The Breach News

Critical Security Vulnerabilities Identified in Sage X3 Enterprise Management Software

Published: July 8, 2021

Recent research has revealed four significant security vulnerabilities in Sage X3’s enterprise resource planning (ERP) software. Two of these vulnerabilities can potentially be combined to facilitate an attack, allowing malicious actors to execute harmful commands and gain control over compromised systems. These issues were identified by researchers at Rapid7, who reported their findings to Sage Group on February 3, 2021. In response, the company has released patches for various versions of Sage X3, including Version 9 (Syracuse 9.22.7.2), Sage X3 HR & Payroll Version 9 (Syracuse 9.24.1.3), Version 11 (Syracuse 11.25.2.6), and Version 12 (Syracuse 12.10.2.8) in March. The identified vulnerabilities include:

  • CVE-2020-7388 (CVSS score: 10.0): Unauthenticated Remote Command Execution (RCE) as SYSTEM in the AdxDSrv.exe component.
  • CVE-2020-7389 (CVSS score: 5.5): System “CHAINE” Variable Script Command Injection (No fix planned).

Sage X3 Enterprise Management Software Exposed to Critical Vulnerabilities On July 8, 2021, it was reported that four significant security vulnerabilities have been identified within the Sage X3 enterprise resource planning (ERP) software suite. Two of these vulnerabilities are particularly concerning, as they can potentially be exploited in tandem to…

Read More

Critical Security Vulnerabilities Identified in Sage X3 Enterprise Management Software

Published: July 8, 2021

Recent research has revealed four significant security vulnerabilities in Sage X3’s enterprise resource planning (ERP) software. Two of these vulnerabilities can potentially be combined to facilitate an attack, allowing malicious actors to execute harmful commands and gain control over compromised systems. These issues were identified by researchers at Rapid7, who reported their findings to Sage Group on February 3, 2021. In response, the company has released patches for various versions of Sage X3, including Version 9 (Syracuse 9.22.7.2), Sage X3 HR & Payroll Version 9 (Syracuse 9.24.1.3), Version 11 (Syracuse 11.25.2.6), and Version 12 (Syracuse 12.10.2.8) in March. The identified vulnerabilities include:

  • CVE-2020-7388 (CVSS score: 10.0): Unauthenticated Remote Command Execution (RCE) as SYSTEM in the AdxDSrv.exe component.
  • CVE-2020-7389 (CVSS score: 5.5): System “CHAINE” Variable Script Command Injection (No fix planned).

Widespread Cyber Attack Targets South Korean Banks and TV Networks

March 20, 2013

On Wednesday, major South Korean banks and leading TV broadcasters experienced simultaneous network crashes due to a significant cyber attack. Authorities, including South Korean police, are investigating the incidents reported by major broadcasters like KBS, MBC, and YTN, as well as Shinhan and Nonghyup banks. The Korea Information Security Agency confirmed that systems went blank at 2 p.m., with some still nonoperational more than seven hours later.

Unlike a distributed denial-of-service (DDoS) attack, this disruption appears to have originated from a virus infecting the machines within these organizations, triggering its effects at the same time. Investigators from the Korea Communications Commission suspect that the malicious code may have been disseminated through company servers responsible for automatic security software updates and virus patches. The Associated Press has reported ongoing developments.

Cyber Attack Disrupts Major South Korean Banks and Broadcasters On March 20, 2013, South Korea experienced a significant cyber attack that led to the failure of computer networks across several prominent banks and television broadcasters. The assault began around 2 PM, with major organizations including KBS, MBC, and YTN, alongside…

Read More

Widespread Cyber Attack Targets South Korean Banks and TV Networks

March 20, 2013

On Wednesday, major South Korean banks and leading TV broadcasters experienced simultaneous network crashes due to a significant cyber attack. Authorities, including South Korean police, are investigating the incidents reported by major broadcasters like KBS, MBC, and YTN, as well as Shinhan and Nonghyup banks. The Korea Information Security Agency confirmed that systems went blank at 2 p.m., with some still nonoperational more than seven hours later.

Unlike a distributed denial-of-service (DDoS) attack, this disruption appears to have originated from a virus infecting the machines within these organizations, triggering its effects at the same time. Investigators from the Korea Communications Commission suspect that the malicious code may have been disseminated through company servers responsible for automatic security software updates and virus patches. The Associated Press has reported ongoing developments.

