Fake Battlefield 6 Downloads Are Spreading Malware, Stealing Player Data

Bitdefender Labs found fake Battlefield 6 pirated copies and trainers spreading aggressive malware, C2 agents, and infostealers, designed to steal player data and crypto-wallets...

PT-2025-48114

Name of the Vulnerable Software and Affected Versions DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 Description The software is susceptible to a SQL injection issue through the status sql.php endpoint. The endpoint...

Everest ransomware claims breach at Spain’s national airline Iberia with 596 GB data theft

Everest claims large breaches at Iberia and Air Miles España with major data taken from both travel platforms placing millions of users at risk...

MAL-2025-191347 Malicious code in @voiceflow/exception (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eb8d68b66e59da1a4b42db0ac46ad31c940a051f6d6da86d55cd0ad7ac3f33b The package @voiceflow/exception was found to contain malicious code. Source: ghsa-malware...

WordPress plugin ProjectList SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. The WordPress ProjectList plugin suffers from a SQL injection vulnerability that stems from insufficient cleaning and escaping of parameter ids, which can be exploited by a...

MAL-2025-190959 Malicious code in enforce-branch-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63b39bd3b9b616432b7d29c60d2da9d425b52f8823742287d8f6c4203319383a The package enforce-branch-name was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190949 Malicious code in colors-regex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84ccf2bd5bd452f49978832d66685075c10f116c9cc007d7d8c31a2e001b3efe The package colors-regex was found to contain malicious code. Source: ghsa-malware 79632b803684fda175b5701ef644e5ef4e7791334d60bf8e8635cdb0f0d01164 A...

MAL-2025-191008 Malicious code in sa-company-registration-number-regex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f15485422c9807206afeb3c43ed1e03d2f2499b0c689d8bf253e663cf72d7fa7 The package sa-company-registration-number-regex was found to contain malicious code. Source: ghsa-malware...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

The hidden costs of illegal streaming and modded Amazon Fire TV Sticks

Ahead of the holiday season, people who have bought cheap Amazon Fire TV Sticks or similar devices online should be aware that some of them could let cybercriminals access personal data, bank accounts, and even steal money. BeStreamWise, a UK initiative established to counter illegal streaming,...

To buy or not to buy: How cybercriminals capitalize on Black Friday

The global e‑commerce market is accelerating faster than ever before, driven by expanding online retail, and rising consumer adoption worldwide. According to McKinsey Global Institute, global e‑commerce is projected to grow by 7–9% annually through 2040. At Kaspersky, we track how this surge in...

New RadzaRat Spyware Poses as File Manager to Hijack Android Devices

Certo Software found RadzaRat, an Android RAT disguised as a file manager that has a 0/66 detection rate on VirusTotal. It keylogs passwords and steals files...

A week in security (November 17 – November 23)

Last week on Malwarebytes Labs: AI teddy bear for kids responds with sexual content and advice about weapons Fake calendar invites are spreading. Here’s how to remove them and prevent more Budget Samsung phones shipped with unremovable spyware, say researchers What the Flock is happening with...

Code-Projects Library System SQL注入漏洞

Library System is a library system. The Library System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter ID of the file /mail.php. An attacker can exploit this vulnerability to execute illegal SQL commands to stea...

Code-Projects Blog Site SQL注入漏洞

Blog Site is a blogging system. Blog Site suffers from an SQL injection vulnerability that originates from the lack of validation of the name/field parameter in the file /resources/functions/blog.php for externally typed SQL statements. An attacker can exploit this vulnerability to execute illega...

Code-Projects Library System SQL注入漏洞

Library System is a library system. Library System suffers from an SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter Username in the file /index.php. The vulnerability can be exploited by an attacker to execute illegal SQL...

WordPress Community Events plugin SQL Injection Vulnerability

WordPress Community Events plugin is an event management plugin on the WordPress platform , mainly used to create and display the event calendar , support for AJAX dynamic loading and event submission form features . WordPress Community Events plugin suffers from a SQL injection vulnerability tha...

Everest Ransomware Says It Breached Brazilian Energy Giant Petrobras

Everest ransomware claims to have stolen over 180GB of seismic survey data from Petrobras, demanding contact through qTox with a countdown in place...

Courier Management System search-edit.php File SQL Injection Vulnerability

Courier Management System is a courier management system. Courier Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter Consignment in the file /search-edit.php. An attacker can exploit this...

Small CRM change-password.php File SQL Injection Vulnerability

Small CRM a customer relationship management system. Small CRM suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the oldpass parameter of change-password.php. This vulnerability can be exploited by an attacker to execute...