Aggregator

A vulnerability, which was classified as critical, has been found in HashiCorp Vault and Vault Enterprise up to 1.20.x. This impacts an unknown function of the component AWS Auth Method. This manipulation causes authentication bypass using alternate channel. This vulnerability is handled as CVE-2025-11621. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

主要通过赌博网站传播的寰宇浏览器（Universe Browser）号称是“全网权威安全认证，值得信赖的浏览器”，安全公司 Infoblox 发现该浏览器会将流量理由经过中国境内的服务器，会秘密安装多个在后台静默运行的程序，它们的功能类似恶意程序，包括键盘记录、秘密连接和更改设备网络连接。研究人员表示，寰宇浏览器与赌博网站 BBIN（aka 寶盈集團）相关，研究人员将该组织命名为 Vault Viper，他们是在研究柬埔寨一赌场的系统时发现了 Vault Viper 相关的独特 DNS 指纹。研究人员逆向工程了寰宇浏览器，发现了很多类似恶意软件的功能，它还会试图逃避杀毒软件的检测。在浏览器启动时，它会立即检查用户的位置、语言以及是否在虚拟机中运行。它安装了两个扩展：其中一个允许上传屏幕截图。Infoblox 认为寰宇浏览器是识别富有玩家并获取其设备访问权限的完美工具。

其一，滥用配置不当的GitLab OIDC信任策略，实现从低权限用户到敏感角色的权限提升；其二，利用暴露的Spring Boot Actuator端点构造SSRF，窃取实例元数据并绕过S3存储桶的VPC端点限制。

Операция Cronos оказалась лишь временной паузой для хакеров.

Dell Technologies has disclosed three critical vulnerabilities in its Storage Manager software that could allow attackers to bypass authentication, disclose sensitive information, and gain unauthorized access to systems. Announced on October 24, 2025, these flaws affect versions of Dell Storage Manager up to 20.1.21 and pose significant risks to organizations relying on the tool for […]

The post Critical Dell Storage Manager Vulnerabilities Let Attackers Compromise System appeared first on Cyber Security News.

最新研究显示，80% 的企业缺乏对 API 的持续实时监控，这意味着它们针对 AI 智能体的攻击“视而不见”。

强势围观

👍 👍 👍

HackerNews 编译，转载请注明出处： 黑客组织SafePay声称对德国视频监控提供商Xortec的成功攻击负责，并将该公司列入其数据泄露网站。勒索软件支付截止日期为2025年10月27日。 Xortec GmbH总部位于法兰克福，在德国各地设有办事处，是一家增值分销商和系统集成商，专注于视频监控、IP网络和安全解决方案。该公司为企业及安装服务客户提供摄像头、网络录像机、门禁系统、布线与咨询服务。Xortec于2021年被Beyond Capital Partners收购，是一家快速增长的B2B公司，拥有数十名员工，年收入超过750万欧元，其增长主要由大型安装项目驱动。 该公司的客户主要为B2B类型：包括系统集成商、专业安装商、系统厂商以及在全球（尤其是在德语区及更广泛的国际市场）运营的经销商。鉴于其核心业务聚焦于视频监控和通信解决方案，Xortec提供的产品与服务构成了零售、物流、公共及私人基础设施和关键设施等多个行业安全基础架构的支撑。 对Xortec这类公司的攻击可能因其在安全供应链中的角色而产生广泛影响。攻击者可能在安装商使用的硬件或软件中植入后门，从而泄露客户数据、监控布局和运输记录。遭篡改的固件可能破坏对数千个已部署系统的信任。若Xortec的物流运营受阻，其影响将波及经销商和最终用户，甚至可能涉及交通或公用事业等关键行业——这使得此次入侵事件成为一个超越单一公司范畴的、系统性的、多层级风险。 SafePay是一个自2024年底开始活跃的快速崛起的勒索软件组织。该组织独立运营，采用数据窃取与加密的双重勒索策略，其攻击目标遍布制造业、医疗保健和政府等全球多个行业。该网络犯罪组织在获取访问权限后的24小时内迅速行动，并且会避开俄罗斯系统，这暗示其可能源于东欧地区。   消息来源：securityaffairs； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

