The DeFi protocol Balancer suffered a significant theft of $128 million due to an exploit involving a rounding function vulnerability and batch swap operations. Attackers manipulated the protocol's logic to drain funds, but recovery efforts have begun. This exploit targets the integrity of smart contract operations within decentralized finance platforms. European organizations involved in DeFi or holding assets on Balancer could face financial losses and reputational damage. Mitigation requires thorough auditing of smart contract code, especially around arithmetic operations and transaction batching. Countries with active DeFi markets and blockchain development, such as Germany, the Netherlands, and the UK, are most likely to be affected. The threat is assessed as medium severity due to the complexity of exploitation and the need for specific knowledge to execute the attack. Defenders should prioritize monitoring for unusual batch swap activity and ensure robust contract validation before deployment.
Norton researchers have successfully cracked the Midnight ransomware and released a free decryptor tool, enabling victims to recover their encrypted data without paying ransom. Midnight ransomware is a malware strain that encrypts victim files to extort payment. The availability of a decryptor significantly reduces the threat posed by this ransomware. There are no known active exploits in the wild currently, and the discussion around this development is minimal. The threat severity is assessed as medium due to the ransomware’s potential impact but mitigated by the decryptor’s release. European organizations previously targeted or vulnerable to Midnight ransomware can now leverage this decryptor to recover data. However, vigilance remains necessary as ransomware variants evolve rapidly. Practical mitigation includes deploying the decryptor if infected, maintaining robust backups, and enhancing endpoint security. Countries with higher ransomware incidents and significant use of affected systems are more likely to benefit from this development. Overall, this represents a positive step in combating ransomware threats but does not eliminate the need for comprehensive cybersecurity defenses.
CVE-2025-11953 is a critical OS command injection vulnerability in the Metro Development Server version 4.8.0 used by the React Native Community CLI. The server binds to external interfaces by default and exposes an endpoint that allows unauthenticated network attackers to execute arbitrary commands. On Windows systems, this enables attackers to run shell commands with fully controlled arguments. The vulnerability has a CVSS score of 9.8, indicating critical severity. No patch or official remediation information is currently available.
To deploy AI tools securely and ethically, teams must balance innovation with accountability—establishing strong governance, upskilling developers, and enforcing rigorous code reviews. The post How Software Development Teams Can Securely and Ethically Deploy AI Tools appeared first on SecurityWeek .
The APT group Cloud Atlas has launched a new wave of cyberattacks targeting Russia's defense industry. They are using stolen document templates from previously infected organizations to create malicious Microsoft Office files. The group cleans metadata from these documents to avoid revealing compromised entities. They move between targeted companies using compromised email accounts (BEC attacks). The attacks focus on defense industry enterprises, with malicious documents disguised as invitations, anti-corruption checks, mobilization documents, employee records, and financial statements. Cloud Atlas uses Google Sheets API for data exfiltration and employs the PowerShower backdoor. The group's infrastructure has migrated to new servers and domains, indicating ongoing campaign development.
The Eclipse Foundation revoked leaked Open VSX tokens after their exposure was discovered by Wiz. These tokens could have allowed unauthorized access to Open VSX services, potentially enabling malicious actors to manipulate or disrupt the open-source extension registry. Although no known exploits are currently active in the wild, the incident highlights risks related to leaked credentials in software supply chains. European organizations relying on Open VSX for development or distribution of extensions should be aware of the potential for unauthorized access and take immediate steps to verify token security. The threat is considered high severity due to the sensitive nature of the tokens and the potential impact on software integrity and availability. Mitigation involves auditing token usage, rotating credentials, and enhancing monitoring for suspicious activity. Countries with strong open-source ecosystems and significant software development sectors, such as Germany, France, and the Netherlands, are likely to be most affected. Vigilance is required to prevent exploitation and maintain trust in open-source infrastructure.
