レッドエージェントの視点：航空会社のGraphQL APIにおけるオブジェクトレベルの認可の不備の悪用

パート2：Red Agentはいかにしてバックエンドリゾルバーをバイパスし、15分で航空会社全体の予約データベースを露出させたか...

EUVD-2026-28930

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6...

I Built a RAG Bot to Decode Airline Bureaucracy (So You Don't Have To)

...

EUVD-2009-0632

Malware in sbrugna...

EUVD-2015-2946

Malware in sbrugna...

EUVD-2009-4638

Malware in sbrugna...

EUVD-2024-48412

Malicious code in bioql PyPI...

EUVD-2024-31937

Malicious code in bioql PyPI...

EUVD-2024-48411

Malicious code in bioql PyPI...

EUVD-2024-48414

Malicious code in bioql PyPI...

EUVD-2024-48413

Malicious code in bioql PyPI...

EUVD-2024-48410

Malicious code in bioql PyPI...

MAL-2025-47702 Malicious code in openai-airline-agentsdk-demo-3w (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in openai-airline-agentsdk-demo-3w (npm)

--- -= Per source details. Do not edit below this line.=-...

A week in security (September 15 – September 21)

Last week on Malwarebytes Labs: ChatGPT Deep Research zero-click vulnerability fixed by OpenAI Disrupted phishing service was after Microsoft 365 credentials Update your Chrome today: Google patches 4 vulnerabilities including one zero-day Age verification and parental controls coming to ChatGPT ...

Baggage Tag Scam

I just heard about this: There's a travel scam warning going around the internet right now: You should keep your baggage tags on your bags until you get home, then shred them, because scammers are using luggage tags to file fraudulent claims for missing baggage with the airline. First, the scam i...

Spying on People Through Airportr Luggage Delivery Service

Airportr is a service that allows passengers to have their luggage picked up, checked, and delivered to their destinations. As you might expect, it's used by wealthy or important people. So if the company's website is insecure, you'd be able to spy on lots of wealthy or important people. And mayb...

UK Arrests Four in ‘Scattered Spider’ Ransom Group

Authorities in the United Kingdom this week arrested four people aged 17 to 20 in connection with recent data theft and extortion attacks against the retailers Marks & Spencer and Harrods , and the British food retailer Co-op Group. The breaches have been linked to a prolific but loosely-affiliat...

Behind the Booking: How Bots Are Undermining Airline Revenue

The airline industry is under constant attack from malicious bots. Bad actors use automation to scrape fares, hoard inventory, commit fraud, and compromise customer accounts. While every airline faces its own unique challenges, the business impacts are remarkably consistent—lost revenue, inflated...

Scattered Spider’s Strategic Hunt: Is Your Industry Next?

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Introduction In April 2025, a single phone call didn’t just ‘help crash’ Marks & Spencer’s...