Today's cybersecurity landscape highlights critical vulnerabilities, with several zero-day exploits actively targeting popular platforms and tools. Data breaches continue to expose sensitive information, underscoring the ongoing need for robust security measures across all sectors.
Magento/Adobe Commerce 'StyleSmuggler' Zero-Day Actively ExploitedVulnerability
A critical zero-day vulnerability, dubbed 'StyleSmuggler,' affecting all versions of Magento and Adobe Commerce, is currently being exploited in the wild. Attackers are leveraging this flaw to execute code and install stealthy backdoors on compromised online stores, enabling long-term unauthorized access.
Why it matters: If you operate an online store using Magento or Adobe Commerce, immediately check for updates and apply any available patches or mitigations to prevent your site from being backdoored.
Read more at BleepingComputer ↗
N-able N-central RMM Platform Hit by Max-Severity RCE FlawVulnerability
N-able has released an emergency fourth hotfix in five weeks for its N-central remote monitoring and management (RMM) platform to address a maximum-severity remote code execution (RCE) vulnerability. This flaw has been exploited in the wild, posing a significant risk to organizations managing IT assets through the platform.
Why it matters: If your business uses N-able N-central, prioritize applying the latest hotfix immediately to protect your systems from active exploitation.
Read more at BleepingComputer ↗
MikroTik RouterOS Flaws Exploited to Hijack RoutersVulnerability
Threat actors are actively exploiting a chain of two recently disclosed vulnerabilities in MikroTik RouterOS to gain control of devices. Routers with SSH services exposed to the internet are particularly vulnerable to these attacks, allowing unauthorized access and potential network manipulation.
Why it matters: Secure your network by ensuring your MikroTik routers are updated with the latest patches and limiting SSH access to trusted networks only.
Read more at BleepingComputer ↗
ConnectWise ScreenConnect Abused in Worm-Like CampaignsVulnerability
Cybersecurity researchers have observed worm-like activity exploiting ConnectWise ScreenConnect, where malicious Visual Basic Scripts are distributed to newly connected systems. Attackers are using various initial access methods, including tech-support scams and phishing, to compromise ScreenConnect instances and propagate payloads.
Why it matters: If you use ConnectWise ScreenConnect, monitor for unusual activity, apply all available patches, and be wary of suspicious phishing attempts or tech-support scams.
Read more at The Hacker News ↗
Fake IT Support Calls Target Executives for Microsoft 365 Data TheftThreat
A widespread data theft and extortion campaign is targeting Microsoft 365 and other SaaS offerings by impersonating IT help desks through 'vishing' calls. Attackers use adversary-in-the-middle (AitM) techniques to steal authentication tokens, primarily focusing on executive staff to gain access to sensitive organizational data.
Why it matters: Educate your employees, especially executives, about vishing attacks and reinforce that IT will never ask for credentials over the phone or through suspicious links. Implement robust MFA and ensure token theft detection is in place.
Read more at The Hacker News ↗
JSCeal Malware Bypasses Google Authentication with Stolen Session CookiesThreat
JSCeal, a sophisticated JavaScript malware, has been uncovered with capabilities to harvest credentials, conduct surveillance, and intercept traffic. Notably, it can bypass Google authentication by exploiting stolen session cookies, posing a significant threat to user accounts and data.
Why it matters: Protect your online accounts by using strong, unique passwords, enabling multi-factor authentication (MFA) on all services, and being vigilant about phishing attempts that could lead to cookie theft.
Read more at The Hacker News ↗
Mathspace Discloses Data Breach Affecting Over 1 Million IndividualsBreach
The online math learning platform Mathspace has disclosed a data breach that exposed information belonging to more than one million students, staff, and parents. Attackers compromised the company's internal Metabase reporting system to exfiltrate the sensitive data.
Why it matters: If you or your children use Mathspace, be aware of potential phishing attempts targeting the exposed data and consider changing relevant passwords. Always use unique passwords for different services.
Read more at BleepingComputer ↗
Trezor Data Breach Expands to Affect 81,000 CustomersBreach
Hardware cryptocurrency wallet manufacturer Trezor has confirmed that an August data breach at its shipping and logistics provider, ShipMonk, now impacts an additional 67,000 U.S. customers. This brings the total number of affected Trezor customers to 81,000, with concerns about exposed personal shipping information.
Why it matters: If you are a Trezor customer, remain vigilant for phishing attempts or other scams that might leverage your shipping details. Ensure your crypto assets are secure and be wary of unsolicited communications.
Read more at BleepingComputer ↗
Complex PEEP Toolkit Turns Browsers into BackdoorsThreat
Researchers have detailed PEEP, a sophisticated Chromium-based post-exploitation toolkit designed to operate as a malicious browser extension. Once administrative access or code execution is achieved on a host, PEEP can be injected into Chrome/Edge profiles, bypassing standard security checks and turning the browser into a persistent backdoor.
Why it matters: Preventing initial administrative or code execution access is paramount. Implement strong endpoint security, regularly patch operating systems and browsers, and educate users about suspicious downloads or links.
Read more at The Hacker News ↗
North Korean Hackers Deploy New Linux Espionage ToolkitThreat
North Korean state-sponsored threat actors have been observed using a new, stealthy Linux espionage toolkit. This toolkit embeds a backdoor within HAProxy and is primarily targeting automotive and media organizations in South Korea for long-term surveillance and data exfiltration.
Why it matters: If your business operates in the targeted sectors or regions, enhance your Linux server monitoring, regularly audit HAProxy configurations, and apply advanced threat detection capabilities to identify unusual network behavior.
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.