Last week, a new AI agent framework was introduced to automate "live". It targets office work in particular, focusing on messaging and interacting with systems. The tool has gone viral not so much because of its features, which are similar to those of other agent frameworks, but because of a stream of security oversights in its design.
ShinyHunters has claimed the theft of 14 million records from the US bakery-cafe chain’s systems. The post Hackers Leak 5.1 Million Panera Bread Records appeared first on SecurityWeek .
The article details a sophisticated supply chain attack on Notepad++ that occurred from July to October 2025. Attackers compromised the update infrastructure, deploying various malicious payloads through three distinct infection chains. The attack targeted individuals and organizations in Vietnam, El Salvador, Australia, and the Philippines. The infection methods evolved over time, using NSIS installers, Metasploit downloaders, and Cobalt Strike Beacons. The attackers employed clever techniques to evade detection, including the abuse of legitimate software and the use of multiple C2 servers. The article provides a comprehensive timeline of the attack, describes the different execution chains, and offers guidance on detecting traces of the attack.
Rapid7 Labs has uncovered a sophisticated campaign attributed to the Chinese APT group Lotus Blossom, involving a new custom backdoor named Chrysalis. The attack compromised Notepad++ infrastructure to deliver the backdoor. Analysis revealed multiple custom loaders, including one using Microsoft Warbird for obfuscation. The Chrysalis backdoor has extensive capabilities for information gathering, file operations, and remote command execution. Additional artifacts found include Cobalt Strike beacons and Metasploit payloads. The campaign shows Lotus Blossom evolving its tactics, mixing custom and off-the-shelf tools with advanced obfuscation techniques to evade detection.
CVE-2026-1591 is a stored cross-site scripting (XSS) vulnerability in Foxit PDF Editor Cloud's file upload feature (pdfonline.foxit.com) affecting versions before 2026-02-03. The vulnerability arises because malicious usernames embedded in uploaded file lists are not properly escaped, allowing arbitrary JavaScript execution when the list is viewed. Exploitation requires authenticated access and some user interaction, with a medium severity CVSS score of 6.3. While no known exploits are currently in the wild, successful attacks could lead to theft of sensitive information or session hijacking. European organizations using this cloud-based PDF editor should prioritize patching or mitigating this vulnerability to prevent potential client-side attacks. Countries with high adoption of Foxit products and significant cloud service usage, such as Germany, France, and the UK, are most likely to be affected. Mitigation includes applying vendor patches when available, restricting user input, and employing Content Security Policies to limit script execution.
CVE-2026-24449 is a medium-severity vulnerability affecting ELECOM CO. ,LTD. 's WRC-X1500GS-B and WRC-X1500GSA-B wireless routers. The issue arises because the initial device passwords can be easily derived from publicly available system information, enabling unauthorized access without user interaction or authentication. This vulnerability impacts confidentiality but does not affect integrity or availability. Exploitation requires network access to the device but no prior privileges. There are no known exploits in the wild, and no patches have been published yet. European organizations using these devices risk unauthorized disclosure of sensitive network information. Mitigation involves changing default credentials immediately upon deployment and restricting network access to management interfaces. Countries with higher adoption of ELECOM networking hardware, particularly Japan's trading partners and countries with strong electronics import ties such as Germany, France, and the UK, are more likely to be affected.
CVE-2025-65875 is a high-severity arbitrary file upload vulnerability in the AddFont() function of FPDF version 1.86 and earlier. It allows attackers with low privileges to upload crafted PHP files without user interaction, leading to remote code execution. The vulnerability impacts confidentiality, integrity, and availability of affected systems and can be exploited remotely over the network. No known exploits are currently in the wild, and no patches have been published yet. European organizations using vulnerable FPDF versions in web applications are at risk, especially those in sectors relying heavily on PDF generation. Mitigation involves restricting file upload capabilities, implementing strict input validation, and monitoring for suspicious file uploads. Countries with significant software development and digital services sectors, such as Germany, France, and the UK, are more likely to be affected. Due to the high impact and ease of exploitation, this vulnerability demands urgent attention from defenders.
The KRVTZ-NET IDS alerts from February 3, 2026, report automated reconnaissance activity detected by intrusion detection systems, involving IP addresses linked to Censys, a known internet scanning service. This activity is categorized as reconnaissance in the cyber kill chain and involves scanning HTTP User-Agent strings to gather information about potential targets. No specific vulnerabilities, exploits, or malware are associated with these alerts, and no active exploitation is reported. The severity is low, reflecting the preliminary nature of reconnaissance without direct impact on confidentiality, integrity, or availability. European organizations should treat this as an early warning and maintain vigilance, as reconnaissance can precede targeted attacks. Mitigation involves network monitoring, tuning IDS/IPS to detect scanning patterns, network segmentation, and maintaining asset inventories. No patches or immediate remediation are required. The threat is low severity but warrants continued observation to prevent escalation.