Sliver is a command and control framework that uses a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the netstack does not limit traffic between Wireguard clients. This allows clients to communicate with each other unrestrictedly, potentially enabling leaked or recovered keypairs to be used to attack operators or allowing port forwardings to be accessible from other implants.
BlueNoroff is a financially motivated threat actor conducting sophisticated campaigns named GhostCall and GhostHire targeting macOS, Windows, and Linux systems. GhostCall focuses on tech executives and venture capitalists via fake Zoom-like meetings, while GhostHire targets Web3 developers through fraudulent recruitment processes. These campaigns deploy multi-stage malware including ZoomClutch, DownTroy, CosmicDoor, RooTroy, and SilentSiphon, leveraging social engineering and AI-generated images. The attacks aim beyond cryptocurrency theft, focusing on comprehensive data acquisition to enable supply chain attacks and exploit trust relationships. The threat involves complex malware chains and advanced persistence techniques, affecting high-value targets in the tech and crypto sectors. Exploitation requires user interaction but no prior authentication, increasing risk. The campaigns pose a medium severity threat with significant potential impact on confidentiality and integrity. European organizations involved in technology, venture capital, and blockchain development are particularly at risk, especially in countries with strong tech ecosystems. Mitigation requires targeted user awareness, enhanced endpoint detection, and strict verification of recruitment and meeting invitations.
CVE-2025-62725 is a path traversal vulnerability in Docker Compose that allows an attacker to escape the local cache directory and overwrite arbitrary files on the host machine. This occurs because Docker Compose trusts path information embedded in remote OCI compose artifacts and improperly joins attacker-supplied values with local paths. The vulnerability affects multiple platforms and workflows that resolve remote OCI compose artifacts, including Docker Desktop, standalone Compose binaries on Linux, CI/CD runners, and cloud development environments. The issue is fixed in Docker Compose version 2.40.2.
A recent analysis of thousands of Ethereum smart contracts using SolidityScan reveals persistent vulnerabilities, with reentrancy attacks being the most prevalent. Other common issues include access control flaws, unchecked external calls, and unsafe proxy upgrade logic. These vulnerabilities continue to appear even in contracts developed by experienced teams, highlighting systemic security practice weaknesses. While automated tools help detect many issues, robust security depends heavily on secure development habits, thorough testing, and a strong review culture. No known exploits are currently active in the wild, but the widespread presence of these vulnerabilities poses a significant risk. European organizations involved in blockchain and decentralized finance (DeFi) should be particularly vigilant. Mitigation requires adopting secure coding standards, comprehensive audits, and continuous monitoring of smart contract behavior. Countries with active blockchain ecosystems and financial hubs are most at risk. The threat is assessed as high severity due to the potential for significant financial loss and disruption if exploited.
Next.js server actions use hashed identifiers in POST requests, obscuring their purpose and complicating penetration testing. When productionBrowserSourceMaps is enabled, these hashes can be mapped back to function names using the NextjsServerActionAnalyzer Burp extension, improving visibility into server actions. This tool automates extraction of mappings from JavaScript bundles, enabling testers to identify and test unused or hidden server actions effectively. The presence of productionBrowserSourceMaps in production environments can inadvertently leak debugging information, increasing attack surface. European organizations using Next.js with this configuration risk exposure of sensitive backend functionality. Mitigation involves disabling productionBrowserSourceMaps in production, monitoring server action usage, and employing tools like this extension for thorough security assessments. Countries with strong web development sectors and high adoption of Next.js, such as the UK, Germany, and France, are most likely affected.
CVE-2025-61928 is a critical vulnerability in the Better-Auth authentication library, widely used in applications with API key functionality enabled. This flaw allows unauthenticated attackers to create API keys, leading to complete account takeover without requiring user interaction or prior authentication. With approximately 300,000 weekly downloads, this vulnerability potentially affects a large number of projects and organizations relying on Better-Auth for authentication. Although no known exploits are currently observed in the wild, the ease of exploitation and the critical impact on confidentiality, integrity, and availability make this a high-risk threat. European organizations using Better-Auth in their applications are at significant risk of unauthorized access and data compromise. Immediate mitigation involves disabling API key creation until patches are available, implementing strict API key management policies, and monitoring for suspicious API key generation activities. Countries with high software development activity and extensive use of open-source JavaScript libraries, such as Germany, the UK, France, and the Netherlands, are most likely to be impacted. Given the critical nature of the vulnerability and the broad scope of affected systems, organizations must prioritize remediation efforts to prevent account takeovers and potential downstream attacks.
