Waper
Use on the web

Cybersecurity

Major breaches and actively exploited vulnerabilities, threat research worth reading, and the policy and business moves in security.

  • Official
  • Public
  • 0 followers
Sign up to followCustomize it
You're reading the brief from Fri, Oct 23.
Back to the latest brief

A supply-chain compromise gave a ransomware group access to around 40 shipping companies, while exploitation of the recently disclosed PHP2Shell flaws has begun.

Cybersecurity5 items

New research also examines credential theft through LiteLLM and low-cost attacks using AI models.

New4

Breaches & attacks

Supply-chain attack gives ransomware group access to around 40 shipping companies

NonGroup breached a shared IT provider and used that access to reach around 40 maritime and global shipping companies, according to Symantec. Cydome researchers believe the provider was Cyberlogitech, and the group's leak-site demands total more than $1.2 billion.

Why it matters: The breach shows how a single shared IT provider can expose many shipping companies to ransomware threats.

Breaches & attacks

State Bank of India suffers customer personal-data leak

State Bank of India suffered a leak of customer personally identifiable information. The supplied report does not state how many customers were affected.

Why it matters: An established underground market for personal data in India can amplify the consequences of customer information exposure.

Follow-ups1

VulnerabilitiesFollows up on Thu, Oct 22:PHP patches two critical flaws permitting unauthenticated remote code execution

PHP2Shell exploitation begins as researchers examine exposure and patching challenges

Exploitation of the recently patched critical PHP flaws has begun. Additional coverage examines exploitability and warns that assessing exposure and applying fixes is not necessarily straightforward.

Why it matters: Active exploitation makes identifying exposed PHP deployments and verifying effective remediation more urgent.

Ask Kiki about this brief

Sign in to ask questions about this brief.

Recent briefs

  1. Tue, Nov 38 itemsA hijacked security-tool update channel delivered backdoors to Linux servers, while active exploitation hit Siemens industrial devices, Node-RED and Synology NAS systems. Other major developments include a breach affecting over 1.3 million people and a cyberattack on Brazil’s largest cryptocurrency exchange.
  2. Mon, Nov 26 itemsGoogle and partners disrupted a 1.3 million-device Android botnet, while active attacks continued against Ivanti gateways, GitLab servers and outdated BTCPay Server installations. New developments included Binance theft tracing and Polymarket’s reimbursement pledge.
  3. Sun, Nov 15 itemsThe FBI attributed the Binance crypto theft to North Korea-linked TraderTraitor, while a hijacked third-party script cost Polymarket traders about $2.7 million. Alpine Linux rebuilt its GitLab server after an attempted exploit, and newly detailed vulnerabilities affect Canonical infrastructure and Android phones.
  4. Sat, Oct 318 itemsActive exploitation of Ivanti Connect Secure flaws and a remote-root Linux kernel vulnerability lead this edition. Northflank and Chainalysis disclosed breaches, while OpenAI fixed a flaw that could expose private ChatGPT conversations.
  5. Fri, Oct 308 itemsBinance reported a $6.3 billion theft, while Florida disclosed a financial-aid breach exposing 4.9 million people’s Social Security numbers. A compromised coding extension and active exploitation of GitLab, Drupal and PHP flaws add immediate priorities for security teams.
  6. Thu, Oct 296 itemsActive exploitation of Cisco firewall, PHP and Brotli vulnerabilities makes patch prioritization urgent. Major data exposures affected DHS personnel and Sony ISP customers, while a cyberattack forced Moldova to take more than 80 public services offline.
  7. Wed, Oct 288 itemsCISA confirmed active exploitation affecting Brotli and Adobe Commerce, while a Sony subsidiary disclosed a breach involving approximately 2.5 million customer records. Other major developments include widespread public-service disruption in Moldova and new details of PHP2Shell attacks.

Who and what it tracks

  • CISAOrganization8
  • GoogleCompany5
  • MicrosoftCompany4
  • CrowdStrikeCompany2
  • Palo Alto NetworksCompany1