Skip to content

Breaking

Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan
Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan

ConnectWise

Everything RedTeam Tribune has reported about ConnectWise: 2 stories, newest first. Part of our Cyber Attacks coverage.

17 Oct
Cyber Attacks

ConnectWise SkyKick credential abuse exposes 162 M365 tenants to broad backup app permissions

Huntress confirms attackers abused vendor credentials to access Microsoft 365 data across 162 tenants using broad backup application permissions.

13 Oct
Cyber Attacks

Attackers Abuse Microsoft Power BI Dashboards to Distribute ScreenConnect RMM

Huntress researchers found a campaign using public Power BI dashboards to trick users into downloading remote management software.