The incident highlights how cybercriminals are increasingly targeting trusted SaaS providers and business integrations to gain access to downstream organizations.

How the Incident Occurred

LastPass became aware of the issue after Klue, a competitive intelligence platform that integrates with services such as Salesforce and Gong, disclosed a security incident affecting multiple customers. The implications of the LastPass Data Exposed are being closely monitored.

According to the investigation, attackers obtained OAuth tokens stored by Klue and used them to access connected customer environments. In the case of LastPass, the compromised tokens provided unauthorized access to certain information stored within its Salesforce environment.

Because OAuth tokens are designed to allow trusted applications to access systems without repeatedly requiring user credentials, they can become valuable targets for attackers when exposed or improperly secured.

Importantly, the attack did not require direct access to LastPass infrastructure. Instead, the attackers exploited the trust relationship established through third-party integrations.

What Data Was Accessed?

LastPass confirmed that the exposure was limited to systems connected to Klue and did not impact its core products or password management platform.

The accessed information included:

• Customer names
• Email addresses
• Phone numbers
• Physical addresses
• Customer support records
• Sales and business relationship information

The company stated that there is no evidence that encrypted password vaults, master passwords, authentication systems, or sensitive credentials were compromised during the incident.

Why This Attack Matters

While the exposed data is considered standard business information, security experts warn that such information can still be highly valuable to attackers.

Contact information and customer records can be used to:

• Launch targeted phishing campaigns
• Conduct social engineering attacks
• Impersonate trusted organizations
• Attempt credential theft
• Gather intelligence for future attacks

The incident also demonstrates a growing trend in which threat actors target third-party vendors rather than attacking organizations directly. By compromising a trusted service provider, attackers can potentially gain access to multiple connected environments through a single breach.

LastPass Response

Following discovery of the incident, LastPass implemented several containment and remediation measures to reduce risk and prevent further unauthorized access.

Actions taken included:

• Revoking and rotating affected OAuth tokens
• Disabling employee access to Klue
• Launching an investigation with Klue and Salesforce
• Notifying law enforcement agencies
• Sharing threat intelligence with the security community

The company continues to monitor the situation and investigate any potential downstream impact.

Security Recommendations for Organizations

The incident serves as a reminder that securing third-party integrations is just as important as protecting internal systems.

Organizations should consider:

• Regularly reviewing third-party SaaS integrations
• Rotating OAuth tokens and API credentials
• Applying least-privilege access controls
• Monitoring API activity for unusual behavior
• Reviewing vendor security practices
• Implementing continuous detection and monitoring capabilities

As businesses become increasingly dependent on interconnected cloud services, attackers are expected to continue targeting trusted integrations and SaaS providers. Strengthening visibility into third-party access and enforcing strict token management practices can help reduce the risk of similar supply chain incidents.

The LastPass-Klue breach demonstrates that even when core systems remain secure, weaknesses in connected services can still expose valuable business data and create opportunities for future attacks.

IoC:

The post LastPass Impacted by Klue OAuth Token Breach appeared first on First Hackers News.

The vulnerability carries a maximum severity rating and impacts organizations running vulnerable versions of the LiteSpeed User-End cPanel Plugin. Because cPanel is widely used across hosting environments, a successful attack could affect multiple websites, customer accounts, databases, and server resources hosted on the same infrastructure.

Vulnerability Details

CVE Information

The vulnerability stems from an incorrect privilege assignment issue within the plugin, enabling authenticated cPanel users or compromised accounts to execute scripts with elevated privileges.

Technical Analysis of the Exploit

Researchers found that attackers can abuse the plugin’s lsws.redisAble functionality to execute arbitrary commands as the root user. In a shared hosting environment, this effectively breaks the isolation between users and grants attackers complete control over the server.

Because many hosting providers rely on LiteSpeed and cPanel for website management, exploitation could allow attackers to:

• Execute arbitrary scripts
• Modify server configurations
• Access customer data
• Create backdoors Deploy malware
• Pivot to other hosted accounts

Unlike many privilege escalation flaws that require complex attack chains, this vulnerability can be abused by any authenticated cPanel user account, including accounts already compromised through phishing, credential theft, or web application attacks.

