Magento StyleSmuggler zero-day exploited to deploy Linux backdoor

🕵️ RESEARCH & DEEP DIVES

• 404 Media marks three years with two sold-out anniversary events in NYC
  404 Media celebrated its three-year anniversary with two sold-out events in New York City.

  • 404 Media, the independent outlet founded by Jason Koebler, Emanuel Maiberg, Samantha Cole, and Joseph Cox, marked three years since its August 2023 launch.
  • The outlet hosted two sold-out anniversary nights in NYC: a live podcast taping and an afterparty the following evening.
  • The taping was held at WNYC's Greene Space with contributors Becky Ferreira and Matthew Gault; the afterparty took place at Threes Brewing in Gowanus, Brooklyn.
  • DeleteMe sponsored the events, and the full live taping will be published as a podcast episode and is available on 404 Media's YouTube channel.
  Sources 📎 Coverage: 404media.co · 👁 via 404 Media

• Magento StyleSmuggler zero-day exploited to deploy Linux backdoor — BleepingComputer

• BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations — BleepingComputer

• Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks — The Hacker News

• ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More — The Hacker News

• Glib2: toctou symlink race in g_file_create_replace_destination fallback pa... — CVE ThreatInt

• java-json-tools jackson-coreutils URL Validation JsonLoader.java JsonLoader.f... — CVE ThreatInt

• java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply res... — CVE ThreatInt

• Bimbo Bakeries USA Confirms Data Breach in Oracle EBS Zero-Day Attack — Cyber Security News

• OpenAI Reports Rogue Agent Web Takeover to EU Regulators as Safety Concerns Grow — securityboulevard.com (discovered)

• AI Can Jump Sandboxes. Easy-Peasy. The World Needs New Borders That Can Actually Contain It. — securityboulevard.com (discovered)

• AI Created a Leaked Credentials Flood: Here’s How We’re Draining It — securityboulevard.com (discovered)

• APIs Are the Attack Surface That Matters in AI-Powered Apps – FireTail Blog — securityboulevard.com (discovered)

• DDoS Testing Vendor Comparison: Red Button, MazeBolt, RedWolf and NimbusDDoS — securityboulevard.com (discovered)

• Cyberattack on IT firm hits at least 80 Luxembourg doctors' offices https:// today.rtl.lu/news/luxembourg/c... — @metacurity@infosec.exchange

• Good god. — @metacurity@infosec.exchange

• I'm going to be at the Billington Cybersecurity Summit tomorrow and Wednesday. — @metacurity@infosec.exchange