Security researchers at Datadog have uncovered a sophisticated phishing technique that weaponizes Microsoft Copilot Studio to conduct OAuth token theft attacks. Dubbed “CoPhish,” this attack method leverages the legitimate appearance of Microsoft domains to trick users into consenting to malicious applications. The attack exploits a fundamental trust issue: users naturally trust URLs hosted on official […]

The post Critical CoPhish Exploit Uses Copilot Studio to Hijack OAuth Tokens appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers are actively exploiting a critical flaw in Microsoft’s Windows Server Update Services (WSUS), with security researchers reporting widespread attempts in the wild. The vulnerability, tracked as CVE-2025-59287, allows remote code execution on unpatched WSUS servers, potentially granting attackers full control over enterprise networks. As of October 27, 2025, firms monitoring global scan data have […]

The post Hackers Exploiting Microsoft WSUS Vulnerability In The Wild – 2800 Instances Exposed Online appeared first on Cyber Security News.

HackerNews 编译，转载请注明出处： 据当地媒体报道，本周初俄罗斯农业与食品安全监管机构遭遇网络攻击，导致全国范围内的食品运输受阻。 俄罗斯联邦动植物卫生监督局表示，其在周三遭受了大规模分布式拒绝服务攻击，影响了其在线基础设施，包括用于追踪农产品和化学品流动的”VetIS”和”Saturn”系统。 据俄罗斯贸易媒体《Shopper’s》报道，此次中断导致食品交付严重延迟，因为电子兽医认证平台”Mercury”——VetIS系统的组成部分——一度无法访问。两家主要乳制品生产商和一家婴儿食品制造商向该媒体透露，他们在周三数小时内无法运输产品。 俄罗斯联邦动植物卫生监督局称，其网络中存储的数据”在完整性和机密性方面未受到威胁”。该机构未对事件进一步置评，目前尚无黑客组织声称对此次攻击负责。 根据俄罗斯法律，处理肉类、牛奶、鸡蛋和其他动物产品的公司必须在Mercury系统注册，并出具确认产品真实性和安全性的电子兽医证书。没有这些证书，供应商无法合法地向零售商或加工商交付货物。 一家公司经理表示，生产流通瘫痪了半日，并补充说由于缺乏允许在没有电子文件的情况下发货的应急程序，导致了经济损失。 俄罗斯联邦动植物卫生监督局否认了关于系统长时间中断的报道，并于周四表示Mercury系统正在”照常运行”。截至周五，该机构的网站可以访问，但尚不清楚所有受影响的系统是否已完全恢复。 据报道，这是Mercury系统今年第四次遭遇攻击。在6月份，类似事件曾迫使乳制品生产商恢复使用纸质证书，由于区域分销中心和主要零售商难以应对供应中断，引发了物流混乱。 据当地乳制品行业协会称，一些零售商当时拒绝接收没有电子文件的产品，而监管机构不明确的指导也导致了供应商的困惑。   消息来源：therecord.media； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

Компания молчит о деталях инцидента, оставляя место для самых тревожных предположений.

A vulnerability was found in airesvsg ACF to REST API Plugin up to 3.3.4 on WordPress and classified as problematic. This affects an unknown function. The manipulation results in insertion of sensitive information into sent data. This vulnerability is identified as CVE-2025-62979. The attack can be executed remotely. There is not any exploit available.

A vulnerability has been found in WPeka WP AdCenter Plugin up to 2.6.1 on WordPress and classified as problematic. The impacted element is an unknown function. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2025-62984. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability, which was classified as critical, was found in KiotViet Sync Plugin up to 1.8.5 on WordPress. The affected element is an unknown function. Executing manipulation can lead to missing authorization. The identification of this vulnerability is CVE-2025-62978. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in llamaman Simple Pull Quote Plugin up to 1.6.3 on WordPress. Impacted is an unknown function. Performing manipulation results in cross site scripting. This vulnerability was named CVE-2025-62985. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as problematic was found in Sarah Giles Dynamic User Directory Plugin up to 2.3 on WordPress. This issue affects some unknown processing. Such manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-62982. The attack can be launched remotely. No exploit exists.

A vulnerability classified as problematic has been found in FanBridge Signup Plugin up to 0.6 on WordPress. This vulnerability affects unknown code. This manipulation causes cross-site request forgery. This vulnerability is handled as CVE-2025-62986. The attack can be initiated remotely. There is not any exploit available.