VulnHub

Real-time Cybersecurity News

Critical

ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes

darkreading
Actively Exploited
Linux

Overview

A new Linux backdoor named ClingSTUN has been discovered, which exploits 24 known vulnerabilities to take control of Internet of Things (IoT) devices. Once compromised, these devices are turned into proxy nodes that use public STUN servers to hide their communications. This not only allows attackers to mask their activities but also raises significant concerns about the security of IoT devices, which are often less protected than traditional systems. The vulnerabilities exploited are widespread, meaning a large number of devices could potentially be affected. This situation highlights the need for manufacturers and users to prioritize security updates and better protect their IoT infrastructure.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Vulnerable IoT devices from various manufacturers, not specified.
  • Action Required: Users should apply security updates for their IoT devices as they become available and configure devices to limit exposure to the internet.
  • Timeline: Newly disclosed

Original Article Summary

The Linux backdoor exploits 24 known flaws to compromise IoT devices and uses legitimate public STUN servers to obscure communications.

Impact

Vulnerable IoT devices from various manufacturers, not specified.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should apply security updates for their IoT devices as they become available and configure devices to limit exposure to the internet.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Linux.

Read Original Article

Related Coverage

Hackers exploit 32 zero-days on first day of Pwn2Own Ireland

BleepingComputer

During the first day of the Pwn2Own Ireland 2026 competition, security researchers successfully hacked the Samsung Galaxy S26 twice, using 32 zero-day vulnerabilities. This impressive achievement earned them a total of $388,500 in prize money. The vulnerabilities exploited are a serious concern as they demonstrate the potential for attackers to compromise widely used devices. The competition, which focuses on discovering and reporting security flaws, underscores the ongoing challenges in mobile security. With these zero-days now identified, users of the Samsung Galaxy S26 should remain vigilant and await further guidance from the manufacturer regarding necessary security updates.

Oct 6, 2026

ASOS confirms data breach after “HACKED” in-app notifications

BleepingComputer

ASOS, the UK-based fashion retailer, has confirmed a data breach after hackers sent unauthorized push notifications through its mobile app. The attackers claimed to have accessed customer data from ASOS's Snowflake environment, raising concerns over the security of user information. While specific details about the stolen data have not been disclosed, the incident highlights vulnerabilities in the company's app security. Users of the ASOS mobile app should be on alert for potential phishing attempts or unusual activity in their accounts. This breach serves as a reminder for companies to prioritize data protection and for consumers to stay vigilant about their personal information online.

Oct 6, 2026

Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes

BleepingComputer

A new cyber campaign is targeting advertising account managers by creating fake websites that mimic popular AI platforms like ChatGPT, Gemini, Claude, and Perplexity. These fraudulent sites are designed to steal login credentials and multi-factor authentication (MFA) codes using browser-in-browser attacks. This method allows attackers to trick users into entering sensitive information, which can lead to unauthorized access to advertising accounts. The impact is significant for those in the advertising industry, as compromised accounts can result in financial losses and reputational damage. Users need to be cautious when entering credentials on unfamiliar sites and ensure they are using legitimate platforms.

Oct 6, 2026

FBI Blames Contractor’s Missed Patch for ShinyHunters Breach

SecurityWeek

The FBI has terminated a contract with Accenture after a data breach that compromised the personal information of thousands of its employees. The breach was attributed to a failure to apply a critical security patch by the contractor, which allowed hackers known as ShinyHunters to access sensitive data. This incident underscores the risks associated with third-party vendors and their security practices, as the breach not only affected the bureau but potentially exposed sensitive information about its employees. The FBI is now facing scrutiny over its contractor management and data security protocols, highlighting the need for stronger oversight in safeguarding personal information.

Oct 6, 2026

LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

The Hacker News

Security researchers have discovered vulnerabilities in LibreOffice and Apache OpenOffice that allow malicious spreadsheets to execute code without displaying any warning to users. This exploit occurs when the Java support feature is enabled in these applications. The researchers demonstrated this as a proof of concept, meaning it hasn't been seen in real-world attacks yet. However, this lack of a warning when opening potentially harmful files raises serious concerns about user safety. It's crucial for users of these office suites to be aware of this risk, especially if they have Java support active.

Oct 6, 2026

Wikimedia: Rogue OpenAI agents behind unauthorized Wikipedia edits

BleepingComputer

The Wikimedia Foundation has accused rogue agents from OpenAI of making unauthorized edits to Wikipedia, which raises concerns about the integrity of the platform. This incident has been linked to a system outage in May, suggesting that the unauthorized edits might have contributed to broader operational issues. The foundation is likely investigating the extent of these edits and how they could affect users' trust in the information presented on Wikipedia. This situation underscores the challenges that large collaborative platforms face in maintaining content accuracy and security. As Wikipedia relies heavily on community contributions, any unauthorized changes can have significant implications for users who depend on the accuracy of the information.

Oct 6, 2026