news
Security Leftovers
-
Hacker News ☛ China-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB Nodes
A China-nexus threat actor known as UAT-7290 has been attributed to espionage-focused intrusions against entities in South Asia and Southeastern Europe.
The activity cluster, which has been active since at least 2022, primarily focuses on extensive technical reconnaissance of target organizations before initiating attacks, ultimately leading to the deployment of malware families such as RushDrop, DriveSwitch, and SilentRaid, according to a Cisco Talos report published today.
"In addition to conducting espionage-focused attacks where UAT-7290 burrows deep inside a victim enterprise's network infrastructure, their tactics, techniques, and procedures (TTPs) and tooling suggest that this actor also establishes Operational Relay Box (ORBs) nodes," researchers Asheer Malhotra, Vitor Ventura, and Brandon White said.
"The ORB infrastructure may then be used by other China-nexus actors in their malicious operations, signifying UAT-7290's dual role as an espionage-motivated threat actor as well as an initial access group."
-
Security Boulevard ☛ The Myth of Linux Invincibility: Why Automated Patch Management is Key to Securing the Open Source Enterprise [Ed: It can also break things if not tested, supervised etc.]
-
Scoop News Group ☛ Inside Vercel’s sleep-deprived race to contain React2Shell
Talha Tariq quickly found his company at the center of a fast-moving, high-stakes mitigation effort. The result: a bounty program, a cat-and-mouse patch fight, and a debate about open-source security coordination.
-
Security Week ☛ Critical HPE OneView Vulnerability Exploited in Attacks
The maximum-severity code injection flaw can be exploited without authentication for remote code execution.
-
Scoop News Group ☛ Researchers rush to warn defenders of max-severity defect in n8n
Roughly 100,000 servers running the automated workflow platform for Hey Hi (AI) and other enterprise tools are potentially exposed to exploitation.
-
Security Week ☛ Researchers Expose WHILL Wheelchair Safety Risks via Remote Hacking
CISA advisory warns that unauthenticated Bluetooth access in WHILL devices allows for unauthorized movement.
-
Security Week ☛ Critical Vulnerability Exposes n8n Instances to Takeover Attacks
Tracked as CVE-2026-21858 (CVSS score 10), the bug enables remote code execution without authentication.
-
Security Week ☛ Critical Vulnerability Patched in jsPDF
The bug can allow attackers to read arbitrary files from the system, potentially exposing configurations and credentials.