The Manchester Airports Group data breach has been claimed by extortion group FulcrumSec, which told BleepingComputer that it stole approximately 86 GB of data. Samples reviewed by BleepingComputer contained information consistent with MAG's disclosure while indicating that the breach exposed considerably more detailed customer, booking, and travel information than initially revealed. Manchester Airports Group (MAG), the United Kingdom's largest airport operator, disclosed on August 27 that an unauthorized third party had stolen customer data related to Manchester, London Stansted, and East Midlands airports. The company said the affected information came from car park, lounge, and Fast Track bookings and in-airport Wi-Fi registrations. In emails to BleepingComputer, FulcrumSec claimed responsibility for the attack and shared samples of the allegedly stolen data as evidence.
Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage. The company is signing affected users out of Claude, removing saved payment methods, and refunding charges it identifies as unauthorized. "We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people's computers, then using those login sessions to access Claude accounts and consume their usage," Anthropic said in an email sent to an affected user, who shared it on Reddit. "If your usage limits looked like they refilled and then drained while you weren't using Claude, this was likely the cause," Anthropic warned. It is also worth noting that infostealers can copy an already authenticated browser session, which means the attacker may not need to go through the normal password and 2FA login process again.
Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, and to inject ClickFix lures. Researchers say all 16 malicious modules uncovered in the campaign serve distinct purposes and are designed to be "highly extensible." The operation was uncovered by application security company Socket, and the investigation indicates that it may have been active since early 2024. Socket says that when initially published on the Chrome Web Store, many of the extensions provided the advertised functionality and contained no malware. According to the researchers, five of the extensions were acquired from their original creators and injected with malware via updates delivered automatically. One example is the "Enable Right Click & Copy — Smart Unlock + OCR" extension, the only one in the campaign available for both Chrome and Edge, which had a Chrome user base of at least 70,000 when it turned malicious. The number of installs on Edge was 10,000 at the time.
PaperCut servers are under active attack, while 47% of tracked installations still run unpatched versions vulnerable to remote code execution. PaperCut, the print management software running in schools, hospitals, and offices worldwide, confirmed on August 27 that a pre-authentication remote code execution flaw is being actively exploited against real customers. Researchers at Huntress found evidence of exploitation in two customer environments, and the security firm went further, reproducing the entire attack chain from scratch against a clean, unpatched install. “Observed activity focused on system discovery. We have not observed secondary malware, further command-and-control traffic, or additional persistence or post-exploitation from the recovered payload.” reads the report published by Hutress. “Huntress reproduced a full pre-authentication RCE chain against a vanilla PaperCut NG 25.0.11.75758 server. We have reached out to PaperCut to coordinate with them on continued vulnerability analysis.” The vulnerability starts with a simple authorization mistake in PaperCut. An attacker can send a specially crafted request that makes the server display one page while actually running an action from another page. PaperCut checks the permissions for the page it displays instead of the action it actually performs. This flaw, tracked as CVE-2026-81578, can let an attacker change the server’s configuration without logging in. That access can then be combined with a second flaw, CVE-2026-82078. The issue in PaperCut’s database utilities can load unsafe Java classes, allowing the attacker to run arbitrary Java code on the server. The real-world attacks Huntress observed were almost quaint compared to the severity of the bug itself. One incident lasted under two minutes total, with the attacker running nothing more aggressive than whoami and ver, basic commands to identify the compromised account and Windows version. A second incident added tasklist to the mix, checking what processes were running, but neither case showed evidence of deeper persistence, secondary malware, or follow-up command-and-control traffic. The activities observed by Huntress read like reconnaissance rather than a finished operation, the kind of activity that usually precedes something worse. The forensic trail attackers left behind is genuinely useful for defenders, and it’s worth understanding exactly what it looks like. Investigators found a malicious Java class file dropped directly into PaperCut’s own installation directory, capable of running commands, writing results to a temporary file, and then deleting both the output and the server’s own log file to cover its tracks. One artifact survived that cleanup regardless: a Derby database log entry reading memory:...