xerox

PaperCut warns of hackers using printer management software flaw in attacks The company behind a popular brand of printer management software warned customers of a new vulnerability currently being used by cybercriminals. PaperCut released an emergency advisory on Thursday evening saying vulnerabilities in their print management software, PaperCut NG and MF, are under active exploitation. The company released patches for the bugs, tracked as CVE-2026-82078 and CVE-2026-81578, which both carry severity scores over 8.8 out of 10. “PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. We are aware of confirmed customer incidents and are treating this matter with the highest priority,” the company said. PaperCut’s software is used widely across large organizations like universities, corporations and governments. Organizations use PaperCut software to manage a variety of printer brands including Canon, Epson, Xerox, Brother and more. The company urged customers to remove their servers from the public internet and restrict web access to only trusted IP addresses. Customers need to take every step to ensure PaperCut server’s web interfaces cannot be reached from untrusted internet addresses. “Take this action now, even if you have not observed suspicious activity,” PaperCut said. In the security advisory issued on Thursday, the company said it used information provided by a university customer’s security team to reproduce the vulnerability and develop a fix. Multiple cybersecurity companies confirmed evidence of exploitation including Huntress, which said it has at least two customers impacted by the campaign targeting the bugs. An initial patch issued by PaperCut did not sufficiently address the vulnerabilities and the company said it worked with experts from Huntress and watchTwr to create a new patch released on Friday. Jake Knott, head of threat intelligence at watchTowr, noted that previous PaperCut vulnerabilities were used by ransomware gangs and opportunistic attackers to gain initial access. “PaperCut is a prime target for attackers of every motivation, as not only is it an internet-facing pivot into a corporate environment, but it is a sensitive information treasure trove if printed documents can be stored and exfiltrated,” Knott said. In 2023, U.S. law enforcement agencies warned that ransomware gangs like Bl00dy and Clop were exploiting PaperCut bugs. The Cybersecurity and Infrastructure Security Agency (CISA) specifically issued an advisory for K-12 schools that said the education sector is particularly exposed to PaperCut vulnerabilities. Microsoft said an Iranian state-backed group known for attacking critical infrastructure exploited the same bug that year in multiple attacks. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Barba rabbinica, tonaca e sandali: nel 2000 si autodefinì “sull’orlo dell’autismo”. Storia di Richard Stallman, l’uomo del software libero e di una rivoluzione digitale che nessuno aveva previsto. Sono diverse le figure della comunità scientifica che hanno contribuito in maniera fondamentale a traghettare la nostra civiltà dal vecchio mondo analogico all’attuale società dell’informazione (digitale). Tra queste personalità quella che occupa sicuramente un posto di rilievo nell’pantheon informatico è sicuramente Richard Stallman. Richard Stallman è un programmatore statunitense, oggi settantatreenne. Nasce e cresce a New York e ha fatto parte del celebre laboratorio di intelligenza artificiale del MIT nel Massachusetts fino al gennaio del 1984. È proprio nel perimetro di questo laboratorio che si verifica l’evento destinato a dare una svolta al corso dell’informatica. La Xerox aveva donato all’AI Lab (laboratorio di intelligenza artificiale ) del MIT una stampante laser professionale di nuova generazione ma per una strana eterogenesi dei fini questa macchina si inceppava di continuo. Stallman conosceva il problema, sapeva come risolverlo avendo negli anni precedenti risolto problemi simili su altri dispositivi di stampa ma non aveva accesso al codice perché la Xerox distribuiva solo gli eseguibili, quindi, niente reverse engineering. Una buona occasione gli si presentò quando seppe di un ricercatore che aveva lasciato la Xerox PARC per trasferirsi alla Carnegie Mellon University portando con sé il codice. Si reca quindi di persona per chiedergli del sorgente ma tutto si riduce in una breve e brutale conversazione: l’ex ricercatore aveva firmato un accordo di riservatezza con l’azienda e dunque rifiutò di concedergli il codice e qualunque altra cosa. Tempo dopo lo stesso Stallman dichiarerà: “ Era la prima volta che m’imbattevo in una clausola di non divulgazione, e mi resi immediatamente conto come questi accordi producano delle vittime. In questo caso la vittima ero io .” Stallman arrabbiato, andò via senz’aggiungere una parola. Un incontro, durato forse 30 secondi, divenne il punto di svolta della sua vita. Da quel giorno dichiarerà: ogni volta che colleghi del MIT mi offrivano lavoro in aziende che richiedevano un contratto di riservatezza, mi rifiutavo. Questo isolamento progressivo lo portò a definirsi, riprendendo Steven Levy “ l’ultimo vero hacker ”. Questo è quanto basta per convincere il giovane Stallman che il codice proprietario non deve essere l’unica strada percorribile, anzi deve esserci un’alternativa valida e condivisibile ma per questo deve costruirla da zero. Ma per capire meglio la portata di questa scelta bisogna fare un ulteriore passo indietro. Agli inizi degli anni Settanta nei Bell Labs, Ken Thompson e Dennis Ritchie stavano riscrivendo il codice di Unix donando al mondo un nuovo linguaggio di programmazione, il Linguaggio C. Questo rendeva Unix (riscritto in C) oltreché portabile su altre macchine, anche di più facile manutenzione, scelta che successivamente avrebbe permesso al progetto GNU , e più tardi a Linux, di poggiare su basi solide ma, in particolare, era la situazione accademica di quegli anni a renderlo un periodo particolare: Il clima accademico aperto, quello che Stallman vive al MIT, permetteva a ricercatori e università di scrivere e scambiarsi liberamente idee e software creato. Ma con il passare del tempo, questo clima andò via via ridimensionandosi e anche Unix avrebbe perso parte della sua apertura, diventando sempre più chiuso: codice a pagamento, licenze restrittive. Quella di Stallman fu quindi una reazione a queste increspature industriali e ad un contesto che andava cristallizzandosi verso sempre una maggiore chiusura. Così nel gennaio del 1984 anziché schierarsi dalla parte di chi si batteva per il copyright per il software come aveva fatto Bill Gates pochi anni prima scrivendo la celebre: “ Lettera aperta agli hobbisti “, Stallman si decise a compiere un gesto retrospettivamente rivoluzionario, lasciò il laboratorio del MIT per fondare un progetto nuovo, tutto suo. Nasce così il progetto GNU , dal quale nasceranno poi la Free Software Foundation e la licenza GPL . Richard Matthew Stallman Richard viene al mondo a New York nel 1953, figlio di Daniel Stallman e Alice Lippman. Il padre è un veterano della Seconda Guerra Mondiale che ha partecipato allo sbarco in Normandia: un uomo integro, ricorderà il figlio, ma anaffettivo. La madre insegna arte ed è un’attivista sindacale. Vivace e politicamente impegnata di orientamento progressista, l’esatto opposto del giovane Richard, all’epoca adolescente dalle idee conservatrici. Le loro opposte idee li porteranno spesso a quotidiani e furiosi scontri. I genitori divorzieranno nel 1958, quando Richard ha solo cinque anni. Inizia così per il futuro informatico un periodo di pendolarismo tra l’appartamento della madre a Manhattan e la casa del padre nel Queens. Anni di incomprensioni che Stallman ricorderà sempre con tristezza. Richard Matthew Stallman Un introverso enfant prodige Fin dall’infanzia si distingue per comportamenti inusuali: la madre, Alice Lippman, racconta due episodi in particolare. Da bambino, portato in spiaggia, iniziava a urlare ben prima di arrivare alla battigia, infastidito dal rumore della risacca; e piangeva ogni volta che la nonna, dai capelli rosso vivo, tentava di prenderlo in braccio, quasi infastidito dal colore stesso. Episodi che la madre, anni dopo, ricollegherà a certe caratteristiche dello spettro autistico. Sviluppa presto un proprio metodo per orientarsi nel mondo: a 7 anni memorizza le mappe della metropolitana di New York stando al finestrino del primo vagone, e lancia modellini di razzi a Riverside Drive Park annotando i risultati di ogni lancio. Fu proprio in un periodo di lutto, a dieci anni, dopo la morte dei nonni paterni, che un istruttore di un corso estivo gli procurò un manuale dell’IBM 7094: Richard iniziò a scrivere programmi su carta, senza ancora avere una macchina su cui farli girare. Comportamenti che lo stesso Stallman stigmatizzerà in un’intervista al Toronto Star del 9 ottobre 2000 (firma di Judy Steed), nella quale si autodefinì: “Sull’orlo dell’autismo” Gli studi Altro comportamento che lo contraddistingueva dai suoi coetanei a scuola era la sua avversione per i compiti scritti che per anni aveva boicottato e sistematicamente eluso. Il suo ultimo tema risaliva alla quarta elementare. Mentre frequentava la Louis D. Brandeis High School, scuola presso cui si sarebbe diplomato, Richard frequentava il Columbia Science Honors Program, un corso riservato ai migliori studenti delle medie di New York e lavorava come assistente di laboratorio alla Rockefeller University, dove il direttore rimase talmente colpito dal suo talento da telefonare alla madre anni dopo per sapere come stesse, convinto che avrebbe avuto un grande futuro in biologia. Il suo primo vero programma lo scrisse in estate all’IBM New York Scientific Center: un preprocessore per il 7094 in linguaggio PL/I, poi riscritto interamente in assembler perché troppo grande per quella macchina. Andava ancora alle medie. Mentre è ancora all’università che ha inizio la sua leggenda grazie anche alla capacità di correggere i suoi professori mentre facevano lezione, cosa che gli attirò molte antipatie, nel 1974 ad Harvard consegue la laurea in fisica. Dopo la laurea, entra a far parte del laboratorio di intelligenza artificiale del MIT (AI Lab), dove aveva già iniziato a lavorare nel 1971. In quel contesto la parola “ hacker ” non ha una valenza negativa, anzi, si riferiva a chi studiava e s’impegnava senza sosta per migliorare software e sistemi. Scrivere codice era solo un punto di partenza. La filosofia dell’AI Lab era semplice: dare e ricevere, tutto era improntato sulla condivisione e sul miglioramento del codice e chiunque poteva usarlo e migliorarlo restituendolo alla comunità scientifica con nuove aggiunte. Il laboratorio, nei suoi anni d’oro, era per Stallman qualcosa di simile a una città viva: alcune sezioni si rinnovavano continuamente, altre restavano immutate al punto che si poteva riconoscere, dalla scrittura del codice, il lavoro dei programmatori degli anni Sessanta. Poi, nei primi anni Ottanta, quella città cominciò a svuotarsi. La Symbolics, una startup nata da una costola dello stesso MIT, si portò via i migliori programmatori a uno a uno, e tutti firmarono accordi di non divulgazione con l’azienda. Stallman restò Solo. Richard Matthew Stallman Il rivoluzionario Ateo Nonostante fosse figlio di madre ebrea, si dichiarava non credente. Ma era molto provocatorio anche nel professare il suo ateismo. Leggenda vuole che girasse con una spilla su cui era scritto “Processiamo Dio”. La logica era la seguente: se una divinità così potente avesse creato il mondo senza mai correggerne i problemi, avrebbe ragionato, forse più che adorarla, sarebbe stato il caso di processarla. Questa stessa provocazione negli anni prese forma di un piccolo monologo che recita ancora oggi, impersonando l’imputato. La goccia che fa traboccare il vaso Alcuni anni dopo l’evento della stampante laser, gli hacker del MIT sotto la guida di Richard Greenblatt avevano modificato e perfezionato la Lisp Machine, un computer dell’AI Labs creato da John McCarthy negli anni Cinquanta per il linguaggio Lisp. Agli inizi degli anni 80 questo progetto si divise in due rami diversi ognuno rappresentato da una diversa azienda. La Symbolics rappresentata da Russell Noftsker, ex amministratore del laboratorio, e la Lisp Machine Inc di Greenblatt. Le due aziende si contesero il personale dell’AI Lab: alcuni furono assunti come consulenti dalla Symbolics, il resto degli esperti (hacker) andò alla Lisp Machine Inc. L’unico degli esperti che decise di rimanere all’AI Lab fu Stallman che rimase a guardia della Lisp Machine dell’AI Lab. Nel giorno del suo ventinovesimo compleanno la Symbolics ritira il suo accordo informale stipulato con il