A hacker involved in compromising PowerSchool systems was sentenced to four years in prison. The incident highlights the risks associated with attacks on educational software platforms that manage sensitive student and staff data. While no specific technical details or exploited vulnerabilities are provided, the case underscores the importance of securing such critical infrastructure. The threat does not describe an ongoing or new vulnerability but rather reports on a legal outcome following a cyberattack. European organizations using PowerSchool or similar educational management systems should remain vigilant. The severity of the threat is assessed as medium due to the potential impact on confidentiality and integrity of educational data, though exploitation details are lacking. No active exploits or patches are mentioned, limiting immediate technical mitigation steps. Countries with significant educational technology adoption and digital infrastructure in schools may be more concerned. Overall, this is a security incident report rather than a new technical threat or vulnerability disclosure.
A sophisticated campaign targeting macOS developers has been uncovered, utilizing fake websites impersonating trusted platforms like Homebrew, TradingView, and LogMeIn to distribute Odyssey Stealer and AMOS malware. The attackers employ social engineering tactics, prompting users to paste base64-encoded commands in Terminal, which downloads malicious payloads. Over 85 phishing domains were identified, linked through shared SSL certificates and infrastructure. The campaign's infrastructure includes long-standing IP addresses showing multi-year activity. The malware attempts privilege escalation, performs anti-analysis checks, and disrupts backup services. This coordinated operation demonstrates the attackers' ability to adapt tactics and maintain persistence in the macOS ecosystem.
LinkPro is a newly discovered Linux rootkit that leverages eBPF (extended Berkeley Packet Filter) technology to stealthily hide its presence on infected systems. It activates upon receiving specially crafted 'magic' TCP packets, allowing attackers to control compromised hosts covertly. This rootkit's use of eBPF, a legitimate kernel feature, makes detection challenging as it operates at a low level within the Linux kernel. Although no known exploits are currently reported in the wild, the rootkit's capabilities pose a significant risk to Linux-based infrastructure. European organizations relying on Linux servers, especially those exposed to external networks, could be targeted. The rootkit threatens system confidentiality, integrity, and availability by enabling persistent unauthorized access and potential data exfiltration or sabotage. Mitigation requires advanced monitoring of eBPF programs, network traffic analysis for anomalous TCP packets, and strict kernel security policies. Countries with high Linux adoption in critical sectors and strategic geopolitical relevance are more likely to be affected. Given its stealth, activation method, and potential impact, this threat is assessed as high severity. Defenders should prioritize detection and containment strategies tailored to eBPF misuse and network-based triggers.
Singularity is a modern stealth Linux kernel rootkit recently analyzed in a detailed blog post by Kyntra. It represents an advanced persistent threat capable of deeply compromising Linux systems by operating at the kernel level, enabling attackers to hide processes, files, and network activity. Although no known exploits in the wild have been reported yet, the rootkit's stealth capabilities and kernel-level access pose significant risks to system confidentiality and integrity. European organizations relying on Linux servers, especially in critical infrastructure and technology sectors, could face targeted attacks leveraging such rootkits. Mitigation requires advanced kernel integrity monitoring, strict access controls, and proactive threat hunting focused on kernel anomalies. Countries with high Linux adoption in enterprise and government environments, such as Germany, France, and the Netherlands, are more likely to be affected. Given the rootkit's complexity, stealth, and potential for deep system compromise without user interaction, the threat severity is assessed as high. Defenders should prioritize detection capabilities for kernel-level threats and ensure rapid incident response readiness.
A Secure Boot bypass vulnerability has been identified affecting nearly 200,000 Linux Framework laptops. This flaw allows attackers to circumvent Secure Boot protections, potentially enabling unauthorized code execution during system startup. Although no known exploits are currently active in the wild, the risk is rated high due to the critical role of Secure Boot in maintaining system integrity. The vulnerability primarily impacts Linux Framework laptops, a niche but growing hardware platform popular among security-conscious users. European organizations using these devices could face increased risk of firmware-level compromise, threatening confidentiality and system trustworthiness. Mitigation is complicated by the lack of available patches and requires careful firmware validation and monitoring. Countries with higher adoption of Linux Framework laptops and strategic technology sectors are more likely to be affected. Given the ease of exploitation at the boot level and the broad impact on system integrity, the threat severity is assessed as high. Defenders should prioritize firmware integrity checks and restrict physical access to vulnerable devices to reduce risk.
