The Breach News

SAP Releases Critical Patches for NetWeaver (CVSS Scores Up to 10.0) and High-Risk S/4HANA Vulnerabilities

Date: September 10, 2025
Category: Software Security / Vulnerability

On Tuesday, SAP issued security updates to rectify numerous vulnerabilities, including three critical flaws in SAP NetWeaver that could lead to remote code execution and unauthorized file uploads. Details of the vulnerabilities are as follows:

  • CVE-2025-42944 (CVSS Score: 10.0) – A deserialization vulnerability in SAP NetWeaver that allows unauthenticated attackers to submit malicious payloads via the RMI-P4 module, potentially executing operating system commands.
  • CVE-2025-42922 (CVSS Score: 9.9) – An insecure file operations vulnerability in SAP NetWeaver AS Java enabling authenticated non-administrative users to upload arbitrary files.
  • CVE-2025-42958 (CVSS Score: 9.1) – A missing authentication check in the SAP NetWeaver application on IBM i-series, which could let unauthorized highly privileged users read, modify, or delete sensitive information, and access administrative functionalities.

SAP Addresses Critical Vulnerabilities in NetWeaver and High-Severity Flaws in S/4HANA On September 10, 2025, SAP issued several security updates aimed at mitigating significant vulnerabilities in its software, particularly within SAP NetWeaver. Among the disclosed issues are three critical vulnerabilities categorized with a Common Vulnerability Scoring System (CVSS) score peaking…

Read More

SAP Releases Critical Patches for NetWeaver (CVSS Scores Up to 10.0) and High-Risk S/4HANA Vulnerabilities

Date: September 10, 2025
Category: Software Security / Vulnerability

On Tuesday, SAP issued security updates to rectify numerous vulnerabilities, including three critical flaws in SAP NetWeaver that could lead to remote code execution and unauthorized file uploads. Details of the vulnerabilities are as follows:

  • CVE-2025-42944 (CVSS Score: 10.0) – A deserialization vulnerability in SAP NetWeaver that allows unauthenticated attackers to submit malicious payloads via the RMI-P4 module, potentially executing operating system commands.
  • CVE-2025-42922 (CVSS Score: 9.9) – An insecure file operations vulnerability in SAP NetWeaver AS Java enabling authenticated non-administrative users to upload arbitrary files.
  • CVE-2025-42958 (CVSS Score: 9.1) – A missing authentication check in the SAP NetWeaver application on IBM i-series, which could let unauthorized highly privileged users read, modify, or delete sensitive information, and access administrative functionalities.

Code Execution Vulnerability Discovered in Yamale Python Package, Impacting Over 200 Projects

On October 7, 2021, a serious code injection vulnerability was identified in Yamale, a schema and validator for YAML files developed by 23andMe. This flaw could be easily exploited by attackers to execute arbitrary Python code. Designated as CVE-2021-38305 with a CVSS score of 7.8, the vulnerability arises from the improper handling of the schema file input, enabling circumvention of security measures.

The issue lies within the schema parsing function, which inadequately evaluates and executes all inputs, allowing maliciously crafted strings to execute system commands. Yamale is widely utilized by developers for validating YAML, a data serialization language commonly used in configuration files, with at least 224 repositories on GitHub relying on this package. This vulnerability presents a significant risk for any projects that utilize input schema files, enabling potential Python code injection for those with access.

Critical Code Execution Vulnerability Discovered in Yamale Python Package October 07, 2021 A significant security vulnerability has been uncovered in the Yamale Python package, a widely utilized tool for validating YAML files. This code injection flaw, identified as CVE-2021-38305, has been assigned a high CVSS score of 7.8, indicating its…

Read More

Code Execution Vulnerability Discovered in Yamale Python Package, Impacting Over 200 Projects

On October 7, 2021, a serious code injection vulnerability was identified in Yamale, a schema and validator for YAML files developed by 23andMe. This flaw could be easily exploited by attackers to execute arbitrary Python code. Designated as CVE-2021-38305 with a CVSS score of 7.8, the vulnerability arises from the improper handling of the schema file input, enabling circumvention of security measures.

The issue lies within the schema parsing function, which inadequately evaluates and executes all inputs, allowing maliciously crafted strings to execute system commands. Yamale is widely utilized by developers for validating YAML, a data serialization language commonly used in configuration files, with at least 224 repositories on GitHub relying on this package. This vulnerability presents a significant risk for any projects that utilize input schema files, enabling potential Python code injection for those with access.

