Do Son A Critical (CVSS 10.0) RCE flaw (CVE-2025-65108) in md-to-pdf allows arbitrary JavaScript code execution via malicious front-matter. Over 47K weekly downloads are affected. Update to v5.2.5.
Supply Chain
ASEC exposed a VPN supply chain attack deploying NKNShell, a Go-based backdoor that uses P2P NKN and MQTT for stealthy C2. The installer bypasses AMSI using AI-generated code and grants full remote access (MeshAgent, gs-netcat).
A Critical DoS flaw (CVE-2025-65015) in joserfc allows unauthenticated attackers to overwhelm log/SIEM systems by injecting massive JWT payloads into exception messages.
Mandiant exposed UNC1549, an Iranian APT, using DLL search order hijacking on Citrix/VMware to deploy TWOSTROKE and DCSYNCER.SLICK. The group performs VDI breakouts for long-term espionage.
NVISO exposed the Contagious Interview APT using JSON Keeper and npoint.io as covert C2 channels. The North Korean group uses fake job lures on GitLab to deploy BeaverTail to steal Web3 credentials.
A Critical flaw in Lite XL (CVE-2025-12120) allows RCE when opening a project: the editor automatically executes malicious .lite_project.lua files, risking developer compromise.
Fortinet exposed TruffleNet, a massive BEC campaign using stolen AWS keys to exploit Amazon SES for email fraud. It abuses Portainer as a C2 and uses TruffleHog for reconnaissance.
Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global Espionage
Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global Espionage
Symantec exposed a complex Chinese APT network (Glowworm/UNC5221) deploying Zingdoor and ShadowPad across US/South American targets. The groups abuse DLL sideloading and PetitPotam for credential theft.
A NuGet typosquat named Netherеum.All used a Cyrillic homoglyph to fool 11M+ downloads. The malicious package injected an XOR-decoded backdoor to steal crypto wallet and private key data.
Cisco Talos exposed Famous Chollima using fake job offers and a trojanized Node.js app (Chessfi) to infect developers. The OtterCookie RAT steals crypto wallets, credentials, and source code.
Resecurity exposed Qilin RaaS's reliance on bulletproof hosting (BPH) in Russia/HK. The same network was linked to the Asahi Group Holdings ransomware attack that stole 27 GB of data.
F5 disclosed a breach by a "highly sophisticated nation-state" that stole BIG-IP source code and internal vuln info. CISA issued an Emergency Directive mandating immediate patching of 44 flaws.
Symantec exposed China's Jewelbug APT in an unprecedented 5-month intrusion on a Russian IT provider. The group used Yandex Cloud for data exfiltration and Graph API for stealthy C2 via custom malware.
ReliaQuest exposed Flax Typhoon for a year-long breach, where the China-backed APT turned a legitimate ArcGIS Java SOE into a web shell and embedded it in backups to ensure persistence.
CERT/CC warns that Clevo’s UEFI firmware updates accidentally exposed Intel Boot Guard private keys (CVE-2025-11577), risking pre-boot firmware integrity on multiple OEM laptops.
Ming-Chi Kuo reports that the iPhone Fold's critical hinge mechanism cost has been reduced to $70-$80 per unit, improving profit margins and accelerating its mass production feasibility.
Trend Micro discovered that Axis Communications leaked hardcoded Azure SAS tokens in a signed DLL for its Autodesk Revit plugin, exposing three cloud storage accounts to unauthorized access.
Socket’s Threat Research Team has uncovered a massive supply-chain abuse campaign leveraging npm’s public registry and unpkg.com’s...
Apple's supply chain in India has created 350,000 jobs and grown to include 45 local partners. The entire iPhone 17 series is set to be fully assembled in India.
EclecticIQ reports on how ShinyHunters is expanding with AI-driven voice phishing, supply chain compromises, and insider recruitment, blurring lines with APTs.
A set of ten critical flaws, dubbed "Frostbyte10," were found in industrial controllers. These bugs could allow attackers to tamper with global food and medicine supply chains.
Apple is reportedly making robotic assembly a requirement for its suppliers, forcing partners to invest in costly automation to remain in its ecosystem.