Security· · 2 minPHP's Vulnerability Woes.
Today's cybersecurity landscape is buzzing with vulnerabilities and breaches that affect major players across various sectors. From PHP's unpatched RCE risks to the alarming rise of token-spraying attacks on Microsoft 365, it's clear that the threat landscape is evolving rapidly. Buckle up, because these stories could impact you or your organization.
PHP's Vulnerability Woes
PHP is in hot water again. Just two days after emergency patches for PHP2Shell, they announced yet another unpatched remote code execution (RCE) vulnerability. With millions of PHP hosts exposed, developers need to tighten their security measures ASAP.
Adding to the chaos, a critical flaw in the widely-used Pillow library allows code execution via crafted images. It's a double whammy for developers relying on these tools.
Cyber Attacks Escalate
Russian-linked hackers have deployed a new mesh network backdoor in Ukraine, showcasing the increasing sophistication of cyber warfare tactics. This attack highlights the need for robust defense mechanisms amid ongoing geopolitical tensions.
Meanwhile, a massive breach affecting 11 million Capcom customers raises serious concerns about data security in the gaming industry. Users are advised to stay vigilant for phishing attempts following the breach.
Widespread Data Breaches
Quest Diagnostics has confirmed a breach exposing patient records, reminding us how critical healthcare data protection is. This breach adds to a troubling trend, with 69% of data breach victims recently affected by third-party breaches, primarily linked to tech firms.
In a shocking revelation, Toronto Crime Stoppers paused tip submissions after a breach compromised the anonymity promise to tipsters. This incident underscores the importance of data security for organizations handling sensitive information.
Emerging Threats
AI is making waves, but not all of them are good. A new report shows how AI agents can be manipulated into executing harmful commands without any software vulnerabilities. This raises serious concerns about the safety and oversight of AI technology.
On the supply chain front, LiteLLM suffered a fresh attack, with compromised packages downloaded over 49,000 times in just three hours. It's a stark reminder of how crucial supply chain security is in today's digital landscape.
PHP Warns of Another Unpatched RCE Risk
PHP has identified a new RCE vulnerability just days after emergency patches. Developers are urged to apply mitigations until a patch is available.
Capcom Breach Affects 11 Million Users
Capcom confirms a breach affecting over 11 million users, with hackers accessing email addresses and some personal information.
- Widespread Token-Spraying Attacks Target Microsoft 365 AccountsA new BEC campaign targets Microsoft 365 accounts using token-spraying attacks. — Infosecurity Magazine
- HPE Patches Eight Max Severity RCE and Auth Bypass AOS FlawsHPE patches critical vulnerabilities in ArubaOS affecting enterprise networks. — Bleeping Computer
- Microsoft Windows Server 2016 Reaches End of SupportMicrosoft warns that Windows Server 2016 will no longer receive security updates after January. — Bleeping Computer
- Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016The Iranian APT resumes operations with a C&C server based in the US. — SecurityWeek
- MythicRatatoskr: An Yggdrasil-enabled BackdoorA new backdoor utilizing the Yggdrasil mesh network has been identified. — ESET
Was this issue useful?
One click is enough — it shapes the next one.