\pwn, an oddly named database directory that PaperCut’s own investigation guidance now flags as a high-confidence indicator of compromise. “After exploitation, the .class file deletes its own Udydn.out file, as well as the server’s server.log file. The server.log file recorded the execution of this code in a log line that contains the string DB URL: jdbc:derby:memory:pwn that immediately followed the large encoded data blob’s appearance in the log.” continues the report. “We observed /data/internal/derby.log was not deleted, and it contains one insightful breadcrumb” PaperCut’s patching process is more complicated than simply installing an update. The company released an emergency patch first, then issued another update less than 24 hours later after additional testing. Fixes for version 24 were still being developed when the report was published. The timing is important because the second confirmed attack targeted a server running version 24, before the fix for that version was available. Huntress successfully recreated the exploit chain in a test environment. From a remote system, the researchers were able to trigger code execution without authentication. The attack caused PaperCut’s pc-app.exe Application Server to launch charmap.exe with SYSTEM privileges, confirming that the vulnerability can lead to code execution at the highest Windows privilege level. The bigger concern involves older versions. Huntress found that about 47% of the roughly 2,500 PaperCut installations it tracks still run version 23 or earlier, and there is currently no patch for those versions. Huntress is working with PaperCut to analyze the vulnerability and coordinate the response. If your organization runs one of these older versions, the safest option for now is to remove the PaperCut Application Server from the public internet. Restrict access through a VPN or a trusted internal network until a proper fix becomes available. If your PaperCut server has been publicly accessible recently, installing the patch should not be the end of your response. It should be the start of an investigation. Before restarting the server, save its logs and configuration files so you don’t lose important evidence. Check whether pc-app.exe has launched a command shell or tools such as tasklist, and look for unexpected .class files in the server’s lib directory. Even a short two-minute reconnaissance attempt could be an early sign of a more serious attack. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Philippine nuclear and naval targets)
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Hack One Robot, Reach the Next: Unitree G1 Security FlawsRhysida Ransomware Group Targets Berlin Government Ahead of VotePhilippine Nuclear and Naval Targets Hit by Suspected Chinese OperatorLove Electric Breach: 877,000 Driver Records Offered for $600Trump Targets Foreign Technology in New U.S. Power Grid Security OrderU.S. CISA adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its Known Exploited Vulnerabilities catalogRussian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic OrganizationsPaperCut Zero-Day Under Active Attack: Emergency Patch ReleasedU.S. CISA adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalogCyberattack on UK Airport Operator MAG Exposes Data of 8.7 Million Customers Across Three AirportsDark Caracal Deploys New Go Malware With Ethereum-Based C2 FallbackAustralian Police Charge Two Over TeamPCP Credential TheftMeta to Pay Up to $18B Over Teen Social Media UseCISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers DoOpenAI banned Russian ChatGPT accounts backing covert influence operationCISA Red Team Fully Compromised Two Critical Infrastructure OrgsFBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical InfrastructureU.