Ticker feed

IBM disclosed a serious blind SQL injection vulnerability (CVE-2025-0165) in its Watsonx Orchestrate Cartridge for Cloud Pak Data, earning a 7.6 CVSS score. The flaw stems from improper input sanitization, allowing attackers with low-level access to inject malicious SQL commands through exposed API endpoints.

Attackers could potentially read confidential data, modify user permissions, delete critical information, or insert malicious entries into backend databases. The vulnerability affects versions 4.8.4-4.8.5 and 5.0.0-5.2.

IBM urges immediate upgrades to version 5.2.0.1, which includes strict input validation and parameterized queries. No workarounds exist, making prompt patching essential for protecting AI-driven workflows.

Source: Cyber Security News

AT&T will pay $177 million to settle lawsuits over two massive data breaches that exposed personal information of nearly 181 million customers. The 2019 breach affected 73 million people, exposing Social Security numbers and birth dates. The 2024 breach compromised phone records of 109 million customers through cloud provider Snowflake.

Customers affected by the 2019 breach can claim up to $5,000 with documented losses, while 2024 breach victims can receive up to $2,500. Those without proof of losses will receive smaller payments from the settlement pools. People hit by both breaches can file separate claims.

The deadline to file claims is November 18, 2025. Payments should begin early next year once the settlement receives final court approval.

Source: CNET

Critical infrastructure faced 420 million cyberattacks between January 2023-2024, a 30% jump equaling 13 attacks per second. Nation-state hackers like Iran's CyberAv3ngers are targeting water, oil, and gas systems with custom malware, while 60% of energy sector attacks link to state-sponsored groups.

Experts say industrial "crown jewels" now extend beyond physical machines to include digital twins, cloud platforms, data flows, and remote access gateways. The challenge? Many organizations only discover critical assets after breaches expose hidden dependencies.

As operational technology merges with IT systems, companies must continuously map assets and vulnerabilities rather than react to incidents. The stakes are clear: poor protection risks safety, uptime, and competitive advantage in an increasingly connected industrial landscape.

Source: Industrial Cyber

The Maryland Transit Administration rolled out emergency transportation Friday for mobility device users after a cyberattack knocked out its paratransit booking system earlier this week. Riders needing urgent medical appointments can now call Hart to Heart at 443-573-2037 for rides, while others can use the Call-A-Ride service at 410-664-2030.

The cyberattack disrupted MTA's ability to schedule new Mobility paratransit trips, though existing bookings remain intact. Regular transit services like buses, subway, and light rail continue running normally, but riders lost real-time arrival information and call center access. MTA hasn't identified who's behind the attack.

Source: CBS News Baltimore

Cybercriminals hijacked the popular Nx development tool on npm, infecting eight versions with malware that exploited AI coding assistants like Claude, Gemini, and Amazon Q. The attack, which lasted just over five hours on August 26, forced these AI tools to scan infected systems for GitHub tokens, SSH keys, cryptocurrency wallets, and other sensitive data.

The stolen information was automatically uploaded to public GitHub repositories under victims' own accounts using the naming pattern "s1ngularity-repository-" - eliminating the need for external servers. Thousands of developers were potentially exposed during the brief window.

A second wave followed, with attackers using stolen credentials to expose and duplicate private organizational repositories. This marks the first known case of malware weaponizing AI development tools for data theft.

Source: Infosecurity Magazine

Attackers compromised the popular Nx JavaScript build system on August 26, infecting over 1,000 developers and stealing 20,000 sensitive files in just four hours. The malware used AI tools like Claude Code and Gemini to hunt for GitHub tokens, SSH keys, and cryptocurrency wallets on victims' systems.

The attackers published malicious Nx packages at 10:32 PM UTC, then uploaded stolen data to public GitHub repositories with names like "singularity-repository-0" for easy collection. They also sabotaged victims' terminals to crash on startup, slowing incident response.

Despite quick takedown efforts, the damage was severe: over 1,000 valid GitHub tokens and dozens of cloud credentials were exposed. Shockingly, 90% of leaked GitHub tokens remain active, creating ongoing security risks for affected developers and their organizations.

Source: Dark Reading

Credit bureau TransUnion suffered a major data breach on July 28 that exposed sensitive information of 4.4 million customers. The breach compromised names, Social Security numbers, and birthdates through unauthorized access to a third-party application storing customer data.

State filings reveal conflicting details about what information was accessed, but the most serious filing from Texas confirms Social Security numbers were exposed. Since the breach occurred months ago, experts warn the stolen data may already be circulating on the dark web.

TransUnion is offering affected customers 24 months of free credit monitoring and notifying those impacted. Consumer rights firm Wolf Haldenstein advises people to watch for unusual credit report activity and consider freezing their credit.

Source: CNET

Cybercriminals executed a sophisticated supply chain attack called "s1ngularity" targeting the Nx JavaScript build system, which has over 4 million weekly downloads. On August 26, hackers exploited a workflow vulnerability to steal GitHub and NPM tokens, publishing eight malicious versions of Nx packages between 6:32-8:37 PM EDT.

The malware systematically harvested sensitive data from infected systems, including SSH keys, API tokens, and cryptocurrency wallet information. In a groundbreaking twist, attackers weaponized AI tools like Claude and Gemini to assist with reconnaissance and data theft—marking the first known case of AI being turned against developers in supply chain attacks.

Security firms discovered over 2,300 stolen secrets uploaded to more than 1,000 GitHub repositories. Half of these credentials remained valid when discovered, highlighting the urgent need for immediate revocation of compromised tokens.

Source: Security Week

A new phishing campaign called "ZipLine" is turning traditional tactics upside down by making victims initiate contact first. Attackers submit fake partnership inquiries through company contact forms, then spend weeks building trust through professional emails before striking with malicious zip files containing the "MixShell" implant.

The scammers use abandoned domains from 2015-2019 with legitimate business histories to bypass security filters. Their fake websites all use identical templates featuring the same stock photo of White House butlers as company founders.

Industrial manufacturers are prime targets, though the campaign spans biotech, pharma, and semiconductor companies. Check Point Software warns this sophisticated approach requires extensive preparation but exploits human trust through legitimate business channels.

Source: Dark Reading

A sophisticated ransomware attack hit Nevada's government systems Sunday, forcing all state offices to close and potentially compromising personal information. Gov. Joe Lombardo initially said no data was stolen, but officials revealed Wednesday that hackers may have accessed personal records during the breach.

The cyberattack immobilized essential services statewide. DMV offices remain closed, leaving residents unable to complete appointments. Law enforcement lost access to state records, and Nevada State Police dispatch lines went down temporarily, though 911 services stayed operational.

State officials are carefully rebuilding systems to ensure hackers are completely removed before reconnecting networks. The attack highlights growing threats to smaller government agencies nationwide.

Source: CBS News