Dec 4, 2024
1 new incident, 3 with updates.
Started
- ClosedPatched
Ultralytics PyPI releases backdoored with a crypto miner
Attackers compromised the Ultralytics YOLO project's GitHub Actions workflows (by poisoning the Actions cache) and published ultralytics 8.3.41 and 8.3.42 to PyPI with an XMRig cryptominer. They later pushed 8.3.45 and 8.3.46 using a leftover PyPI API token. All four versions were removed. PyPI's analysis credits Trusted Publishing attestations with making the attack auditable.
ultralytics (PyPI)Closed Dec 11, 2024
Updated
- ClosedPatched
@solana/web3.js npm package backdoored to steal private keys
A publish-access account for @solana/web3.js was compromised. Malicious versions 1.95.6 and 1.95.7, live on npm from 15:20 to 20:25 UTC on 2024-12-03, exfiltrated private key material from apps and bots that handle keys directly. Non-custodial wallets were generally not affected. Fixed in 1.95.8.
@solana/web3.js (npm)Closed Dec 4, 2024
- ClosedCriticalNo fix needed
Salt Typhoon: Chinese state hackers inside US telecom networks
PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.
US telecommunications carriersClosed Dec 4, 2024
- ClosedPatched
CyberPersons CyberPanel: 2 actively exploited vulnerabilities
CVE-2024-51567: CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root. CVE-2024-51378: CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property. Added to the CISA KEV catalog on 2024-11-07, 2024-12-04. CISA lists known use in ransomware campaigns.
CyberPersons CyberPanelClosed Dec 4, 2024