China Asserts Commitment to International Collaboration in Addressing Cybersecurity Challenges

On November 6, 2013, at Stanford University, cybersecurity experts and leaders from over 40 nations convened to discuss the pressing issues of cyberspace security and international collaboration. The increasingly borderless nature of the internet highlights the urgent need for cooperative efforts in cybersecurity. Cai Mingzhao, Minister of the State Council Information Office of China, expressed the country’s eagerness to work alongside other nations to confront cybersecurity threats. Notably, this statement comes amid allegations of China’s involvement in significant cyberattacks. “To ensure cybersecurity, we must enhance international cooperation,” he stated, adding that China is prepared to expand partnerships with other countries and relevant international organizations on the principles of equality and mutual benefit. He further noted that China itself has been a victim of cybersecurity breaches, with over 80% of incidents affecting Chinese interests.

China Expresses Commitment to International Cybersecurity Cooperation On November 5th, 2013, a significant gathering took place at Stanford University, where cybersecurity experts and leaders from over 40 nations convened to address the pressing challenges of cyberspace security and the necessity for enhanced international collaboration. The discussions highlighted the intrinsic borderless…

Read More

China Asserts Commitment to International Collaboration in Addressing Cybersecurity Challenges

On November 6, 2013, at Stanford University, cybersecurity experts and leaders from over 40 nations convened to discuss the pressing issues of cyberspace security and international collaboration. The increasingly borderless nature of the internet highlights the urgent need for cooperative efforts in cybersecurity. Cai Mingzhao, Minister of the State Council Information Office of China, expressed the country’s eagerness to work alongside other nations to confront cybersecurity threats. Notably, this statement comes amid allegations of China’s involvement in significant cyberattacks. “To ensure cybersecurity, we must enhance international cooperation,” he stated, adding that China is prepared to expand partnerships with other countries and relevant international organizations on the principles of equality and mutual benefit. He further noted that China itself has been a victim of cybersecurity breaches, with over 80% of incidents affecting Chinese interests.

Beware of Salty2FA: New Phishing Kit Targeting Enterprises in the US and EU

September 10, 2025
Malware Analysis / Enterprise Security

Phishing-as-a-Service (PhaaS) platforms are continuously evolving, providing cybercriminals with quicker and cheaper methods to infiltrate corporate accounts. Researchers at ANY.RUN have identified a new threat: Salty2FA, a sophisticated phishing kit capable of bypassing various two-factor authentication methods and evading traditional defenses. Currently active in campaigns across the US and EU, Salty2FA threatens numerous industries, including finance and energy. Its complex execution chain, evasive infrastructure, and ability to intercept credentials and 2FA codes make it one of the most formidable PhaaS frameworks observed this year.

Why Salty2FA Poses a Significant Risk for Enterprises
With the ability to bypass push notifications, SMS, and voice-based 2FA, Salty2FA allows stolen credentials to easily lead to account takeovers. Targeting sectors such as finance, energy, and telecommunications, this kit transforms ordinary phishing emails into severe security breaches.

Identifying the Targets
ANY.RUN analysts have mapped Salty2FA campaigns and highlighted…

Beware of Salty2FA: Emerging Phishing Kit Targeting US and EU Businesses September 10, 2025 By BreachSpot News Team The landscape of cybersecurity threats is evolving rapidly, with Phishing-as-a-Service (PhaaS) platforms gaining momentum among malicious actors. In a recent discovery, cybersecurity analysts at ANY.RUN have identified a new phishing kit dubbed…

Read More

Beware of Salty2FA: New Phishing Kit Targeting Enterprises in the US and EU

September 10, 2025
Malware Analysis / Enterprise Security

Phishing-as-a-Service (PhaaS) platforms are continuously evolving, providing cybercriminals with quicker and cheaper methods to infiltrate corporate accounts. Researchers at ANY.RUN have identified a new threat: Salty2FA, a sophisticated phishing kit capable of bypassing various two-factor authentication methods and evading traditional defenses. Currently active in campaigns across the US and EU, Salty2FA threatens numerous industries, including finance and energy. Its complex execution chain, evasive infrastructure, and ability to intercept credentials and 2FA codes make it one of the most formidable PhaaS frameworks observed this year.

Why Salty2FA Poses a Significant Risk for Enterprises
With the ability to bypass push notifications, SMS, and voice-based 2FA, Salty2FA allows stolen credentials to easily lead to account takeovers. Targeting sectors such as finance, energy, and telecommunications, this kit transforms ordinary phishing emails into severe security breaches.

