// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Yesterday
-
Capcom confirms data breach affecting 11.7 million accounts
Capcom has confirmed a breach of its CAPCOM ID membership service exposed email addresses and related data for 11.7 million accounts.
-
Disgraced eMudhra drops out of TLS business after using cert private key of 4
eMudhra left the TLS certificate business after a signing ceremony error exposed a private key that could issue certificates for any website.
-
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised LiteLLM’s PyPI package and published malicious Docker images that steal credentials, secrets, and environment variables.
-
The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat
A webinar discusses AI agents operating on employee laptops with stored credentials and internal access, raising concerns about oversight and insider risk.
-
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Arista reports active exploitation of a zero-day SQL injection flaw in VeloCloud Orchestrator that allows authenticated users to gain operator privileges.
-
Indian tech company eMudhra announces withdrawal from certificate business after security incident
eMudhra announced it will withdraw from certificate services after a security incident involving a poorly generated private key.
-
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
eMudhra will exit its global SSL/TLS certificate business after a researcher found eight intermediate CA private keys were easily guessable.
-
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
A security roundup describes AI secrets leaks, PingCAP source theft, a Signal hang-up flaw, a Laravel authentication bypass, and other software vulnerabilities.
-
Exclusive: Bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber
A bipartisan U.S. bill would direct federal agencies to develop guidance on AI distillation attacks and convene industry on defensive cybersecurity.
-
Max-severity GitLab bug allows remote code execution over 12 years of releases
GitLab disclosed a critical bug enabling remote code execution affecting releases over 12 years.
-
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks issued security updates for an actively exploited zero-day vulnerability in VeloCloud Orchestrator on-premises deployments.
-
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Two CVSS 9.0 remote code execution flaws in Linux's KSMBD kernel SMB server were publicly disclosed before mainline kernel fixes were available.
-
Disgraced Indian cert issuer leaves the cert issuing business
Indian certificate authority eMudhra said it will stop issuing SSL/TLS certificates after a private key was reportedly the number 4.
-
Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
A Chinese state-aligned hacking group used automated AI tools in a supply chain attack against IT management software provider ConnectWise and is attempting similar compromises globally, Microsoft said.
-
Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations
A New Mexico court ordered Meta to pay $25 billion after finding 43 million privacy violations in a lawsuit linked to Cambridge Analytica.
-
PHP2Shell puts dozens of UK government services out of service
A PHP-related issue disrupted dozens of UK government services, with ministers reporting 32 unavailable and four partly disrupted but no confirmed compromise.
-
Microsoft shares how to fix broken Exchange Online EWS apps
Microsoft has outlined a temporary option to re-enable retired Exchange Web Services in Exchange Online so affected applications can continue working.
-
Hackers got a four-day head start on epic PHP2Shell vulnerability
Attackers began probing a PHP vulnerability before defenders were notified, giving them a four-day head start.
-
When the attacker becomes the user: Rethinking account takeover
A sponsored feature discusses how AI makes phishing easier, prompting a reevaluation of account takeover threats.
-
eMudhra kills its certificate business after researchers cracked its private keys in under a second
eMudhra shut down its certificate business after researchers said its private keys were weak enough to be cracked in under a second.
-
[tl;dr sec] #351 - PHP2Shell, Autopatching Skills, AWS Pathrunner
The post covers PHP2Shell, Trail of Bits open-source skills, and AWS Pathrunner, a tool for automating AWS IAM privilege escalation path checks.
-
Machine speed attacks require machine speed detection and response
A security report says stolen GitHub tokens, malicious AI installers, and MFA phishing can enable rapid data theft before defenders respond.
-
INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown
INTERPOL announced arrests of 1,462 suspects and disruption of 10,909 cybercrime networks during Operation Serengeti III, recovering over $105 million.
-
Amazon says PHP2Shell exploitation began 4 days before patches
Amazon reports that attackers began exploiting PHP2Shell vulnerabilities four days before security patches were released.
-
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
AWS says attacks on PHP2Shell began before disclosure, and Cloudflare reported millions of exploit attempts against the vulnerability.
-
GitLab warns of new max severity code execution vulnerability
GitLab has released patches for a maximum-severity regular expression compiler flaw that could allow remote attackers to execute arbitrary code on vulnerable servers.
-
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
333 Tor exit nodes were hijacked for three days to intercept SSH traffic and retrieve plaintext email.
-
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
Microsoft reports that a ConnectWise breach enabled Chinese spies to access 2,250 cloud tenants, with privileged access gained in some environments within three hours.
-
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
Railway reported possible unauthorized access to customer environment variables, with some decrypted values exposed, affecting a subset of users.
-
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A vulnerability in OpenCode allowed malicious MCP servers to execute code on Windows or WSL during sign-in, fixed in version 1.18.33.