SANS ISC reports that ESAFENET “CDG” systems have been observed in internet scans, with multiple basic security issues including SQL injection, XSS, and default-password risk. The pattern suggests defenders should treat perimeter access to document-management appliances as high-risk until exposed endpoints are hardened and credentials are rotated. If your org uses ESAFENET CDG (or similar appliances), prioritize authentication hardening, patching, and input validation coverage for web-facing components.
Source: SANS ISC
Java Spring Boot “/actuator/heapdump” scanners highlight secret exposure risk
Researchers warn that automated scanning is targeting Spring Boot’s debug endpoint at /actuator/heapdump. When reachable, the endpoint can expose a binary heap dump containing application secrets such as API keys and database credentials. Organizations should verify actuator endpoints are disabled or locked down (IP allowlists, strong auth, network controls) and ensure sensitive data is not present in heap dumps in production configurations.
Source: SANS ISC
GitHub introduces a “cooldown” to slow poisoned dependency PRs after releases
Security reporting indicates GitHub’s Dependabot will wait at least three days after a new package release before opening update pull requests, reducing the chance that compromised releases are rapidly adopted. The change directly targets “release-time” supply-chain attacks where malicious maintainers or stolen credentials publish poisoned packages. Dev teams should review their dependency update workflows, confirm cooldown settings, and continue using provenance controls (lockfiles, SBOMs, and dependency scanning) rather than relying on automation alone.
Source: The Hacker News
Hackers hijack hotel Wi‑Fi gateways to steal Microsoft 365 credentials
ReliaQuest documents activity where attackers compromise hotel/conference Wi‑Fi gateways and redirect visitors to fake Microsoft 365 login pages—credential theft without sending phishing emails or malicious attachments. This elevates the importance of “trust boundaries” in travel settings, where users often assume network safety. Defenders and users should encourage phishing-resistant MFA (e.g., FIDO2), strong browser protections, and alerting for suspicious sign-in patterns that may not originate from expected geolocations or device baselines.
Source: Security Affairs
Anthropic’s Opus 5 advances code-and-bug workflows but limits exploit generation
SecurityWeek notes that Opus 5 approaches Mythos-class progress for bug finding, while still blocking binary-based vulnerability scanning, penetration testing, and exploit generation. For practitioners, this means AI assistance may increase faster than automated exploitability—but also that attackers will adapt around tool limits. Organizations should treat AI-enabled vulnerability discovery as a defensive opportunity while maintaining rigorous patch management, threat modeling, and validation of exposed attack surfaces.
Source: Security Week
Ransomware pressure on healthcare and critical services continues with large data-theft claims
Separate reporting highlights major medical-business management and dental-coverage breaches where attackers claimed stolen data volumes large enough to affect millions. These cases reinforce the prevailing double-extortion model: data theft for leverage, followed by publication threats to maximize pressure. Security teams should validate backup integrity and offline recovery readiness, strengthen access controls to patient/PII repositories, and ensure monitoring can detect both initial intrusion activity and lateral movement toward data stores.
Source: Security Week
You May Also Be Interested In... TELESHIM uses Telegram for C2 in attacks against Middle East governments
Nono: open-source sandbox for AI agents to reduce credential reach
Microsoft introduces TPM attestation requirements for KMS hosts to curb piracy tools