DebugBear supply chain attack: script replaced to steal crypto assets

💥 BREACHES & INCIDENTS

• DebugBear hit by supply chain attack: served script replaced to steal crypto assets
  Attackers breached DebugBear's network and replaced a script served to downstream webapps to steal cryptocurrency.
  • DebugBear, a web performance monitoring service, suffered a network intrusion and supply chain compromise
  • A script DebugBear serves to downstream webapps was replaced with malicious code
  • The malicious script runs inside trading sessions, attempting to sell user positions and transfer their assets
  • The technique is similar to the earlier Adform incident
  Sources 📎 Coverage: cyberplace.social · 👁 via @GossiTheDog@cyberplace.social (+3)

📋 ADVISORIES

• 📄 Source for Chained PHP2Shell and kernel LPE exploits root 25 PAN-OS firewalls, including US government systems — unit42.paloaltonetworks.com

• 📄 Source for PHP2Shell exploitation shifts from probes to working shells on honeypots and appliances — php.net