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog88 ID Verification Breaches Show the Cost of Collecting Identity DataWhatsApp Adds Stronger Security as Passkeys Hit 1 BillionOperation Jackal: 58 Arrests Expose the Money Laundering Machine Behind Global ScamsNorway ’s Digital Government Infrastructure Hit by a new DDoS AttackWhen the Algorithm Fires You: Uber Faces €825M FineTwo CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as VulnerableU.S. CISA adds maximum-severity Oracle flaw to its Known Exploited Vulnerabilities catalogFake Minecraft Sites Are Still Spreading WeedHack After C2 TakedownCybercriminals Turn GTA VI Leaks Into Malware BaitSlovakia Warns of Cyber Risks in Road Speed CamerasTikTok Settles U.S. Child Privacy Case for $400 MillioniAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password ResetUK Power Plant Disabled for Four Days by Iran-Linked Hackers, Concurrent with US Water AttacksZero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context Injection International Press – Newsletter Cybercrime iAuthFlow v2 Enrolls Google Passkeys That Survive Password Resets Fake GTA VI ISO circulates on the internet a few days after leak, internet sleuths claim 113GB download is padded malware Taiwan charges 9 over illegal AI server exports to China, including Nvidia and Super Micro staff Indian man who fled US arrested on charges he helped scammers siphon $7.5 million from the elderly 58 arrests in global effort to dismantle West African organized crime groups Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain RTM Locker interview: a ransomware actor on the RaaS market Two WA men charged following AFP-FBI-WAPF disruption of alleged global cybercrime syndicate Love Electric driver data for sale: NI, licence numbers Ransomware group says it stole Berlin data, offers it for auction Malware FTP Banners: The New Dead Drop Resolver Delivering Novel RATs The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads SLEEPWALKER: A Passive Backdoor With Its Own Command Language Hacking One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin A Tale of Two SOCs: Insights From Two Red Team Assessments Three UK airports hit by cyber-attack with data of 8.7m customers accessed New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access PaperCut Releases Emergency Patch for Exploited Zero-Day Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities The Hugging Face incident and the road ahead Power Leak: Amazon Kiro IDE Prompt Injection Enables Data Exfiltration Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users’ Reservations in Tests UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range PaperCut Actively Exploited: A Pre-Auth RCE Chain Intelligence and Information Warfare Iranian hackers shut down UK power plant Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor Digdir stabilizes solutions after cyberattack Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure The infrastructure quartermaster: inside a China-nexus state enablement model Disrupting a new covert influence campaign from Russia Tortoiseshell: New Toolset and Operational Infrastructure Exposed Treasury Launches Unprecedented Campaign Against Iranian Regime on Economic D-Day Dark Caracal Reloaded: New Malware, Same Hunting Grounds Cambodia-focused cluster uses multistage infection chain with localized lures BlueDelta Targets Defense and Diplomacy with HOOKEDGE Cybersecurity Warning about the risks of road meters One billion people are now protected with passkeys on WhatsApp, plus more account security features An ID Check Breach Timeline: 2011–2026 Internet Exposure Reduction Guidance Meta agrees to pay $18 billion to settle US lawsuits over children’s social media addiction DECLARING A NATIONAL EMERGENCY TO SECURE THE UNITED STATES BULK-POWER SYSTEM Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell. "While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex
Anthropic is permanently increasing Claude Code's standard weekly usage limits by 25% for Pro, Max, Team, and seat-based Enterprise plans, but it's not as good as it sounds. If you use Claude, you're actually getting a 17% reduction compared to what you have today. Claude Code currently has a temporary 50% increase in weekly limits, which Anthropic says will remain in place until September 14. "Starting September 14, we're permanently raising standard weekly limits in Claude Code by 25% for Pro, Max, Team, and seat-based Enterprise plans," Anthropic wrote on X. "Until then, the current 50% increase will be in place." It's a clever way to frame words, as it almost sounds like you're winning as a customer, but you're not, and it's a downgrade. If Claude Code's original weekly allowance was 100, the temporary boost gives you 150 today. On September 14, that drops to 125.
The latest version of the Brave browser, 1.94, introduces a feature called ‘Email Aliases’ that allows users to generate disposable email addresses when signing up to a new service. Using an alias address keeps the user's real email address hidden from the website while still forwarding messages from the service. Brave already uses data isolation to prevent websites from inferring user identities based on cookie-based or cache correlations; however, email addresses are still stored on website servers, creating a privacy gap. Brave’s new feature addresses this risk by blocking cross-site identity matching, reducing spam, and protecting users from threats such as phishing attacks that can follow data breaches. “If a website you signed up for is hacked, your information can be leaked and end up with data brokers or worse,” explains Brave in the announcement.