Salt Typhoon Exploits Vulnerabilities in Network Edge Devices to Target 600 Organizations Globally

Date: Aug 28, 2025
Categories: Cyber Espionage / Network Security

The advanced persistent threat (APT) group known as Salt Typhoon, linked to China, has ramped up its cyberattacks on networks worldwide, impacting sectors such as telecommunications, government, transportation, hospitality, and military infrastructure. According to a recent joint cybersecurity advisory, these attackers primarily target major telecommunications backbone routers, as well as provider edge (PE) and customer edge (CE) routers. They leverage compromised devices and trusted connections to infiltrate additional networks, often modifying routers to ensure continuous, long-term access. The advisory, issued by authorities from 13 countries, associates this malicious activity with three Chinese firms: Sichuan Juxinhe Network Technology Co., Ltd., Beijing Huanyu Tianqiong Information Technology Co., Ltd., and Sichuan Zhixin Ruijie Network Technology Co., Ltd.

Salt Typhoon Exploits Vulnerabilities in Edge Network Devices to Compromise 600 Organizations Globally In a significant escalation of cyber threats, the China-linked advanced persistent threat (APT) group known as Salt Typhoon has successfully infiltrated networks across a diverse range of sectors, affecting approximately 600 organizations worldwide. This includes critical industries…

Read More

Salt Typhoon Exploits Vulnerabilities in Network Edge Devices to Target 600 Organizations Globally

Date: Aug 28, 2025
Categories: Cyber Espionage / Network Security

The advanced persistent threat (APT) group known as Salt Typhoon, linked to China, has ramped up its cyberattacks on networks worldwide, impacting sectors such as telecommunications, government, transportation, hospitality, and military infrastructure. According to a recent joint cybersecurity advisory, these attackers primarily target major telecommunications backbone routers, as well as provider edge (PE) and customer edge (CE) routers. They leverage compromised devices and trusted connections to infiltrate additional networks, often modifying routers to ensure continuous, long-term access. The advisory, issued by authorities from 13 countries, associates this malicious activity with three Chinese firms: Sichuan Juxinhe Network Technology Co., Ltd., Beijing Huanyu Tianqiong Information Technology Co., Ltd., and Sichuan Zhixin Ruijie Network Technology Co., Ltd.

Significant Vulnerabilities Identified in Philips Vue PACS Medical Imaging Systems

Date: July 9, 2021

A series of security vulnerabilities have been revealed in the Philips Clinical Collaboration Platform Portal (commonly known as Vue PACS). Some of these vulnerabilities could potentially be exploited by malicious actors to gain control over affected systems. According to a warning from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), “Successful exploitation of these vulnerabilities could allow an unauthorized person or process to eavesdrop, view or modify data, gain system access, perform code execution, install unauthorized software, or compromise system data integrity, thereby threatening the confidentiality, integrity, or availability of the system.”

These 15 vulnerabilities affect the following systems:

  • VUE Picture Archiving and Communication Systems (versions 12.2.x.x and earlier)
  • Vue MyVue (versions 12.2.x.x and earlier)
  • Vue Speech (versions 12.2.x.x and earlier)
  • Vue Motion (versions 12.2.1.5 and earlier)

Notably, four specific issues (CVE-2020-1938, CVE-2018-12326, CVE-2018-11218, CVE-2020-4670, and CVE-2018-8014) have been assigned a Critical rating.

Critical Security Vulnerabilities Identified in Philips Vue PACS Imaging Systems On July 9, 2021, significant security vulnerabilities were reported in the Philips Clinical Collaboration Platform Portal, commonly referred to as Vue PACS. These vulnerabilities pose a serious risk, as they could potentially allow malicious actors to gain control over affected…

Read More

Significant Vulnerabilities Identified in Philips Vue PACS Medical Imaging Systems

Date: July 9, 2021

A series of security vulnerabilities have been revealed in the Philips Clinical Collaboration Platform Portal (commonly known as Vue PACS). Some of these vulnerabilities could potentially be exploited by malicious actors to gain control over affected systems. According to a warning from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), “Successful exploitation of these vulnerabilities could allow an unauthorized person or process to eavesdrop, view or modify data, gain system access, perform code execution, install unauthorized software, or compromise system data integrity, thereby threatening the confidentiality, integrity, or availability of the system.”

