|
🇨🇳 Chinese hackers breached NASA and the Fed
LINK
|
- Chinese state-sponsored hackers broke into computers at NASA, the Federal Reserve, the Department of Justice, the Department of Energy, Health and Human Services, the National Institutes of Health, and the US Senate, according to a US Justice Department disclosure.
- The group, named in court documents as QTFY, ran two paid hacking services, QScan and QTRouter, that detect and infect internet-connected devices to build a proxy network hiding the origin of their traffic so they could slip into US networks undetected.
- The FBI and Justice Department have disrupted the botnet and hacking platform, seizing the infrastructure and shutting the services down; court documents say QTFY was hired by the Nanjing Xinjiuwei Network Technology Company to run the operations against US critical infrastructure.
|
🕵️ China-linked spies hijack Cisco routers
LINK
|
- A China-linked spying group known as Fire Ant hijacked Cisco IOS XR routers over the past year, stealing administrator logins and rewriting logs to hide its activity while using the devices to reach high-value connected networks.
- According to Sygnia, the group planted a toolkit written for the router's own internals that hid a rogue GRE tunnel interface, disguised itself as a boot service running only during odd-numbered hours, and filtered syslog so any message without the word "Health" silently vanished.
- Fire Ant injected a malicious library into the running TACACS authentication daemon to copy credentials from live administrator logins in real time, ran a backdoor that opens a shell only after seeing packets with a magic string, and edited wtmp, utmp and btmp login records to erase its tracks.
|
🐛 npm worm steals dev secrets
LINK
|
- A supply-chain attack called Trinitite hijacked the npm package @7nohe/openapi-react-query-codegen, a TanStack Query code-generation library with over 150,000 weekly downloads, planting a worm that steals developer, cloud, CI/CD, and source-control secrets.
- Attackers abused the project's GitHub Actions release workflow, which treated a pull request comment saying "npm publish" as publish authorization without checking the commenter was a maintainer, letting an account named p00paboot mint a legitimate trusted-publishing token and ship signed malware.
- The worm hides Python inside a malicious binding.gyp file so it runs even with npm install --ignore-scripts, scrapes Runner.Worker memory for secrets, republishes packages to spread, and can wipe home directories; teams should pin releases 0.5.3, 1.6.2, 2.2.0, or 3.0.2 and rotate credentials.
|
🚨 Ruby on Rails flaw enables remote code
LINK
|
- Hackers are actively exploiting a critical Ruby on Rails flaw dubbed KindaRails2Shell, tracked as CVE-2026-66066 (critical, CVSS 9.5), that lets an unauthenticated attacker read arbitrary files, expose secrets, run code remotely, and move to other machines.
- The bug abuses conflicting file-type checks: an attacker crafts a file declared as MATLAB Level 5, so libvips routes it through libmatio to HDF5, whose External File List reads an attacker-chosen file off the server and returns its contents as pixels.
- VulnCheck says exploitation began last week, roughly a month after July patches, and warns the fix for patched version 8.1.3.1 blocks the libvips file read but leaves a Marshal deserialization gadget that still runs code given a valid signature.
|
🖨️ PaperCut flaw lets hackers run code
LINK
|
- PaperCut has issued a second emergency patch within 24 hours after confirming on August 27 that print management servers in schools, hospitals, and offices are under active attack through a pre-authentication remote code execution flaw.
- The bug, CVE-2026-81578, is an authorization mistake that lets an unauthenticated attacker send a crafted request so the server checks permissions for a displayed page while running an action from another, allowing configuration changes and code execution.
- Huntress found the flaw actively exploited in two customer environments and reproduced the full chain, and warns 47% of roughly 2,500 tracked installations run version 23 or earlier with no patch, advising removing the Application Server from the public internet.
|
|
