In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: dealloc commit test ctx always The damon_ctx for testing online DAMON parameters commit inputs is deallocated only when the test fails. This means memory is leaked for every successful online DAMON parameters commit. Fix the leak by always deallocating it.
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: catch commit test ctx alloc failure Patch series "mm/damon/sysfs: fix commit test damon_ctx [de]allocation". DAMON sysfs interface dynamically allocates and uses a damon_ctx object for testing if given inputs for online DAMON parameters update is valid. The object is being used without an allocation failure check, and leaked when the test succeeds. Fix the two bugs. This patch (of 2): The damon_ctx for testing online DAMON parameters commit inputs is used without its allocation failure check. This could result in an invalid memory access. Fix it by directly returning an error when the allocation failed.
SVG Clickjacking is a newly identified variant of the classic clickjacking attack that leverages Scalable Vector Graphics (SVG) elements to deceive users into interacting with hidden or disguised UI components. This technique exploits the unique properties of SVGs to craft more effective and stealthy clickjacking attacks. Although no known exploits are currently in the wild, the medium severity rating reflects the potential for significant user interaction deception without requiring authentication. European organizations that heavily rely on web applications rendering SVG content are at risk, especially those in sectors with high online user engagement. Mitigation requires specific attention to SVG handling in web applications, including strict Content Security Policies, frame busting techniques, and user interface design reviews to prevent overlay attacks. Countries with advanced digital economies and high web service usage, such as Germany, France, and the UK, are more likely to be affected due to their extensive web infrastructure and user base. Given the attack's reliance on user interaction and the absence of authentication bypass, the suggested severity is medium. Defenders should prioritize awareness and targeted mitigations to reduce the risk of this novel clickjacking method.
Russia has blocked access to the Roblox platform citing the distribution of LGBT "propaganda" as the reason. This action is a government-imposed restriction rather than a direct cybersecurity threat or vulnerability affecting the Roblox platform or its users. There is no indication of exploitation, malware, or technical compromise involved. The event reflects geopolitical and regulatory censorship impacting access to online services. European organizations are indirectly affected mainly through potential disruptions in user access and content availability. No technical vulnerabilities or exploits have been reported in connection with this event. The block may influence companies relying on Roblox for marketing, education, or community engagement within Russia. The situation underscores the importance of monitoring geopolitical risks and regulatory environments. Defenders should focus on understanding regional access restrictions and preparing for potential service disruptions. This is not a cybersecurity threat in the traditional sense but a political and regulatory action affecting service availability.
Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation. This affects deployments configured with the SSHPOP provisioner. This vulnerability is fixed in 0.29.0.
CVE-2025-66208 is a high-severity OS command injection vulnerability affecting Collabora Online's built-in CODE Server (richdocumentscode proxy) in versions prior to 25.04.702. This flaw allows unauthenticated remote attackers to execute arbitrary OS commands via the proxy.php interface, particularly when used with Nextcloud and an intermediate reverse proxy. The vulnerability arises from improper neutralization of special elements in OS commands (CWE-78). No user interaction or privileges are required, and the vulnerability has not yet been observed exploited in the wild. The issue is fixed in version 25.04.702.
The Aisuru botnet has been identified as the source of a new record-breaking distributed denial-of-service (DDoS) attack reaching 29.7 Tbps. This attack represents one of the largest volumetric DDoS attacks ever recorded, leveraging a massive network of compromised devices to overwhelm targeted infrastructure. Such an attack can severely disrupt online services, degrade network performance, and cause significant operational downtime. European organizations, especially those with critical online services or digital infrastructure, are at risk of service outages and reputational damage. Mitigation requires advanced DDoS protection strategies, including traffic filtering, rate limiting, and collaboration with upstream providers and ISPs. Countries with high internet penetration, significant digital economies, and strategic infrastructure are more likely to be targeted. Given the scale and potential impact, this threat is assessed as high severity. Defenders should prioritize monitoring for unusual traffic spikes and ensure robust incident response plans are in place.
Arkanix Stealer is a newly discovered information-stealing malware designed for short-term financial gain. Initially developed in Python, it has evolved into a more sophisticated C++ version employing VMProtect obfuscation and a technique called 'Chrome Elevator' to bypass App Bound Encryption. It targets browsers, crypto wallets, VPN accounts, Steam accounts, and system information. Distributed primarily via Discord and online forums disguised as legitimate tools, it offers threat actors a web panel with premium features for managing stolen data. The malware demonstrates advanced capabilities and rapid evolution, highlighting the ease of launching cybercrime operations for quick profits. While no known exploits in the wild have been reported yet, its medium severity reflects the potential impact on confidentiality and financial assets. European organizations using targeted browsers, crypto wallets, or VPN services are at risk, especially those with users active on Discord or similar platforms. Mitigation requires targeted detection of obfuscated binaries, network monitoring for suspicious domains like arkanix.pw, and user education on social engineering risks. Countries with high crypto adoption and active gaming communities are more likely to be affected.