Potential Attack Chain

• Initial Access
• Vulnerability Exploitation
• Root Access
• Post-Exploitation Activities

Indicator of Compromise (IOC) Detection

LiteSpeed provided a log analysis command that administrators can use to identify potential exploitation attempts.

Detection Command

grep -rE 'cpanel_jsonapi_func=(generateEcCert|packageUserSize)|cert_action_entry .*geneccert' /usr/local/cpanel/logs/ /var/cpanel/logs/ 2>/dev/null

What This Command Does

The command searches:

• /usr/local/cpanel/logs/
• /var/cpanel/logs/

for suspicious API requests and activity patterns associated with exploitation attempts.

If the command returns no results, there may be no evidence of exploitation within the available logs.

Why This Vulnerability Matters

Shared hosting environments depend heavily on privilege separation between users. Once an attacker obtains root access, they can potentially compromise every website and account hosted on the affected server.

The widespread adoption of LiteSpeed across hosting providers significantly increases the potential impact of this vulnerability. A single successful exploitation could expose customer data, website files, SSL certificates, configuration settings, and administrative credentials.

Security Recommendations

Update Immediately

Upgrade to:

• LiteSpeed cPanel Plugin 2.4.7 or later
• LiteSpeed WHM Plugin 5.3.1.0 or later

Review Logs

Run the IOC detection command and investigate any suspicious results.

Audit User Accounts

• cPanel users
• Administrative accounts
• Recently created users
• Failed login attempts

Restrict Access

• Multi-Factor Authentication (MFA)
• IP restrictions
• Least privilege access controls

The active exploitation of CVE-2026-48172 highlights the risks posed by privilege escalation vulnerabilities in widely deployed hosting software. Since the flaw can allow attackers to obtain root-level access from a standard cPanel account, organizations and hosting providers should prioritize patching, review logs for indicators of compromise, and continuously monitor their environments for signs of malicious activity.

The post Critical LiteSpeed cPanel Plugin Vulnerability Enables Root Privilege Escalation Attacks appeared first on First Hackers News.

The issue is significant because BitLocker is widely used by enterprises and government organizations to protect sensitive data. If exploited successfully, attackers could gain access to encrypted information without requiring the BitLocker recovery key, reducing the effectiveness of one of Windows’ most important security controls.

How It Works

The GreatXML exploit reportedly abuses the way Windows Recovery Environment processes configuration files during recovery operations. Researchers observed that specially crafted XML files, including an unattend.xml file and modified recovery configuration files, can be placed within the recovery partition.

When the affected system enters Recovery Mode, these files are processed automatically. Instead of loading the expected recovery interface, the manipulated configuration may trigger a command shell running with elevated SYSTEM privileges, granting access to the unlocked BitLocker-protected volume. The exploit appears to leverage trusted recovery mechanisms rather than traditional memory corruption or kernel vulnerabilities.

The Attack Chain Can Involve

1. Initial Device Access

• Physical access to a workstation or laptop.
• Administrative access obtained through another compromise.

2. Recovery Partition Modification

• Placement of malicious XML files within the recovery partition.
• Modification of recovery configuration settings.

3. Privilege Escalation

• Launch of a SYSTEM-level command shell.
• Access to BitLocker-protected storage.

4. Data Access and Collection

• Viewing sensitive files.
• Extraction of credentials and corporate information.
• Offline forensic evasion activities.

Multiple Other Methods Threat Actors May Use

Although GreatXML focuses on recovery partition XML files, attackers frequently target BitLocker through additional techniques, including:

• indows Recovery Environment abuse
• Boot Manager manipulation
• Privilege escalation vulnerabilities
• Offline disk analysis after system theft

Modern attackers often combine multiple vulnerabilities to increase the likelihood of success and evade detection.

Why Legacy Components Remain a Risk

Many organizations focus heavily on operating system patching and endpoint detection while overlooking legacy recovery components and boot infrastructure. Recovery partitions, WinRE configurations, deployment scripts, unattended setup files, and offline maintenance tools often receive less monitoring than standard system files.

Attackers increasingly target these trusted components because they operate outside traditional security controls. Since recovery environments are designed to help administrators regain access to systems, they frequently possess elevated privileges and trusted execution paths. When abused, these features can become powerful attack vectors.