A researcher chained two Unitree G1 flaws to gain root access remotely and showed how a compromised robot could attack others nearby. Security researcher Olivier Laflamme spent about three months digging into the Unitree G1 humanoid robot and eventually found a way to fully compromise it without plugging in a single cable. In his technical write-up, he details two vulnerabilities, CVE-2026-76639 and CVE-2026-76640, that can be chained across Bluetooth, Unitree’s cloud infrastructure, the mobile app, and the robot’s firmware to gain unauthenticated root access to any G1 within Bluetooth range. The first bug lives entirely inside the robot itself, no wireless attack surface needed if you can reach it over Ethernet. The G1’s AI chatbot service accepts a “knowledge” upload with almost no validation on the filename it writes to disk, and a classic path traversal payload lets an attacker write an arbitrary file anywhere on the filesystem, including into a directory that a separate service called bashrunner treats as trusted. Restart bashrunner, tell it to run the newly planted file, and you’ve got root-level shell execution with five DDS messages and zero authentication. The second chain is the one that should worry anyone deploying these robots at scale. It starts with a Bluetooth characteristic that accepts writes without pairing, something The Hacker News also covered in its own report on the disclosure. An unpaired device can request the robot’s encrypted key bootstrap blob, and Unitree’s cloud API would decrypt that blob for any free, logged-in Unitree account without ever checking whether the account actually owned that specific robot. “The blob is RSA-encrypted & the corresponding RSA private key is held by Unitree’s cloud infrastructure. This, in theory, is safe.. This is the security boundary Unitree appears to have relied on. Nearby devices can request the bootstrap blob, but only Unitree owns the RSA private key capable of opening it.” reads Laflamme’s report. “However, the Unitree mobile app reassembles the BLE notification chunks and slingshots that shit via a POST to Unitree’s cloud API /device/bindExtData on global-robot-api.unitree.com and the app stores the response body as gcmKey.” That decryption oracle is the crux of the whole chain, and Laflamme doesn’t undersell how convenient it made everything. “This single AES-128 key unlocks both the BLE protocol and the WebRTC signaling channels.” continues the report. Once an attacker has obtained it, they can authenticate to the robot’s Bluetooth handshake and unlock WiFi configuration commands that were previously locked behind that same key. From there, an oversized WiFi password triggers a fallback code path in Unitree’s own configuration script that inserts attacker-controlled text directly into a config file without escaping it, letting the attacker force the robot to join a hotspot they control, no physical access needed at any point. Going from “the robot connects to my Wi-Fi” to a full root shell required a buffer overflow in the G1’s Bluetooth server, and this is where the research gets particularly impressive. The server used a 500-byte buffer without proper bounds checking, allowing Laflamme to overwrite nearby memory with a carefully crafted 1,050-byte payload. He used that payload to create a fake cleanup structure that the program later interpreted as a legitimate function pointer, causing it to execute an attacker-controlled command with root privileges. There was one more obstacle: randomized memory addresses. To make the exploit work reliably, Laflamme first needed to discover where the vulnerable program was loaded in memory. He solved that by turning the first vulnerability into an information leak and using the result to make the second exploit work. In other words, one bug effectively helped unlock the other. The wormability is what turns this from an interesting security flaw into a much more serious operational risk. Once an attacker compromises one G1, that robot can use the same attack against other G1 robots within Bluetooth range, without requiring additional discovery or configuration. Laflamme tested the technique on just two robots in the same room, so the real-world reach of a chain reaction remains unclear. In a warehouse, laboratory, or campus where dozens of these robots operate close to each other, however, the possibility of one compromised machine spreading the attack to others is difficult to ignore. Unitree’s response gets genuine credit in the writeup, and it’s worth noting given how often vendor disclosure stories go badly. The company patched the cloud ownership-check flaw within about two months of the report, paid out a combined $5,000 bounty across both chains, and worked through verification quickly enough that Laflamme calls the collaboration close to ideal. “July 1-6 August, 2026 — Unitree implemented an