A recent investigation by Cyble Research and Intelligence Labs (CRIL) has uncovered a sophisticated phishing campaign exploiting globally recognized and regional brands to steal user credentials, marking an escalation in adversary tradecraft and reach. Unlike conventional phishing threats, this operation delivers meticulously crafted HTML attachments often camouflaged as procurement documents or invoices directly through email, […]
SAP has released a significant security update addressing 18 new vulnerabilities across its enterprise software portfolio, including several critical flaws related to code execution and data injection. This monthly security patch day features four high-severity vulnerabilities that require immediate attention from organizations utilizing SAP infrastructure. The most severe vulnerabilities have a CVSS score of 10.0, […]
A sophisticated Android remote-access trojan named KomeX RAT has emerged on underground hacking forums, with the threat actor Gendirector actively marketing the malware through tiered subscription models. The malware, built on the foundation of previously documented BTMOB, poses a significant threat to Android device owners due to its extensive capabilities and aggressive advertising campaign within […]
AI-enabled supply chain attacks jumped 156% last year. Discover why traditional defenses are failing and what CISOs must do now to protect their organizations.
Download the full CISO’s expert guide to AI Supply chain attacks here.
TL;DR
AI-enabled supply chain attacks are exploding in scale and sophistication – Malicious package uploads to open-source repositories jumped 156% in
With more than 5.4 billion social media users worldwide, Facebook remains a critical marketing channel for businesses of all sizes. This massive reach and trusted brand status, however, make it an increasingly attractive target for sophisticated threat actors seeking to exploit user confidence in the platform. Security researchers at Check Point have recently uncovered a […]
Cybersecurity researchers have discovered a malicious npm package named “@acitons/artifact” that typosquats the legitimate “@actions/artifact” package with the intent to target GitHub-owned repositories.
“We think the intent was to have this script execute during a build of a GitHub-owned repository, exfiltrate the tokens available to the build environment, and then use those tokens to publish
A new security investigation reveals that 65% of prominent AI companies have leaked verified secrets on GitHub, exposing API keys, tokens, and sensitive credentials that could compromise their operations and intellectual property.
The wiz research, which examined 50 leading AI companies from the Forbes AI 50 list, uncovered widespread security vulnerabilities across the industry.
These leaked secrets were discovered in deleted forks, gists, and developer repositories, representing an attack surface that standard GitHub scanning tools routinely overlook.
What Makes this Different
Unlike commodity secret-scanning tools that rely on surface-level GitHub organization searches. The Wiz researchers employed a three-pronged methodology targeting depth, perimeter, and coverage.
Analysis of secrets leak to AI companies
The “Depth” approach examined complete commit histories, deleted forks, workflow logs, and gists, the submerged portion of the security iceberg.
The “Perimeter” dimension expanded discovery to include secrets accidentally committed by organization members to their personal repositories.
Meanwhile, “Coverage” addressed detection gaps for emerging AI-specific secret types across platforms such as Perplexity, Weights & Biases, Groq, and NVIDIA.
Among the most impactful leaks were Langsmith API keys granting organization-level access and enterprise-tier credentials from ElevenLabs, discovered in plaintext configuration files.
One anonymous AI50 company’s exposure included a Hugging Face token that provided access to approximately 1,000 private models, alongside multiple Weights and Biases keys that compromised proprietary training data.
Troublingly, 65% of exposed companies were valued at over $400 billion collectively. Yet, smaller organizations proved equally vulnerable, even those with minimal public repositories demonstrated exposure risks.
Wiz experts emphasize the urgent need for action by AI companies. Implementing mandatory secret scanning for public version-control systems is essential and cannot be overlooked.
Establishing proper disclosure channels from inception protects companies during vulnerability remediation. Additionally, AI service providers must develop custom detection for proprietary secret formats, as many leak their own platform credentials during deployment due to inadequate scanning.
The wiz research underscores a critical message: organizational members and contributors represent extended attack surfaces requiring security policies during onboarding.
Treating employees’ personal repositories as part of corporate infrastructure becomes essential as AI adoption accelerates. In an industry racing ahead, the message is clear: speed cannot compromise security.
Comprehensive secret detection must evolve alongside emerging AI technologies to raise organizational defense standards.
Cybersecurity researchers have disclosed details of a new Android remote access trojan (RAT) called Fantasy Hub that’s sold on Russian-speaking Telegram channels under a Malware-as-a-Service (MaaS) model.
According to its seller, the malware enables device control and espionage, allowing threat actors to collect SMS messages, contacts, call logs, images, and videos, as well as intercept, reply,
A critical vulnerability in WatchGuard Firebox firewalls could allow attackers to gain complete administrative access to the devices without any authentication.
The flaw, tracked as CVE-2025-59396, stems from insecure default configurations that expose SSH access on port 4118 using hardcoded credentials.
WatchGuard Firebox appliances through September 10, 2025, ship with default SSH credentials (admin:readwrite) that remain accessible on port 4118.
This means that any attacker with network access to the device can remotely connect and gain full administrative privileges.
The vulnerability requires no special exploit tools; simple SSH clients like PuTTY are sufficient to establish a connection.
According to the advisory released on GitHub, there is a dangerous misconfiguration that affects the entire Firebox firewall series.
Aspect
Details
CVE ID
CVE-2025-59396
Vendor
WatchGuard
Product
Firebox Series
Affected Component
SSH Service (Port 4118)
Attack Vector
Remote unauthenticated access
CVSS Impacts
RCE, Privilege Escalation, Information Disclosure
WatchGuard Firebox Firewall Vulnerability
An unauthenticated remote attacker can retrieve sensitive network information, including ARP tables, network configurations, and user account details. They can also access feature keys and device location data.
More critically, attackers can modify or turn off firewall rules and security policies, effectively turning off network protections.
This opens the door to lateral movement throughout the internal network, allowing attackers to spread to other systems and exfiltrate valuable data.
In worst-case scenarios, attackers could completely interrupt network services or shut down critical infrastructure protected by the firewall.
GitHub-intimate organizations using WatchGuard Firebox devices should immediately check their configurations. Change default SSH credentials immediately if they haven’t been modified.
WatchGuard administrators should also restrict SSH access on port 4118 if not required, or limit it to authorized IP addresses only.
Check WatchGuard’s security advisories for firmware patches and follow their remediation guidance. This vulnerability highlights the persistent threat posed by default credentials in network security appliances.
Firewall devices, by their nature, protect critical network infrastructure; leaving them exposed with default passwords essentially defeats their entire purpose.
Ferocious Kitten, a covert cyber-espionage group active since at least 2015, has emerged as a persistent threat to Persian-speaking dissidents and activists within Iran. The group, known for its careful targeting and evolving tactics, deploys its custom implant “MarkiRAT” to perform keystroke and clipboard logging, screenshot capture, credential theft, and much more, advancing its clandestine […]
