Daily Cyber News coverage affecting Technology.
Older Apple devices now have protection against a security issue used in highly targeted attacks. Apple backported the fix through iOS and iPadOS 18.7.11 after initially addressing newer software in September. A maliciously crafted file could allow code execution on an affected device. Public details…
An active campaign is using stolen GitHub tokens to extract secrets from private repositories. More than 13,500 malicious branches were recovered across over 850 compromised accounts. The attacker plants a workflow that encodes secrets, writes them into a run log, downloads the log through GitHub’s API…
A poisoned LiteLLM release exposed users to credential theft and remote access. The attack began with a master key accidentally published in a public repository in May and removed without being revoked. The attacker later used that key to obtain a privileged GitHub token and compromise additional…
Organizations running PHP face active exploitation attempts against two newly disclosed security issues. Federal civilian agencies were ordered to patch by Thursday, while other organizations were told to identify every PHP system and update it. Thousands of failed attack attempts have been reported…
Teams adopting OpenSSL 4.1.0 receive DTLS 1.3 support alongside four known defects in that code. Two issues can cause applications to misread connection states and either wait on a dead connection or close one that still works. Another can abort a handshake after packet loss, while a KeyUpdate issue can…
Organizations running affected Java releases need an update that removes impacted root certificate authority certificates related to eMudhra. Oracle classified the issue as critical with a 9.1 severity score. Affected software includes listed releases of Java SE, GraalVM Enterprise Edition and GraalVM for…
Developer credentials and systems can be exposed when AI coding agents interpret a downloaded instruction file as trusted project guidance. Researchers found an AGENTS.md file in a customer’s Downloads folder that directed an agent toward a rogue npm package. They reproduced the technique against OpenAI…
Web server compromise is now more practical because public exploit code is available for two critical PHP issues. A researcher used the pair to win a public Bitcoin challenge, although the published script was developed and tested against a local lab copy and succeeded about seven of ten times there. PHP…
Trust in eight eMudhra intermediate certificates collapsed after researchers reconstructed their weak private keys in under a second. Major browsers and software ecosystems blocked or updated trust for the affected certificates. eMudhra revoked them and announced its withdrawal from the global SSL and TLS…
Cloud intrusions moved from initial targeting to privileged access in less than three hours in some attacks attributed to China-aligned Storm-0940. The group used the ARTEX AI penetration-testing framework and stolen ConnectWise Cloud Backup credentials to target Microsoft 365 environments. Activity…
Developer and cloud credentials were put at risk when attackers compromised LiteLLM’s release pipeline. Version 1.107.0 on PyPI and affected Docker tags carried malware across Windows, Linux, and macOS. The payload ran during Python startup, stole secrets and environment data, and could fetch additional…
Public access to government services was disrupted as agencies took vulnerable PHP systems offline. UK ministers reported 32 services unavailable and four partly disrupted, mostly as a precaution while patches and mitigations were applied; no central government compromise was confirmed. Other governments…
Machine-learning workloads could execute attacker-controlled code and expose cloud credentials because of an unsafe SageMaker Python SDK default. The SDK generated a predictable storage bucket name without confirming that the caller’s account owned the bucket. An attacker who created the bucket first…
Developer secrets were placed at risk when attackers replaced OVHcloud command-line tool assets with malicious binaries. The binaries were available for one hour and 33 minutes and downloaded approximately 250 times. They were designed to retrieve secrets from disk. Attackers used a compromised developer…
Websites, software, and encrypted connections could be impersonated because eight eMudhra intermediate certificates used extremely weak private keys. Six certificates covered web encryption and two covered code signing. Browser and operating-system vendors have begun blocking the affected trust paths, and…
Attackers are chaining four Plex Media Server weaknesses to obtain administrator tokens and run code with elevated privileges. Exploitation reports began on October 17, with early activity targeting honeypots to deploy a cryptocurrency miner. CISA warned that attackers are actively exploiting the…
Cloud, AI, and developer credentials may be compromised on systems that ran LiteLLM 1.107.0. Attackers inserted a credential stealer and remote-access backdoor into the release distributed through Python and Docker registries. The malware targeted browser data, cloud credentials, AI provider keys, SSH…
Customer access and service availability were disrupted after attackers used a ConnectWise supply-chain path to reach Microsoft 365 environments. Microsoft attributed the activity to China-aligned Storm-0940, which used the ARTEX agentic AI framework to accelerate scanning, password spraying, and OAuth…
Developers who installed five compromised OVHcloud command-line releases may have exposed secrets stored on their machines. Versions v0.11.0 through v0.15.0 were altered on GitHub before the malicious downloads were blocked. A compromised contributor account replaced existing release files without…
Eight compromised eMudhra intermediate certificates created a path to forge certificates for legitimate domains. Their private keys were so weak that researchers could recover them by testing only 256 possible values. The certificates were revoked, and major browsers and operating systems began blocking…
Developer systems and AI services may have executed malware after installing LiteLLM 1.107.0. All seven PyPI wheel files were compromised, and affected images also reached container registries. The payload used Python startup hooks, allowing an unrelated Python command to trigger credential theft. PyPI…
Organizations are facing intrusion campaigns in which AI agents can choose actions and execute commands at machine speed. CrowdStrike documented four previously unreported actors whose exposed frameworks showed different levels of automation and autonomy. Reported victims included healthcare, government…
Public-facing web servers face an urgent update cycle after critical PHP weaknesses opened paths to code execution, data exposure and service disruption. The issues affect PHP installations serving web requests, including common Apache, PHP-FPM and CGI configurations. Fixes are available in PHP 8.5.12…