Certain malicious packages published on popular software repositories npm, PyPI, and RubyGems have been discovered exfiltrating developer data to Discord channels. These packages covertly send sensitive information such as environment variables, source code snippets, or credentials to attacker-controlled Discord servers. The threat affects developers who incorporate these packages into their projects, potentially exposing confidential data and intellectual property. Although no known exploits in the wild have been reported yet, the high severity rating is due to the risk of data leakage and supply chain compromise. This issue highlights the risks inherent in open-source software supply chains and the need for rigorous package vetting. European organizations relying on these ecosystems for software development could face confidentiality breaches and reputational damage. Mitigations include auditing dependencies, using software composition analysis tools, and restricting network egress from development environments. Countries with strong software development sectors and high adoption of these package managers, such as Germany, the UK, France, and the Netherlands, are more likely to be impacted. The threat is assessed as high severity given the potential for significant data exposure without requiring user interaction or authentication. Defenders should prioritize dependency hygiene and monitoring for suspicious outbound traffic from development systems.
A recently reported security concern involves the ability to bypass OpenAI’s Guardrails using simple prompt injection attacks. These attacks manipulate the input prompts to override or circumvent the safety and content filtering mechanisms embedded in OpenAI’s language models. While no known exploits are currently active in the wild, the vulnerability highlights risks in relying solely on prompt-based controls for AI safety. The attack does not require complex technical skills, making it accessible to a broad range of adversaries. The medium severity rating reflects the moderate impact potential, given that exploitation could lead to generation of harmful, misleading, or unauthorized content. European organizations using OpenAI’s services or integrating these models into their products should be aware of this threat. Mitigation requires a combination of improved prompt handling, additional layers of content validation, and monitoring for anomalous outputs. Countries with significant AI adoption and technology sectors, such as Germany, France, and the UK, are more likely to be affected. The threat underscores the need for robust AI security practices beyond current guardrails.
The video game software development company says the incident impacted users of its SpeedTree website. The post Malicious Code on Unity Website Skims Information From Hundreds of Customers appeared first on SecurityWeek .
Blind enumeration of gRPC services exploits subtle differences in error messages returned by gRPC servers when invalid requests are made. Attackers can map available services and methods even when server reflection is disabled, by sending crafted requests and analyzing error codes such as UNIMPLEMENTED, NOT_FOUND, and INVALID_ARGUMENT. This technique reveals service sprawl, method proliferation, and inconsistent authentication controls, often arising from partial migrations and fragmented development teams. Although crafting valid protobuf messages still requires additional effort, enumerating service existence significantly aids attackers in reconnaissance. The threat is particularly relevant for organizations using gRPC-based microservices architectures without strict security controls or proper network segmentation. European organizations with complex service deployments and legacy microservices are at risk of information disclosure and potential unauthorized access. Mitigation involves strict authentication enforcement on all methods, network segmentation of internal services, disabling or tightly controlling reflection endpoints, and regular audits for service sprawl and auth drift. Countries with strong technology sectors and widespread gRPC adoption, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. The severity is assessed as medium due to the information disclosure nature, the need for some attacker effort, and the lack of direct remote code execution or data manipulation without further exploitation.
The Stealit malware campaign leverages Node.js Single Executable Application (SEA) technology to distribute malicious payloads as standalone binaries, bypassing the need for a Node.js runtime. Distributed mainly as disguised game and VPN installers via file-sharing sites, the malware employs heavy obfuscation and anti-analysis techniques to evade detection. Once executed, it acts as a Remote Access Trojan (RAT), stealing sensitive information such as login credentials and cryptocurrency wallet data. The campaign demonstrates adaptability by switching between Node.js SEA and Electron frameworks for payload delivery. Although no known exploits are currently active in the wild, the malware’s capability to control victim systems and extract valuable data poses a significant threat. The campaign’s medium severity rating reflects its stealth and information theft focus, with no immediate widespread exploitation reported. European organizations using Node.
