Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE

🕵️ RESEARCH & DEEP DIVES

• Toy Ghouls group deploys new backdoors abusing HiveMQ MQTT and Element messenger
  Kaspersky GERT has discovered new Toy Ghouls backdoors that use HiveMQ MQTT broker and Element messenger as C2 servers.

  • Affects organizations targeted by the Toy Ghouls threat group, as tracked by Kaspersky GERT.
  • Two new backdoor variants were discovered, using legitimate services for command-and-control: the HiveMQ MQTT broker and the Matrix-based Element messenger.
  • Abusing legitimate messaging and IoT infrastructure helps the attackers blend C2 traffic in with normal service usage.
  Sources 📎 Coverage: securelist.com · 👁 via Securelist (Kaspersky)

• AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks — Schneier on Security

• Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws — The Hacker News

• Why judgment is emerging as cybersecurity’s defining skill — CyberScoop

• Restaurant Menu and Food Ordering before 2.4.12 - Unauthenticated Payment Bypass v... — CVE ThreatInt

• ePayco Payment Gateway for WooCommerce before 8.4.7 - Unauthenticated Payment Conf... — CVE ThreatInt

• AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected... — CVE ThreatInt

• fastify vulnerable to request validation bypass via skipped boolean false sch... — CVE ThreatInt

• fastify vulnerable to authentication bypass via malformed URLs reaching encap... — CVE ThreatInt

• Corosync: corosync: integer overflow in check_memb_commit_token_sanity may by... — CVE ThreatInt

• Memory leak in scan methodMissing release of memory after effective lifetime ... — CVE ThreatInt

• Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISPA cr... — CVE ThreatInt

• fastify vulnerable to request body replacement via an async validation result... — CVE ThreatInt

• Interinfo|DreamMaker - Reflected Cross-site ScriptingDreamMaker developed by ... — CVE ThreatInt

• Interinfo|DreamMaker - SQL InjectionDreamMaker developed by Interinfo has a S... — CVE ThreatInt

• MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Reque... — CVE ThreatInt

• WordPress WoodMart theme before 8.3.8 - Cross Site Scripting (XSS) vulnerabilityIm... — CVE ThreatInt

• @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form... — CVE ThreatInt

• MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Perm... — CVE ThreatInt

• Corosync: corosync: heap-based buffer overflow in totempg assembly buffer dur... — CVE ThreatInt

• PALLET CONTROL products contain an incorrect default permission vulnerability... — CVE ThreatInt

• MISP Sharing Group Authorization Bypass via Omitted Distribution ParameterAn ... — CVE ThreatInt

• WordPress WP Rentals theme before 3.16.0 - Insecure Direct Object References (IDOR... — CVE ThreatInt

• Snowflake JDBC Driver auto-configuration account validation permits credentia... — CVE ThreatInt

• Microsoft Teams to Add QR Code Protection in Teams Messaging — Cyber Security News

• Supply Chain of Distrust — Microsoft/GitHub Supply-Chain Compromise Targets AI Developers — securityboulevard.com (discovered)

• Can AI Actually Reduce Application Maintenance Costs, or Does It Just Generate More Code? — securityboulevard.com (discovered)

• Attacking and Defending SCOM: Management Server Relay and Obtaining Run As Credentials — securityboulevard.com (discovered)

• Detecting living-off-the-land binaries with Sysmon process events — securityboulevard.com (discovered)