The Breach News

Cyber Attackers Leverage Apache HTTP Server Vulnerability to Install Linuxsys Cryptocurrency Miner

July 17, 2025
Cryptocurrency / Security Threats

Recent findings by cybersecurity experts reveal a new campaign that targets a known vulnerability in the Apache HTTP Server to deploy a cryptocurrency miner named Linuxsys. This vulnerability, identified as CVE-2021-41773, carries a high severity rating (CVSS score: 7.5) and involves a path traversal issue in Apache HTTP Server version 2.4.49, which allows for remote code execution. According to Jacob Baines from VulnCheck, “Attackers exploit compromised legitimate websites to disseminate malware, facilitating hidden delivery and evasion of detection.” The infection process, traced back to an Indonesian IP address (103.193.177[.]152), aims to transfer a subsequent payload from “repositorylinux[.]org” using tools like curl or wget. This payload, a shell script, is tasked with downloading the Linuxsys cryptocurrency miner from five separate legitimate sites, indicating that the threat actors…

Hackers Target Apache HTTP Server Vulnerability to Deploy Linuxsys Cryptocurrency Miner On July 17, 2025, cybersecurity experts reported a dangerous campaign exploiting a vulnerability in the Apache HTTP Server, enabling attackers to deploy a cryptocurrency miner known as Linuxsys. This specific flaw, identified as CVE-2021-41773, carries a high severity rating…

Read More

Cyber Attackers Leverage Apache HTTP Server Vulnerability to Install Linuxsys Cryptocurrency Miner

July 17, 2025
Cryptocurrency / Security Threats

Recent findings by cybersecurity experts reveal a new campaign that targets a known vulnerability in the Apache HTTP Server to deploy a cryptocurrency miner named Linuxsys. This vulnerability, identified as CVE-2021-41773, carries a high severity rating (CVSS score: 7.5) and involves a path traversal issue in Apache HTTP Server version 2.4.49, which allows for remote code execution. According to Jacob Baines from VulnCheck, “Attackers exploit compromised legitimate websites to disseminate malware, facilitating hidden delivery and evasion of detection.” The infection process, traced back to an Indonesian IP address (103.193.177[.]152), aims to transfer a subsequent payload from “repositorylinux[.]org” using tools like curl or wget. This payload, a shell script, is tasked with downloading the Linuxsys cryptocurrency miner from five separate legitimate sites, indicating that the threat actors…

Understanding Deepfake Vishing Attacks: How They Operate and Why Detection is Challenging

In recent developments, instances of fraudulent calls utilizing artificial intelligence to replicate familiar voices have surfaced with alarming frequency. These scams often manipulate the voice of a grandchild, colleague, or executive to convey urgent messages, compelling victims to rapidly wire money, share sensitive information, or visit harmful websites. The deceptive…

Read MoreUnderstanding Deepfake Vishing Attacks: How They Operate and Why Detection is Challenging

Dialysis Company Breach Impacts 1 Million People, Incurred Costs of $13.5 Million So Far

Data Breach Notification, Data Security, Fraud Management & Cybercrime Interlock Claims to Possess 1.5TB of DaVita’s Data Amid Rising Costs Marianne Kolbasuk McGee (HealthInfoSec) • August 6, 2025 Image: DaVita Inc. DaVita Inc., a leading provider in kidney dialysis services globally, recently reported to regulators that a cyberattack occurring in…

Read MoreDialysis Company Breach Impacts 1 Million People, Incurred Costs of $13.5 Million So Far

Air France and KLM Confirm Theft of Customer Data in Third-Party Breach

Cybersecurity has suffered another blow as hackers have reportedly accessed personal information belonging to potentially hundreds of customers of KLM and Air France through a supply chain attack. This alarming breach was first unveiled in a report on KLM’s Dutch website, with a spokesperson from Air France-KLM confirming that the…

Read MoreAir France and KLM Confirm Theft of Customer Data in Third-Party Breach

Severe Flaw in NVIDIA Container Toolkit Enables Privilege Escalation in AI Cloud Services

On July 18, 2025, cybersecurity experts revealed a critical vulnerability in the NVIDIA Container Toolkit that threatens AI cloud services. Identified as CVE-2025-23266, this flaw has a CVSS score of 9.0 out of 10.0 and has been dubbed “NVIDIAScape” by Wiz, a cloud security firm owned by Google. According to NVIDIA’s advisory, the vulnerability arises from issues in the initialization hooks of the container, allowing attackers to execute arbitrary code with elevated permissions. Successful exploitation could lead to privilege escalation, data tampering, information leakage, and denial-of-service attacks. This vulnerability affects all versions of the NVIDIA Container Toolkit up to 1.17.7 and the NVIDIA GPU Operator up to 25.3.0, with patches included in versions 1.17.8 and 25.3.1.

