Malware in @harvest-finance/harvest-strategy-polygon

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

New BPFDoor Controller Enables Stealthy Lateral Movement in Linux Server Attacks

Cybersecurity researchers have unearthed a new controller component associated with a known backdoor called BPFDoor as part of cyber attacks targeting telecommunications, finance, and retail sectors in South Korea, Hong Kong, Myanmar, Malaysia, and Egypt in 2024. "The controller could open a...

BPFDoor’s Hidden Controller Used Against Asia, Middle East Targets

A controller linked to BPF backdoor can open a reverse shell, enabling deeper infiltration into compromised networks. Recent attacks have been observed targeting the telecommunications, finance, and retail sectors across South Korea, Hong Kong, Myanmar, Malaysia, and Egypt...

Russia’s Storm-2372 Hits Orgs with MFA Bypass via Device Code Phishing

Russian APT group Storm-2372 employs device code phishing to bypass Multi-Factor Authentication MFA. Targets include government, technology, finance,…...

MAL-2025-2958 Malicious code in eth-defi (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Bitcoin and Cybersecurity: Protecting Digital Assets in a Decentralized World

One of the many advancements in the financial system is the adoption of Bitcoin, which has shifted the…...

CVE-2025-25326

An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link...

CVE-2025-25326

An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link...

CVE-2025-25326: Improper Neutralization of Encoded URI Schemes in a Web Page

An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link...

CVE-2025-25326

An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link...

CVE-2025-25326

An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link...

CVE-2025-25326

A security vulnerability exists in Merchants Union Finance (specifically the iOS version 6.19.0 ) due to the improper neutralization of encoded URI schemes in a web page. Attackers can exploit this by supplying a crafted link to access sensitive user information . Remediation involves updating th...

MUCFC Merchants Union Finance 安全漏洞

MUCFC Merchants Union Finance MUCFC is a credit loan installment borrowing platform from China Merchants Union MUCFC Corporation. A security vulnerability exists in MUCFC Merchants Union Finance iOS version 6.19.0, which originates from a specially crafted link that can access sensitive user...

PT-2025-8967

Name of the Vulnerable Software and Affected Versions Merchants Union Finance version 6.19.0 Description An issue in Merchants Union Finance allows attackers to access sensitive user information via supplying a crafted link. Recommendations For version 6.19.0, update to a newer version that...

RansomHub Becomes 2024's Top Ransomware Group, Hitting 600+ Organizations Globally

The threat actors behind the RansomHub ransomware-as-a-service RaaS scheme have been observed leveraging now-patched security flaws in Microsoft Active Directory and the Netlogon protocol to escalate privileges and gain unauthorized access to a victim network's domain controller as part of their...

Canadian Charged in $65M KyberSwap, Indexed Finance DeFi Hack

Canadian man charged in $65 million DeFi hack. Exploited KyberSwap, Indexed Finance smart contracts, laundered funds, and attempted extortion. Faces 20 years...

CVE-2024-21074

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite component: Finance LOV. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management...

WordPress WP Finance plugin <= 1.3.6 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin WP Finance versions = 1.3.6...

WordPress WP Finance plugin <= 1.3.6 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin WP Finance versions = 1.3.6...

CVE-2024-13096

The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...