Dysphoria Compromised 296,000 IoT Devices for DDoS and Proxy Abuse
Shadowserver's retrospective Dysphoria report identifies about 296,000 compromised IoT devices and gives network owners evidence to locate and rebuild affected systems.
Reader edition
The Feed
WordPress Extension Flaws Expose Admin Accounts and Web Servers
Five newly fixed WordPress flaws expose conditional paths to admin takeover or server code execution; defenders should verify six component versions and review AJAX and account activity.
Isolated-vm Flaw Lets Guest Code Hijack the Host Process
A double-read type confusion lets guest JavaScript corrupt host memory; upgrade isolated-vm 6.x to 6.2.0 or 7.x to 7.0.1.
CISA Flags Exploited Linux IPv6 Flaw That Lets Local Users Gain Root
CISA says attackers are exploiting a Linux IPv6 kernel flaw that can give a local user root and, on affected RHEL 10 systems, escape a container.
CISA Gives Federal Agencies Three Days to Patch Exploited NetScaler Flaw
Citrix documents denial of service. Separate research demonstrates a SAML path to root code execution but has not confirmed that it maps to this CVE.
Exposed Server Reveals Aurora Operator's Breach Playbook Across 17 Organizations
An exposed server revealed a repeatable Active Directory attack path, AI-assisted planning, Aurora lockers, and payment trails across multiple victims.
Fake CAPTCHA Campaigns Load Malware That Disables Endpoint Security
ErrTraffic lures lead users to run Cruciferra, which uses a vulnerable signed driver to terminate security processes before the Remus stealer runs.
Two Next.js Flaws Expose Self-Hosted Servers to Remote Code Execution
Next.js fixed two unauthenticated code-execution paths involving AVIF processing and Windows servers. Self-hosted operators need 15.5.24 or 16.3.3.
MuddyWater Uses Deno to Hide a Backdoor in U.S. Companies
Dindoor uses the signed Deno runtime, encoded stages, and a pre-persistence sandbox check. Hunt the fixed process and registry sequence beneath the changing payload.
Attackers Exploit Gitea Flaw to Run Code on Self-Hosted Servers
Gitea’s patch API can turn repository content into server code execution. Upgrade to 1.27.2 or later and check server activity for signs of compromise.
CareCloud AWS Breach Affects 3.7 Million Patients
CareCloud says forensic review confirmed patient data exfiltration. HHS reports 3.76 million affected people, while public records do not map specific fields to each person.
Attackers Exploit Oracle WebLogic Proxy Flaw to Reach Critical Data
CISA confirmed exploitation of a CVSS 10 Oracle WebLogic proxy flaw. Patch affected Apache and IIS plug-ins, then review requests for unauthorized data access.
SynkLoader Uses Teams Lures for Password Phishing and Network Access
A new Windows loader arrives through a fake Teams help desk; modules sent to Expel’s emulator phish passwords and tunnel into internal services.