For the latest discoveries in cyber research for the week of 20th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES F5 has disclosed a cyber attack, reportedly carried out by a nation-state actor with long-term, persistent access to critical product development environments. The attacker exfiltrated files that included portions of BIG-IP source […] The post 20th October – Threat Intelligence Report appeared first on Check Point Research .
In August 2025, a sophisticated nation-state actor gained persistent access to F5's internal systems, specifically targeting the BIG-IP product development environment and engineering knowledge platforms. The attacker exfiltrated portions of BIG-IP source code, details of undisclosed vulnerabilities under development, customer configuration details, and internal engineering documentation. There is no evidence of compromise to CRM, financial, or support systems, nor the software supply chain. The exposure of unpublished vulnerabilities and source code significantly increases the risk of future exploits against BIG-IP deployments worldwide. Organizations using BIG-IP should urgently reassess threat models and patching strategies, anticipating that adversaries may develop exploits from the leaked information. This incident highlights the increasing targeting of critical infrastructure vendors by nation-state actors and the challenges posed by long dwell times. No known exploits are currently in the wild, but the breach is rated critical due to the potential impact. European organizations relying on BIG-IP should prioritize monitoring, segmentation, and rapid patch deployment once fixes are available.
LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery (SSRF) in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls containing the value naive. The service passes the user URLs to Crawler.crawl and the naive implementation performs a server-side fetch of each supplied URL without validating or restricting internal network addresses (such as localhost, 127.0.0.1, private IP ranges, or cloud instance metadata endpoints). This allows an attacker with a valid user token (or in development mode using a bypass header) to make the server disclose responses from internal HTTP services, potentially exposing internal API data or cloud metadata credentials. Version 1.136.2 fixes the issue. Update to version 1.136.2. No known workarounds exist.
Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth component is vulnerable to cross-site scripting when a victim connects to an attacker-controlled remote MCP server. The vulnerability exists in the OAuth flow implementation where the authorization_url provided by a remote MCP server is directly passed to window.open without validation or sanitization. An attacker can craft a malicious MCP server that returns a JavaScript URI (such as javascript:alert(1)) in the authorization_url field, which is then executed when the victim attempts to connect to the MCP server. This allows the attacker to execute arbitrary JavaScript in the context of the Dify application.
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry. NOTE: D-Link states that a fix is under development.
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Login' endpoint returns distinct JSON responses depending on whether the supplied username is associated with an existing account. Because the responses differ in the `error.message`string value, an unauthenticated remote attacker can enumerate valid usernames/accounts on the server. NOTE: D-Link states that a fix is under development.
Hackers are leveraging blockchain smart contracts as a novel vector to distribute malware through compromised WordPress websites. This attack involves embedding malicious payloads or commands within blockchain smart contracts, which are then referenced or executed via infected WordPress sites, enabling malware propagation. The technique exploits the decentralized and immutable nature of blockchain to evade traditional detection and takedown methods. European organizations using WordPress for their web presence are at risk, especially those with limited security controls or outdated plugins. The attack can compromise confidentiality, integrity, and availability of affected systems, potentially leading to data breaches or service disruptions. Mitigation requires advanced monitoring of blockchain interactions, securing WordPress installations, and implementing strict content validation. Countries with high WordPress adoption and significant blockchain development or usage are more likely to be targeted. Given the complexity and stealth of this attack vector, the threat is assessed as high severity. Defenders should prioritize detection of anomalous blockchain-related activities and ensure robust WordPress security hygiene.
