Inside the Vulnerabilities of Public MCP Servers: A Wake-Up Call for Security
OX Security found critical MCP protocol vulnerabilities in thousands of public servers exposing AI agent infrastructure risk.
Wednesday, October 7
Critical Vulnerabilities in WordPress Plugins Lead to Security Breaches
Stored XSS in Ninja Forms and WPC Product Bundles exploited to install backdoors and create rogue WordPress admin accounts.
MALFEX Malware Campaign Exploits NPM Packages with Over 40,000 Downloads
MALFEX campaign published eight malicious NPM packages since 2023, accumulating ~40,000 downloads and supply-chain compromise risk.
Engineer Sentenced for Network Sabotage Impacting Thousands of Devices
Former engineer sentenced for locking 3,000+ employer devices in a ransomware-style sabotage on a Windows network.
Urgent Need for Quantum-Safe Upgrades in Medical Devices
Forescout finds only 6% of IoMT and 16% of medical OT devices are capable of post-quantum cryptography transition.
Frontline Education Data Breach Exposes Sensitive Information of K-12 Staff
Frontline Education breach exposed K-12 staff employee data from school district software provider.
FBI Apprehends Key Figure in ATM Malware Operation
FBI arrests alleged Ploutus ATM malware developer Canelon Aguirre, linked to Tren de Aragua ATM jackpotting campaigns.
Cling Botnet Exploits Realtek SDK Flaw Using STUN Protocol
Exploit attempts against Realtek Jungle SDK attempt to deliver Cling botnet that uses STUN-based command-and-control channels.
Ransomware Attack Hits University of Illinois Chicago's Medical School
Ransomware impacted University of Illinois Chicago College of Medicine, with data theft reported from servers.
Belarusian Hacktivists Infiltrate Russian Healthcare Network for Two Years
Belarusian Cyber Partisans reportedly conducted a two-year espionage campaign within Russian healthcare networks for intel and disruption.
Linux Backdoors Masquerade as Email Security Tools in Asia
Linux backdoors target telecom/network appliances in Korea and Taiwan, impersonating email services to evade detection.
UK Police Promote Passkeys Amid Rising Cybercrime Threat
Law enforcement urges passkeys as account takeover revenue surged 417% year-over-year, increasing fraud and credential theft risk.
Ransomware Attack Disrupts Operations at Osaka Metropolitan University
Osaka Metropolitan University cancels classes after a ransomware outage affecting internal network, email and academic systems.
Iranian Hackers Exploit Fake Recruitment to Infiltrate Iraqi Infrastructure
Iranian-affiliated Blinder Tunnel campaign used a booby-trapped Dubai Airports coding test to target Iraqi critical infrastructure for persistence and tunneling.
AI Agents Suspected in Major South Korean Bank Hacks
South Korea believes AI-assisted tools were used in breaches exposing data for at least seven banks and 68,000 people.
Nikkei Employee Emails Compromised in Security Breach
Nikkei reports attackers breached employee Microsoft and Google accounts, using one to send thousands of phishing emails.
FBI Severs Ties with Contractor After Data Breach Reveals Security Lapse
FBI removed an Accenture contractor after a missed patch contributed to a ShinyHunters breach exposing bureau employee data.
ASOS Investigates Security Breach After Unauthorized Notifications
ASOS confirms investigation after unauthorized 'HACKED' push notifications claimed Snowflake compromise and leaked customer data.
ClickFix Attack Exploits Browser Cache to Deliver Malicious Payloads
ClickFix prefetches payloads into browser cache disguised as PNGs to bypass Run limits and execute malicious scripts.
Massive Data Breach in Denmark's National Registry Exposes Millions
Attackers abused a company's authorized access to expose 8.8 million Danish citizens' personal data.
Get these articles delivered to your inbox.
Subscribe free