These 15 vulnerabilities affect the following systems:

  • VUE Picture Archiving and Communication Systems (versions 12.2.x.x and earlier)
  • Vue MyVue (versions 12.2.x.x and earlier)
  • Vue Speech (versions 12.2.x.x and earlier)
  • Vue Motion (versions 12.2.1.5 and earlier)

Notably, four specific issues (CVE-2020-1938, CVE-2018-12326, CVE-2018-11218, CVE-2020-4670, and CVE-2018-8014) have been assigned a Critical rating.

#OpIsrael: Anonymous Calls for Massive Cyberattack on Israel Ahead of April 7th April 6, 2013 As April 7th approaches, the hacktivist group Anonymous has announced plans for a significant cyber attack on Israel as part of their ongoing #OpIsrael campaign. The collective is actively recruiting new members and mobilizing supporters for an extensive assault on Israeli network infrastructures. This action is a response to the Israeli military’s actions in Palestinian territories, expressing solidarity with the Palestinian people and condemning the Israeli government’s policies. In a statement shared with The Hackers Post, the group emphasized their motivations: “Israel continues its human rights violations. This campaign is meant to show solidarity with the newly recognized Palestinian state. The hacking teams are uniting against Israel as a single entity… Israel should be prepared for a major disruption on the internet.” Anonymous has pledged to “erase Israel from the internet” in this coordinated effort.

Anonymous Launches Cyber Campaign Against Israel on April 7 April 6, 2013 In anticipation of April 7, the hacktivist collective known as Anonymous has announced plans for a substantial cyber offensive targeting Israel. This initiative, dubbed #OpIsrael, follows a series of escalating digital protests against actions taken by the Israeli…

Read More#OpIsrael: Anonymous Calls for Massive Cyberattack on Israel Ahead of April 7th April 6, 2013 As April 7th approaches, the hacktivist group Anonymous has announced plans for a significant cyber attack on Israel as part of their ongoing #OpIsrael campaign. The collective is actively recruiting new members and mobilizing supporters for an extensive assault on Israeli network infrastructures. This action is a response to the Israeli military’s actions in Palestinian territories, expressing solidarity with the Palestinian people and condemning the Israeli government’s policies. In a statement shared with The Hackers Post, the group emphasized their motivations: “Israel continues its human rights violations. This campaign is meant to show solidarity with the newly recognized Palestinian state. The hacking teams are uniting against Israel as a single entity… Israel should be prepared for a major disruption on the internet.” Anonymous has pledged to “erase Israel from the internet” in this coordinated effort.

TamperedChef Malware Masquerading as Fake PDF Editors Gathers Credentials and Cookies

Cybersecurity Alert: Aug 29, 2025

Cybersecurity experts have uncovered a new cybercrime operation utilizing deceptive advertising techniques to funnel victims to fraudulent websites, leading them to download an information-stealing malware known as TamperedChef. Researchers from Truesec—Mattias Wåhlén, Nicklas Keijser, and Oscar Lejerbäck Wolf—reported on the findings, revealing that the goal is to entice victims into installing a Trojan PDF editor. This malicious software is designed to capture sensitive information, including login credentials and web cookies. The scheme primarily leverages multiple fake sites to promote a free PDF editor named AppSuite PDF Editor. Once downloaded and executed, the software prompts users to agree to its terms of service and privacy policy, all while in the background covertly connecting to an external server to install the actual malware.

TamperedChef Malware Poses as Fake PDF Editors to Steal Credentials and Cookies In a recent cybersecurity alert, researchers uncovered a malicious campaign that employs deceptive advertising techniques to lure victims into downloading a second-rate PDF editor. This operation centers around a malware known as TamperedChef, which is specifically designed to…

Read More

TamperedChef Malware Masquerading as Fake PDF Editors Gathers Credentials and Cookies

Cybersecurity Alert: Aug 29, 2025

Cybersecurity experts have uncovered a new cybercrime operation utilizing deceptive advertising techniques to funnel victims to fraudulent websites, leading them to download an information-stealing malware known as TamperedChef. Researchers from Truesec—Mattias Wåhlén, Nicklas Keijser, and Oscar Lejerbäck Wolf—reported on the findings, revealing that the goal is to entice victims into installing a Trojan PDF editor. This malicious software is designed to capture sensitive information, including login credentials and web cookies. The scheme primarily leverages multiple fake sites to promote a free PDF editor named AppSuite PDF Editor. Once downloaded and executed, the software prompts users to agree to its terms of service and privacy policy, all while in the background covertly connecting to an external server to install the actual malware.