Laboratorio del MIT. L’accordo consisteva nel condividere le innovazioni e i miglioramenti del codice sviluppati dall’azienda per aggiornare il sistema operativo comune delle Lisp machine. Da quel giorno in poi se il MIT avesse voluto gli aggiornamenti avrebbe dovuto comprare macchine dalla Symbolics e interrompere ogni rapporto con la concorrenza. Stallman da hacker e genio qual’era reagì male all’ultimatum: descrisse il laboratorio come “ un paese neutrale, come il Belgio ” di fronte a un’invasione se la Germania attacca il Belgio, spiegò, il Belgio si schiera con Francia e Inghilterra. Un paragone che Stallman avrebbe ripetuto, quasi identico, anche in un’altra intervista rilasciata anni dopo al giornalista Michael Gross, segno di quanto quell’immagine gli fosse rimasta impressa. Inizio della leggenda Quel che accade dal 1982 entra a ragione nel leggendario, ogni volta che la Symbolics rilasciava una nuova funzione, un aggiornamento, Stallman lo riscriveva da zero per tenere sempre aggiornata la Lisp Machine del MIT e lo stesso laboratorio al passo coi tempi. Iniziò a sfidare, come si dice, a singolar tenzone, a colpi di tastiera e di codice i suoi migliori ex colleghi di laboratorio, passati alla concorrenza. Fu anche accusato di copiare il codice, ma per smentire le accuse smise anche di leggere il loro codice ricostruendo tutto da zero partendo solo dalla documentazione. Nonostante la tenacia e la preparazione, Stallman sapeva di non poter combattere all’infinito contro un’azienda e la maggior parte dei suoi ex colleghi, che lo ritenevano un romantico hacker anacronistico, passati tutti dal software di laboratorio al software di mercato. Si era convinto che non poteva essere più l’ultimo giapponese rimasto nella foresta a combattere a guerra finita, non aveva più senso.L’AI Lab era come una cucine di certi ristoranti storici: un po’ malandata, un po’ geniale, e impossibile da replicare altrove . Bisognava costruire qualcosa di nuovo e che nessuna azienda potesse ricomprare. GNU non è Unix Gennaio 1984. Per evitare che il MIT metta le mani sul suo codice e lo chiuda in un cassetto proprietario, Stallman taglia i ponti. Lascia l’università e lancia un’idea che ai molti suona semplicemente folle: scrivere un intero sistema operativo da zero, che sia compatibile con UNIX . Il nome scelto è tutto un programma: GNU (acronimo ricorsivo per GNU’s Not Unix ). Le regole d’ingaggio? Nessun segreto. Il codice deve rimanere aperto, studiabile e modificabile. Sempre. C’era però un ostacolo di fondo. Per far girare un sistema Unix-like serve un compilatore C, e all’epoca di roba libera non c’era neanche l’ombra. Che fare? Semplice: scriversene uno. Nasce così la Free Software Foundation (FSF) per raccogliere donazioni, e nel 1987 spunta fuori la primissima versione di GCC . Un punto di non ritorno. Era il primo compilatore C portabile e ottimizzato nato completamente libero. Insieme all’editor Emacs e alle utility di base, GCC diventa il pilastro della futura informatica. E da allora non si è mai più fermato: ha inglobato il C++, ha visto nascere un ramo sperimentale pazzesco (EGCS) che ha riscritto le regole dell’ottimizzazione, fino a supportare Fortran, Java e Ada. Oggi la chiamano GNU Compiler Collection , ed è gestita da un comitato misto di accademici e industriali. Il Kernel E il kernel? Mettiamola così: nei piani originali doveva chiamarsi Alix (il nome della ragazza di Stallman all’epoca). Poi lo sviluppatore principale, Michael Bushnell, ci mise lo zampino e optò per HURD , declassando Alix a un semplice sottosistema interno. Poco dopo la coppia scoppiò, e di Alix rimase solo un vecchio appunto nei file di progetto. Curiosità logistica: prima di Internet, come si distribuiva questa mole di codice? Via posta. Man mano che i programmi diventavano stabili, Stallman masterizzava i nastri magnetici e li spediva a casa di chi li chiedeva, dietro un piccolo rimborso spese. In pratica, aveva appena inventato la prima attività di distribuzione software della storia senza nemmeno rendersene conto. Copyleft Nel 1989 Stallman formalizza la GNU General Public License sul principio del Copyleft. Scrivendo il suo codice software come codice legale. Crea un nuovo tecnicismo giuridico fondato sul capovolgimento del funzionamento del Copyright. Il Copyleft non è usato per limitare, restringere la libertà degli utenti, anzi serve a garantirla. Chiunque sia in possesso di un software sotto licenza GPL può liberamente copiarlo, modificarlo, ridistribuirlo senza nessuna restrizione ma con un unico obbligo: qualsiasi versione derivata deve restare sotto il dominio GPL, in modo da godere delle stesse libertà delle versioni precedenti. Richard Matthew Stallman L’ambiguità Il progetto GNU nasce per promuovere la libertà e la cooperazione tra gli utenti di computer e tra i programmatori. Software libero non significa software gratuito. Con la parola Free il software va pensato come se si pensasse alla “Libertà di parola” e non a una “birra Gratis” ripete da sempre Stallman. Dunque, ci si riferisce alla libertà di chi usa quel programma. Nel manifesto del software libero (GNU), sono elencate 4 libertà Libertà 0 : Eseguire il programma per qualsiasi scopo. (Puoi usarlo come vuoi) Libertà 1 : Studiare come funziona il programma e adattarlo alle proprie necessità. (entrare nel codice e modificarlo) Libertà 2 : Ridistribuire copie per aiutare il prossimo. (Fare copie e passarle agli altri) Libertà 3 : Migliorare il programma e distribuire i miglioramenti a beneficio della comunità. (Modificare il codice e passarlo agli altri) Un software può essere distribuito gratuitamente ma non rispettare nessuna delle 4 libertà, come succede in molti casi di software proprietario distribuito senza costi. Al contrario del software libero che anche se venduto commercialmente chi lo acquista è obbligato a mantenere intatte queste 4 libertà. Sant’IGNUcius il suo Alter Ego giocoso Da anni Richard Stallman presenta conferenze dove divulga il verbo del software libero. E in particolare modo chiunque usi il termine “ open source ” al posto di “free software” viene subito richiamato all’ordine. Leggenda narra che in una conferenza, mentre veniva presentato da un docente di una famosa università statunitense come esperto di open source, Stallman balzò in piedi precisando che lui si occupava di software libero e non di altri movimenti. Ma a queste conferenze non mancano ironia e momenti iconici. A un certo punto della serata tira fuori da una busta un vecchio disco magnetico e se lo mette in testa: la luce dei riflettori lo trasforma in un’aureola perfetta. Indossa poi una tonaca nera e si presenta al pubblico come “ San IGNUcius della Chiesa di Emacs ”, alzando la mano destra in un gesto di benedizione scherzosa: “Benedico il tuo computer, figlio mio”. Lo stesso Stallman racconta sul proprio sito di aver ideato il personaggio nel 1996, come modo per “prendersi gioco di sé stesso” senza prendersi troppo sul serio. Stallman è anche conosciuto per la sua avversione alla stupidità e alle cerimonie, è risaputo che se qualcuno fa qualcosa di stupido non esita a rinfacciarglielo. San IGNUcius della Chiesa di Emacs Il trionfo silenzioso Torniamo ai primi anni Novanta. Il sistema GNU ha quasi tutti i pezzi al loro posto, ma gli manca un cuore pulsante. Il kernel HURD è in ritardo cronico. A togliere le castagne dal fuoco ci pensa, nel 1991, un giovane studente finlandese: Linus Torvalds Sforna il kernel Linux e, nel 1992, decide di pubblicarlo sotto la licenza GPL di Stallman: da lì succede l’imprevedibile. L’unione degli attrezzi di GNU con il motore di Torvalds fa nascere il sistema GNU/Linux. Quello che era partito come un mix tra idealismo radicale e l’hobby di un universitario, oggi tiene letteralmente in piedi il mondo digitale. Non ci credete? Guardatevi attorno. I 500 supercomputer più potenti della Terra usano Linux. I server di Hollywood che renderizzano gli effetti speciali? Linux. Perfino l’elicotterino Ingenuity della NASA, che ha svolazzato su Marte, ha dentro un’anima Linux. E poi, ovviamente, c’è Android. Nel 2005 Google si compra l’omonima startup, infilando di fatto un derivato di Linux nelle tasche di oltre tre miliardi di esseri umani. Ed è qui che si consuma il cortocircuito finale, la firma del vero hacker. A fronte di questo trionfo planetario del suo software, oggi Stallman si rifiuta di toccare uno smartphone. Per lui non sono altro che dispositivi di sorveglianza di massa da portare a passeggio, macchine pensate per tracciare la gente tramite software chiuso. E nel 2026? A gennaio 2026 Stallman era ad Atlanta, al Georgia Institute of Technology . Cinquanta minuti di conferenza, poi un’ora e mezza di domande. Stesso copione di sempre tranne il nemico, che stavolta ha un nome nuovo. L’intelligenza artificiale. O meglio: la “Pretend Intelligence”. Perché chiamarla “intelligente”, ragiona lui, è già cedere terreno. È comprare la réclame. È convincersi che queste macchine capiscano qualcosa mentre generano testo e basta, senza sapere cosa significa. Nel medesimo intervento ha allargato il tiro: auto connesse, backdoor nei processori, dispositivi che il produttore può spegnere da remoto con un aggiornamento. Roba che conosce bene. La logica è identica a quella della stampante Xerox: qualcuno, da qualche parte, tiene le chiavi di casa tua. Tu pensi di possedere qualcosa. Non è così. La differenza tra il 1982 e il 2026? La scala. E il fatto che adesso ci si casca in tre miliardi. Vintage C’è chi, come chi vi scrive, ricorda ancora l’odore dei laboratori informatici universitari: ventole che ronzavano a tutte le ore, e un prompt che aspettava paziente il comando gcc . Per intere generazioni di matricole, imparare il C non significava aprire un ambiente di sviluppo blasonato, ma aprire un editor spartano e invocare quel compilatore nato nel 1987 dalle mani e dalla testardaggine di Richard Stallman: il primo compilatore ANSI C ottimizzante e portabile distribuito come software libero, capace persino di ricompilare sé stesso. Il C, si diceva nei corsi, dava accesso diretto alla memoria della macchina. Un privilegio che si pagava a caro prezzo, come in uno dei tanti casi capitati al chi scrive e ai suoi colleghi di corso che, a ricevimento dal professore, si scontravano con il prodotto tra una matrice e un vettore a colpi di segmentation fault e di notti passate a inseguire un puntatore impazzito con gdb . Ma proprio in quella fragilità, in quel dover capire davvero cosa succedesse sotto il cofano, si nascondeva il fascino: GCC non nascondeva nulla, e nemmeno pretendeva di farlo. Era la prova tangibile che un’idea nata nel 1984 dal progetto GNU la libertà di usare, studiare, modificare e condividere il software potesse reggere il confronto, e spesso vincerlo, con i compilatori commerciali del tempo. Ogni errore di compilazione portava con sé quella strana familiarità con una macchina che sembrava, in fondo, condividere gli stessi principi di chi l’aveva creata. Anni dopo, Richard Stallman fu ospite d’onore in un congresso organizzato a Napoli dall’Università Federico II: un evento al quale il sottoscritto non ebbe il tempo di partecipare. Con grande, grandissimo rammarico. Fonti Sam Williams e Richard M. Stallman, Free as in Freedom 2.0: Richard Stallman and the Free Software Revolution (Free Software Foundation, 2010), distribuito sotto licenza GNU Free Documentation License. Capitolo 3: oreilly.com/openbook/freedom/ch03.html — Capitolo 7: oreilly.com/openbook/freedom/ch07.html Michael Gross, “Richard Stallman: High School Misfit, Symbol of Free Software, MacArthur-Certified Genius”: mgross.com/books/my-generation/my-generation-bonus-chapters/richard-stallman-high-school-misfit-symbol-of-free-software-macarthur-certified-genius/ Richard Stallman, “Saint IGNUcius”, pagina ufficiale dell’autore: stallman.org/saint.html — foto e video, categoria “Saint IGNUcius” su Wikimedia Commons (licenze CC-BY / CC-BY-SA): commons.wikimedia.org/wiki/Category:Saint_IGNUcius Judy Steed, Toronto Star, sezione Business, 9 ottobre 2000, p. C03 (per la citazione ‘sull’orlo dell’autismo’).” manca la precisazione concordata: “Articolo cartaceo, non disponibile in archivio digitale libero. Riferimento bibliografico verificato in: Sam Williams, Free as in Freedom, cap. 3, nota 3. Wikipedia, voce “Richard Stallman” (riferimento pubblico aggiuntivo per il dettaglio del manuale IBM 7094): en.wikipedia.org/wiki/Richard_Stallman Copertura giornalistica indipendente del discorso di Stallman al Georgia Institute of Technology, 23 gennaio 2026, tra cui Slashdot, Hardware Upgrade e Rivista AI. L'articolo RMS: l’Eretico del codice. L’uomo della rivoluzione partita da una stampante rotta proviene da Red Hot Cyber .