Infostealer threats are expanding beyond Windows, targeting macOS and leveraging cross-platform languages like Python. Recent campaigns use social engineering to deploy macOS-specific infostealers such as DigitStealer, MacSync, and AMOS. These stealers use fileless execution and native macOS utilities to harvest credentials and sensitive data. Python-based stealers are also on the rise, allowing attackers to quickly adapt and target diverse environments. Additionally, threat actors are abusing trusted platforms like WhatsApp and PDF converter tools to distribute malware such as Eternidade Stealer. These evolving threats blend into legitimate ecosystems and evade conventional defenses, posing significant risks to organizations across various operating systems and delivery channels.
CVE-2025-13096 is a high-severity Server-Side Request Forgery (SSRF) vulnerability affecting IBM Business Automation Workflow containers versions 24.0.0 through 25.0.0. The flaw arises from XML External Entity (XXE) injection during XML data processing, allowing remote attackers with limited privileges to access sensitive information or cause memory resource exhaustion. Exploitation requires network access and low privileges but no user interaction. While no known exploits are reported in the wild, the vulnerability poses a significant risk to confidentiality and system stability. European organizations using affected IBM workflow containers should prioritize patching once available and implement network segmentation and input validation to mitigate risk. Countries with strong IBM enterprise adoption and critical automation infrastructure, such as Germany, France, and the UK, are most likely impacted.
CVE-2025-12680 is a medium-severity vulnerability affecting Brocade SANnav versions prior to 2.4.0b, where database passwords are stored in plaintext within logs on the standby SANnav server after disaster recovery failover. This flaw allows a remote attacker with administrative privileges and some user interaction to access sensitive logs or supportsave files and extract database credentials. Exploitation requires authenticated admin access but can lead to credential compromise, potentially enabling further unauthorized access to SANnav-managed storage infrastructure. No known exploits are currently reported in the wild. The vulnerability impacts confidentiality primarily, with a CVSS score of 6. European organizations using affected Brocade SANnav versions should prioritize patching and restrict access to logs and supportsave files. Countries with significant enterprise storage deployments and Brocade SANnav usage, such as Germany, France, and the UK, are most likely to be affected.
CVE-2026-23997 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability affecting FacturaScripts versions 2025.71 and earlier. The flaw exists in the Observations field within the History view, where user input is rendered without proper HTML entity encoding, allowing attackers to inject and execute arbitrary JavaScript in the browsers of administrators viewing the history. Exploitation requires at least limited privileges to input data and some user interaction to trigger the payload. The vulnerability impacts confidentiality, integrity, and availability by enabling session hijacking, credential theft, or administrative account compromise. No known exploits are currently reported in the wild. European organizations using FacturaScripts for ERP and accounting functions are at risk, especially those with administrators accessing the affected History view. Mitigation requires applying patches once available, implementing strict input validation and output encoding, and restricting access to the History view to trusted users. Countries with significant SME adoption of FacturaScripts, such as Spain, Germany, France, Italy, and the UK, are most likely affected due to market penetration and the strategic importance of ERP systems. Given the CVSS 3.
A sophisticated phishing campaign has been detected that utilizes a multi-stage approach to evade detection. The attack begins with a procurement-themed email containing a PDF attachment. This PDF redirects victims to another PDF hosted on trusted cloud storage, which then leads to a fake Dropbox login page. The attackers exploit trusted platforms and harmless file formats to bypass security measures. The campaign uses social engineering tactics to harvest credentials, which are then exfiltrated to attacker-controlled infrastructure via Telegram. This method proves effective by leveraging legitimate business processes, trusted file types, and reputable cloud services to appear authentic and bypass automated security checks.
Hackers rely on evolved vishing and login harvesting to compromise SSO credentials for unauthorized MFA enrollment. The post ShinyHunters-Branded Extortion Activity Expands, Escalates appeared first on SecurityWeek .
Yesterday, a single IP address (%%ip:204.76.203.210%%) scanned a number of our sensors for what looks like an anthropic API node. The IP address is known to be a Tor exit node.
A hacker published malicious versions of four established VS Code extensions to distribute a GlassWorm malware loader. The post Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack appeared first on SecurityWeek .
Poland’s CERT has published a report on the recent attack, providing new details on targeted ICS and attribution. The post Default ICS Credentials Exploited in Destructive Attack on Polish Energy Facilities appeared first on SecurityWeek .
MicroWorld Technologies, the maker of eScan antivirus, experienced a supply-chain compromise where malicious updates were pushed through the legitimate eScan updater. This multi-stage malware establishes persistence on infected systems, enables remote access for attackers, and blocks automatic security mechanisms. Although no known exploits are currently observed in the wild, the threat poses a medium severity risk due to its potential impact on confidentiality, integrity, and availability. European organizations using eScan antivirus are at risk, especially those in countries with higher adoption of this product. The attack leverages trusted update channels, making detection and prevention more challenging. Mitigation requires immediate verification of update integrity, network monitoring for unusual remote access, and enhanced endpoint detection capabilities. Countries with significant use of eScan and strategic sectors reliant on this antivirus are more likely to be targeted. The threat underscores the critical risk of supply-chain attacks in cybersecurity defenses.
