Segurança· · 2 minExploits on the Rise.
Today’s cybersecurity landscape is buzzing with vulnerabilities and exploits. From SQL injection flaws to supply chain attacks, it’s clear that attackers are getting more creative. Buckle up — things are getting serious in the world of online security.
Exploits on the Rise
Ghost CMS is in the spotlight after a major SQL injection flaw (CVE-2026-26980) was exploited across 700+ sites, including prestigious universities. The vulnerability allows unauthorized access to sensitive data, and many have yet to patch it. This highlights a critical gap in website security protocols.
In a similar vein, the Drupal core SQL injection bug is now actively exploited and has been added to CISA’s Known Exploited Vulnerabilities catalog. If you’re running Drupal, it’s time to ensure your site is secure or risk a breach.
Supply Chain Attacks Keep Evolving
The npm registry is stepping up its game with 2FA for publishing and package installs to combat supply chain attacks. This move comes after several high-profile incidents, emphasizing the need for stronger security measures in package management.
On the other hand, Laravel Lang packages have been compromised to deploy credential-stealing malware. Attackers cleverly rewrote GitHub tags instead of creating malicious versions, making detection more challenging.
Emerging Threats
A new vulnerability, dubbed Underminr, is allowing attackers to conceal malicious connections behind trusted domains. This technique is a twist on domain fronting, posing new challenges for security teams trying to mitigate threats.
Additionally, a recent supply chain attack affected eight packages using GitHub-hosted Linux malware. It’s a stark reminder that even trusted platforms can be exploited, making vigilance essential.
Legal Moves Against Piracy
Italy's crackdown on the CINEMAGOAL piracy app has disrupted a sophisticated scheme that stole streaming authentication codes. The operation involved extensive searches and highlights the ongoing battle against digital piracy.
This operation illustrates the lengths authorities will go to protect intellectual property and combat unauthorized access to streaming services. Let’s see if other countries follow suit.
Ghost CMS SQL Injection Flaw Exploited
A critical SQL injection flaw in Ghost CMS has been exploited across over 700 domains, including major universities. Despite a patch being available, many sites remain vulnerable.
Laravel Lang Packages Compromised
Attackers hijacked Laravel Lang packages to deliver malware through malicious code hidden in GitHub tags. This supply chain attack has exposed thousands of developers.
Italy Disrupts CINEMAGOAL Piracy App
Italian authorities dismantled the CINEMAGOAL app, which stole streaming authentication codes from platforms like Netflix. The operation involved significant law enforcement coordination.
- npm Adds 2FA for Publishingnpm introduces 2FA-gated publishing and package install controls to thwart supply chain attacks. — The Hacker News
- Packagist Supply Chain Attack Infects 8 PackagesEight packages were infected as part of a supply chain attack using GitHub-hosted Linux malware. — The Hacker News
- CISA Adds Drupal Bug to KEVThe Drupal core SQL injection vulnerability is now actively exploited and listed by CISA. — The Hacker News
- LiteSpeed cPanel Plugin ExploitedA vulnerability in the LiteSpeed cPanel plugin has been exploited to execute scripts with root privileges. — The Hacker News
- Claude Mythos AI Finds High-Severity FlawsClaude Mythos AI has identified over 10,000 high-severity flaws in widely used software. — The Hacker News
Esta edição foi útil?
Um clique basta — isso orienta a próxima.