VulnHub

A second wave of attacks, referred to as Sha1-Hulud, is compromising npm packages and affecting over 25,000 repositories. This supply chain campaign poses a significant threat as it involves credential theft, echoing previous attacks in severity and implications for software supply chains.

Mazda has been identified as a victim of the Cl0p ransomware group's Oracle EBS campaign, but the company asserts that there has been no data leakage or operational impact from the incident. This situation highlights the ongoing threat posed by ransomware groups targeting enterprise systems.

This week, significant cybersecurity threats emerged as hackers exploited new 0-day vulnerabilities in Fortinet and Chrome, infiltrating supply chains and SaaS tools. The rapid response from major companies like Microsoft, Salesforce, and Google highlights the severity of these attacks and the ongoing challenges in securing trusted applications and software updates.

CISA has identified that various cyber threat actors are using commercial spyware to target users of mobile messaging applications, employing tactics such as phishing, zero-click exploits, and impersonation. The focus is primarily on high-value individuals including government and military officials, indicating a serious threat to sensitive communications.

Cox has confirmed a significant data breach involving Oracle EBS, with over 1.6 terabytes of data reportedly stolen and made public by cybercriminals. This incident highlights the severity of cybersecurity threats faced by organizations and the potential exposure of sensitive information for numerous alleged victims.

The ShadowPad malware is exploiting a recently patched vulnerability in Microsoft Windows Server Update Services (WSUS), identified as CVE-2025-59287, allowing attackers to gain full system access. This exploitation highlights the critical need for organizations to promptly apply security updates to vulnerable systems to prevent unauthorized access.

The article discusses a new command-and-control platform, Matrix Push C2, which utilizes browser notifications to execute phishing attacks by distributing malicious links. This fileless framework targets victims across different operating systems using push notifications, fake alerts, and link redirects.

CISA has identified a critical security vulnerability in Oracle Identity Manager, classified as CVE-2025-61757, which is actively being exploited. This vulnerability involves missing authentication for a critical function, posing significant security risks.