used ordinary-looking subjects concerning supply chains, research updates, tourism, gas markets and other industry-related information, making the messages less likely to be treated as malicious.

The emails contained JavaScript loaders and Base64-encoded payload fragments hidden within URLs associated with social-media-style icons. Once triggered, the code assembled and executed the OWAReaper payload.

OWAReaper operates entirely within the OWA reading pane. It can collect the victim's email address, username and Outlook configuration, while also attempting to capture credentials by creating invisible DOM elements that allow the browser's autofill mechanism to populate usernames and passwords.

The backdoor's most concerning capability is its persistence. It searches for Outlook add-ins with "ReadWriteMailbox" permissions and can use the "GetClientAccessToken" operation to obtain OAuth tokens. It then abuses Exchange's "UpdateFolder" operation to grant Owner-level permissions to the "Default" user across the victim's mail folders.

Because these permissions are stored server-side, changing the victim's password or reinstalling the compromised computer does not necessarily remove the attacker's access. OWAReaper also enables browser caching and places a malicious iframe into messages stored in OWA's offline IndexedDB database, allowing the payload to execute again when a poisoned message is opened from the cache.

The malware uses multiple channels for command and control. It periodically searches GitHub commit messages for encrypted commands containing the victim's email address and can also receive commands through specially formatted emails stored in OWA's cache.

For data theft, OWAReaper primarily uses HTTPS with encrypted URI paths that can be routed through image CDN services. It also has a direct-server fallback and a DNS-based exfiltration mechanism that encrypts and Base32-encodes stolen data before transmitting it through DNS queries.

Proofpoint linked OWAReaper to TA488 based on behavioral similarities with ZimReaper, malware previously used by the group against Zimbra email servers. In that campaign, TA488 exploited another XSS flaw, CVE-2025-66376, to steal emails, passwords, application passcodes and two-factor authentication codes.

The latest campaign therefore represents an evolution of the group's "half-click" approach, shifting from compromising individual webmail sessions toward establishing persistent access within the victim's mailbox environment.

Microsoft has since released security updates addressing CVE-2026-42897. The July 2026 Exchange Server update states that the code fix is available, while organizations that previously applied Microsoft's mitigation must follow Microsoft's guidance to remove it after installing the update. The vulnerability affects on-premises Exchange Server deployments, while Exchange Online is not affected.

Proofpoint has published indicators of compromise for the campaign, including malicious domains and the HTML message body containing the exploit and OWAReaper payload. Organizations using affected on-premises Exchange deployments should therefore investigate not only compromised endpoints, but also mailbox permissions, OAuth tokens and OWA browser storage when responding to suspected exploitation.

Read more »
Subscribe to: Posts (Atom)

Featured