Thousands of sensitive secrets have been published on the websites JSONFormatter and CodeBeautify, exposing potentially critical confidential information. This exposure likely includes API keys, credentials, tokens, and other sensitive data that users inadvertently shared or that were improperly handled by these platforms. Although no known exploits are currently reported in the wild, the leak poses a medium severity risk due to the potential for unauthorized access and data breaches. European organizations using these tools or whose developers have used them may be at risk of credential compromise and subsequent attacks. Immediate mitigation involves auditing secrets for exposure, rotating keys, and avoiding the use of online formatting tools for sensitive data. Countries with high technology sector activity and cloud adoption, such as Germany, France, and the UK, are more likely to be impacted. Defenders should prioritize secret management hygiene and monitor for suspicious activity related to leaked credentials. This incident highlights the risks of using third-party online tools for handling sensitive information.
Ahead of Black Friday and festive sales, over 2,000 holiday-themed fake online stores have been detected, organized into two main clusters. These sites impersonate major retailers like Amazon and use uniform holiday banners, fake trust indicators, and phishing kits to deceive shoppers. They employ urgency tactics and fake checkout pages to steal sensitive financial information. The scams are timed to activate during peak shopping periods to maximize victim traffic and financial theft. This campaign leverages social engineering, typosquatting, and e-commerce impersonation to exploit consumer trust during high-volume shopping events. Although no direct exploits target software vulnerabilities, the threat poses significant risks to consumers and indirectly to organizations handling payment and customer data. European organizations involved in e-commerce, payment processing, and consumer protection are particularly at risk. Mitigation requires proactive detection of fraudulent domains, consumer awareness campaigns, and enhanced monitoring of payment fraud. Countries with high e-commerce adoption and large consumer markets are most likely affected. The threat severity is assessed as high due to the potential financial impact and widespread exposure without requiring user authentication but relying on user interaction.
CVE-2025-65647 is an Insecure Direct Object Reference (IDOR) vulnerability in the Track order function of PHPGURUKUL Online Shopping Portal 2.1. It allows an attacker with limited privileges to disclose information by manipulating the 'oid' parameter without requiring user interaction. The vulnerability has a medium severity with a CVSS score of 4.3, impacting confidentiality but not integrity or availability. No known exploits are currently reported in the wild. European organizations using this specific e-commerce platform could be at risk of unauthorized data exposure. Mitigation involves implementing proper access control checks on the 'oid' parameter and validating user permissions before disclosing order information. Countries with higher e-commerce adoption and usage of PHPGURUKUL products, such as Germany, France, and the UK, are more likely to be affected. Given the medium severity and limited scope, organizations should prioritize patching and access control improvements to prevent potential data leaks.
This report highlights ten hidden cybersecurity threats targeting ecommerce online stores, emphasizing the need for robust protection measures. While no specific vulnerabilities or exploits are detailed, the mention of remote code execution (RCE) suggests potential severe risks if exploited. The threat is categorized as medium severity due to the lack of known exploits and minimal technical details. European ecommerce businesses could face risks including data breaches, financial loss, and reputational damage if these hidden threats are not addressed. Mitigation requires tailored security strategies beyond generic advice, focusing on continuous monitoring, secure coding practices, and supply chain security. Countries with significant ecommerce markets and digital infrastructure, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the absence of detailed technical data and exploits, the threat severity is assessed as medium. Defenders should prioritize awareness of these hidden threats and implement comprehensive security frameworks to safeguard online stores effectively.
A flaw has been found in SourceCodester Online Student Clearance System 1.0. Impacted is an unknown function of the file /Admin/changepassword.php. This manipulation of the argument txtconfirm_password causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
A weakness has been identified in code-projects Online Bidding System 1.0. This issue affects the function categoryadd of the file /administrator/addcategory.php. This manipulation of the argument catimage causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
A vulnerability has been found in Campcodes Online Polling System 1.0. Affected by this issue is some unknown functionality of the file /registeracc.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
A flaw has been found in Campcodes Online Polling System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/checklogin.php. Executing a manipulation of the argument myusername can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
A security flaw has been discovered in itsourcecode Online File Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=login. The manipulation of the argument Username results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be exploited.
A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/customer-list.php. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.