Critical Vulnerability Discovered in NVIDIA Container Toolkit: A Major Threat to AI Cloud Services July 18, 2025 Cloud Security / AI Security Recent analysis by cybersecurity experts has uncovered a serious vulnerability within the NVIDIA Container Toolkit, a critical component for AI cloud services, that could allow for significant privilege…

Read More

Severe Flaw in NVIDIA Container Toolkit Enables Privilege Escalation in AI Cloud Services

On July 18, 2025, cybersecurity experts revealed a critical vulnerability in the NVIDIA Container Toolkit that threatens AI cloud services. Identified as CVE-2025-23266, this flaw has a CVSS score of 9.0 out of 10.0 and has been dubbed “NVIDIAScape” by Wiz, a cloud security firm owned by Google. According to NVIDIA’s advisory, the vulnerability arises from issues in the initialization hooks of the container, allowing attackers to execute arbitrary code with elevated permissions. Successful exploitation could lead to privilege escalation, data tampering, information leakage, and denial-of-service attacks. This vulnerability affects all versions of the NVIDIA Container Toolkit up to 1.17.7 and the NVIDIA GPU Operator up to 25.3.0, with patches included in versions 1.17.8 and 25.3.1.

Researchers Reveal Four-Month Cyberattack on U.S. Firm Tied to Chinese Hackers

Dec 05, 2024
Threat Intelligence / Cyber Espionage

A suspected Chinese threat actor infiltrated a prominent U.S. organization earlier this year in a four-month-long cyber assault. According to Broadcom-owned Symantec, the first signs of the breach were detected on April 11, 2024, and continued until August, with the possibility of earlier activity not being ruled out.

“The attackers moved laterally within the organization’s network, compromising multiple computers,” reported the Symantec Threat Hunter Team in a release to The Hacker News. “Some targeted machines were Exchange Servers, indicating that the attackers were likely gathering intelligence through email harvesting. Additionally, exfiltration tools were deployed, implying that sensitive data was extracted from the organization.”

The identity of the affected organization remains undisclosed, though it is significant in size and presence in China. The implications of these links to Chinese actors …

Researchers Uncover Prolonged Cyberattack on U.S. Organization Tied to Chinese Hackers December 5, 2024 In a significant development within the realm of cybersecurity, researchers have revealed that a large U.S. organization fell victim to a sophisticated cyber intrusion believed to be orchestrated by a Chinese threat actor. The incident, which…

Read More

Researchers Reveal Four-Month Cyberattack on U.S. Firm Tied to Chinese Hackers

Dec 05, 2024
Threat Intelligence / Cyber Espionage

A suspected Chinese threat actor infiltrated a prominent U.S. organization earlier this year in a four-month-long cyber assault. According to Broadcom-owned Symantec, the first signs of the breach were detected on April 11, 2024, and continued until August, with the possibility of earlier activity not being ruled out.

“The attackers moved laterally within the organization’s network, compromising multiple computers,” reported the Symantec Threat Hunter Team in a release to The Hacker News. “Some targeted machines were Exchange Servers, indicating that the attackers were likely gathering intelligence through email harvesting. Additionally, exfiltration tools were deployed, implying that sensitive data was extracted from the organization.”

The identity of the affected organization remains undisclosed, though it is significant in size and presence in China. The implications of these links to Chinese actors …

MCP Protocol Vulnerability Allows Attackers to Execute Code via Cursor

Artificial Intelligence & Machine Learning, Next-Generation Technologies & Secure Development Check Point Reports Critical Vulnerability in Cursor Patched Days After Discovery Rashmi Ramesh (rashmiramesh_) • August 6, 2025 A pertinent security vulnerability identified in the AI-driven coding environment known as Cursor has raised alarms within the cybersecurity community. Research from…

Read MoreMCP Protocol Vulnerability Allows Attackers to Execute Code via Cursor

India Sees Record Average Data Breach Cost at INR 220 Million in 2025, According to IBM Report

India Faces Unprecedented Data Breach Costs, Reveals IBM Report Bengaluru, India—August 7, 2025—IBM’s latest Cost of a Data Breach Report highlights a concerning trend for organizations in India, with the average cost of data breaches soaring to INR 220 million this year, reflecting a 13% increase from 2024. This surge…

Read MoreIndia Sees Record Average Data Breach Cost at INR 220 Million in 2025, According to IBM Report