Aggregator

Операция Cronos оказалась лишь временной паузой для хакеров.

bshare分享插件投毒事件分析：废弃组件引发的恶意跳转风险

H2O-3≤V3.46.0.8中ImportSQLTable因正则校验不严，导致JDBC URL绕过引发反序列化漏洞。

用友U8Cloud < 20250924补丁版本 NCCloudGatewayServlet 命令执行漏洞

HackerNews 编译，转载请注明出处： 黑客组织SafePay声称对德国视频监控提供商Xortec的成功攻击负责，并将该公司列入其数据泄露网站。勒索软件支付截止日期为2025年10月27日。 Xortec GmbH总部位于法兰克福，在德国各地设有办事处，是一家增值分销商和系统集成商，专注于视频监控、IP网络和安全解决方案。该公司为企业及安装服务客户提供摄像头、网络录像机、门禁系统、布线与咨询服务。Xortec于2021年被Beyond Capital Partners收购，是一家快速增长的B2B公司，拥有数十名员工，年收入超过750万欧元，其增长主要由大型安装项目驱动。 该公司的客户主要为B2B类型：包括系统集成商、专业安装商、系统厂商以及在全球（尤其是在德语区及更广泛的国际市场）运营的经销商。鉴于其核心业务聚焦于视频监控和通信解决方案，Xortec提供的产品与服务构成了零售、物流、公共及私人基础设施和关键设施等多个行业安全基础架构的支撑。 对Xortec这类公司的攻击可能因其在安全供应链中的角色而产生广泛影响。攻击者可能在安装商使用的硬件或软件中植入后门，从而泄露客户数据、监控布局和运输记录。遭篡改的固件可能破坏对数千个已部署系统的信任。若Xortec的物流运营受阻，其影响将波及经销商和最终用户，甚至可能涉及交通或公用事业等关键行业——这使得此次入侵事件成为一个超越单一公司范畴的、系统性的、多层级风险。 SafePay是一个自2024年底开始活跃的快速崛起的勒索软件组织。该组织独立运营，采用数据窃取与加密的双重勒索策略，其攻击目标遍布制造业、医疗保健和政府等全球多个行业。该网络犯罪组织在获取访问权限后的24小时内迅速行动，并且会避开俄罗斯系统，这暗示其可能源于东欧地区。   消息来源：securityaffairs； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

Security researchers at Datadog have uncovered a sophisticated phishing technique that weaponizes Microsoft Copilot Studio to conduct OAuth token theft attacks. Dubbed “CoPhish,” this attack method leverages the legitimate appearance of Microsoft domains to trick users into consenting to malicious applications. The attack exploits a fundamental trust issue: users naturally trust URLs hosted on official […]

The post Critical CoPhish Exploit Uses Copilot Studio to Hijack OAuth Tokens appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers are actively exploiting a critical flaw in Microsoft’s Windows Server Update Services (WSUS), with security researchers reporting widespread attempts in the wild. The vulnerability, tracked as CVE-2025-59287, allows remote code execution on unpatched WSUS servers, potentially granting attackers full control over enterprise networks. As of October 27, 2025, firms monitoring global scan data have […]

The post Hackers Exploiting Microsoft WSUS Vulnerability In The Wild – 2800 Instances Exposed Online appeared first on Cyber Security News.

前端安全侧信道获取敏感数据的一些方法。

HackerNews 编译，转载请注明出处： 据当地媒体报道，本周初俄罗斯农业与食品安全监管机构遭遇网络攻击，导致全国范围内的食品运输受阻。 俄罗斯联邦动植物卫生监督局表示，其在周三遭受了大规模分布式拒绝服务攻击，影响了其在线基础设施，包括用于追踪农产品和化学品流动的”VetIS”和”Saturn”系统。 据俄罗斯贸易媒体《Shopper’s》报道，此次中断导致食品交付严重延迟，因为电子兽医认证平台”Mercury”——VetIS系统的组成部分——一度无法访问。两家主要乳制品生产商和一家婴儿食品制造商向该媒体透露，他们在周三数小时内无法运输产品。 俄罗斯联邦动植物卫生监督局称，其网络中存储的数据”在完整性和机密性方面未受到威胁”。该机构未对事件进一步置评，目前尚无黑客组织声称对此次攻击负责。 根据俄罗斯法律，处理肉类、牛奶、鸡蛋和其他动物产品的公司必须在Mercury系统注册，并出具确认产品真实性和安全性的电子兽医证书。没有这些证书，供应商无法合法地向零售商或加工商交付货物。 一家公司经理表示，生产流通瘫痪了半日，并补充说由于缺乏允许在没有电子文件的情况下发货的应急程序，导致了经济损失。 俄罗斯联邦动植物卫生监督局否认了关于系统长时间中断的报道，并于周四表示Mercury系统正在”照常运行”。截至周五，该机构的网站可以访问，但尚不清楚所有受影响的系统是否已完全恢复。 据报道，这是Mercury系统今年第四次遭遇攻击。在6月份，类似事件曾迫使乳制品生产商恢复使用纸质证书，由于区域分销中心和主要零售商难以应对供应中断，引发了物流混乱。 据当地乳制品行业协会称，一些零售商当时拒绝接收没有电子文件的产品，而监管机构不明确的指导也导致了供应商的困惑。   消息来源：therecord.media； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

Компания молчит о деталях инцидента, оставляя место для самых тревожных предположений.

攻防演练

详解LOLBAS特性，利用系统自带的合法功能来实施隐蔽操作

深入剖析线程池睡眠混淆与扫描器的工作机制，规避对应的检测

A vulnerability was found in airesvsg ACF to REST API Plugin up to 3.3.4 on WordPress and classified as problematic. This affects an unknown function. The manipulation results in insertion of sensitive information into sent data. This vulnerability is identified as CVE-2025-62979. The attack can be executed remotely. There is not any exploit available.

A vulnerability has been found in WPeka WP AdCenter Plugin up to 2.6.1 on WordPress and classified as problematic. The impacted element is an unknown function. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2025-62984. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability, which was classified as critical, was found in KiotViet Sync Plugin up to 1.8.5 on WordPress. The affected element is an unknown function. Executing manipulation can lead to missing authorization. The identification of this vulnerability is CVE-2025-62978. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in llamaman Simple Pull Quote Plugin up to 1.6.3 on WordPress. Impacted is an unknown function. Performing manipulation results in cross site scripting. This vulnerability was named CVE-2025-62985. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as problematic was found in Sarah Giles Dynamic User Directory Plugin up to 2.3 on WordPress. This issue affects some unknown processing. Such manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-62982. The attack can be launched remotely. No exploit exists.

A vulnerability classified as problematic has been found in FanBridge Signup Plugin up to 0.6 on WordPress. This vulnerability affects unknown code. This manipulation causes cross-site request forgery. This vulnerability is handled as CVE-2025-62986. The attack can be initiated remotely. There is not any exploit available.

A vulnerability marked as critical has been reported in MDZ Persian Admnin Fonts Plugin up to 4.1.03 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to missing authorization. This vulnerability is traded as CVE-2025-62980. It is possible to initiate the attack remotely. There is no exploit available.