A serious vulnerability has been found in n8n, an open-source workflow automation platform, which could allow authenticated users to run arbitrary system commands on the server. This vulnerability, identified as CVE-2025-68668, has a high severity score of 9.9 according to the CVSS system, indicating a significant risk. It stems from a failure in the protection mechanisms that should keep the system secure. Users of n8n should be particularly concerned as this issue could lead to unauthorized control over their systems. The affected versions include all versions prior to the patch that addresses this vulnerability, making it crucial for users to update their installations promptly to prevent potential exploitation.
A serious security flaw known as 'MongoBleed' has been identified in MongoDB servers, allowing attackers who are not authenticated to access sensitive information like passwords and tokens. This vulnerability is currently being exploited in the wild, raising significant concerns for organizations using MongoDB. The issue stems from a memory leak that can be exploited by attackers to extract confidential data directly from the servers. Companies running affected versions of MongoDB should prioritize patching their systems to mitigate the risk of unauthorized data access. Given the potential for serious data breaches, immediate action is essential for any organization relying on MongoDB for data storage.
A significant data breach involving Manage My Health has potentially compromised the sensitive information of over 120,000 patients in New Zealand. The breach raises serious concerns about the security measures in place to protect personal health data. Authorities have ordered a review to understand the extent of the breach and to prevent future incidents. This situation highlights the vulnerability of health information systems and the need for stronger protections to safeguard patient data. Patients affected by this incident may face risks related to identity theft and privacy violations, making it crucial for healthcare providers to enhance their cybersecurity practices.
The European Space Agency (ESA) has confirmed that an external server breach occurred recently, although specific details about the nature of the security issue remain vague. The agency has stated that it is investigating the incident to understand the extent of the breach and what data might have been affected. This incident raises concerns about the security of sensitive information related to space missions and research, especially given the increasing reliance on digital infrastructure in the aerospace sector. The ESA's acknowledgment of the breach underscores the vulnerability of even highly specialized organizations to cyber threats. As investigations continue, stakeholders and the public will be watching closely for updates on the implications of this breach.
Hackread – Cybersecurity News, Data Breaches, AI, and More
Actively Exploited
Hackers using the RondoDox botnet are exploiting a vulnerability in Next.js known as React2Shell to take control of over 90,000 unpatched devices. This includes a range of products such as routers, smart cameras, and small business websites. The attack is particularly concerning because it targets devices that often lack regular updates or security patches, making them easy targets for cybercriminals. Users of these devices should be vigilant and consider updating their systems to protect against this growing threat. The scale of the devices affected raises alarms about the potential for widespread disruption if left unaddressed.
Over 10,000 Fortinet firewalls are currently at risk due to a two-factor authentication (2FA) bypass vulnerability that has been known for five years. This vulnerability allows attackers to exploit systems that have not implemented proper security measures, potentially granting them unauthorized access to sensitive data and networks. The issue is particularly pressing because it affects devices that are publicly accessible on the internet, increasing the likelihood of exploitation. Organizations using these firewalls need to act quickly to secure their systems and protect against potential breaches. It's crucial for users to verify their configurations and apply any available updates to mitigate this serious risk.
The RondoDox botnet has been actively exploiting the React2Shell vulnerability to target Next.js servers since December. This vulnerability allows attackers to compromise systems that are not properly secured, potentially leading to unauthorized access and control. Organizations using Next.js should be particularly vigilant, as the botnet's operators are weaponizing this flaw to expand their reach. It’s crucial for companies to implement security measures to protect their servers from these types of attacks. As the situation develops, users need to stay informed about their server configurations and ensure they are updated against known vulnerabilities.