account-to-robot cloud binding ownership check before returning the AES-128 key. Patching the “cloud-oracle” vulnerability discovered back in May. “August 6, 2026 — a $5,000 USD bounty was paid out, $4,000 for the BLE RCE and $1,000 for the chat_go RCE.” The BLE pairing and buffer overflow issues themselves, notably, sit deeper in the firmware and represent a harder, slower fix than a simple cloud-side ownership check. None of this required exotic tools or some cutting-edge attack technique. That is probably the detail that should get the most attention from anyone who still sees robot security as a niche problem. This was a $20,000 humanoid robot, the kind increasingly used in research labs and universities and likely to appear in more workplaces, compromised with a decompiled Android app, a firmware encryption scheme that researchers had already broken years ago, and a familiar class of buffer overflow that predates humanoid robots by decades. If your organization has a G1 sitting in a lab, lobby, or workspace, checking its patch status should be a priority. A 90-pound robot losing its collision-detection capabilities is not the kind of security incident you want to discover the hard way. “You could use the G1 to spy on people through audio and video, make it say obscene shit in public, swap out or backdoor the ResNet onboard AI models, tamper with perception and movement logic, disable collision detection and other safety checks (it weighs ~90lbs having that run into a kid, a wall, or even step on your toe will do some serious damage).” concludes the researcher. “They also cost a lot! I’d be pissed off if someone hacked into my G1, took control of it, and walked it off my factory/campus.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Robot)
An alleged Chinese-speaking actor breached Philippine nuclear and naval targets by exploiting known flaws, stealing sensitive data. A suspected Chinese-speaking operator targeted a Philippine nuclear research body and a marine engineering company that supports the Philippine Navy, using well-known vulnerabilities in internet-facing ownCloud and WordPress systems. The activity was uncovered after Hunt.io found an exposed server in Amsterdam that contained attack scripts, logs, offensive tooling and data taken from the two organisations. “Hunt.io Attack Capture discovered an open directory containing tooling which documented intrusion activity against two Philippine organizations.” reads the report published by Hunt.io. “A recovered CSV references roughly 9 GB of material stolen from the nuclear agency, most absent from the current directories contents, and a compromise of a project management application, indicating a possible third victim.” Hunt.io disclosed the findings to CERT-PH under the TLP:AMBER sharing standard and delayed publication until 25 August 2026 so the national response team could notify the affected organisations. The incident arrives amid sustained tensions in the South China Sea and continuing reports of suspected Chinese cyber activity against Philippine government, defence and critical-infrastructure targets. “On August 13, 2026, Hunt.io Attack Capture identified an open directory on the host 31.58.209[.]241. The server staged custom Python scripts, per-file transfer logs, open-source offensive security tooling, and exfiltrated data from two Philippine organizations. The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV.” states the report.”A separate intrusion was observed exploiting a WordPress site operated by a Philippine marine engineering and shipbuilding company that provides services to the Philippine Navy.” The server was not a sophisticated hidden service. It exposed a Python SimpleHTTP directory on port 8000, along with SSH, a self-hosted ownCloud login page and other services. The directory contained 1,310 files in 86 folders, totaling 1.17 GB, including scripts, stolen data and tools such as Sliver, Metasploit and Mettle. Researchers gained a rare view of the attacker’s operations after finding tools, logs and stolen files left exposed on the server. The main entry point was likely the nuclear research body’s internet-facing ownCloud service, compromised by exploiting CVE-2023-49105, an authentication-bypass flaw in ownCloud versions before 10.13.1. In this condition, an attacker who knows a valid username can generate WebDAV requests that the server accepts as if they were made by that user. No password is needed. Hunt.io found five custom Python scripts implementing this technique, four focused on individual accounts and a fifth capable of enumerating directories and recording every attempted download. hunt “In vulnerable instances when no such key was configured, a default state on new installs, the signing routine still executed using an empty secret. An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as authentication action by