By Marshall Bennett, Researcher at Adaptive Security In March 2025, a finance director at a multinational firm in Singapore joined what appeared to be a routine Zoom call with her senior leadership team. The CFO was there. Other executives appeared on screen. Everyone looked right. Everyone sounded right. She authorized a $499,000 transfer before anyone flagged the fraud. Every face on that call was AI-generated. This attack has a template. In early 2024, the same approach was used to steal $25.6 million from Arup, one of the world’s largest engineering firms, in a single afternoon. The method has spread widely, and the tools behind it have grown cheaper and easier to use every month since. The organizations that have stopped these attacks all found the same answer: train your people to pause and verify before they act. The Tools to Run This Attack Cost Almost Nothing Cloning someone’s voice takes three seconds of audio and a free download. Three seconds from a voicemail, a podcast appearance, an earnings call, or a LinkedIn video is all a current AI model needs to generate a fully interactive voice replica in real time. The model runs offline, requires no technical background and costs nothing. Voice deepfake incidents rose 680% year-over-year in 2025. More than 100,000 attacks were recorded in the United States in a single year. The tools behind them are available on public repositories, carry no moderation, and run on standard consumer hardware. What makes these attacks so effective is the preparation behind them. Before placing a single call, attackers map the target organization’s org chart, identify who holds financial authority, and study the standard approval workflow for wire transfers. By the time the phone rings, the script is already written. Protect your team from deepfakes, AI voice phishing, and spear phishing attacks with next-generation security awareness training. Companies like Bose PayPal, and Xerox trust Adaptive to defend against deepfakes, voice phishing, and AI-powered attacks. See exactly how Adaptive trains your team to spot them. Tour the #1 AI security platform now Your Security Stack Was Built for a Different Attack A deepfake attack targets people directly. It arrives as a conversation: a familiar face on a Zoom screen, a voice that matches, an urgent request that sounds like any other. Phone calls, video meetings, and voice requests sit outside everything your security stack was built to inspect. The most sophisticated security stack in the world will not stop this attack if the employee fielding the call has never been trained to recognize it. Finance Teams Are the Primary Target. Most Have Never Trained for This. The targets in these attacks are the Controller, the accounts payable specialist, and the HR coordinator handling payroll. Deepfake attackers also call IT help desks with urgent credential reset requests, delivered in a voice that sounds exactly like the CTO. These employees have authority to move money and change account data. The attack surface goes further than most security leaders account for. AI personas are now appearing in hiring pipelines, built from stolen LinkedIn profiles and designed to pass video interviews. Once hired, they get access to internal systems, source code and company data. When I started speaking with CISOs about this threat eighteen months ago, about one in ten had seen a successful deepfake attack at their organization. Today, that number is over half. Most of what I hear never makes the news. Companies have little incentive to disclose that a voice clone just cost them $500,000. The Financial Scale of This Problem Is Growing Fast Deepfake fraud losses exceeded $200 million in the first four months of 2025 alone. The full year of 2024 saw $359 million in total losses. Global deepfake fraud has now crossed $2.19 billion in documented losses, with the United States accounting for the largest share. Among organizations that lost money to a deepfake attack, 61% reported losses above $100,000. Nearly 19% reported losses above $500,000. These are only the losses that were reported. The actual total is far higher. Running this attack at scale requires three things: a name, a three-second audio sample, and one employee without a verification protocol. That combination exists at almost every organization right now. Building the Reflex Before the Call Comes The companies that stop these attacks before money moves all do one thing: they train their employees to verify before they act, regardless of how familiar or urgent the request sounds. Three controls cost nothing to put in place: a verbal passcode for any high-value financial request, a callback requirement on a pre-stored number before approving any wire transfer, and a standing policy that urgency in any financial request is a reason to slow down. Most organizations have none of these in place today. In July 2025, an attacker used an AI-generated voice to impersonate Secretary of State Marco Rubio, sending voice messages via Signal to foreign ministers, a sitting senator, and a governor. None of the recipients acted on the messages. The requests had arrived through an unofficial consumer messaging app, and that inconsistency alone was enough to trigger scrutiny. The incident was reported to the State Department before anyone responded. The attack failed because the recipients paused before acting. A once-a-year compliance module will not build that kind of instinct. Deepfake audio is designed to sound exactly right. An employee who has never experienced a voice clone attack has nothing to draw on when their CFO calls requesting an immediate transfer. The reflex has to be built before that call comes. At Adaptive Security, we simulate AI-powered deepfake attacks across voice, SMS, email, and video. When an employee receives a call from a cloned version of their CFO requesting an urgent wire transfer, it is a test. If they fail, the platform adjusts their risk score and delivers personalized training tied directly to that scenario. Security teams get a clear, real-time view of where they are most exposed and can act before an attacker does. The gap between a synthetic voice and a human one is closing faster than most organizations are preparing. The teams running simulations and building verification habits today are the ones that will catch the call before the transfer clears. Three seconds of your CEO’s voice is already on the internet. Make sure your team knows what to do when it calls. To learn how Adaptive Security helps organizations prevent AI-powered social engineering attacks, visit adaptivesecurity.com. Sponsored and written by Adaptive Security.

Ransomware gang threatens Cheyenne and Arapaho Tribes after shutting down schools The government of the Cheyenne and Arapaho Tribes is being extorted by cybercriminals after a ransomware attack shut down its schools and critical systems in January. The Rhysida ransomware gang took credit for the attack this week and demanded 10 bitcoin, or about $660,000, in exchange for not leaking information stolen from the systems of the Cheyenne and Arapaho Tribes, a federally recognized government headquartered in Concho, Oklahoma. Officials previously confirmed the ransomware attack in January. The tribal government said the cyberattack began on December 8, 2025, when its IT team discovered an attempted intrusion by threat actors. Systems were shut down and the tribe worked with its insurance provider on the recovery effort. A follow-up statement from tribal governor Reggie Wassana confirmed they dealt with a ransomware attack and federal authorities were brought in to help. “The criminals have targeted hundreds of notable companies such as Target, Xerox, Carnival Cruises, Blue Cross Blue Shield as well as local hospitals and airlines. Ironically, it is the high profile and financial success of our tribe that made us a prime target,” he said in a letter to the tribe. “Let me be clear: This was a terrorist attack, and WE DID NOT NEGOTIATE NOR SURRENDER. These criminals have not, and will not, receive one cent from the members of the Cheyenne and Arapaho Tribes.” Wassana committed to continue paying employees of the local Lucky Star Casino as the recovery effort continued through January. The tribe governs about 12,000 residents. The tribe’s Department of Education also warned the attack took down its computers, email and phone system. Students were not penalized for any delays in returning assignments as a result of the internet outages. Tribal administrations across the U.S. were targeted by ransomware gangs in 2025. The city of Durant, just three hours away from Concho and the capital of the Choctaw Nation, was hit with a cyberattack last year, and tribes in Minnesota and Michigan were also attacked by ransomware gangs. The Rhysida ransomware gang has repeatedly targeted governments across the globe, including Kuwait’s Finance Ministry, as well as the transportation department of Maryland, the city of Seattle and the city of Columbus, Ohio. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

An operational security failure allowed researchers to recover data that the INC ransomware gang stole from a dozen U.S. organizations. A deep forensic examination of the artifacts left behind uncovered tooling that had not been used in the investigated attack, but exposed attacker infrastructure that stored data exfiltrated from multiple victims. The operation was conducted by Cyber Centaurs, a digital forensics and incident response company that disclosed its success last November and now shared the full details with BleepingComputer. The Cyber Centaurs investigation began after a client U.S. organization detected ransomware encryption activity on a production SQL Server. The payload, a RainINC ransomware variant, was executed from the PerfLogs directory, which is typically created by Windows. However, ransomware actors have begun to use it more frequently for staging. The researchers also noticed the presence of artifacts from the legitimate backup tool Restic, although data exfiltration had occurred during the lateral movement stage and the threat actor had not used the utility in this attack. This caused a shift in the researchers' investigation "from incident response to infrastructure analysis." The traces that INC ransomware left behind included renamed binaries (like ‘winupdate.exe’), PowerShell scripts to execute Restic, hardcoded repository configuration variables, and backup commands. Restic-related remnants indicated that the threat actor was using the backup tool selectively as part of its operational toolkit. One of the discovered PowerShell scripts, 'new.ps1', contained Base64-encoded commands for Restic and included hardcoded environment variables used to run the tool (access keys, repository paths, and S3 passwords for encrypted repositories). "If INC routinely reused Restic-based infrastructure across campaigns, then the storage repositories referenced in attacker scripts were unlikely to be dismantled once a ransom event concluded," the researchers theorized. "Instead, those repositories would likely persist as long-lived attacker-controlled assets, quietly retaining encrypted victim data well after negotiations ended or payments were made." If this were the case, data stolen from other organizations could still be available in an encrypted form and could potentially be recovered from the backup server. To validate this hypothesis, the team developed a controlled, non-destructive enumeration process that confirmed the presence of encrypted data stolen from 12 unrelated organizations in the healthcare, manufacturing, technology, and service sectors in the United States. None of the organizations were Cyber Centaurs clients, and the incidents were unrelated, distinct ransomware events. The researchers then decrypted the backups and preserved the copies while contacting law enforcement to help validate ownership and guide them through the proper procedure. The Cyber Centaurs report lists multiple tools used in INC ransomware attacks, which include, among others, cleanup tools, remote access software, and network scanners. The researchers also created YARA and Sigma rules to help defenders detect the Restic backup tool or its renamed binaries in the environment or running from suspicious locations, which could signal a ransomware attack in development. INC ransomware is a ransomware-as-a-service (RaaS) operation that emerged in mid-2023. The threat actor claimed several high-profile victims over the years, including Yamaha Motor, Xerox Business Solution, Scotland's NHS, McLaren Health Care, the Texas State Bar, Ahold Delhaize, the Panama Ministry of Economy, the Pennsylvania AG Office, and Crisis24. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Israeli entities spanning academia, engineering, local government, manufacturing, technology, transportation, and utilities sectors have emerged as the target of a new set of attacks undertaken by Iranian nation-state actors that have delivered a previously undocumented backdoor called MuddyViper. The activity has been attributed by ESET to a hacking group known as MuddyWater (aka Mango Sandstorm, Static Kitten, or TA450), a cluster assessed to be affiliated with Iran's Ministry of Intelligence and Security (MOIS). The attacks also singled out one technology company based in Egypt. The campaign took place between September 30, 2024, and March 18, 2025. The hacking group first came to light in November 2017, when Palo Alto Networks Unit 42 detailed targeted attacks against the Middle East between February and October of that year using a custom backdoor dubbed POWERSTATS. It's also known for its destructive attacks on Israeli organizations using a Thanos ransomware variant delivered via the PowGoop loader as part of a campaign referred to as Operation Quicksand. According to data from the Israel National Cyber Directorate (INCD), MuddyWater's attacks have aimed at the country's local authorities, civil aviation, tourism, healthcare, telecommunications, information technology, and small and medium-sized enterprises (SMEs). Typical attack chains involve techniques like spear-phishing and the exploitation of known vulnerabilities in VPN infrastructure to infiltrate networks and deploy legitimate remote management tools – a long-favored approach of MuddyWater. However, at least since May 2024, the phishing campaigns have delivered a backdoor known as BugSleep (aka MuddyRot). Some of the other notable tools in its arsenal include a Blackout, a remote administration tool (RAT); AnchorRat, a RAT that offers file upload and command execution features; CannonRat, a RAT that can receive commands and transmit information; Neshta, a known file infector virus; and Sad C2, a command-and-control (C2) framework that delivers a loader called TreasureBox, which deploys the BlackPearl RAT for remote control, and a binary known as Pheonix to download payloads from the C2 server. The cyber espionage group has a track record of striking a wide range of industries, specifically governments and critical infrastructure, using a mix of custom malware and publicly available tools. The latest attack sequence begins, as in previous campaigns, with phishing emails containing PDF attachments that link to legitimate remote desktop tools like Atera, Level, PDQ, and SimpleHelp. The campaign is marked by the use of a loader named Fooder that's designed to decrypt and execute the C/C++-based MuddyViper backdoor. Alternatively, the C/C++ loader has also been found to deploy go-socks5 reverse tunneling proxies and an open-source utility called HackBrowserData to collect browser data from several browsers, with the exception of Safari in Apple macOS. "MuddyViper enables the attackers to collect system information, execute files and shell commands, transfer files, and exfiltrate Windows login credentials and browser data," the Slovak cybersecurity company said in a report shared with The Hacker News. In all, the backdoor supports 20 commands that facilitate covert access and control of infected systems. A number of Fooder variants impersonate the classic Snake game, while incorporating delayed execution to evade detection. MuddyWater's use of Fooder was first highlighted by Group-IB in September 2025. Also used in the attacks are the following tools - VAXOne, a backdoor that impersonates Veeam, AnyDesk, Xerox, and the OneDrive updater service CE-Notes, a browser-data stealer that attempts to bypass Google Chrome's app-bound encryption by stealing the encryption key stored in the Local State file of Chromium-based browsers (shares similarities with the open-source ChromElevator project) Blub, a C/C++ browser-data stealer that gathers user login data from Google Chrome, Microsoft Edge, Mozilla Firefox, and Opera LP-Notes, a credential stealer written in C/C++ that tricks users into entering their system username and password by displaying a fake Windows Security dialog Importantly, ESET said it observed operational overlaps between MuddyWater and Lyceum (aka Hexane, Spirlin, or Siamesekitten), another Iran-aligned actor and a subgroup of OilRig (aka APT34) that's known for its targeting of entities in the Middle East since at least April 2018. The activity, detected in January and February 2025, involved MuddyWater likely acting as an initial access broker to drop remote desktop tools and a custom Mimikatz loader in a manufacturing-sector organization in Israel. It's assessed that the harvested credentials were likely used by Lyceum to gain deeper access and assume control of operations within the victim environment. "This campaign indicates an evolution in the operational maturity of MuddyWater," ESET said. "The deployment of previously undocumented components – such as the Fooder loader and MuddyViper backdoor – signals an effort to enhance stealth, persistence, and credential harvesting capabilities." Charming Kitten Leaks The disclosure comes weeks after the Israel National Digital Agency (INDA) attributed Iranian threat actors known as APT42 to attacks targeting individuals and organizations of interest in an espionage-focused campaign named SpearSpecter. APT42 is believed to share overlaps with another hacking group tracked as APT35 (aka Charming Kitten and Fresh Feline). It also follows a massive leak of internal documents that has exposed the hacking group's cyber operations, which, according to British-Iranian activist Nariman Gharib, feeds into a system designed to locate and kill individuals deemed a threat to Iran. It's linked to the Islamic Revolutionary Guard Corps (IRGC), specifically its counterintelligence division known as Unit 1500. "The story reads like a horror script written in PowerShell and Persian," FalconFeeds said, adding the leak reveals "a complete map of Iran's IRGC Unit 1500 cyber division." The data dump was posted to GitHub in September and October 2025 by an anonymous collective named KittenBusters, whose motivations remain unknown. Notably, the trove identifies Abbas Rahrovi, also known as Abbas Hosseini, as the operation's leader, and alleges that the hacking unit is managed through a network of front companies. Perhaps one of the other most consequential revelations is the release of the entire source code associated with the BellaCiao malware, which was flagged by Bitdefender in April 2023 as used in attacks targeting companies in the U.S., Europe, the Middle East, and India. Per Gharib, the backdoor is the work of a team operating from the Shuhada base in Tehran. "The leaked materials reveal a structured command architecture rather than a decentralized hacking collective, an organization with distinct hierarchies, performance oversight, and bureaucratic discipline," DomainTools said. "The APT35 leak exposes a bureaucratized cyber-intelligence apparatus, an institutional arm of the Iranian state with defined hierarchies, workflows, and performance metrics. The documents reveal a self-sustaining ecosystem where clerks log daily activity, quantify phishing success rates, and track reconnaissance hours. Meanwhile, technical staff test and weaponize exploits against current vulnerabilities."