Security Experts Recommend That Organizations

To reduce exposure to GreatXML and similar recovery-environment attacks, security teams should:

Harden BitLocker Deployments

• Enable TPM + PIN authentication.
• Enforce strong recovery key management.
• Monitor BitLocker policy compliance.

Secure Recovery Environments

• Restrict unauthorized access to WinRE.
• Monitor changes to recovery partitions.
• Audit recovery-related files and configurations.

Maintain Patch Management

• Apply Microsoft security updates promptly.
• Track new advisories related to BitLocker, WinRE, and Defender Offline Scan.
• Review recovery partition configurations after major updates.

The GreatXML vulnerability serves as a reminder that encryption alone does not guarantee complete protection. Recovery environments, boot processes, and trusted system components can become attractive targets for attackers seeking to bypass traditional security controls. Organizations should adopt a layered security strategy that includes BitLocker hardening, recovery environment monitoring, physical security controls, and continuous threat detection to reduce the risk of compromise.

The post Critical GreatXML Vulnerability Enables Windows BitLocker Bypass via Recovery Partition XML Files appeared first on First Hackers News.

Source code environments are considered high-value targets because they reveal the inner workings of security products. Even limited access can give attackers insights into detection logic, configurations, or potential weaknesses that could be studied for future exploitation or used in supply chain-style attacks.

Investigation Findings and Potential Risks

Trellix has stated that the breach appears contained and, at this stage, there is no evidence of direct impact on customers or product integrity.

Key findings so far include:

• No compromise of the build, release, or update pipeline
• No signs of malicious code being inserted into products
• No evidence of active exploitation using the accessed data

However, the nature of source code exposure still raises concerns. Attackers could analyze the code offline to identify vulnerabilities, reverse-engineer protections, or develop evasion techniques against Trellix security tools.

The company is continuing a detailed forensic review to understand how the access occurred, what data was viewed or copied, and whether any long-term risks remain. Strengthening internal controls, access monitoring, and repository protections is likely part of the ongoing response.

This incident reflects a broader trend where attackers target software vendors instead of end users, aiming to gain leverage through trusted platforms. Similar breaches involving Microsoft, Okta, and LastPass show how valuable internal systems have become as entry points.

Trellix has committed to transparency and plans to release more technical details once the investigation is complete, helping the wider security community understand and defend against similar threats.

The post Trellix Confirms Source Code Repository Breach appeared first on First Hackers News.

Although the number of affected individuals is small compared to Starbucks’ global workforce, the type of information involved makes the incident serious. Exposure of employment and financial records could increase the risk of identity theft for those impacted.

Attack Timeline and Investigation

According to a breach notification filed with the Office of the Maine Attorney General on March 10, 2026, the incident involved accounts connected to the Starbucks Partner Central system. This platform allows employees to access payroll details, benefits information, and other work-related records.

Investigations showed that attackers first gained access on January 19, 2026. Suspicious activity was detected on February 6, and the company fully removed the attackers from its systems by February 11.

Security experts later determined that the attackers used credential harvesting techniques. Employees were directed to fake websites that closely resembled the official Starbucks Partner Central login page. When users entered their credentials on these phishing pages, the attackers captured the login information and used it to access employee accounts.

Because these accounts contained payroll and employment records, the attackers were able to view several types of sensitive personal data, including

• Full names and dates of birth
• Social Security numbers
• Bank account and routing numbers linked to direct deposits

‍Follow Us on:Linkedin, Instagram, Facebook to get the latest security news!

After discovering the breach, Starbucks immediately blocked unauthorized access, notified law enforcement authorities, and strengthened security measures for the employee portal.

The company is also offering 24 months of identity theft protection and credit monitoring services through Experian to help protect the affected individuals.

This incident follows previous cybersecurity challenges faced by the company. In November 2024, Starbucks experienced operational disruptions after a ransomware attack targeted Blue Yonder, a third-party provider used for supply chain and scheduling systems.

Earlier in September 2022, Starbucks’ Singapore operations experienced a major breach that exposed the personal information of more than 219,000 customers after a vendor’s system was compromised.

The latest incident highlights how phishing attacks and stolen credentials continue to be a common method used by cybercriminals to gain access to corporate system

The post Starbucks Data Breach Exposes User Information appeared first on First Hackers News.