that user, without ever supplying credentials.” continues the report. “A total of five custom Python scripts saved from the directory implement this exact technique described above. Four target a single account each; the fifth moves further to include directory enumeration and logging.” The attacker used random delays to make data collection less noticeable and avoid volume-based alerts. Scripts, logs and folders consistently used Simplified Chinese, including labels for nuclear, radiation-safety, finance and IT files. This suggests a Chinese-speaking operator, but does not prove links to a specific government or threat group. The stolen data included nuclear reactor component databases, fuel inventories, radiation-safety documents, incident records and authorised-user lists. It also included strategic plans, IT documents, staff records, CVs, passport and travel data, and financial disclosures from Philippine officials. The exposed server held 176 files, about 372 MB in total. However, a CSV created by the attacker referred to roughly 9 GB of stolen data. This gap suggests the server contained only part of the haul and that the attacker may have accessed much more than researchers could recover. The material also included a KeePass database, AxCrypt-encrypted files and a BitLocker recovery key. Those artefacts matter because they can support follow-on access: a data theft operation can become a credential-theft operation, and a credential-theft operation can become a longer-term intrusion. Researchers additionally recovered a 192 MB SQL dump from a ZKTeco BioTime attendance and personnel system. Such a database can link people to badge identifiers, departments and access records, enabling an attacker to build a picture of who works where, who may have sensitive access and which people are worth targeting next. The same server also contained evidence of a breach involving a Philippine marine engineering and shipbuilding company that works with the Philippine Navy. The attacker exploited CVE-2024-28000, a privilege-escalation flaw in the LiteSpeed Cache WordPress plugin. The flaw let attackers create a WordPress admin account without authentication by exploiting a predictable security hash through the REST API. Hunt.io found the exploit code, compiled tools and logs showing that the attacker successfully gained admin access. The attacker also used WordPress XML-RPC to test passwords for the admin account with the well-known rockyou.txt list. The logs show that this method also found valid credentials. That gave the operator redundancy. Even if one access path were closed, the attacker could retain an administrator account, a valid password or data such as WordPress hashes and secret values from the stolen site database. Redundant access is not glamorous. It is, unfortunately, effective. While examining the compromised WordPress site, Hunt.io also discovered an active EtherHiding-style injection that it believes may be unrelated to the Chinese-speaking operator. The malicious JavaScript used an Ethereum smart contract as a place to retrieve content, then displayed a fake Google verification page designed to push visitors into a ClickFix-style infection flow. The campaign used a service worker for persistence and collected visitor fingerprint data. Hunt.io found 174 unique IP addresses hosting pages with the same NoChain loader strings and smart-contract reference, but said the evidence did not link that activity to the operator who attacked the nuclear and naval-linked targets. That distinction matters. A compromised website can host multiple intrusions or payloads at once, often run by unrelated actors. Analysts should resist the temptation to treat every malicious artefact on one server as evidence of a single campaign. The technical lesson is blunt: old and known weaknesses still provide access to high-value targets. Organisations using ownCloud should upgrade to version 10.13.3 or later, apply the vendor’s relevant fixes and ensure that pre-signed URLs use a strong, non-empty signing key. Teams should also examine WebDAV logs for suspicious PROPFIND directory-enumeration requests, large volumes of file retrieval across multiple accounts, or recurring requests from a single source with artificial gaps between them. Low-and-slow collection is still collection. For WordPress, organisations should update LiteSpeed Cache to version 6.4 or later, remove or restrict XML-RPC when it is not needed, enforce strong unique administrator passwords and require multi-factor authentication. The XML-RPC compromise in this case succeeded against a password from a public wordlist, which is not a vulnerability in WordPress so much as an invitation nobody should leave on the doorstep. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Philippine nuclear and naval targets)
Confirm this action.
Leaving now will discard your changes.