MuddyWater cyber campaign adds new backdoors in latest wave of attacks ESET researchers say an Iran aligned threat group is refining its playbook again, and the latest activity shows how much its tactics have shifted. MuddyWater is a long running cyberespionage group, and new findings points to a campaign that hits a range of organizations in Israel, with one confirmed victim in Egypt. A wider set of targets and tools Researchers say the victims in Israel were in the technology, engineering, manufacturing, local government and educational sectors. The group is also known as Mango Sandstorm and TA450, and ESET attributes it to the Ministry of Intelligence and National Security of Iran. The new investigation centers on a collection of custom tools that MuddyWater operators used to improve defense evasion and maintain persistence. One of the main findings is a new backdoor that researchers calls MuddyViper. According to the researchers, it enables attackers to collect system information, execute files and shell commands, transfer files and exfiltrate Windows login credentials and browser data. The operators also deployed other credential stealers. Among the new components is a loader named Fooder that masquerades as the classic Snake game. Fooder delivers MuddyViper through reflective loading, which lets the malware run in memory. Overview of Fooder loading MuddyViper or other supported payloads. (Source: ESET) Phishing for access with familiar tools Initial access in this campaign came through spearphishing emails. ESET says these often included PDF attachments that linked to installers for remote monitoring and management software. The files were hosted on free file sharing services such as OneHub, Egnyte or Mega. The links downloaded tools including Atera, Level, PDQ and SimpleHelp. The group also used another backdoor called VAX One. It was named after the legitimate products that the malware impersonates, which are Veeam, AnyDesk, Xerox and the OneDrive updater service. Researchers note that MuddyWater often uses this type of access pattern. Because of that, some parts of the activity remain easier to detect and block. New delay tricks and cryptography choices The researchers highlight some shifts in technique. Fooder uses a custom delay function that draws on the logic of the Snake game along with Sleep API calls. The goal is to slow execution so that automated analysis tools do not detect the malicious behavior. Researchers says this behavior is one reason the campaign stands out. MuddyWater developers also used CNG, which is the next generation Windows cryptographic API. ESET researchers say this is unusual for Iran aligned groups and also rare across the broader threat landscape. Another shift shows up in how the operators behaved after they gained access. Researchers says they avoided hands on keyboard sessions, which tend to produce noisy command logs with errors. The researchers say the campaign shows technical evolution with more precision, more targeted delivery and a more advanced toolset. Stacking credential stealers after compromise The post compromise phase included several tools built to gather credentials. ESET lists CE Notes, which targets Chromium based browsers, LP Notes, which stages and verifies stolen credentials, and Blub, which pulls login data from Chrome, Edge, Firefox and Opera. The use of multiple stealers lines up with past MuddyWater operations that tend to rely on modular components. ESET’s review places this activity within that long history. Tracing MuddyWater’s past operations The group has been under public scrutiny since 2017 when Unit 42 profiled it. Researchers note that the long term pattern is steady, with phishing documents, attempts to push users to enable macros and a focus on Middle Eastern targets. ESET points to Operation Quicksand in 2020 as a turning point. That campaign targeted Israeli government and telecommunications organizations with multistage operations. The group also ran a campaign in Türkiye that used social engineering tailored to local groups. In 2023 ESET saw MuddyWater target a victim in Saudi Arabia. The group also ran a campaign in early 2025 that overlapped with Lyceum, which is an OilRig subgroup. Researchers say this suggests MuddyWater may act as an initial access broker for other Iran aligned groups.

Risk management company Crisis24 has confirmed its OnSolve CodeRED platform suffered a cyberattack that disrupted emergency notification systems used by state and local governments, police departments, and fire agencies across the United States. The CodeRED platform enables these agencies to send alerts to residents during emergencies. The cyberattack forced Crisis24 to decommission the legacy CodeRED environment, causing widespread disruption for organizations that use the platform for emergency notifications, weather alerts, and other sensitive warnings. In statements and an FAQ shared with impacted customers, Crisis24 says its investigation found that the attack was contained to the CodeRED environment and did not affect any of its other systems. However, they have confirmed that data was stolen from the platform during the attack. This stolen information includes names, addresses, email addresses, phone numbers, and passwords used for CodeRED user profiles. Crisis24 tells customers that they have seen no indication that the stolen data has been publicly published. "CodeRED has informed us that while there are indications that data was taken from the system, at this time, there is no evidence that this information has been posted online," warned an announcement by the City of University Park, Texas. Because the attack damaged the platform, Crisis24 is rebuilding its service by restoring backups to a newly launched CodeRED by Crisis24 system. However, the available data is from an earlier backup on March 31, 2025, so accounts will likely be missing from the system. Numerous counties, cities, and public safety agencies nationwide have reported on the cyberattack and disruption, stating that they are working to restore emergency alert systems for their residents. INC Ransom gang claims responsibility While Crisis24 only attributed the breach to an "organized cybercriminal group," BleepingComputer has learned that the INC Ransomware gang has taken responsibility for the attack. The group created an entry for OnSolve on its Tor data leak site and published screenshots that appear to show customer data, including email addresses and associated clear-text passwords. The ransomware gang claims to have breached OnSolve's systems on November 1, 2025, and encrypted files on November 10. After allegedly failing to receive a ransom payment, the threat actors say they are now selling the data stolen during the attack. As the passwords shared in the screenshots are in clear text, customers are advised to reset any CodeRED passwords that were reused on other sites. INC Ransom is a ransomware-as-a-service (RaaS) operation that launched in July 2023 and has since targeted organizations worldwide. Its list of victims spans a wide range of sectors, from education and healthcare to government and entities like Yamaha Motor Philippines, Scotland's National Health Service (NHS), food retail giant Ahold Delhaize, and the U.S. division of Xerox Business Solutions (XBS). Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The office of Pennsylvania's attorney general has confirmed that the ransomware gang behind an August 2025 cyberattack stole files containing personal and medical information. This comes after Attorney General Dave Sunday confirmed in early September that the incident was a ransomware attack and his office refused to pay the ransom requested by the cybercriminals after they encrypted compromised systems. "The OAG later learned that certain files may have been accessed without authorization. The OAG reviewed which data may have been involved and learned that certain personal information was contained in some files," said the Pennsylvania Office of the Attorney General (OAG) in a Friday press release. "Based on the OAG's review of the data involved, for some individuals the information involved may have included name, Social Security number, and/or medical information." On August 9th, when the breach was discovered, the threat actors took down systems and services on Pennsylvania OAG's network, including the office's website, employees' email accounts, and landline phone lines, in an attack with widespread and crippling impact. While the Pennsylvania OAG has yet to share more information on how the network was breached, cybersecurity expert Kevin Beaumont found that the Pennsylvania AG's network had several public-facing Citrix NetScaler appliances vulnerable to ongoing attacks exploiting a critical vulnerability (CVE-2025-5777) known as Citrix Bleed 2. According to Beaumont, one of the two devices was taken down since July 29th, while the other has been offline since August 7th. Breach claimed by INC Ransom Although the Pennsylvania OAG didn't publicly attribute the breach to a specific ransomware operation, the INC Ransom gang claimed responsibility for the attack on September 20th, when they added it as a new entry on their dark web leak site. At the time, the ransomware group claimed that they had stolen 5.7TB worth of files from the Pennsylvania OAG's network and said that the breach allegedly provided them with access to an FBI internal network. INC Ransom surfaced as a ransomware-as-a-service (RaaS) operation in July 2023 and has since targeted organizations in the private and public sectors worldwide. Its list of victims spans a wide range of sectors, from education and healthcare to government and entities like Yamaha Motor Philippines, Scotland's National Health Service (NHS), food retail giant Ahold Delhaize, and the U.S. division of Xerox Business Solutions (XBS). This is the third time that Pennsylvania state entities have been breached in a ransomware attack: Delaware County paid a $500,000 ransom following a DoppelPaymer attack in 2020 to recover encrypted systems, and a ransomware attack took down the Pennsylvania Senate Democratic Caucus' network in 2017. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

American business services giant Conduent has confirmed that a 2024 data breach has impacted over 10.5 million people, according to notifications filed with the US Attorney General's offices. Conduent is an American business process outsourcing (BPO) company that provides digital platforms and services for governments and enterprises. The company was spun off from Xerox in 2017 and currently employs 56,000 people across 22 countries, having an annual revenue of $3.4 billion. The company began sending data breach notifications to affected individuals this month, with the largest reported number coming from the Oregon government, which said 10.5 million people were affected. Further data breach notifications shared on the Texas AG site report 4 million people, 76k in Washington, and a couple of hundred in Maine. Given that Conduent provides services to several other states where specific data breach figures aren't published, the actual impact could be far larger. The data breach notifications state that people's name, Social Security Numbers, full date of birth, health insurance policy or ID number, or medical information was exposed. Conduent's notification claims that, as of October 24, 2025, the time of its circulation, there's no evidence that the stolen data has been "misused." BleepingComputer contacted Conduent to learn the exact number of impacted people nationwide, and we will update this post with their response once it reaches us. At the start of the year, Conduent suffered a service outage that it later admitted was caused by a cybersecurity incident. Although the threat actor behind the attack wasn't named, the Safepay ransomware gang took responsibility for it in late February. In April, the firm disclosed in a Form 8-K filing with the SEC that threat actors had stolen files from its systems that contained customer information, as well as data from their customers' clients. An investigation into the scope of the data breach has now determined that the attack impacted millions of people. Furthermore, although the breach was discovered in January 2025, the environment had been compromised much earlier, on October 21, 2024. Notification recipients are recommended to obtain credit reports and consider placing fraud alerts and a security freeze on their accounts, though no identity theft protection and credit monitoring services were offered in this case. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Panama's Ministry of Economy and Finance (MEF) has disclosed that one of its computers may have been compromised in a cyberattack.. The government noted that it activated the security procedures for these situations, stating that the incident has been contained and didn't impact core systems that are vital to its operations. "The Ministry of Economy and Finance informs the public that today an incident involving possible malicious software was detected on one of the Ministry's workstations," MEF says in an official statement. "The established security protocols were immediately activated, and preventive measures across the entire IT system were reinforced to contain the intrusion." "It is important to emphasize that none of MEF's central systems or platforms have been compromised and they continue operating normally." Panama's MEF is an important ministry in the country, managing fiscal policy, public spending, and debt management. Most importantly, it handles the Panama Canal revenues, the country's largest source of income. The MEF says that personal and institutional data are safe, and all industry-standard measures are in place to prevent future incidents. Hoewever, the INC Ransom gang has claimed an attack on MEF last week in a post on its data leak site. The hackers say that they stole more than 1.5 TB of data from MEF's systems, including emails, financial documents, budgeting details, and more. The threat group added MEF to its list of victims on the dark web on September 5, and leaked data samples in the form of internal documents as proof of the breach. BleepingComputer contacted MEF to ask about the validity of INC Ransom's claims, but we have not received a response by publication time. INC Ransom emerged in mid-2023 as a ransomware-as-a-service (RaaS). They targeted multiple high-profile victims such as Yamaha Motor, Xerox Business Solution, Scotland's NHS, McLaren Health Care, the Texas State Bar, and Ahold Delhaize. In May 2024, a threat actor using the moniker "salfetka" posted on the Russian-speaking hacking forums that they had the source code for the ransomware and offered to sell it for $300,000. