Daily Cyber News coverage tagged Supply Chain & Third Party.
Attackers compromised a shared analytics script loaded by checkout pages on stores using the Brazilian e-commerce platform Convertr. Malicious code inserted into the legitimate tracker collected payment information as shoppers completed purchases. The suspected initial vulnerability has not been…
A memory-corruption issue in the Brotli compression library reaches far beyond Node.js. Any application that decompresses attacker-controlled Brotli data with a vulnerable decoder may be exposed, including .NET, Python clients, proxies and data platforms. Public exploit code exists, and threat sensors…
Trust in eight eMudhra intermediate certificates collapsed after researchers reconstructed their weak private keys in under a second. Major browsers and software ecosystems blocked or updated trust for the affected certificates. eMudhra revoked them and announced its withdrawal from the global SSL and TLS…
Customer applications may be exposed after suspicious activity reached Railway systems that store environment variables. The company said an unauthorized third party may have accessed encrypted variables and obtained some decrypted contents, including possible API, database, registry, and cloud…
Eight compromised eMudhra intermediate certificates created a path to forge certificates for legitimate domains. Their private keys were so weak that researchers could recover them by testing only 256 possible values. The certificates were revoked, and major browsers and operating systems began blocking…