VulnHub

A recent cybersecurity threat involves attackers masquerading as AI bots from companies like OpenAI, Anthropic, and Meta. These impersonators are conducting relentless scans for exposed credentials, aiming to access sensitive data. This tactic not only puts individual users at risk but also endangers the integrity of the companies being impersonated. As these attackers cleverly exploit the trust associated with well-known AI brands, it raises significant concerns about data security and the potential for broader breaches. Companies and users alike need to be vigilant and ensure their credentials are secure to prevent unauthorized access.

The article discusses the PHP2Shell vulnerability, which demonstrates how quickly attackers can exploit serious security flaws, often before organizations can implement necessary patches. Token Security emphasizes the importance of not just fixing these vulnerabilities but also limiting access for service accounts, API keys, and AI agents to mitigate the potential damage from breaches. This approach could be crucial in reducing the impact of an attack while organizations work on addressing vulnerabilities. The article suggests that understanding both the severity of a vulnerability and the potential blast radius is vital for effective cybersecurity strategies.

Cybersecurity experts have identified that attackers are actively probing a recently patched critical vulnerability in Oracle E-Business Suite. This flaw, tracked as CVE-2026-101767, has a high severity score of 9.8 and resides in the Oracle Application Object Library. Oracle addressed this vulnerability in its latest Critical Patch Update released last week. The urgency of this situation is underscored by the fact that threat actors are already seeking to exploit it, which could put organizations using this software at significant risk. Companies relying on Oracle E-Business Suite need to ensure they have applied the latest security patches to protect their systems from potential attacks.

Hackers are actively scanning for vulnerable systems that haven't been updated to address a newly identified flaw in Oracle E-Business Suite (EBS). This vulnerability is deemed critical, and its discovery has prompted a rush among attackers to identify and exploit unpatched systems. Companies using Oracle EBS are at risk, particularly if they have not yet applied the necessary updates. The urgency stems from the risk of data breaches and other malicious activities that could follow if these vulnerabilities are left unaddressed. Organizations are advised to check their systems and apply the latest patches to protect themselves from potential attacks.

Adobe has patched eight critical vulnerabilities in Campaign Classic that could allow attackers to execute arbitrary code, bypass security features, and escalate privileges. One of the most severe vulnerabilities, identified as CVE-2026-104351, has a CVSS score of 9.9, indicating a high level of risk. These flaws affect users of Adobe Campaign Classic, which is widely used for marketing and communication purposes. If exploited, these vulnerabilities could lead to significant security breaches, putting sensitive data at risk. Users and organizations are urged to apply the latest updates to safeguard their systems against potential attacks.

A recent analysis by ANY.RUN has revealed a phishing campaign named Skyw4lker that is specifically targeting American organizations. This campaign deviates from traditional methods of stealing credentials by exploiting legitimate cloud services and authentication mechanisms, allowing attackers to access corporate accounts with minimal detection. The sophistication of this approach means that businesses may not notice the breach until significant damage is done. As these tactics become more common, organizations need to enhance their security measures to protect against such covert threats. This incident serves as a reminder of the evolving nature of cyberattacks, emphasizing the importance of vigilance in cybersecurity practices.

Japan's GMO Internet Group has announced a reward of up to $1 million for information leading to the arrest of those behind a breach of its Onamae.com Desktop Cloud service. This breach affected a platform that hosts Windows desktops used for foreign exchange (FX) trading. The company decided against paying an extortion demand from the attackers and instead launched the reward program on October 28. Tips will only be rewarded if they directly contribute to an arrest or an international wanted notice. This incident raises concerns about the security of financial trading platforms and the potential impact on users who rely on these services.

A recently reported vulnerability in Oracle PeopleSoft, exploited by the cybercrime group ShinyHunters since May, is actually a combination of three flaws working together. Researchers identified the root cause as a server-side request forgery (SSRF) that allows access to an internal management interface due to PeopleSoft's trust in its own loopback address. Oracle addressed these vulnerabilities in June with a patch identified as CVE-2026-35273. This situation is concerning because it highlights how attackers can chain multiple flaws to exploit systems effectively. Organizations using affected versions of PeopleSoft should ensure they apply the latest patches to protect against potential breaches.

The GMO Group, a prominent Japanese internet services provider, has issued a warning to its customers to disconnect their systems from the internet and shut down their computers. This precaution follows a breach in the company's Onamae Desktop Cloud, where a threat actor has threatened to initiate a ransomware attack. This incident raises concerns for users of the Onamae service, as ransomware can lead to significant data loss and operational disruptions. The company is urging immediate action to protect sensitive information and prevent potential data breaches. Customers should take these warnings seriously to minimize the risk of falling victim to the attack.

The University of New Mexico Health Sciences Center has reported a ransomware attack that led to significant disruptions in patient care and academic operations. The cyberattack caused system outages, affecting both administrative and clinical functions, which in turn delayed surgeries and other critical healthcare services. This incident raises concerns about the security of healthcare systems and the potential risks to patient safety. Such attacks not only hinder immediate medical care but also undermine trust in healthcare institutions. The situation is still developing, and further details about the extent of the impact and recovery efforts are awaited.

A group of hackers has taken over a shared analytics script used by Convertr, an e-commerce platform, to siphon off payment card information from customers during the checkout process. This attack specifically targets shoppers, allowing the hackers to capture sensitive credit card details as they complete their purchases. The use of a compromised script means that many online retailers using Convertr may be vulnerable, putting a large number of customers at risk. This incident serves as a reminder for e-commerce sites to scrutinize third-party scripts and ensure they are secure to protect their customers' financial information. Users who have made purchases through affected sites should monitor their bank statements for any unauthorized transactions.

A new social engineering campaign is spreading malware through external team chats, potentially linked to the Black Basta ransomware group. This attack involves tricking users into downloading malware that can compromise their systems, and it appears to be part of a larger strategy to target organizations and individuals. The ongoing nature of this campaign suggests that many users could be at risk if they are not vigilant about the links and files they share in team communication platforms. It's crucial for users to be cautious and recognize potential phishing attempts in these chats, as the threat could lead to significant data breaches or ransomware incidents.