Unauthenticated attackers are actively exploiting a critical vulnerability affecting Adobe Commerce and Magento platforms worldwide. The flaw, tracked as CVE-2025-54236 and dubbed SessionReaper, enables remote code execution and customer account takeover on thousands of online stores. CVE ID Vulnerability Name Affected…
Russian Hackers Pivot Fast With New “ROBOT” Malware Chain
Russian hackers launched a new “ROBOT” malware chain after LOSTKEYS was exposed. The post Russian Hackers Pivot Fast With New “ROBOT” Malware Chain appeared first on eSecurity Planet. This article has been indexed from eSecurity Planet Read the original article:…
Jira Software Vulnerability Let Attacker Modify Any Filesystem Path Writable By JVM process
Atlassian has disclosed a high-severity path traversal vulnerability in Jira Software Data Center and Server that enables authenticated attackers to arbitrarily write files to any path accessible by the Java Virtual Machine (JVM) process. This flaw, tracked as CVE-2025-22167 with…
CISA Warns of Motex LANSCOPE Endpoint Manager Vulnerability Exploited in Attacks
CISA has issued a critical alert regarding a severe vulnerability in Motex LANSCOPE Endpoint Manager, a popular tool for managing IT assets across networks. Dubbed an improper verification of the source of a communication channel flaw, this issue allows attackers…
Apple may have to open its walled garden to outside app stores
The UK’s competition watchdog says Apple’s “walled garden” gives it too much control—and may soon force it to allow rival app stores on iPhones. This article has been indexed from Malwarebytes Read the original article: Apple may have to open…
Building Confidence Through Traceability: Lessons From Mail and Tech
Learn how traceability builds customer trust through certified mail tracking and modern authentication. Boost reliability online and offline in 2025. The post Building Confidence Through Traceability: Lessons From Mail and Tech appeared first on Security Boulevard. This article has been…
PhantomCaptcha RAT Attack Targets Aid Groups Supporting Ukraine
SentinelLABS’ research reveals PhantomCaptcha, a highly coordinated, one-day cyber operation on Oct 8, 2025, targeting the International Red Cross, UNICEF, and Ukraine government groups using fake emails and a Remote Access Trojan (RAT) linked to Russian infrastructure. This article has…
Jingle Thief Hackers Exploit the Festive Season with Weaponized Gift Card Scams
Cybersecurity researchers have uncovered a sophisticated campaign targeting global retail and consumer services organizations through credential theft and gift card fraud. Dubbed “Jingle Thief,” this operation exploits the festive shopping season when companies are most vulnerable to financial fraud schemes.…
U.S. CISA adds Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Motex LANSCOPE flaw, tracked as CVE-2025-61932 (CVSS v4 score of 9.3), to its Known…
Exploitation of Critical Adobe Commerce Flaw Puts Many eCommerce Sites at Risk
Patched in September, the SessionReaper bug could be exploited without authentication to bypass a security feature. The post Exploitation of Critical Adobe Commerce Flaw Puts Many eCommerce Sites at Risk appeared first on SecurityWeek. This article has been indexed from…
Vibe Coding’s Real Problem Isn’t Bugs—It’s Judgment
As AI coding tools flood enterprises with functional but flawed software, researchers urge embedding security checks directly into the AI workflow. The post Vibe Coding’s Real Problem Isn’t Bugs—It’s Judgment appeared first on SecurityWeek. This article has been indexed from…
Critical Adobe Commerce, Magento vulnerability under attack (CVE-2025-54236)
Attackers are trying to exploit CVE-2025-54236, a critical vulnerability affecting Adobe Commerce and Magento Open Source, Sansec researchers have warned. The company blocked over 250 exploitation attempts targeting multiple stores on Wednesday, and expects the attacks to continue at pace.…
Why Organizations Are Abandoning Static Secrets for Managed Identities
As machine identities explode across cloud environments, enterprises report dramatic productivity gains from eliminating static credentials. And only legacy systems remain the weak link. For decades, organizations have relied on static secrets, such as API keys, passwords, and tokens, as…
Major Vulnerabilities Found in TP-Link VPN Routers
Forescout researchers discovered critical and high-severity vulnerabilities in several TP-Link VPN routers This article has been indexed from www.infosecurity-magazine.com Read the original article: Major Vulnerabilities Found in TP-Link VPN Routers
Warlock Ransomware Exploits SharePoint ToolShell Zero-Day in New Attack Campaign
Chinese-linked threat actors behind the Warlock ransomware operation have emerged as a significant cybersecurity concern following their exploitation of a critical Microsoft SharePoint vulnerability. The group’s sophisticated attack infrastructure, combined with evidence of historical espionage activities dating back to 2019,…
Meta boosts scam protection on WhatsApp and Messenger
This is part of its broader push to fight impersonation and fraud, after removing more than 21,000 fake customer-support pages from Facebook. This article has been indexed from Malwarebytes Read the original article: Meta boosts scam protection on WhatsApp and…
The Smishing Deluge: China-Based Campaign Flooding Global Text Messages
Global smishing activity tracked by Unit 42 includes impersonation of many critical services. Its unique ecosystem allows attackers to quickly scale. The post The Smishing Deluge: China-Based Campaign Flooding Global Text Messages appeared first on Unit 42. This article has…
GlassWorm Malware Targets Developers Through OpenVSX Marketplace
GlassWorm, a self-propagating malware, infects VS Code extensions through the OpenVSX marketplace, stealing credentials and using blockchain for control. This article has been indexed from Hackread – Cybersecurity News, Data Breaches, Tech, AI, Crypto and More Read the original article:…
OpenAI Faces DHS Request to Disclose User’s ChatGPT Prompts in Investigation
Over the past year, federal agents struggled to uncover who operated a notorious child exploitation site on the dark web. Their search took an unexpected turn when the suspect revealed their use of ChatGPT, marking a significant moment in digital…
Over 250 attacks hit Adobe Commerce and Magento via critical CVE-2025-54236 flaw
Hackers exploit CVE-2025-54236 in Adobe Commerce and Magento to hijack accounts via REST API. Over 250 attacks in 24 hours. E-commerce security company Sansec researchers warn that threat actors are exploiting a critical flaw in Adobe Commerce and Magento, tracked…
Impacket Tool in Kali Repo Upgraded With New Attack Paths and Relay Tricks
The popular Impacket toolkit, a staple in penetration testing and now integrated into the Kali Linux repository, is set for a major upgrade. Maintained by Fortra’s cybersecurity team, the forthcoming release, building on version 0.12, addresses long-standing community requests with…
BIND Updates Address High-Severity Cache Poisoning Flaws
The vulnerabilities allow attackers to predict source ports and query IDs BIND will use, and to inject forged records into the cache. The post BIND Updates Address High-Severity Cache Poisoning Flaws appeared first on SecurityWeek. This article has been indexed…
IT Security News Hourly Summary 2025-10-23 12h : 9 posts
9 posts were published in the last hour 10:4 : IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response 10:4 : New Python-Based RAT Disguised as Minecraft App Steals Sensitive User Data 10:4 : This…
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
Cisco Talos Incident Response observed a surge in attacks exploiting public-facing applications — mainly via ToolShell targeting SharePoint — for initial access, with post-exploitation phishing and evolving ransomware tactics also persisting this quarter. This article has been indexed from Cisco…