Today's cybersecurity headlines reveal a surge in actively exploited vulnerabilities and several significant data breaches impacting millions. From critical software flaws being targeted in the wild to major companies like Shell and RingCentral facing data theft, the threat landscape remains dynamic and challenging.
Max-Severity SAP Commerce Cloud Vulnerability Actively ExploitedVulnerability
A critical remote code execution flaw in SAP Commerce Cloud, patched just days ago, is already under active exploitation by attackers. This vulnerability poses a severe risk, allowing unauthorized individuals to execute malicious code within affected systems.
Why it matters: If your business uses SAP Commerce Cloud, immediately apply the latest security patches to prevent potential remote code execution and protect your e-commerce operations.
Read more at BleepingComputer ↗
Hackers Exploiting macOS Screen Sharing Flaw with Monero MinerVulnerability
A recently discovered authentication bypass vulnerability in macOS Screen Sharing is being actively exploited by hackers. These attackers are using public exploit code to deploy Monero cryptocurrency miners on compromised macOS systems.
Why it matters: Ensure all macOS devices are updated with the latest security patches and disable Screen Sharing if it's not essential for your business to prevent unauthorized access and cryptominer infections.
Read more at BleepingComputer ↗
Unpatched GeoServer Zero-Day Under Active AttackVulnerability
Threat actors are currently exploiting an unpatched SQL injection vulnerability in GeoServer, which could lead to remote code execution. This zero-day exploit allows attackers to gain significant control over affected servers.
Why it matters: If your website or application uses GeoServer, monitor for any suspicious activity and apply patches immediately once available to protect against potential remote code execution.
RingCentral Data Breach Exposes 1.6 Million AccountsBreach
The ShinyHunters extortion group successfully breached RingCentral in July, compromising personal information from 1.6 million user accounts. The stolen data includes names, addresses, email addresses, and phone numbers.
Why it matters: If your business uses RingCentral, advise employees to be vigilant against phishing attempts that leverage this exposed personal information and consider enabling multi-factor authentication.
Read more at BleepingComputer ↗
Shell Investigates Data Theft Claims by Clop Ransomware GangRansomware
Oil giant Shell is conducting an investigation into a potential security incident after the Clop ransomware group claimed to have stolen 89GB of their data. This incident highlights the ongoing threat posed by sophisticated ransomware operations targeting large enterprises.
Why it matters: Regularly back up your data, implement strong network segmentation, and train employees on ransomware prevention to minimize the impact of such attacks on your business.
Read more at BleepingComputer ↗
Over 1,000 Charities Affected by Beacon CRM Data BreachBreach
More than 1,000 charitable organizations have been impacted by a data breach stemming from Beacon CRM. The incident's root cause is believed to be a compromised AWS access key that was publicly exposed through JavaScript build artifacts.
Why it matters: If your charity uses Beacon CRM, monitor for any unusual account activity and verify the security posture of any third-party services that handle sensitive data.
Arrests Made in €30M Bank Fraud Exploiting Service Provider FlawBreach
An international investigation has led to the arrest of four cybercriminals in Brazil and charges against three others in Europe. The group allegedly exploited a vulnerability at a service provider, enabling them to illicitly withdraw €30 million from Commerzbank customer accounts.
Why it matters: Regularly review the security practices of your third-party service providers and ensure strong contractual security clauses are in place to protect your business and customers from supply chain attacks.
Read more at BleepingComputer ↗
French Tax Authority Investigates Breach Affecting 600,000Breach
French authorities are investigating a data breach at the Directorate General of Public Finances (DGFIP) that occurred in late June. A hacker claims to have compromised the personal information of 600,000 individuals, reportedly gaining access by stealing or misusing an identity.
Why it matters: Be cautious of emails or communications claiming to be from tax authorities, as this breach could lead to targeted phishing scams; always verify official communications directly.
AmnesiaStealer macOS Malware Targets User Data and Browser SessionsThreat
A new Rust-based macOS information stealer, dubbed AmnesiaStealer, is designed to harvest sensitive user data. This malware collects passwords, keychain information, data from Chromium-based browsers, and Safari cookies, potentially enabling attackers to control browser sessions.
Why it matters: Keep your macOS systems updated, use a reputable antivirus solution, and be wary of downloading software from untrusted sources to protect against infostealers like AmnesiaStealer.
Google Cloud Outlines Post-Quantum Cryptography RoadmapPolicy
Google Cloud has released its comprehensive roadmap for achieving full post-quantum cryptography readiness, with significant milestones planned for 2027 and 2028. The company aims for complete readiness by 2029, preparing for the future threat of quantum computing breaking current encryption standards.
Why it matters: While directly impacting large cloud providers first, small businesses should begin to understand quantum-safe encryption to prepare for future security shifts and maintain data integrity in the long term.
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.