CyberNews A massive cache of sensitive employee data has been put up for sale on the dark web by a threat actor claiming to have stolen 3.6 million records from major companies that use Microsoft Azure infrastructure. The attacker, known as “TheHatman,” claims to have accessed these records using compromised credentials, exploiting vulnerabilities in Azure’s security. … Read more
A sophisticated cyber threat actor has been using a custom-built command-and-control (C2) framework, dubbed Cavern C2, to evade detection and blend into legitimate network traffic. The framework’s unique approach involves leveraging DNS queries and Google Apps Script to maintain a low profile, making it particularly challenging for security teams to detect. The Cavern C2 framework … Read more
A Critical WordPress Flaw Exposes Sites to Remote Code Execution Attacks A severe vulnerability in Forminator, a popular WordPress plugin used by millions of websites, has been disclosed. The flaw allows attackers to execute arbitrary code on affected sites without authentication, potentially leading to data breaches and complete website takeover. This critical weakness is particularly … Read more
A critical vulnerability in GitHub Actions has been discovered, allowing attackers to inject malicious commands on vulnerable repositories. The flaw, found by a security researcher, lets hackers create specially crafted issues that can exploit a weakness in the way GitHub processes user input. This vulnerability affects all users of GitHub’s issue-tracking feature and poses a … Read more
Critical GitLab GraphQL Flaw Exposes Public Projects to Deletion by Unauthenticated Attackers A serious vulnerability in the GitLab platform’s GraphQL API has been discovered, allowing unauthenticated attackers to delete public projects. The flaw affects all GitLab instances that have the GraphQL feature enabled, making it a widespread issue that requires immediate attention from users and … Read more
Pokémon Center Suffers Data Breach Exposing Customer Information and Canceling Orders In a concerning development, Pokémon Center has announced that it has suffered a data breach after hackers targeted its third-party logistics provider, CEVA Logistics. The incident has exposed customer personal and order information for customers in the United Kingdom and Germany, prompting the company … Read more
A massive data breach affecting multiple major companies has come to light, with a threat actor claiming to have stolen over 3.6 million Azure account records from Fortune 500 organizations. The alleged hacker, known as “TheHatman,” is selling these databases on the dark web, which could potentially put millions of employees at risk. According to … Read more
A sophisticated threat actor has been using a novel technique called Cavern C2 to blend malicious activity with legitimate traffic, evading detection by security systems. This clever tactic leverages Google Apps Script and DNS to create an almost undetectable attack path, putting countless organizations at risk. Cavern C2 works by utilizing Google’s cloud infrastructure to … Read more
A Critical Flaw in Forminator WordPress Plugin Exposes Sites to Remote Code Execution Attacks A severe vulnerability has been discovered in the popular Forminator plugin for WordPress, which allows attackers to execute arbitrary code on affected websites without authentication. The critical flaw, uncovered by security researchers, can be exploited via malicious PHP uploads, putting hundreds … Read more
A Critical GitHub Actions Flaw Exposes Developers to Command Injection Attacks A severe vulnerability has been discovered in GitHub’s Actions feature, which allows maliciously crafted issues to trigger command injection attacks against developers’ repositories. The flaw, identified by a researcher, enables an attacker to inject arbitrary system commands into affected projects, giving them elevated privileges … Read more