PayPal has notified a small group of customers about a cybersecurity incident that exposed personal data for almost six months. The issue was traced to a software error in its PayPal Working Capital (PPWC) loan application system, which provides funding to small businesses based on their PayPal sales history.

The exposure occurred between July 1, 2025, and December 13, 2025. PayPal detected the issue on December 12 and reversed the faulty code the following day.

The affected data included:

• Name
• Email address
• Phone number
• Business address
• Social Security number (SSN)
• Date of birth

Because SSNs and birth dates were involved, the risk of identity theft and fraud is significantly higher. PayPal stated that the notification was not delayed due to any law enforcement investigation.

Company Response and Customer Guidance

After discovering the issue, PayPal removed unauthorized access, fixed the code error, and strengthened internal security controls. Passwords for affected accounts were reset, and customers will be prompted to create new ones if they have not already done so. Refunds were issued to the few users who reported unauthorized transactions.

The company is offering two years of free three-bureau credit monitoring and identity restoration services through Equifax. Affected customers must enroll by June 30, 2026.

PayPal advises impacted users to review account activity and credit reports carefully, enroll in the credit monitoring service, and stay alert for phishing attempts. The company reminds customers it will never request passwords, one-time codes, or authentication details via email, phone, or text. Using strong, unique passwords and enabling multi-factor authentication are strongly recommended.

Although PayPal described the number of affected customers as small, prolonged exposure of Social Security numbers and dates of birth presents serious identity fraud risks. The company has not released further public details beyond direct notifications to affected users.

‍Follow Us on: Linkedin, Instagram, Facebook to get the latest security news!

The post PayPal Data Exposure: Six Months of User Information Leaked Online appeared first on First Hackers News.

Cisco’s security response team has confirmed real-world attacks and advises customers to take immediate action.

How the Attack Works

The issue originates in the web-based management interface, where HTTP request input is not properly validated.

Attackers can exploit this weakness by:

• Sending crafted HTTP requests to the management endpoint
• Bypassing authentication controls
• Executing commands on the operating system
• Escalating privileges to full root access

Because the flaw allows complete system takeover, Cisco classified it as Critical, prioritizing impact over traditional scoring metrics.

Impacted Cisco Products

Cisco confirmed the following products are affected, independent of configuration:

Other Cisco UC components, including Contact Center-related platforms, are confirmed not vulnerable.

Software Updates and Fix Availability

Cisco has released fixes for supported versions. Only the releases listed below are validated by Cisco PSIRT.

Unified CM, IM&P, SME, Webex Calling

Unity Connection

Cisco has observed attackers targeting unpatched deployments, likely using automated discovery techniques to locate exposed management interfaces. Environments supporting enterprise voice and collaboration services are particularly attractive targets.

The vulnerability has also been added to CISA’s Known Exploited Vulnerabilities catalog, increasing compliance pressure for affected organizations.

What Cisco Recommends

Organizations should take the following steps immediately:

• Apply Cisco security updates or upgrade to fixed releases
• Restrict access to management interfaces using network controls
• Monitor HTTP activity for abnormal request patterns
• Investigate systems for indicators of compromise

The post Cisco Unified Communications Zero-Day RCE Enables Root Access appeared first on First Hackers News.

The campaign, active since late November 2025 and disclosed on December 10, lets attackers run system-level commands and install a persistent Python backdoor called AquaShell.

Cisco Talos links the activity to UAT-9686, a China-nexus APT with overlaps to groups like APT41 and UNC5174. AquaShell uses stealthy persistence methods commonly seen in advanced Chinese threat groups.

The attackers compromise appliances with non-standard configurations. They insert AquaShell into index.py, where it quietly waits for unauthenticated POST requests, decodes the payload, and executes shell commands.

After gaining access, the threat actors deploy extra tools:
• AquaTunnel – a Go-based reverse SSH tunnel
• Chisel – for tunneling TCP/UDP traffic
• AquaPurge – a log-cleaning script to hide activity

The Secure Email & Web Manager, which oversees email filtering and policies, makes this a high-impact target.

Cisco urges customers to check the advisory for IOCs and apply remediation immediately.

