Security news.
Today's security landscape is dominated by critical active exploitation, with ransomware gangs leveraging a SharePoint flaw and CISA warning about Gunra ransomware targeting government and critical infrastructure. Supply chain and AI-related threats also feature prominently, alongside revelations of malicious SIM cards and Chrome extensions.
CISA: Microsoft SharePoint Flaw Now Exploited in Ransomware Attacks
Ransomware groups are actively exploiting a high-severity Microsoft SharePoint remote code execution vulnerability, initially flagged in early July, to compromise systems.
Malicious SIM Cards Can Run Attacker Code in Cellular IoT Modems
Researchers discovered that a malicious SIM card can execute arbitrary commands on cellular modules in devices like EV chargers and industrial routers, potentially leading to full device takeover.
US and South Korea Warn of Gunra Ransomware Targeting Govt Agencies
US federal agencies and South Korea's National Policy Agency have issued a joint warning about Gunra ransomware, which exploits Fortinet and Schneider Electric flaws to target government and critical infrastructure organizations worldwide.
Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Exposure
Mozilla revoked the cryptographic key used for Firefox and Thunderbird Linux downloads after it was accidentally committed unencrypted to a private code repository, impacting the verification of legitimate software packages.
Extension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious Activities
A malicious Chrome extension, previously banned for stealing AI chat data and with over 300,000 installs, has reappeared on the Chrome Store and resumed its data-stealing activities.
Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11
Windows Plug and Play's ability to automatically install signed vendor software for emulated USB devices can be chained to achieve SYSTEM-level access on fully updated Windows 11 machines.
Cisco Warns of High-Severity ClamAV Flaws With Public Exploits
Cisco has issued a warning regarding two high-severity vulnerabilities in ClamAV, part of Secure Endpoint Connector, which could allow attackers to trigger denial-of-service conditions with public exploits available.
Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets
A connected malicious tool server can exploit AI coding assistants by fragmenting commands into seemingly innocuous parts, enabling the exfiltration of sensitive data like SSH keys and source code.