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Dozens of SAP NetWeaver instances are susceptible to compromise after a threat actor released a new working exploit that chains two critical-severity vulnerabilities for code execution. The flaws, tracked as CVE-2025-31324 (CVSS score of 10) and CVE-2025-42999 (CVSS score of 9.1), are described as a missing authorization check issue and an insecure deserialization bug, and were resolved with security notes released in April and May, respectively. Both security defects had been exploited in the wild before fixes were rolled out for them, for the deployment of web shells and remote command execution. Ransomware groups such as BianLian and RansomEXX, and Chinese APTs were seen targeting them. On Friday, threat intelligence and research project Vx-Underground warned that someone apparently linked to the Scattered Spider cybercrime group released on Telegram a new – allegedly zero-day – exploit targeting SAP NetWeaver instances. After analyzing the exploit, enterprise application security firm Onapsis concluded that it was actually built to chain the known flaws CVE-2025-31324 and CVE-2025-42999 for the execution of arbitrary system commands with administrator privileges. “In essence, the attackers first use the missing authentication vulnerability (CVE-2025-31324) to access the critical functionality without authentication and get their malicious payload to the server. Then, they exploit the de-serialization flaw (CVE-2025-42999) to deserialize the malicious payload and execute that code with the privileges of the SAP system,” Onapsis explains. The security firm warns that the deserialization gadget in this exploit could be reused in other contexts, such as the exploitation of deserialization flaws that SAP patched in July. “This potentially opens up new attack vectors in other areas of SAP applications. It’s a powerful tool in an attacker’s arsenal, and its publication in the wild is a significant event. Organizations should ensure these SAP vulnerabilities have been also promptly patched in their environments,” Onapsis notes. While the exploit does not target new SAP vulnerabilities, NetWeaver instances that have not been patched against CVE-2025-31324 and CVE-2025-42999 are exposed to a fresh wave of attacks. According to data from The Shadowserver Foundation, over 50 NetWeaver servers were still vulnerable to CVE-2025-31324 as of August 18. The number is significantly lower compared to the 400 vulnerable instances observed at the end of April. Related: SAP Patches Critical S/4HANA Vulnerability Related: Hundreds of N-able N-central Instances Affected by Exploited Vulnerabilities Related: OT Networks Targeted in Widespread Exploitation of Erlang/OTP Vulnerability Related: Vulnerabilities in Xerox Print Orchestration Product Allow Remote Code Execution

Power doesn’t just disappear in one big breach. It slips away in the small stuff—a patch that’s missed, a setting that’s wrong, a system no one is watching. Security usually doesn’t fail all at once; it breaks slowly, then suddenly. Staying safe isn’t about knowing everything—it’s about acting fast and clear before problems pile up. Clarity keeps control. Hesitation creates risk. Here are this week’s signals—each one pointing to where action matters most. ⚡ Threat of the Week Ghost Tap NFC-Based Mobile Fraud Takes Off — A new Android trojan called PhantomCard has become the latest malware to abuse near-field communication (NFC) to conduct relay attacks for facilitating fraudulent transactions in attacks targeting banking customers in Brazil. In these attacks, users who end up installing the malicious apps are instructed to place their credit/debit card on the back of the phone to begin the verification process, only for the card data to be sent to an attacker-controlled NFC relay server. The stolen card details are passed on to money mules who link the information to contactless payment systems like Apple Pay or Google Pay in person to obtain physical goods. Security from Code to Cloud: IaC Best Practices Cloud misconfigurations don’t wait. Neither should you. Infrastructure-as-Code (IaC) accelerates development, but even small mistakes in templates can become major production risks—like unencrypted S3 buckets or overly permissive access settings. This best practices guide shows you how to fix IaC misconfigurations at the source to secure your cloud environment from the start. Get the Guide ➝ 🔔 Top News Two N-able N-central Flaws Exploited in the Wild — Two security flaws impacting N-able N-central have come under active exploitation in the wild. The flaws, CVE-2025-8875 and CVE-2025-8876, allow command execution and command injection, respectively. The issues have been addressed in N-central versions 2025.3.1 and 2024.6 HF2 released on August 13, 2025. N-able is also urging customers to make sure that multi-factor authentication (MFA) is enabled, particularly for admin accounts. New 'Curly COMrades' APT Targets Georgia and Moldova — A previously undocumented threat actor dubbed Curly COMrades has been observed targeting entities in Georgia and Moldova as part of a cyber espionage campaign designed to facilitate long-term access to target networks. The activity, tracked by the Romanian cybersecurity company since mid-2024, has singled out judicial and government bodies in Georgia, as well as an energy distribution company in Moldova. Curly COMrades are assessed to be operating with goals that are aligned with Russia's geopolitical strategy. It gets its name from the heavy reliance on the curl utility for command-and-control (C2) and data transfer, and the hijacking of the component object model (COM) objects. Persistent access to the infected endpoints is accomplished by means of a bespoke backdoor called MucorAgent. XZ Utils Backdoor Found in Dozens of Docker Hub Images — Several Docker images built around the time of the XZ Utils compromise contain the backdoor, some of which are still available via the container image library Docker Hub. Binary said it identified 35 Debian images on Docker Hub that embedded the backdoor. That includes 12 Docker images and 23 second-order images. The main takeaway is that users should only rely on up-to-date images. The findings are a sign that traces of the supply chain threat have remained after more than a year since the incident came to light. U.S. Expands Sanctions on Garantex — The U.S. Treasury Department sanctioned Russian cryptocurrency exchange Garantex, its successor Grinex, and related affiliates as part of continued efforts by the government to halt the flow of ransomware proceeds facilitated by the platforms. Garantex is estimated to have processed more than $100 million in transactions linked to illicit activities since 2019. "Digital assets play a crucial role in global innovation and economic development, and the United States will not tolerate abuse of this industry to support cybercrime and sanctions evasion," the Treasury Department said. EncryptHub Continues to Exploit Windows Flaw for Stealer Attacks — The Russia-aligned threat actor known as EncryptHub is continuing to exploit a now-patched security flaw impacting Microsoft Windows to deliver malicious payloads, including a stealer called Fickle Stealer. The campaign combines social engineering and the exploitation of a vulnerability in the Microsoft Management Console (MMC) framework (CVE-2025-26633, aka MSC EvilTwin) to trigger the infection routine via a rogue Microsoft Console (MSC) file. ShinyHunters and Scattered Spider Join Forces — ShinyHunters and Scattered Spider appear to be working together to carry out financially motivated attacks, including those targeting Salesforce customers. These include the use of adoption of tactics that mirror those of Scattered Spider, such as highly-targeted vishing (aka voice phishing) and social engineering attacks, leveraging apps that masquerade as legitimate tools, employing Okta-themed phishing pages to trick victims into entering credentials during vishing, and VPN obfuscation for data exfiltration. 🔥 Trending CVEs Hackers don’t wait—they strike within hours of a flaw being exposed. A missed patch, a hidden bug, or even a single overlooked CVE is enough to hand them the keys. What starts as “just one gap” can escalate into disruption, theft, or compromise before defenders even realize it’s happening. Below are this week’s high-risk vulnerabilities. Review them, patch quickly, and stay ahead before someone else makes the first move. This week's list includes — CVE-2025-20265 (Cisco Secure Firewall Management Center), CVE-2025-8671 (HTTP/2), CVE-2025-8875, CVE-2025-8876 (N-able N-central), CVE-2025-25256 (Fortinet FortiSIEM), CVE-2025-53779 (Microsoft Windows), CVE-2025-49457 (Zoom Clients for Windows), CVE-2025-8355, CVE-2025-8356 (Xerox FreeFlow Core), CVE-2024-42512, CVE-2024-42513, CVE-2025-1468 (OPC UA .NET Standard Stack), CVE-2025-42950, CVE-2025-42957 (SAP), CVE-2025-54472 (Apache bRPC), CVE-2025-5456, CVE-2025-5462 (Ivanti Connect Secure), CVE-2025-53652 (Jenkins), CVE-2025-49090, CVE-2025-54315 (Matrix), CVE-2025-52970 (Fortinet FortiWeb),CVE-2025-7384 (Database for Contact Form 7, WPforms, Elementor forms plugin), CVE-2025-53773 (GitHub Copilot), CVE-2025-6186, CVE-2025-7739, CVE-2025-7734 (GitLab), CVE-2025-8341 (Grafana Infinity Datasource Plugin), CVE-2025-47227, CVE-2025-47228 (ScriptCase), CVE-2025-30404, CVE-2025-30405, CVE-2025-54949, CVE-2025-54950, CVE-2025-54951, CVE-2025-54952 (Meta ExecuTorch), CVE-2025-55154, and CVE-2025-55004 (ImageMagick). 📰 Around the Cyber World Flaws in ZTNA Software — Cybersecurity researchers have discovered multiple security flaws impacting Zero Trust Network Access (ZTNA) solutions from Zscaler (CVE-2025-54982), NetSkope and Check Point Perimeter 81 that could be abused by attackers to escalate privileges on end user devices and to completely bypass authentication, granting access to internal resources as any user. The findings follow the discovery of critical weaknesses in Cato Networks' Cato client, including one that could allow an attacker to gain full administrative control of a user’s device simply by having the user visit a malicious web page. Google Address Promptware Attack — Google has remediated a serious security issue that allowed maliciously crafted Google Calendar invites to remotely take over Gemini agents running on the target's device, leak sensitive user data, and hijack control of smart home systems. The targeted promptware attack is initiated simply by an attacker sending a Google Calendar invite to a victim whose name contains an indirect prompt injection. When Google's flagship AI chatbot is asked to summarize its upcoming calendar events, those dormant instructions are triggered, causing havoc in the physical environment, such as remotely controlling a victim's home appliances. The attacks employ an approach called delayed automatic tool invocation to get around Google's existing safety measures. They also demonstrate a potential side effect of Gemini's broad permissions to take actions across the Google ecosystem. "As a result, we were able to hijack the application context, invoke its integrated agents, and exploit their permissions to perform a shocking range of malicious activities -- including identifying the victim's location, recording the victim, and even making changes within the victim's physical environment." The approach shows that Promptware, a variant of EchoLeak, is capable of performing both inter-agent lateral movement, by triggering malicious activity between different Gemini agents, and inter-app lateral movement, by escaping the boundaries of Gemini and leveraging applications installed on a victim's smartphone, to perform malicious activities with real-world consequences. The promptware attacks further show that Gemini can be made to send spam links, generate vulgar content, open up the Zoom app and start a call, steal email and meeting details from a web browser, and download a file from a smartphone's web browser. Google has since rolled out fixes like security thought reinforcement to address the issues. Indirect prompt injections are a more serious AI threat, as the malicious prompt is inserted by an outside source, either embedded within a web page or as text in a white font in an email that's invisible to the naked eye, but can be parsed by AI systems. Addressing prompt injections is a hard problem since the methods LLMs can be tricked are continually evolving, and the attack surface is simultaneously getting more complex. Matter Adds New Security Features — Matter, a unifying, IP-based connectivity protocol and technical standard for smart home and IoT devices, has received numerous security enhancements in version 1.4.2, including (1) Wi-Fi Only Commissioning, which enables devices to be onboarded to Matter ecosystems over Wi-Fi without requiring Bluetooth Low Energy (LE) radios, (2) Vendor ID (VID) Verification, which allows controllers to cryptographically verify that the Admins installed on a device are genuinely from the vendors they claim, (3) Access Restriction Lists (ARLs), which provide a mechanism to restrict access to sensitive settings and data to only trusted, verified Controllers, and (4) Certificate Revocation Lists (CRLs), which offers support for revoking unused or compromised Device Attestation Certificates. Smart Buses Can Be Remotely Hacked — Cybersecurity researchers have discovered that Taiwanese smart buses that incorporate various systems to improve safety, efficiency, and passenger experience, such as Advanced Public Transportation