Tessera
Folgen

DCG 201

@dcg201.bsky.social

Dirty Jersey Represent! We meet in Jersey City once a month to work on hardware/software projects! Part of DEFCON Groups. DMs open. CFP: info @ http://defcon201.org Deetz: https://linktr.ee/defcon201

617 Posts987 Follower1030 Folgt
CVE Alerts @cve.skyfleet.blue · last mo.

CVE-2026-10077 - YOOtheme Pro CVE ID : CVE-2026-10077 Published : July 2, 2026, 6 a.m. | 1 hour, 46 minutes ago Description : The yootheme WordPress theme before 5.0.35 does not prevent its bundled front-end framework from treating certain HTML attributes, which are perm...

CVE-2026-10077 - YOOtheme Pro < 5.0.35 - Author+ Stored XSS via UIkit Data Attributes

The yootheme WordPress theme before 5.0.35 does not prevent its bundled front-end framework from treating certain HTML attributes, which are permitted by wp_kses_post(), as markup, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the browser of any user who views the affected post.

cvefeed.io

drew@grmnygrmny.bsky.social · last mo.

my 13 years at bandcamp are coming to an end - i’ve been laid off along with most of the remaining engineers. best job i’ve ever had, working with the best people you could ever work with. unceremonious end to quite a ride.

HushCon@hushcon.com · 2mo ago

Say hello to our mascot for HushCon New York this year. He's looking forward to seeing you all next week. Be there or be square.

Rat in a jacket standing next to a Commodore PET
PJC Cahill@pjccahill.bsky.social · last mo.

Just to make Sony Playstation execs wake up in a cold sweat: I still have all the cables, devices, and my physical games for: PS1 PS2 PS3 PS4 Sega Genesis Dreamcast SNES N64 Gamecube Wii Switch So, yes, hundreds of games And a huge library of DVDs and BluRays. F@#$ companies taking our property.

MeidasTouch@meidastouch.com · last mo.

NEWS: Two people have climbed to the top of the Empire State Building antenna. They are holding a banner that reads: “When the power of love beats the love of power, the world knows peace”

BildBild
InfoSec@infosec.skyfleet.blue · last mo.

Nissan Confirms Data Breach Following Oracle PeopleSoft 0-Day Attacks

Nissan Confirms Data Breach Following Oracle PeopleSoft 0-Day Attacks

Nissan Americas has officially confirmed a data breach affecting current and former employees across four countries after threat actors exploited a critical zero-day vulnerability in Oracle PeopleSoft software, a campaign attributed to the ShinyHunters extortion group. The attack stems from CVE-2026-35273 , a CVSS 9.8-rated unauthenticated Server-Side Request Forgery (SSRF)-to-Remote Code Execution (RCE) vulnerability residing in the Updates Environment Management (PSEMHUB) component of Oracle PeopleSoft PeopleTools versions 8.61 and 8.62. The flaw requires no authentication, no user interaction, and is exploitable over plain HTTP, meaning any attacker with network reach to a vulnerable instance could achieve full remote code execution. Oracle issued an emergency out-of-band security patch on June 10, 2026, and the vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog just two days later. Mandiant and Google’s Threat Intelligence Group (GTIG) attribute the campaign to UNC6240 (ShinyHunters) , a financially motivated cybercrime collective also tracked as Bling Libra. Exploitation was observed as early as May 27, 2026, more than two weeks before Oracle’s advisory, with the group compromising over 300 PeopleSoft instances across 100+ organizations worldwide using automated attack scripts. Nissan Confirms Data Breach According to breach notifications filed with the California Attorney General’s Office, Nissan Americas confirmed it was specifically singled out within the broader campaign. The breach window spans May 27 to June 9, 2026, and potentially exposed sensitive employee data including: Contact and banking information Social Security Numbers (SSN), Social Insurance Numbers (SIN), and National Identification Numbers Financial and tax data Dependent and beneficiary information The incident is believed to impact current and former Nissan employees in the United States, Canada, Mexico, and Brazil. Nissan activated its incident response protocols immediately upon notification, engaging external cybersecurity specialists and cooperating with law enforcement authorities. As a containment measure, the company restricted payroll system access, including pay slip viewing and direct deposit changes, to corporate network computers or secure VPN connections, with additional identity authentication layers implemented before processing payroll requests. Nissan is also arranging free credit and dark web monitoring services for affected individuals where available. Mandiant’s analysis reveals that ShinyHunters deployed MeshCentral remote management agents on compromised hosts, disguising them as legitimate Microsoft Azure services (e.g., meshagent64-azure-ops.exe ) with C2 communications routed to wss://azurenetfiles[.]net:443/agent.ashx . Post-exploitation activity included internal PeopleSoft configuration reconnaissance, lateral movement scripting, and data exfiltration using zstd compression. Compromised servers were marked with a ransom note file named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT . Key Indicators of Compromise (IOCs) Type Indicator Description IP 142.11.200[.]186–190 Staging/C2 infrastructure Domain azurenetfiles[.]net C2 masquerading as Azure SHA-256 f02a924c9ff92a8780ce812511341182... meshagent64-azure-ops.exe URL Path /PSEMHUB/hub Exploitation endpoint URL Path /PSIGW/HttpListeningConnector SSRF exploitation endpoint File README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT Extortion marker Mitigations Organizations running PeopleTools 8.61 or 8.62 should treat patching as an emergency priority. Beyond patching, Rapid7 and Mandiant recommend: Disable or restrict the PSEMHUB service and block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the network perimeter Monitor outbound SMB traffic (TCP/445) from PeopleSoft servers for external NetNTLM hash capture attempts Hunt for compromise indicators even post-patching, given exploitation activity predates Oracle’s advisory by two weeks Rotate all credentials accessible from potentially compromised PeopleSoft instances This marks the second CVSS 9.8 Oracle ERP zero-day exploited in under eight months, following Cl0p’s abuse of CVE-2025-61882 in Oracle E-Business Suite beginning in August 2025 — a pattern that signals ERP platforms have become primary industrialized targets for organized extortion operations.  Strengthen Your SOC by Accelerating Threat Detection &amp; Rapid Investigations. -&gt; Integrate ANY.RUN With Your SOC Now . The post Nissan Confirms Data Breach Following Oracle PeopleSoft 0-Day Attacks appeared first on Cyber Security News .

cybersecuritynews.com

InfoSec@infosec.skyfleet.blue · last mo.

CVE-2025-60467: Use-After-Free in GPAC/MP4Box via gf_filter_pid_inst_swap_delete_task on crafted MPEG-2 TS file

oss-sec: CVE-2025-60467: Use-After-Free in GPAC/MP4Box via gf_filter_pid_inst_swap_delete_task on crafted MPEG-2 TS file

Posted by Alexander A. Shvedov on Jun 26 Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60467 CWE: CWE-416 (Use After Free) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel &lt; https://infosec.exchange/@sigdevel &gt; Description: The gf_filter_pid_inst_swap_delete_task() function in GPAC's filter session core (filter_core/filter_pid.c:574) is a scheduled task that deletes a...

seclists.org