Urgent: Critical RCE Vulnerability in ForgeRock Access Manager Under Active Exploitation

Cybersecurity agencies in Australia and the U.S. are sounding the alarm about a serious vulnerability in ForgeRock’s OpenAM access management system, which is being actively exploited to execute remote code on compromised systems. The Australian Cyber Security Centre (ACSC) has reported that threat actors are leveraging this flaw to infiltrate multiple hosts, deploying additional malware and tools. However, details regarding the nature and scope of the attacks, as well as the identities of the perpetrating actors, remain undisclosed.

Identified as CVE-2021-35464, this vulnerability is a pre-authentication remote code execution (RCE) flaw linked to unsafe Java deserialization in the Jato framework used by ForgeRock Access Manager. Exploiting this vulnerability allows attackers to execute commands within the context of the current user rather than as a root user.

Critical RCE Vulnerability in ForgeRock Access Manager Under Active Exploitation On July 13, 2021, cybersecurity agencies from Australia and the United States issued a serious warning regarding an actively exploited vulnerability within ForgeRock’s OpenAM access management solution. This security flaw could allow attackers to execute arbitrary code on affected systems…

Read More

Urgent: Critical RCE Vulnerability in ForgeRock Access Manager Under Active Exploitation

Cybersecurity agencies in Australia and the U.S. are sounding the alarm about a serious vulnerability in ForgeRock’s OpenAM access management system, which is being actively exploited to execute remote code on compromised systems. The Australian Cyber Security Centre (ACSC) has reported that threat actors are leveraging this flaw to infiltrate multiple hosts, deploying additional malware and tools. However, details regarding the nature and scope of the attacks, as well as the identities of the perpetrating actors, remain undisclosed.

Identified as CVE-2021-35464, this vulnerability is a pre-authentication remote code execution (RCE) flaw linked to unsafe Java deserialization in the Jato framework used by ForgeRock Access Manager. Exploiting this vulnerability allows attackers to execute commands within the context of the current user rather than as a root user.

Three LulzSec Hackers Admit Guilt in NHS and Sony Cyber Attacks

April 9, 2013

Three members of the notorious hacktivist group LulzSec have pleaded guilty to their involvement in a series of cyber attacks targeting the NHS, Sony, and News International. Ryan Ackroyd, Jake Davis, and Mustafa Al-Bassam confessed to committing an unauthorized act to disrupt computer operations, violating the Criminal Law Act of 1977.

In July 2011, the Sun’s website was compromised, with users momentarily redirected to a fake page falsely announcing Rupert Murdoch’s death. Both Davis, hailing from Shetland, and Bassam, a student from Peckham in south London, admitted to conspiring to attack websites of law enforcement agencies in the UK and US, including the CIA and the Serious Organized Crime Agency (SOCA).

As an offshoot of the Anonymous hacktivists, LulzSec, along with Anonymous, caused significant disruption throughout 2011 and 2012, taking thousands of websites offline and stealing data from prominent companies. The three men are facing…

Three LulzSec Hackers Admit Guilt in NHS and Sony Attacks Date: April 9, 2013 In a significant turn of events within the cyber threat landscape, three members of the notorious hacking collective LulzSec have pleaded guilty to participating in a range of cyber attacks against high-profile targets, including the National…

Read More

Three LulzSec Hackers Admit Guilt in NHS and Sony Cyber Attacks

April 9, 2013

Three members of the notorious hacktivist group LulzSec have pleaded guilty to their involvement in a series of cyber attacks targeting the NHS, Sony, and News International. Ryan Ackroyd, Jake Davis, and Mustafa Al-Bassam confessed to committing an unauthorized act to disrupt computer operations, violating the Criminal Law Act of 1977.

In July 2011, the Sun’s website was compromised, with users momentarily redirected to a fake page falsely announcing Rupert Murdoch’s death. Both Davis, hailing from Shetland, and Bassam, a student from Peckham in south London, admitted to conspiring to attack websites of law enforcement agencies in the UK and US, including the CIA and the Serious Organized Crime Agency (SOCA).

As an offshoot of the Anonymous hacktivists, LulzSec, along with Anonymous, caused significant disruption throughout 2011 and 2012, taking thousands of websites offline and stealing data from prominent companies. The three men are facing…