Services (APTS) and Advanced Driver Assistance Systems (ADAS) can be remotely hacked. The research showcased it's possible to easily bypass the on-board router's authentication and gain unauthorized access to its administration interface, and then take over the APTS and ADAS functionality due to a lack of network segmentation. This enables an attacker to leverage the remote access to track the vehicle's movements, manipulate controls, or access the camera. The vulnerabilities impact routers from BEC Technologies, which are commonly installed on smart buses in Taiwan. Cmimai Stealer Spotted in the Wild — A new Visual Basic Script (VBS) stealer malware called Cmimai Stealer has been observed in the wild since June 2025, employing capabilities to harvest a wide range of information from infected hosts and exfiltrating the data using a Discord webhook. "It is lightweight and lacks advanced features like persistence on system restart, encrypted communication, and credential theft; perhaps by design," K7 Security said. "Although it is collecting browser data and screenshots, making us classify it as an Infostealer, it can be used for the dual purpose as a Stealer and also as a second-stage reconnaissance tool used for strategizing further future attacks." Windows Hello or Windows Hell No? — Cybersecurity researchers have presented a novel attack targeting Windows Hello for Business (WHfB) that leverages the storage subsystem of the biometric unit in order to conduct bypass attacks. Essentially, the attack can facilitate biometric injection from another computer that would compromise biometric authentication, granting access to any face or fingerprint submitted. ERNW Research demonstrated that a local admin, or someone who has access to their credentials via malware or other means, can inject biometric information into a computer that would allow it to recognize any face or fingerprint. While the biometric templates are "encrypted," a local administrator can exchange biometric features in the database, allowing authentication as any user already enrolled in the targeted system, including the possibility to make a lateral movement by usurping a domain administrator. Microsoft's Enhanced Sign-in Security (ESS), which operates at a higher hypervisor virtual trust level (VTL1), blocks this line of attack. Securam Prologic Lock Flaws Disclosed — Researchers James Rowley and Mark Omo managed to discover a "backdoor" intended to let authorized locksmiths open Securam Prologic locks used in Liberty Safe and seven other brands. In addition, they discovered a way for a hacker to exploit that backdoor—intended to be accessible only with the manufacturer's help—to open a safe on their own in seconds, as well as found another security vulnerability in many newer versions of Securam's locks that would allow a bad actor to insert a tool into a hidden port in the lock and instantly obtain a safe’s unlock code, WIRED reported. Securam is expected to fix the issues in future models of the ProLogic lock. UAC Bypass via eudcedit.exe — An inventive User Account Control (UAC) bypass method exploits Windows' built-in Private Character Editor ("eudcedit.exe"), allowing attackers to gain elevated privileges without user consent. The technique once again highlights how legitimate Windows utilities can be weaponized to circumvent critical security mechanisms. "If eudcedit.exe is executed under a user context that already belongs to the Administrators group, and UAC is configured permissively (e.g., 'Elevate without prompting'), Windows will launch it immediately with high integrity, without showing a UAC dialog," security researcher Matan Bahar said. Information Leak in Multi-User Linux Environments — New research has demonstrated how basic Linux commands like "ps auxww" can be weaponized to extract database credentials, API keys, and administrative passwords in multi-user Linux environments, "without ever escalating privileges or exploiting a single bug," according to Ionut Cernica. Privacy Leaks Via Siri — Privacy issues have been uncovered in Apple Siri, finding the chat assistant transmits metadata about installed and active open apps, as well as audio playback metadata (e.g., recording names) without the user's ability to control these privacy settings or their consent. What's more, messages dictated via Siri to apps like iMessage and WhatsApp are sent to Apple's servers, along with the recipient phone number and other identifiers. The issues have been codenamed AppleStorm by Lumia Security. Apple said the behavior stemmed from third-party services' use of SiriKit, its extension system for integrating external apps with Siri. OAuth Apps as a Privilege Escalation Tool — Malicious OAuth applications could be used to escalate privileges or move laterally within a target environment. That's according to findings from Praetorian, which has open-sourced a red teaming tool called OAuthSeeker that performs phishing attacks using malicious OAuth applications to compromise user identities within Microsoft Azure and Office365. "It is possible for external verified or internal unverified applications to request user_impersonation privileges within Microsoft Azure, which then allows the attacker to impersonate the user to cloud computing resources within Microsoft Azure, such as accessing compute infrastructure, such as virtual machines," Praetorian said. "Operators can leverage OAuthSeeker for both gaining initial access into an environment, for lateral movement after obtaining initial access, and for persistence purposes after compromising an account leveraging other methods." Fake Minecraft Setup Leads to NjRAT — A new malware campaign has been observed using fake Minecraft installers or mods to distribute a remote access trojan called NjRAT. "It is written in .NET and allows attackers to fully control infected machines remotely, making it one of the most popular and persistent malware families used in cyber espionage, cybercrime, and surveillance operations," Point Wild said. The disclosure comes as the cybersecurity company detailed the inner workings of another RAT called Sakula RAT that has been employed in targeted intrusions since at least 2012. Besides harvesting sensitive data, the malware can connect to a command-and-control (C2) server to receive instructions from the attacker to run arbitrary commands and download additional payloads. Israel Targeted by PowerShell RAT Using ClickFix — Speaking or RATs, multiple Israeli organizations have been targeted by spear-phishing attacks that direct users to fake landing pages mimicking Microsoft Teams invites, while using ClickFix-like lures to trick recipients into launching PowerShell commands under the guise of joining the conversation. The command initiates the retrieval and execution of a secondary PowerShell script from the attacker's server, which, in turn, acts as a loader for a PowerShell remote access trojan that can run PowerShell commands from the C2 and run more malware. "The adversary leveraged compromised internal email infrastructure to distribute phishing messages across the regional business landscape," Fortinet said. "The attacker systematically compromised multiple Israeli companies over several consecutive days, using each breached environment as a launchpad to target additional organizations in the region. This tactic closely mirrors MuddyWater's typical approach to lateral expansion." The absence of remote management tools (RMMs), a hallmark of MuddyWater's attacks, indicates a tactical deviation. The disclosure came as Profero said it cracked the encryption of the DarkBit (aka Storm-1084) ransomware gang's encryptors, allowing victims to recover files for free without paying a ransom. DarkBit is assessed to share overlaps with MuddyWater. The decrypter exploits a weak key generation algorithm used by the DarkBit group to brute-force the decryption key. Kimsuky Allegedly Suffers Data Breach — The North Korean state-sponsored hackers known as Kimsuky have reportedly suffered a data breach after a pair of hackers, named Saber and cyb0rg, stole the group's data and leaked it publicly online. "Kimsuky, you are not a hacker. You are driven by financial greed, to enrich your leaders, and to fulfill their political agenda," the hackers remarked in an analysis published in the latest issue of Phrack magazine. "You steal from others and favour your own. You value yourself above the others: You are morally perverted." Among the leaked data are Kimsuky's backend, exposing hacking tools, email addresses, internal manuals, and passwords that could provide insight into unknown campaigns and undocumented compromises. Saber and cyb0rg claim to have found evidence of Kimsuky compromising several South Korean government networks and companies. The files also include the group's Android Toybox modifications and use of exploits like Bushfire. Another program is a Loadable Kernel Module (LKM) style rootkit with the ability to hide from detection and operate on any network port. "The main purpose of the rootkit is to create a persistent and stealthy backdoor," Sandfly Security said. "The backdoor is activated when a special magic packet is received, combined with a correct password to initiate an SSL connection. The backdoor can be activated on any port. This is important to understand because a firewall alone may not protect the target system. If the magic packet is able to hit the victim, then the backdoor may be activated." The tranche of data is said to have originated from a virtual workstation and virtual private server (VPS) used by the threat actor. That said, indications are that the dumps may have originated from a likely Chinese actor who has knowledge of Kimsuky's tradecraft. 2 Founders of Samourai Wallet Plead Guilty to Money Laundering — Two senior executives and founders of the Samourai Wallet cryptocurrency mixer have pleaded guilty to charges involving washing more than $200 million worth of crypto assets from criminal proceeds and concealing the nature of illicit transactions using services like Whirlpool and Ricochet. Samourai CEO Keonne Rodriguez and CTO William Lonergan Hill were arrested last year after the U.S. Federal Bureau of Investigation (FBI) took down their service. As part of their plea agreements, Rodriguez and Hill have also agreed to forfeit $237,832,360.55. "The defendants created and operated a cryptocurrency mixing service that they knew enabled criminals to wash millions in dirty money, including proceeds from cryptocurrency thefts, drug trafficking operations, and fraud schemes," the U.S. Department of Justice (DoJ) said. "They did not just facilitate this illicit movement of money, but also encouraged it." Tornado Cash Founder Convicted of Operating a Money Transmitting Business — Roman Storm, a co-founder of the cryptocurrency mixing service Tornado Cash, was found guilty of conspiring to operate an unlicensed money-transmitting business. However, the jury failed to reach a ruling on the more significant charges of conspiracy to commit money laundering and to violate sanctions. "Roman Storm and Tornado Cash provided a service for North Korean hackers and other criminals to move and hide more than $1 billion of dirty money," the DoJ said. Storm is set to be sentenced later this year and faces a maximum prison sentence of five years. The development came as the U.S. Treasury Department dropped its appeal against a court ruling that forced it to lift sanctions against Tornado Cash last month. Tornado Cash was delisted from the Specially Designated National and Blocked Persons (SDN) list earlier this March. The service was sanctioned in 2022 for its alleged links to cybercriminals and for having "repeatedly failed to impose effective controls” to prevent money laundering. India's UPI to Stop P2P Money Requests to Tackle Fraud — The National Payments Corporation of India (NPCI) announced it will discontinue the person-to-person (P2P) Collect Request feature from the country's instant payment system, Unified Payments Interface (UPI), starting October 1, 2025, aiming to strengthen security and prevent payment-related fraud. The feature allows users to request money from another individual via UPI, but has been misused by fraudsters by sending fake money transfer requests that can be inadvertently approved by a simple tap, thereby tricking unwitting users into authorizing payments. The change, however, does not apply to merchants. Microsoft Plans to Block Dangerous File Types in Teams — Microsoft revealed it's planning to block dangerous file types and malicious URLs in Teams chats and channels. "Microsoft Teams now blocks messages containing weaponizable file types, such as executables, in chats and channels, increasing protection against malware and other file-based attacks," the company said. "Microsoft Teams can now detect and warn users on malicious URLs sent in Teams chat and channels, increasing protection against malware attacks." Separately, the tech giant said it's also integrating Teams with Defender for Office 365 Tenant Allow/Block List to allow administrators to centrally manage blocked external domains in Teams. USB Worm Delivers Crypto Miner — A USB-based worm is being used to deliver the XMRig cryptocurrency miner as part of a global campaign targeting financial, education, healthcare, manufacturing, telecom, and oil and gas sectors in Australia, India, the U.S., and other countries. "The infection starts with execution of a VB script file from a USB drive (using a file name that starts with x and random 6 digits) from a folder named 'rootdir,'" CyberProof said. The attack chain subsequently leverages DLL side-loading techniques to launch a malicious DLL that's responsible for starting the mining process. In a related development, Russian companies have become the target of the Kinsing (aka H2Miner and Resourceful Wolf) cryptojacking group as part of large-scale attacks that brute-force SSH instances or scan internet-exposed servers for known vulnerabilities (e.g., CVE-2017-9841) in order to drop the Monero cryptocurrency miner. SMM Flaws in AMI Aptio UEFI Firmware — System Management Mode (SMM) memory corruption vulnerabilities (CVE-2025-33043) have