Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.
The post PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress appeared first on SecurityWeek.
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed.
The post Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network appeared first on SecurityWeek.
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit.
The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek.
Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
Running at system boot, it periodically polled the update domain to execute any code served, with full privileges.
The post Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover appeared first on SecurityWeek.
953 Online Stores Infected in Long-Lasting Malware Campaign
Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection.
The post 953 Online Stores Infected in Long-Lasting Malware Campaign appeared first on SecurityWeek.
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe.
The post In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware appeared first on SecurityWeek.
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments.
The post China APT Uses AI Pentest Tool Artex in ConnectWise Attacks appeared first on SecurityWeek.
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016.
The post Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 appeared first on SecurityWeek.
Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader.
The post Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI appeared first on SecurityWeek.
AI Platform Cairn Abused to Hack Over 100 Organizations
At least three threat actors have been abusing Cairn for persistent access and financial theft.
The post AI Platform Cairn Abused to Hack Over 100 Organizations appeared first on SecurityWeek.