Identifying the Targets
ANY.RUN analysts have mapped Salty2FA campaigns and highlighted…

Major Vulnerability in OpenSea Could Have Allowed Hackers to Steal Cryptocurrency from User Wallets

Oct 13, 2021

A recently patched critical vulnerability in OpenSea, the leading marketplace for non-fungible tokens (NFTs), had the potential to be exploited by hackers to siphon cryptocurrency from victims by sending specially-crafted tokens. This revelation comes from cybersecurity firm Check Point Research, which launched an investigation following reports of cryptocurrency theft linked to free airdropped NFTs. The issues were resolved within an hour of responsible disclosure on September 26, 2021. “If left unaddressed, these vulnerabilities could have permitted hackers to seize user accounts and drain entire cryptocurrency wallets by crafting malicious NFTs,” stated researchers from Check Point. NFTs, as unique digital assets, include items like photos, videos, and audio, traded on the blockchain, which serves as a certificate of authenticity.

OpenSea’s Recent Vulnerability Exposed Cryptocurrency Wallets to Potential Theft On October 13, 2021, a significant security flaw was discovered and promptly resolved within OpenSea, the largest marketplace for non-fungible tokens (NFTs) globally. This vulnerability permitted hackers to potentially siphon off cryptocurrency from user wallets through the delivery of specially designed…

Read More

Major Vulnerability in OpenSea Could Have Allowed Hackers to Steal Cryptocurrency from User Wallets

Oct 13, 2021

A recently patched critical vulnerability in OpenSea, the leading marketplace for non-fungible tokens (NFTs), had the potential to be exploited by hackers to siphon cryptocurrency from victims by sending specially-crafted tokens. This revelation comes from cybersecurity firm Check Point Research, which launched an investigation following reports of cryptocurrency theft linked to free airdropped NFTs. The issues were resolved within an hour of responsible disclosure on September 26, 2021. “If left unaddressed, these vulnerabilities could have permitted hackers to seize user accounts and drain entire cryptocurrency wallets by crafting malicious NFTs,” stated researchers from Check Point. NFTs, as unique digital assets, include items like photos, videos, and audio, traded on the blockchain, which serves as a certificate of authenticity.

Men Purchase Hacking Tools to Target Wives and Friends

Cybersecurity Threats Emerge from Telegram Communities Targeting Women Recent findings reveal alarming activities within Telegram groups where thousands of men engage in the sale and promotion of hacking and surveillance services. These services, which can be exploited to target individuals like friends, partners, and ex-partners, raise significant concerns about cyber…

Read MoreMen Purchase Hacking Tools to Target Wives and Friends

Microsoft Announces Fix for 80 Security Vulnerabilities, Including Critical SMB Privilege Escalation and Azure CVSS 10.0 Issues

On September 10, 2025, Microsoft released patches for 80 security flaws across its software. This update includes one vulnerability that had already been disclosed publicly. Among these, eight are classified as Critical, while 72 are deemed Important. Fortunately, none were exploited in the wild as zero-day vulnerabilities. Similar to the previous month, 38 flaws are linked to privilege escalation, followed by 22 related to remote code execution, 14 concerning information disclosure, and 3 classified as denial-of-service. “For the third time this year, Microsoft has addressed more privilege escalation vulnerabilities than remote code execution issues,” noted Satnam Narang, Senior Staff Research Engineer at Tenable. “Almost half (47.5%) of the vulnerabilities this month are related to privilege escalation.” This patch release also includes updates to 12 vulnerabilities in Microsoft’s Chromium-based Edge browser since August 2025’s Patch Tuesday.

Microsoft Addresses 80 Security Flaws, Including Critical SMB Privilege Escalation and Azure Vulnerabilities On September 10, 2025, Microsoft released patches for 80 identified security vulnerabilities in its software ecosystem. Among these flaws, eight have been classified as Critical, while the remaining 72 are deemed Important in terms of severity. Notably,…

Read More

Microsoft Announces Fix for 80 Security Vulnerabilities, Including Critical SMB Privilege Escalation and Azure CVSS 10.0 Issues

On September 10, 2025, Microsoft released patches for 80 security flaws across its software. This update includes one vulnerability that had already been disclosed publicly. Among these, eight are classified as Critical, while 72 are deemed Important. Fortunately, none were exploited in the wild as zero-day vulnerabilities. Similar to the previous month, 38 flaws are linked to privilege escalation, followed by 22 related to remote code execution, 14 concerning information disclosure, and 3 classified as denial-of-service. “For the third time this year, Microsoft has addressed more privilege escalation vulnerabilities than remote code execution issues,” noted Satnam Narang, Senior Staff Research Engineer at Tenable. “Almost half (47.5%) of the vulnerabilities this month are related to privilege escalation.” This patch release also includes updates to 12 vulnerabilities in Microsoft’s Chromium-based Edge browser since August 2025’s Patch Tuesday.