been identified in UEFI modules present in AMI Aptio UEFI firmware that could be exploited by an attacker to elevate privileges and execute arbitrary code in the highly privileged SMM environment. "This could bypass certain firmware-level protections, such as those protecting the SPI flash memory, and enable persistent modifications to the firmware that operate independently of the OS," CERT Coordination Center (CERT/CC) said. Former Intel Engineer Sentenced to 2 Years of Probation for Stealing Trade Secrets — An engineer who stole trade secrets from Intel and shared them with his new employer, Microsoft, was sentenced to two years of probation and ordered to pay a fine of more than $34,000. Varun Gupta was employed at Intel from July 2010 to January 2020, when he secured his new job at Microsoft. Gupta pleaded guilty to possessing trade secrets back in February 2025. "Between February and July 2020, while employed by the company in Washington, Gupta possessed and accessed his previous employer's trade secrets and proprietary information without authorization," the Justice Department noted at the time. "Gupta accessed information related to customized product design and pricing for significant purchases of computer processors, which Gupta used, as a representative of the Washington company, during head-to-head negotiations with his previous employer." He was sued by Intel in early 2021. GitHub Repositories Deliver Stealer Malware — GitHub repositories disguised as legitimate projects, including game cheats, software cracks, and automation tools, have been used to distribute a malware loader called SmartLoader. It's believed that users searching for such tools on search engines are the target of the campaign. The loader acts as a conduit for the Rhadamanthys information stealer malware, which is retrieved from a remote server. Users who search for tools to download YouTube videos for free have also been found to be served fake sites like YTMP4, where those who enter a video URL are displayed a "Download Now" button that drops DigitalPulse proxyware on the victim's host by means of an executable hosted on GitHub. In a separate campaign, Facebook ads are being used to redirect users to fake landing pages that aim to deceive users into installing phony versions of cryptocurrency exchange apps like Binance that contain malware. The activity overlaps with a threat cluster dubbed WEEVILPROXY. Phishing Attacks Use Personalized Subject Lines and Links — Phishing attacks have been observed crafting personalized subject lines, attachment names, and embedded links to create a sense of familiarity or urgency, and increase the likelihood that the recipients engage with the email messages. "This strategy is not limited to the subject line; it is often extended to the email attachments, links, and message body," Cofense said. "By including customized elements, attackers aim to increase the likelihood of a successful compromise." These subject customization campaigns bearing travel Assistance, Response, Finance, Taxes, and Notification-themed emails have been found to deliver remote access trojans and information stealers. Finance-themed campaigns predominantly deliver jRAT, a cross-platform Remote Access Trojan written in Java that enables multi-operating system compatibility, whereas response-themed emails frequently serve PikaBot malware. Google pKVM Achieves SESIP Level 5 Certification — Google announced that its protected Kernel-based Virtual Machine (pKVM) for Android has achieved SESIP Level 5 certification, the highest security assurance level for IoT and mobile platforms. "This makes pKVM the first software security system designed for large-scale deployment in consumer electronics to meet this assurance bar," Google said. "This includes vital features, such as on-device AI workloads that can operate on ultra-personalized data, with the highest assurances of privacy and integrity." 81% of Organizations Knowingly Ship Vulnerable Code — While 98% of organizations experienced breaches due to vulnerable code, 81% knowingly shipped that code, often to meet business goals. "Under pressure to deliver, teams are treating patch-later practices as acceptable risk, embedding insecurity into the SDLC," Checkmarx said in its Future of AppSec report. The report is based on a survey of 1,500 application security leaders. Half of the respondents already use AI security code assistants, and 34% admitted that more than 60% of their code is generated using artificial intelligence (AI) tools. Pak Entities Targeted by Blue Locker Ransomware — Pakistan's National Cyber Emergency Response Team (NCERT) issued an alert warning of Blue Locker ransomware attacks targeting the oil and gas sector. The ransomware, believed to be connected to the Shinra malware family, is distributed via a PowerShell-based loader that attempts to disable security defenses, escalate privileges, and launch its main payload. Phishing emails, malicious attachments, drive-by downloads, and insecure remote access are some of the initial access routes used by the threat actors behind the operation. "The motive behind these events may vary, but it is unlikely that a traditional cybercriminal organization is responsible; instead, it is more probable that a nation-state group is attacking critical infrastructure," Resecurity said. "Very often, advanced actors operate under the guise of cybercrime to blur attribution and avoid geopolitical context." The disclosure came as Huntress detailed a KawaLocker (aka KAWA4096) ransomware incident that involved the attackers accessing a victim's endpoint via Remote Desktop Protocol (RDP) using a compromised account, followed by disabling security tools using kernel drivers and then dropping the locker. Phishing Campaign Uses "ん" as a URL Forward Slash — A Booking.com-themed phishing campaign has been observed using the Unicode character "ん" in URLs as a substitute for forward slashes when rendered in a web browser to trick unsuspecting users into running malicious MSI installers that are likely capable of delivering additional malware. Threat Actors Sell Access to Compromised Law Enforcement Accounts — A flourishing underground economy is enabling unauthorized access to hacked government and law enforcement accounts. These accounts are either compromised through phishing or through information-stealing infections. A single account is available for as little as $40. Chrome Tests Blocking Fingerprinting in Incognito Mode — Google's Chrome team said it's testing a Script Blocking feature that's aimed at thwarting scripts engaging in known, prevalent techniques for browser re-identification using browser APIs to extract additional information about the user's browser or device characteristics. The feature is expected to be shipped in version 140. Norway Says Russian Hackers Sabotaged Dam — The Norwegian Police Security Service said pro-Russian hackers likely sabotaged a dam in the country's southwest in April 2025. This is the first time officials have publicly linked the incident to Russia. "The aim of this type of operation is to influence and to cause fear and chaos among the general population," PST said. Exactly who is behind it is presently unknown. NIST Finalizes Lightweight Cryptography Standard to Secure IoT Devices — The U.S. National Institute of Standards and Technology (NIST) has completed work on the Ascon cryptographic standard. The standard contains four cryptographic algorithms (ASCON-128 AEAD , ASCON-Hash 256, ASCON-XOF 128, and ASCON-CXOF 128) designed to be used on low-memory IoT devices, as well as RFID tags and medical implants. The agency has been working on the standard since 2023. Chinese AI Firm Runs Propaganda Campaigns — The Chinese government is enlisting the help of domestic AI companies to monitor and manipulate public opinion on social media through sophisticated propaganda campaigns. One such company, named GoLaxy has run influence operations targeting Hong Kong and Taiwan with the help of AI tools. Founded in 2010, it has also used a tool named GoPro to build psychological profiles and build data profiles for at least 117 sitting U.S. lawmakers and more than 2,000 other American political and thought leaders. Furthermore, GoLaxy is believed to be tracking thousands of right-wing influencers and journalists. The company has since attempted to scrub its digital footprint, albeit unsuccessfully. In a statement to The New York Times, GoLaxy said its products are mainly based on open-source data. 🎥 Cybersecurity Webinars 5 Hidden Risks in Your Code-to-Cloud Pipeline—And How to Fix Them Fast: Security gaps don’t start in the cloud—they begin in your code. Join us to discover how code-to-cloud visibility unites developers, DevOps, and security teams with one shared map of risk. Learn how to cut noise, speed remediation, and protect your business-critical applications before attackers find the weak link. How to Detect the Silent AI Threats Hiding in Your Systems: AI is no longer just a tool—it can act like a rogue insider hiding in plain sight. Join our webinar, Shadow Agents and Silent Threats, to uncover how AI is reshaping identity risks, why traditional defenses aren’t enough, and what you can do now to stay ahead of invisible threats. How to Stop Rogue AI Agents Before They Hijack Your Identities and Data: AI Agents are multiplying inside your business faster than most teams can track—slipping into workflows, cloud platforms, and identities without warning. In this exclusive panel, security experts will uncover where Shadow AI hides, the risks they pose, and the practical steps you can take right now to regain control—without slowing innovation. 🔧 Cybersecurity Tools Buttercup: It is a Cyber Reasoning System (CRS) built to automatically find and fix vulnerabilities in open-source software. Developed by Trail of Bits for DARPA’s AIxCC program, it combines fuzzing, program analysis, and AI-driven patching to discover security flaws and generate repairs. Designed to work with OSS-Fuzz compatible C and Java projects, Buttercup integrates multiple components—like an orchestrator, fuzzer, and patcher—into a workflow that can test, monitor, and secure code at scale. Beelzebub: It is an open-source honeypot framework that provides a controlled environment for studying cyber attacks. It combines low-code configuration with AI-driven simulation to mimic high-interaction systems while maintaining a safer, low-interaction core. Supporting multiple protocols like SSH, HTTP, and TCP, as well as monitoring through Prometheus and ELK integration, Beelzebub helps researchers and defenders observe attacker behavior, test defenses, and analyze emerging threats. ExtensionHound: It is a forensic analysis tool designed to trace Chrome extensions’ DNS activity. By correlating network requests with specific extensions, it overcomes Chrome’s default process-level attribution barrier, making it possible to identify which extension generated suspicious queries. With optional integrations for domain reputation (VirusTotal), extension details (Secure Annex), and YARA-based signature detection, ExtensionHound provides investigators with clearer visibility into extension behavior across Windows, macOS, and Linux environments. Disclaimer: These newly released tools are for educational use only and haven’t been fully audited. Use at your own risk—review the code, test safely, and apply proper safeguards. 🔒 Tip of the Week Clipboard Permissions — A Hidden Data Leak Waiting to Happen — Most people think of their clipboard as a harmless convenience — copy some text, paste it where you need it, done. But in modern browsers like Chrome, the clipboard is a shared space between your computer and any website you grant permission to. Once allowed, a site can read whatever is currently in your clipboard — not just what you copied from that site, but from anywhere: your password manager, a PDF, a corporate document, or even secure notes. The danger isn’t just “technical paranoia” — clipboard access is a known target for attackers because it bypasses a lot of security boundaries. If you’ve allowed a site to read your clipboard: It can read sensitive data from other apps — (e.g., passwords, personal IDs, bank info) if that data is in your clipboard while the site is open. It can read more than what you paste — Once permission is granted, a site can read your clipboard when you interact with it (e.g., clicking a button). It can see data copied from anywhere, not just from that site. It’s silent — there’s no pop-up or alert for each read. You won’t know it’s happening. For example, you allow design-tool[.]com to read your clipboard because you want to paste an image directly into the site. Later in the day, you copy: A password from your password manager, A confidential client email snippet, Or a crypto wallet address. While you’re still working in design-tool[.]com, its code could (maliciously or due to a compromise) send each clipboard read to a remote server — without you ever pressing “paste.” Unlike file downloads or microphone access, Chrome’s clipboard permission is “all or nothing” for that site. Once allowed, the site can read at will until you manually revoke the permission. What You Can Do Grant Access Only When Needed: Go to chrome://settings/content/clipboard and set permissions to “Ask before accessing.” Revoke Access After Use: Click the lock icon next to the address bar → Site settings → Block clipboard access. Use Separate Profiles: Keep clipboard-trusted sites in a dedicated Chrome profile; close it when not in use. Avoid Copying Sensitive Data While a Site is Open: If you must copy sensitive info, close the tab for any site with clipboard permissions first. Clipboard access is like giving a stranger a window into your desk — you may only want them to look once, but if you leave the window open, they can keep peeking without asking. Treat clipboard permissions as carefully as camera or microphone access. Conclusion The pace isn’t slowing down, and the risks aren’t waiting. Every delay, every blind spot, becomes an opening someone else is ready to use. What’s urgent isn’t just patching or reacting—it’s staying one step ahead.