In April and May 2023, a Chinese advanced persistent threat (APT) group exploited a zero-day vulnerability in Ivanti's Endpoint Mobile Management (EPMM) platform, impacting thousands of organizations. This attack allowed unauthorized access and control over mobile devices managed through Ivanti's software, raising serious concerns about the security of sensitive data within those systems. The incident serves as a stark reminder of the vulnerabilities that can exist in widely used management tools. Security experts warn that similar attacks could occur again if organizations do not take proactive measures to secure their systems. Companies using Ivanti EPMM should assess their security posture and implement necessary updates to prevent future breaches.
The RondoDox botnet has been identified exploiting a serious vulnerability known as React2Shell (CVE-2025-55182) to compromise Next.js servers. This flaw allows attackers to inject malware and cryptominers into systems that have not been properly secured. Organizations using Next.js frameworks are particularly at risk, as the botnet targets these servers directly. This incident underscores the necessity for companies to regularly update their software and apply security patches to prevent such attacks. The ongoing exploitation of this vulnerability poses significant risks to data integrity and can lead to unauthorized resource usage, impacting both performance and costs for affected users.
IBM has identified a serious vulnerability in its API Connect software, classified as CVE-2025-13915. Rated 9.8 out of 10 on the CVSS scale, this flaw allows remote attackers to bypass authentication, potentially granting them unauthorized access to the application. This issue poses a significant risk to organizations using API Connect, as it could lead to data breaches and other malicious activities. Users of the software are advised to take immediate action to protect their systems. With this vulnerability being so critical, it is essential for companies to stay informed and apply any necessary updates or patches as soon as they become available.
IBM has issued a warning about a serious authentication bypass vulnerability in its API Connect platform. This flaw could allow attackers to gain unauthorized access to applications remotely, putting sensitive data at risk. Businesses using this enterprise tool should prioritize applying the necessary patches to safeguard their systems. The vulnerability affects various versions of the API Connect platform, making it critical for companies to act swiftly to prevent potential breaches. Ignoring this issue could lead to significant security incidents and data compromises.
The European Space Agency (ESA) has confirmed a security breach that affected its external science servers. The incident came to light after a hacker attempted to sell stolen data from these servers. While the ESA is currently investigating the breach, details about the extent of the data compromised have not been fully disclosed. This incident raises concerns about the security of sensitive scientific data and the potential implications for ongoing research and collaboration within the space sector. The breach highlights the increasing vulnerability of even highly specialized organizations to cyberattacks, underscoring the need for robust cybersecurity measures.
A serious vulnerability known as MongoBleed (CVE-2025-14847) was disclosed shortly after Christmas 2023, allowing attackers to remotely access and leak memory from unpatched MongoDB servers using zlib compression, without requiring any authentication. This flaw primarily affects deployments of MongoDB Server that utilize zlib network compression, a common feature in many setups. The vulnerability is significant because it exposes sensitive data stored in these databases, potentially impacting organizations across the U.S., China, and the EU. Cybersecurity experts are urging companies that use MongoDB to assess their systems for this vulnerability and apply necessary updates or patches to protect against exploitation. The situation highlights ongoing security challenges in the management of popular open-source database systems.
Sax, a major US accounting firm, has revealed a data breach that has affected around 220,000 individuals. The breach was detected over a year ago, but the firm took considerable time to investigate the incident thoroughly. While specific details about how the breach occurred have not been disclosed, it raises significant concerns about the security of sensitive financial information. Affected individuals may need to monitor their accounts closely for any signs of unauthorized activity. This incident highlights the ongoing vulnerability of even well-established firms in protecting client data against cyber threats.
On December 26, 2023, the Oltenia Energy Complex, Romania's largest coal-based energy producer, fell victim to a ransomware attack attributed to the Gentlemen ransomware group. The attack severely disrupted the company's IT infrastructure, impacting its ability to operate effectively. Although specific details about the extent of the damage or data breaches have not been disclosed, the incident raises concerns about the vulnerability of critical infrastructure to cyber threats. As energy providers are essential for public services, such attacks can significantly affect energy supply and operational stability. Authorities and cybersecurity experts are likely to investigate the incident further to understand its implications and improve defenses against similar attacks in the future.