The post 𝗖𝗶𝘀𝗰𝗼 𝗔𝘀𝘆𝗻𝗰𝗢𝗦 𝟬-𝗗𝗮𝘆 𝗨𝗻𝗱𝗲𝗿 𝗔𝗰𝘁𝗶𝘃𝗲 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗮𝘁𝗶𝗼𝗻 appeared first on First Hackers News.

• SSRF (Server-Side Request Forgery) to coerce backend servers into making arbitrary requests.
• CRLF injection to insert custom headers into requests.
• Request smuggling to access internal endpoints and upload malicious templates.

This attack abuses the ability of JSP files to load untrusted stylesheets, allowing arbitrary code execution. Persistent HTTP connections are used to chain multiple requests, increasing reliability and reducing detection.

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-61882 to its Known Exploited Vulnerabilities (KEV) catalog. The agency has warned that the vulnerability has already been used in ransomware campaigns. All federal agencies have been ordered to apply security patches by October 27, 2025.

Security experts have raised alarms that mass exploitation is expected within days. Cl0p has already targeted multiple organizations since August, stealing sensitive data and issuing extortion emails.

Organizations using Oracle EBS are being strongly advised to patch immediately, conduct threat hunts, and strengthen access controls. Delays in remediation could lead to significant data breaches, financial loss, and operational disruption.

SEO Keywords included: Oracle E-Business Suite, CVE-2025-61882, Cl0p ransomware, remote code execution, SSRF, CRLF injection, WatchTowr Labs, CrowdStrike, CISA KEV, cybersecurity vulnerability, patch advisory.

The post Critical Oracle EBS Vulnerability CVE-2025-61882 Actively Exploited by Cl0p Ransomware Group appeared first on First Hackers News.

Arctic Wolf observed multiple incidents where SonicWall Secure Mobile Access (SMA) appliances were accessed despite OTP-based MFA being active. In each case, multiple OTP challenges were issued, but attackers still authenticated successfully, suggesting they had access to the correct OTP codes.

Background: Zero-Day Vulnerability and CVE-2024-40766

These incidents follow a wave of Akira ransomware attacks earlier this year that exploited an unknown vulnerability in SonicWall’s SMA VPN appliances. At the time, the method of initial access was unclear. However, SonicWall later confirmed the attackers were exploiting a zero-day vulnerability, now tracked as CVE-2024-40766, involving improper access control in the web management interface.

A patch was released in August 2024, and SonicWall urged customers to upgrade to the latest versions of SonicOS 7.1.1-7040 / 7.0.1-5146 and SMA 100 firmware to mitigate the issue. They also advised administrators to reset all user credentials for impacted VPN portals, particularly those not integrated with Active Directory.

However, Arctic Wolf’s new findings indicate that the threat actors may have already harvested OTP seed data during prior compromises—making even patched devices vulnerable if credentials were not rotated.

OTP MFA Bypass: What Researchers Observed

According to Arctic Wolf’s investigation:

• In multiple breach incidents, VPN user logins occurred with OTP MFA enabled.
• Multiple OTP prompts were issued, yet the login was ultimately successful.
• This behavior suggests that the attackers possessed valid OTP secrets or were able to generate valid tokens at will.
• The exploitation was not due to a new vulnerability, but likely stemmed from previously compromised credentials and OTP seeds.

This theory is supported by a June 2024 report from Google’s Threat Analysis Group (TAG) and Mandiant, which detailed how another threat group, UNC6148, used stolen OTP seeds to bypass MFA on SonicWall SMA 100 series devices—even when those systems were fully patched.

Post-Breach Activity: Fast and Aggressive Lateral Movement

Once initial access was achieved, Akira operators wasted no time escalating privileges and moving laterally within victim networks. Arctic Wolf reports that:

• Internal network scanning typically began within 5 minutes of VPN login.
• Attackers used tools like Impacket, RDP, and Active Directory enumeration utilities including:

• dsquery
• SharpShares
• BloodHound

• A high-priority target was the Veeam Backup & Replication server, a critical system used for managing backup infrastructure.The threat actors deployed custom PowerShell scripts to:
• Extract and decrypt credentials from Veeam, MSSQL, and PostgreSQL databases.
• Retrieve Data Protection API (DPAPI) secrets to further compromise systems.

The post Akira Ransomware Now Breaches MFA‑Protected SonicWall VPNs, Researchers Warn appeared first on First Hackers News.