Stealit malware is a newly identified threat that uses Node.js to conceal itself within fake game and VPN installers. It masquerades as legitimate software to trick users into installation, leveraging the popularity of gaming and VPN tools. Although no known exploits are currently active in the wild, the malware's use of Node.js for obfuscation complicates detection and analysis. The threat primarily targets end users who download software from untrusted sources, potentially leading to data theft or system compromise. European organizations could face risks if employees install these fake applications, especially in sectors with high VPN usage or gaming communities. Mitigation requires enhanced endpoint protection capable of detecting Node.js-based malware, user education on verifying software sources, and network monitoring for unusual outbound connections. Countries with significant gaming markets and high VPN adoption, such as Germany, the UK, France, and the Nordics, are more likely to be affected.
GreyNoise has discovered that attacks exploiting Cisco, Fortinet, and Palo Alto Networks vulnerabilities are launched from the same infrastructure. The post Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign appeared first on SecurityWeek .
The RondoDox botnet is actively targeting 56 known n-day vulnerabilities in a series of worldwide attacks. These n-day flaws represent previously disclosed but unpatched security issues across multiple products and platforms. Although no known exploits in the wild have been confirmed yet, the botnet's broad targeting and high-priority classification indicate a significant threat. The attacks are global, leveraging the botnet's capability to scan and exploit vulnerable systems that remain unpatched. European organizations are at risk, especially those with delayed patch management or using affected software. The botnet's exploitation could lead to compromised confidentiality, integrity, and availability of systems. Mitigation requires rapid identification of vulnerable systems, prioritized patching, and enhanced network monitoring for anomalous botnet activity. Countries with high technology adoption and critical infrastructure reliance on vulnerable platforms are most at risk. Given the scope and ease of exploitation of known vulnerabilities without authentication, the threat severity is assessed as high. Defenders should focus on proactive vulnerability management and network defenses to mitigate this evolving botnet threat.
Threat actors have begun leveraging the Velociraptor digital forensics and incident response (DFIR) tool as part of ransomware attack campaigns. Velociraptor, originally designed for legitimate forensic investigations and incident response, is being repurposed by attackers to facilitate lateral movement, reconnaissance, and data collection within compromised networks. This misuse enhances attackers' ability to identify valuable targets and escalate privileges before deploying ransomware payloads. The threat is considered high severity due to the tool's powerful capabilities, ease of use, and the significant impact ransomware attacks can have on confidentiality, integrity, and availability of systems. European organizations, especially those with critical infrastructure and large enterprise environments, face increased risk given the tool’s effectiveness in complex networks. Mitigation requires tailored detection of Velociraptor usage patterns, strict endpoint monitoring, and network segmentation to limit attacker movement. Countries with high adoption of enterprise IT infrastructure and critical sectors such as finance, manufacturing, and government are most likely to be targeted. Given the lack of a CVSS score, the threat is assessed as high severity due to the potential for widespread disruption, ease of exploitation by skilled attackers, and the critical nature of impacted assets.
Hidden comments allowed full control over Copilot responses and leaked sensitive information and source code. The post GitHub Copilot Chat Flaw Leaked Data From Private Repositories appeared first on SecurityWeek .
&#;x26;#;x5b;This is a Guest Diary by Jin Quan Low, an ISC intern as part of the SANS.edu Bachelor&#;x26;#;39;s Degree in Applied Cybersecurity (BACS) program &#;x26;#;x5b;1].]
How security posture management for AI can protect against model poisoning, excessive agency, jailbreaking and other LLM risks. The post Will AI-SPM Become the Standard Security Layer for Safe AI Adoption? appeared first on SecurityWeek .
OpenAI has reported an increasing trend of foreign threat groups exploiting AI tools for malicious purposes. These threat actors are leveraging AI capabilities to enhance cyberattacks, automate phishing, generate malicious code, and evade detection. While no specific vulnerabilities or exploits have been detailed, the growing misuse of AI tools represents a medium-level security concern. European organizations could face increased risks in confidentiality, integrity, and availability due to AI-augmented attacks. Mitigation requires proactive monitoring of AI tool usage, employee training on AI-driven threats, and enhanced detection capabilities tailored to AI-generated attack patterns. Countries with high AI adoption and critical infrastructure reliance on AI technologies are most at risk. Given the ease of AI tool access and the broad scope of potential targets, the suggested severity is medium. Defenders should prioritize understanding AI threat landscapes and integrating AI threat intelligence into their cybersecurity strategies.