New ‘Trojan Source’ Technique Allows Hackers to Conceal Vulnerabilities in Source Code

November 1, 2021

A groundbreaking class of vulnerabilities has emerged, enabling threat actors to inject misleading malware that technically adheres to coding logic while distorting its intended functionality. Known as “Trojan Source attacks,” this method exploits nuances in text-encoding standards like Unicode, allowing the arrangement of source code tokens to differ from their displayed order. This results in vulnerabilities that evade detection by human reviewers, according to researchers Nicholas Boucher and Ross Anderson from Cambridge University, who outlined the findings in a recent paper. These vulnerabilities, identified as CVE-2021-42574 and CVE-2021-42694, impact compilers across numerous widely-used programming languages, including C, C++, C#, JavaScript, Java, Rust, Go, and Python. Compilers are essential tools that convert high-level human-readable code into executable machine code.

New ‘Trojan Source’ Technique Enables Hackers to Conceal Vulnerabilities in Code On November 1, 2021, researchers at Cambridge University unveiled a concerning development in cybersecurity: a technique known as “Trojan Source attacks.” This novel class of vulnerabilities allows threat actors to incorporate visually misleading malware within source code, maintaining logical…

Read More

New ‘Trojan Source’ Technique Allows Hackers to Conceal Vulnerabilities in Source Code

November 1, 2021

A groundbreaking class of vulnerabilities has emerged, enabling threat actors to inject misleading malware that technically adheres to coding logic while distorting its intended functionality. Known as “Trojan Source attacks,” this method exploits nuances in text-encoding standards like Unicode, allowing the arrangement of source code tokens to differ from their displayed order. This results in vulnerabilities that evade detection by human reviewers, according to researchers Nicholas Boucher and Ross Anderson from Cambridge University, who outlined the findings in a recent paper. These vulnerabilities, identified as CVE-2021-42574 and CVE-2021-42694, impact compilers across numerous widely-used programming languages, including C, C++, C#, JavaScript, Java, Rust, Go, and Python. Compilers are essential tools that convert high-level human-readable code into executable machine code.

FBI Alerts: Anonymous Hackers Have Compromised US Government Networks for Nearly a Year

November 17, 2013

The FBI has issued a warning that members of the hacktivist group Anonymous have been covertly infiltrating US government computers and stealing sensitive information in a campaign that started nearly a year ago. The group has exploited vulnerabilities in Adobe software to breach targeted systems and install backdoors, allowing ongoing access to compromised computers, with activities dating back to last December, according to a Reuters report.

This hacking campaign has affected various government entities, including the U.S. Army, Department of Energy, and the Department of Health and Human Services. The FBI described the intrusion as “a widespread problem that warrants immediate attention” and has provided guidance to system administrators on identifying potential compromises in their networks. Investigators are currently assessing the extent of the breaches, with concerns that the hackers’ activities are ongoing.

FBI Alerts on Anonymous Hackers Compromising U.S. Government Systems for Nearly a Year November 17, 2013 The FBI has issued a significant alert regarding the hacktivist collective known as Anonymous, revealing that its members have clandestinely infiltrated U.S. government computer systems, leading to the theft of sensitive data over the…

Read More

FBI Alerts: Anonymous Hackers Have Compromised US Government Networks for Nearly a Year

November 17, 2013

The FBI has issued a warning that members of the hacktivist group Anonymous have been covertly infiltrating US government computers and stealing sensitive information in a campaign that started nearly a year ago. The group has exploited vulnerabilities in Adobe software to breach targeted systems and install backdoors, allowing ongoing access to compromised computers, with activities dating back to last December, according to a Reuters report.

This hacking campaign has affected various government entities, including the U.S. Army, Department of Energy, and the Department of Health and Human Services. The FBI described the intrusion as “a widespread problem that warrants immediate attention” and has provided guidance to system administrators on identifying potential compromises in their networks. Investigators are currently assessing the extent of the breaches, with concerns that the hackers’ activities are ongoing.