Two serious vulnerabilities were patched recently by Xerox in its FreeFlow Core print orchestration platform. According to pentesting company Horizon3, whose researchers discovered the flaws, FreeFlow Core is affected by an XXE injection flaw (CVE-2025-8355) and a path traversal issue (CVE-2025-8356). The researchers discovered that the vulnerabilities could allow an unauthenticated, remote attacker to execute arbitrary code on affected FreeFlow Core instances. The potential impact has been demonstrated with an exploit that placed a webshell on the targeted system. FreeFlow Core is designed for prepress automation workflows and it’s typically used by organizations with large-scale printing operations, including universities, packaging and marketing firms, and even government agencies, according to Horizon3. “Given the nature of the product, FreeFlow Core installations have a lot of moving parts and require relatively open access and availability, which combined with the fact that print jobs of this kind generally contain pre-public information around marketing campaigns makes this an ideal target for attackers,” the security firm warned. The vulnerabilities were reported to Xerox in June and they were patched on August 8, when the vendor published an advisory to inform customers about the availability of patches. Fixes are included in FreeFlow Core version 8.0.5. Earlier this year, researchers disclosed vulnerabilities in Xerox VersaLink multifunction printers that could allow attackers to retrieve authentication credentials, which could then be used for lateral movement. Related: New Vulnerabilities Expose Millions of Brother Printers to Hacking Related: Printer Company Procolored Served Infected Software for Months Related: Critical Vulnerability Found in Canon Printer Drivers Related: Fortinet, Ivanti Release August 2025 Security Patches

Vulnerabilità in Xerox FreeFlow Core Alert AL02/250814/CSIRT-ITA Sintesi Rilevate due nuove vulnerabilità, di cui una con gravità “critica” e una con gravità “alta”, in Xerox FreeFlow Core, software di automazione e ottimizzazione dei processi di prestampa e produzione. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato remoto di bypassare i meccanismi di sicurezza o di eseguire codice arbitrario sui sistemi target. Tipologia Remote Code Execution Security Restrictions Bypass Prodotti e versioni affette Xerox FreeFlow Core, versioni precedenti alla 8.0.5 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti.

Xerox heeft kwetsbaarheden verholpen in Xerox FreeFlow Core. De kwetsbaarheden omvatten een Path Traversal kwetsbaarheid die kan worden misbruikt door aanvallers om toegang te krijgen tot ongeautoriseerde bestanden, wat kan leiden tot Remote Code Execution (RCE). Daarnaast is er een kwetsbaarheid door onjuiste verwerking van XML-invoer, die aanvallers in staat stelt om Server-Side Request Forgery (SSRF) uit te voeren door externe entiteiten in het systeem te injecteren.

Zoom and Xerox have addressed critical security flaws in Zoom Clients for Windows and FreeFlow Core that could allow privilege escalation and remote code execution. The vulnerability impacting Zoom Clients for Windows, tracked as CVE-2025-49457 (CVSS score: 9.6), relates to a case of an untrusted search path that could pave the way for privilege escalation. "Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access," Zoom said in a security bulletin on Tuesday. The issue, reported by its own Offensive Security team, affects the following products - Zoom Workplace for Windows before version 6.3.10 Zoom Workplace VDI for Windows before version 6.3.10 (except 6.1.16 and 6.2.12) Zoom Rooms for Windows before version 6.3.10 Zoom Rooms Controller for Windows before version 6.3.10 Zoom Meeting SDK for Windows before version 6.3.10 The disclosure comes as multiple vulnerabilities have been disclosed in Xerox FreeFlow Core, the most severe of which could result in remote code execution. The issues, which have been addressed in version 8.0.4, include - CVE-2025-8355 (CVSS score: 7.5) - XML External Entity (XXE) injection vulnerability leading to server-side request forgery (SSRF) CVE-2025-8356 (CVSS score: 9.8) - Path traversal vulnerability leading to remote code execution "These vulnerabilities are rudimentary to exploit and if exploited, could allow an attacker to execute arbitrary commands on the affected system, steal sensitive data, or attempt to move laterally into a given corporate environment to further their attack," Horizon3.ai said. The cybersecurity company said CVE-2025-8355 stems from the fact the binary ("jmfclient.jar") responsible for handling Job Message Format (JMF) messages, which contain commands for managing print jobs and reporting their status, included an XML parsing utility that did not sanitize or limit usage of XML External Entities. As a result, an attacker could send a specially crafted request to perform SSRF attacks. CVE-2025-8356, on the other hand, has to do with the XML parsing routine's inadequate handling of JMF commands related to file upload and processing, opening the door for a path traversal attack. This vulnerability could be weaponized to drop a web shell in a publicly accessible location via a crafted HTTP request. "While the service on port 4004 doesn't contain any features that would allow this file to be served, the primary web portals provide all the necessary functionality for executing and serving our malicious payload," security researcher Jimi Sebree said.

Microsoft on Tuesday rolled out fixes for a massive set of 111 security flaws across its software portfolio, including one flaw that has been disclosed as publicly known at the time of the release. Of the 111 vulnerabilities, 16 are rated Critical, 92 are rated Important, two are rated Moderate, and one is rated Low in severity. Forty-four of the vulnerabilities relate to privilege escalation, followed by remote code execution (35), information disclosure (18), spoofing (8), and denial-of-service (4) defects. This is in addition to 16 vulnerabilities addressed in Microsoft's Chromium-based Edge browser since the release of last month's Patch Tuesday update, including two spoofing bugs affecting Edge for Android. Included among the vulnerabilities is a privilege escalation vulnerability impacting Microsoft Exchange Server hybrid deployments (CVE-2025-53786, CVSS score: 8.0) that Microsoft disclosed last week. The publicly disclosed zero-day is CVE-2025-53779 (CVSS score: 7.2), another privilege escalation flaw in Windows Kerberos that stems from a case of relative path traversal. Akamai researcher Yuval Gordon has been credited with discovering and reporting the bug. It's worth mentioning here that the issue was documented in detail back in May 2025 by the web infrastructure and security company, giving it the codename BadSuccessor. The novel technique essentially allows a threat actor with sufficient privileges to compromise an Active Directory (AD) domain by misusing delegated Managed Service Account (dMSA) objects. "The good news here is that successful exploitation of CVE-2025-53779 requires an attacker to have pre-existing control of two attributes of the hopefully well protected dMSA: msds-groupMSAMembership, which determines which users may use credentials for the managed service account, and msds-ManagedAccountPrecededByLink, which contains a list of users on whose behalf the dMSA can act," Adam Barnett, lead software engineer at Rapid7, told The Hacker News. "However, abuse of CVE-2025-53779 is certainly plausible as the final link of a multi-exploit chain which stretches from no access to total pwnage." Action1's Mike Walters noted that the path traversal flaw can be abused by an attacker to create improper delegation relationships, enabling them to impersonate privileged accounts, escalate to a domain administrator, and potentially gain full control of the Active Directory domain. "An attacker who already has a compromised privileged account can use it to move from limited administrative rights to full domain control," Walters added. "It can also be paired with methods such as Kerberoasting or Silver Ticket attacks to maintain persistence." "With domain administrator privileges, attackers can disable security monitoring, modify Group Policy, and tamper with audit logs to hide their activity. In multi-forest environments or organizations with partner connections, this flaw could even be leveraged to move from one compromised domain to others in a supply chain attack." Satnam Narang, senior staff research engineer at Tenable, said the immediate impact of BadSuccessor is limited, as only 0.7% of Active Directory domains had met the prerequisite at the time of disclosure. "To exploit BadSuccessor, an attacker must have at least one domain controller in a domain running Windows Server 2025 in order to achieve domain compromise," Narang pointed out. Some of the notable Critical-rated vulnerabilities patched by Redmond this month are below - CVE-2025-53767 (CVSS score: 10.0) - Azure OpenAI Elevation of Privilege Vulnerability CVE-2025-53766 (CVSS score: 9.8) - GDI+ Remote Code Execution Vulnerability CVE-2025-50165 (CVSS score: 9.8) - Windows Graphics Component Remote Code Execution Vulnerability CVE-2025-53792 (CVSS score: 9.1) - Azure Portal Elevation of Privilege Vulnerability CVE-2025-53787 (CVSS score: 8.2) - Microsoft 365 Copilot BizChat Information Disclosure Vulnerability CVE-2025-50177 (CVSS score: 8.1) - Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability CVE-2025-50176 (CVSS score: 7.8) - DirectX Graphics Kernel Remote Code Execution Vulnerability Microsoft noted that the three cloud service CVEs impacting Azure OpenAI, Azure Portal, and Microsoft 365 Copilot BizChat have already been remediated, and that they require no customer action. Check Point, which disclosed CVE-2025-53766 alongside CVE-2025-30388, said the vulnerabilities allow attackers to execute arbitrary code on the affected system, leading to a full system compromise. "The attack vector involves interacting with a specially crafted file. When a user opens or processes this file, the vulnerability is triggered, allowing the attacker to take control," the cybersecurity company said. The Israeli firm revealed that it also uncovered a vulnerability in a Rust-based component of the Windows kernel that can result in a system crash that, in turn, triggers a hard reboot. "For organizations with large or remote workforces, the risk is significant: attackers could exploit this flaw to simultaneously crash numerous computers across an enterprise, resulting in widespread disruption and costly downtime," Check Point said. "This discovery highlights that even with advanced security technologies like Rust, continuous vigilance and proactive patching are essential to maintaining system integrity in a complex software environment." Another vulnerability of importance is CVE-2025-50154 (CVSS score: 6.5), an NTLM hash disclosure spoofing vulnerability that's actually a bypass for a similar bug (CVE-2025-24054, CVSS score: 6.5) that was plugged by Microsoft in March 2025. "The original vulnerability demonstrated how specially crafted requests could trigger NTLM authentication and expose sensitive credentials," Cymulate researcher Ruben Enkaoua said. "This new vulnerability [...] allows an attacker to extract NTLM hashes without any user interaction, even on fully patched systems. By exploiting a subtle gap left in the mitigation, an attacker can trigger NTLM authentication requests automatically, enabling offline cracking or relay attacks to gain unauthorized access." Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors over the past several weeks to rectify several vulnerabilities, including — 7-Zip Adobe Amazon Web Services AMD AMI Apple Arm ASUS Atlassian Autodesk Axis Communications Bosch Broadcom (including VMware) Check Point Cisco CODESYS D-Link Dell Drupal Elastic Emerson F5 Fortinet Fortra Foxit Software FUJIFILM Fujitsu Gigabyte GitLab Google Android and Pixel Google Chrome Google Cloud Google Wear OS HMS Networks HP HP Enterprise (including Aruba Networking) Huawei IBM Intel Ivanti Juniper Networks Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitel Mitsubishi Electric Moxa Mozilla Firefox, Firefox ESR, and Thunderbird NVIDIA Palo Alto Networks Qualcomm Rockwell Automation Salesforce Samsung SAP Schneider Electric ServiceNow Siemens SolarWinds SonicWall Sophos Splunk Spring Framework Supermicro Synology TP-Link Trend Micro WinRAR Xerox Zimbra Zoom, and Zyxel

CISA has warned that attackers are actively exploiting two security vulnerabilities in the SysAid IT service management (ITSM) software to hijack administrator accounts. The two unauthenticated XML External Entity (XXE) flaws, tracked as CVE-2025-2775 and CVE-2025-2776, were reported by watchTowr Labs security researchers in December 2024 and patched in March with the release of SysAid On-Prem version 24.4.60. One month later, watchTowr Labs also published proof-of-concept code, showing that the SysAid vulnerabilities are trivial to exploit and allow attackers to retrieve local files containing sensitive information. While CISA didn't share any additional details regarding these ongoing attacks, it did add the two vulnerabilities to its Known Exploited Vulnerabilities Catalog, giving Federal Civilian Executive Branch (FCEB) agencies three weeks to patch their systems by August 12 as mandated by the November 2021 Binding Operational Directive (BOD) 22-01. Although BOD 22-01 primarily targets U.S. federal agencies, the cybersecurity agency encourages all organizations, including private companies, to prioritize patching the two actively exploited flaws as soon as possible. "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA warned. SysAid On-Prem is hosted on customers' infrastructure, enabling IT teams to manage various services within an organization. According to Shadowserver data, dozens of SysAid instances are currently exposed online, most of them from North America and Europe. "At SysAid, we take security very seriously and would like to assure our users that we have addressed and mitigated these vulnerabilities through appropriate patches," a SysAid spokesperson told BleepingComputer. "We have also provided CISA with the latest information on how to patch these vulnerabilities, and we encourage all customers to ensure their systems are updated with the most recent security updates." SysAid has over 5,000 customers and more than 10 million users across 140 countries worldwide, serving a diverse range of clients, from small businesses to Fortune 500 enterprises, including high-profile companies such as Xerox, IKEA, Coca-Cola, Honda, Michelin, and Motorola. Update July 24, 03:33 EDT: Added SysAid statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report