The Chinese gaming company sold the online platform to an investor group called San Vicente Acquisition LLC in May 2020. Privacy laws by sharing sensitive data for commercial purposes such as advertising. Over allegations https://leeds-welcome.com/poor-security-of-critical-infrastructure-objects.html that it shared users’ personal information, including their HIV status, with third-parties.

• 11 years of practitioner data on what it takes to keep pace with a field that keeps shifting.
• Progress Software patched the flaws in July, and exploitation requires a non-default configuration — but the release pairs a detailed write-up with a ready-to-run tool and two payloads, putting a complete attack path in public hands for the first time.
• “Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications,” Trezor said .
• “We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems.” The exposure is in addition to 13,689 customers the company disclosed last month as having had their data either fully or partially exposed.
• Security firm TantoSec has published a working exploit chain targeting vulnerabilities in Telerik UI for ASP.NET AJAX that can allow an unauthenticated attacker to execute remote code on the server hosting a vulnerable application.

Google’s Chrome 152 security update resolves 12 vulnerabilities, including a high-severity type confusion flaw in the V8 engine. Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. The designation applies when a model can independently find and exploit zero-day vulnerabilities across many well-defended systems. Catch promises the capabilities of a trusted executive assistant, with built-in controls governing what data and systems it can access. The attacks rely on backdoored ScreenConnect instances to transfer and execute payloads to newly connected clients.

• The researchers, led by Sydney Von Arx of the AI safety nonprofit Nightingale Collective , reconstructed the deleted pages from edit history and published their analysis along with a downloadable copy of the data.
• Sansec said all current versions are affected, including 2.4.9, and that it reproduced the full unauthenticated chain on clean Magento Open Source installations of 2.4.7, 2.4.8, and 2.4.9.
• The StyleSmuggler zero-day allows attackers to execute code and deploy a stealthy backdoor on Adobe Commerce and Magento stores.
• Map cross-domain privilege escalation to sever breach routes at key choke points.
• N-able’s incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed.
• CERT says the fixes prevent the observed attacks and recommends immediate installation, followed by a check for unauthorized configuration changes.

“Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions,” JetBrains said . As of September 6, Adobe has not published an advisory, a CVE identifier, a patch, or a workaround, and its Adobe Commerce security bulletin index lists nothing after the August 11 update. “Sansec is publishing early because stores are being compromised right now,” the company said. CERT says the fixes prevent the observed attacks and recommends immediate installation, followed by a check for unauthorized configuration changes. Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska’s https://labverra.com/articles/beneficiaries-of-5g-technology/ attack warning , published on September 5.

HPE Patches Critical RCE Vulnerabilities in AOS-CX

N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw “Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications,” Trezor said . The exposed information includes customer names, email addresses, phone numbers, shipping addresses, and order numbers between November 2019 and August 2021. “A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host,” Broadcom said in an alert.

“The payloads are protected with javascript-obfuscator , using multiple techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers,” Check Point Research said in a technical report published last week. N-able’s incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed. Progress Software patched the flaws in July, and exploitation requires a non-default configuration — but the release pairs a detailed write-up with a ready-to-run tool and two payloads, putting a complete attack path in public hands for the first time. For the 2026 Cloud Security Index , Intruder analyzed misconfiguration data from 3,000 organizations across AWS, Azure, and Google Cloud and found that risk profiles across providers have almost nothing in common. Add active attacks on browsers, routers, and online stores, and there’s plenty to check—even for teams that have kept up with the patches. It also functions as a remote access and browser monitoring toolkit that runs host commands, steals credentials, hijacks sessions…

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

Security firm TantoSec has published a working exploit chain targeting vulnerabilities in Telerik UI for ASP.NET AJAX that can allow an unauthenticated attacker to execute remote code on the server hosting a vulnerable application. Hacker group published roughly 550GB of data after MAG reportedly refused to pay a ransom demand; the group says it gained access via exposed admin keys. The flaws could allow attackers with administrative access to a virtual machine to execute code on the host system.

• Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop.
• The company named the four programs ProManager , WinUpdate , SoftManager , and LockAppHost and published the findings on September 2 , along with a technical white paper .
• Hacker group published roughly 550GB of data after MAG reportedly refused to pay a ransom demand; the group says it gained access via exposed admin keys.
• However, once the ScreenConnect instances were installed, the cybersecurity company said it observed the clients repeatedly spawning “wscript.exe” to execute VBScripts named 1.vbs, 2.vbs, 3.vbs, and 4.vbs.
• If managing security across multiple cloud providers wasn’t hard enough, each one fails in a different way.
• “Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions,” JetBrains said .

Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems. If managing security across multiple cloud providers wasn’t hard enough, each one fails in a different way. Read the full recap for the week’s major developments, plus more research, attacks, and security news beyond what we covered last week.