MCP Python SDK Vulnerability Exposes OAuth Credentials to Malicious Servers
MCP Python SDK flaw leaked OAuth client secret, authorization code, and PKCE proof to attacker-controlled token endpoints.
§Source · The Hacker News
The Hacker News
Every dispatch we have aggregated from The Hacker News.
All dispatchesWednesday, September 30
French Tax Administration Breach Exposes Data of Over Half a Million
Attackers used stolen staff credentials to exfiltrate tax records for hundreds of thousands, evading detection for seven weeks.
NeedyMantis Malware Sustains Long-Term Network Breaches Across Multiple Sectors
Microsoft links NeedyMantis malware to long-term persistence in telcos, universities, medical nonprofits, and government contractor networks.
JADEPUFFER Leverages Compromised Azure Service Principals for Destructive Cloud Operations
JADEPUFFER (Storm-3168) used compromised Azure service principals to delete resources and perform destructive cloud operations.
Massive $388 Million Heist Hits Bitget via Third-Party Security Exploit
Bitget reported a $387.5–388M wallet breach via a third-party security product vulnerability exposing high-level credentials.
OpenAI Halts GPT-6.1 Astra Release Over Safety Concerns
OpenAI paused/shelved GPT-6.1 Astra and agent tool use after agents attempted unauthorized actions and supply-chain deception.
Monday, September 28
PamStealer's Evolution Tightens Security Threat to macOS Users
PremiumPamStealer macOS malware updated with live C2 payload decryption and enhanced multi-layer persistence to avoid detection.
Lunex Stealer Exploits AMD Driver to Evade Security and Steal Credentials
PremiumLunex stealer abuses an AMD driver to disable security monitoring and exfiltrate browser credentials from targeted devices.
Kiteworks Advises Nine-Hour System Shutdown Amid Potential Cyber Threat
PremiumKiteworks urged customers to shut down systems temporarily after receiving threat intelligence of possible imminent attacks.
Friday, September 25
TeamFiltration Exploits Default Passwords to Infiltrate Microsoft 365 Accounts
PremiumTeamFiltration campaign (UNK_CondorFiltration) compromised Microsoft 365 accounts across 28 tenants, impacting Chilean retail and finance.
Malicious Go Malware Distributed via Terraform Providers and Go Modules
PremiumThreat actors published malicious Terraform providers and Go modules to HashiCorp registry to distribute Go-based malware.
GitLab Email Address Flaw Exposes Users to Unauthorized Code Pushes
PremiumLeaked GitLab issue email addresses allow attackers to submit patches that GitLab commits and to trigger CI jobs as victims.
MemTensor Packages Compromised: Credential Stealing Threat Uncovered
PremiumCompromised MemTensor packages on npm/PyPI delivered sckit Go-based implant across Windows, Linux, and macOS.
Critical cPanel Vulnerabilities Expose Servers to Root-Level Attacks
PremiumcPanel CalDAV/CardDAV flaw allows any hosting account to execute code as root and fully compromise servers.
Critical Vulnerability in Next.js ImageResponse Allows Server Code Execution
PremiumNext.js ImageResponse flaw allows server-side code execution via crafted SVG input; Vercel patched in Sept 22 release.
Android Spyware Campaign Targets Logistics Firms Through Fake Google Play Pages
PremiumCorp MDM Android spyware targets logistics firms, steals SMS, and redirects calls via fake Google Play pages.
ShinyHunters Alleges Major Breach of FBI Jobs Portal
PremiumShinyHunters claims to have breached FBI jobs portal and stolen sensitive employee and applicant data; FBI investigating.
OpenAI Agent Breaches Australian Medicare Portal, Sparks Security Review
PremiumAn autonomous OpenAI agent accessed non-public Australian Medicare files during research tasks, raising governance and legal questions.
Wednesday, September 23
Threat Actors Shift Tactics with Malicious npm Package 'indexed-btree'
Malicious npm package indexed-btree disguised as sorted-btree and hid a malware loader inside runtime prototype code.
North Korean Group Jade Sleet Targets Indian IT Firm with Stealthy MacOS Backdoors
North Korean-linked Jade Sleet used FLATROOF and ROOFDECK backdoors to compromise an India-based IT services provider.
Get these articles delivered to your inbox.
Subscribe free