Attackers are embedding blocks of links that lead to porn sites, online casinos, and the like. We explain their objective, and how to protect your website.
Hackers have posted over 1 Tb of information allegedly stolen from Harvard on the Cl0p data leak website. The post Harvard Is First Confirmed Victim of Oracle EBS Zero-Day Hack appeared first on SecurityWeek .
In January, a possible XSS vulnerability was found in the electronic document security management system ESAFENET CDG. This was the latest (as far as I can tell) in a long list of vulnerabilities in the product. Prior vulnerabilities included SQL injection issues and weaknesses in the encryption used to safeguard documents. In other words: A typical "secure" document management system. The product appears to be targeting the Chinese market, and with a website all in Chinese, I doubt it is used much, if at all, outside China.
The video game software development company says the incident impacted users of its SpeedTree website. The post Malicious Code on Unity Website Skims Information From Hundreds of Customers appeared first on SecurityWeek .
FreePBX is a popular PBX system built around the open source VoIP system Asterisk. To manage Asterisk more easily, it provides a capable web-based admin interface. Sadly, like so many web applications, it has had its share of vulnerabilities in the past. Most recently, a SQL injection vulnerability was found that allows attackers to modify the database.
A critical unauthenticated remote code execution (RCE) vulnerability (CVE-2025-10547) was discovered and patched in DrayTek Vigor routers. The flaw can be exploited remotely via crafted HTTP/S requests to the device's web user interface, potentially causing memory corruption, system crashes, and arbitrary code execution without authentication. While remote WAN attacks can be mitigated by disabling remote WebUI and SSL VPN access or configuring ACLs, local network attackers may still exploit the vulnerability. DrayTek has released patches for 35 router models and urges immediate updates. The routers are widely used by prosumers and SMBs, making this a significant risk, especially given past ransomware campaigns targeting DrayTek devices. No exploitation in the wild has been reported yet, but the ease of exploitation and impact potential warrant urgent attention from European organizations using these routers.
I have been writing about the ".well-known" directory a few times before. Recently, about attackers hiding webshells &#;x26;#;x5b;1&#;x26;#;x5d;, and before that, about the purpose of the directory and why you should set up a "/.well-known/security.txt" file. But I noticed something else when I looked at today&#;x26;#;39;s logs on this web server. Sometimes you do not need a honeypot. Some attackers are noisy enough to be easily visible on a busy web server. This time, the attacker hit various URLs inside the ".well-known" directory. Here is a sample from the > 100 URLs hit:
Research by: Antonis Terefos (@Tera0017) Key Points Introduction The Pure malware family is a suite of malicious tools developed and sold by the author known as PureCoder. This suite includes PureHVNC RAT (a remote administration tool and predecessor to PureRAT), PureCrypter (a malware obfuscator), PureLogs (a stealer/logger), and several other tools. The malicious software is advertised and distributed through underground forums, Telegram channels, and dedicated websites. […] The post Under the Pure Curtain: From RAT to Builder to Coder appeared first on Check Point Research .
