We’re Tracking the Future of Security

Category: News

Current, event-driven reporting, announcements and industry developments.

  • Mathspace Data Breach Exposes Over 1 Million Students, Teachers and Parents

    Mathspace Data Breach Exposes Over 1 Million Students, Teachers and Parents

    Online mathematics platform Mathspace has disclosed a data breach affecting more than 1 million students, teachers, staff and parents or guardians, after hackers exploited a known vulnerability the company was slow to patch.

    A Known Flaw, Patched Too Late

    Mathspace says the breach traces back to its self-hosted Metabase analytics instance, which was compromised using CVE-2026-72898, a maximum-severity SQL injection vulnerability that Metabase had already patched on Aug. 6 after it was exploited in the wild as a zero-day. The extortion group ShinyHunters claimed responsibility for hacking Metabase shortly after that patch was released.

    According to Mathspace’s incident notice, unauthorized access began on Aug. 10, and data was downloaded from its Australian reporting database on Aug. 27. The company did not escalate Metabase’s critical advisory internally and did not upgrade its instance until Aug. 29, more than two weeks after the patch became available, and it also failed to complete the compromise checks Metabase had recommended, which meant the intrusion went undetected when the update was finally applied.

    What Was Exposed

    The breach affects 1,079,819 students, teachers, staff and parents or guardians in Australia and New Zealand. Exposed data includes names, user IDs, usernames, email addresses, email verification status, time zone, country, date joined, and last login and account-active dates. Mathspace says no academic records, learning activity, assessment results, password hashes, authentication tokens or API credentials were exposed, and the leaked data does not link user accounts to specific schools.

    Response and Warning to Users

    Mathspace has taken the affected Metabase instance offline, revoked API keys, disabled the associated database accounts, reset passwords and exported logs for investigation. The company says it is reviewing why the original security advisory was not escalated and why recommended compromise checks were skipped, and is changing its internal processes as a result. Mathspace has reported the incident to Australian authorities and began notifying affected individuals over the weekend, warning that the stolen contact information could be used to craft convincing phishing messages referencing accurate details of the incident.

  • 153 Million Driver’s License Scans Offered on Dark Web, Likely Tied to IDScan.net

    153 Million Driver’s License Scans Offered on Dark Web, Likely Tied to IDScan.net

    A threat actor began offering digital scans of more than 153 million U.S. and Canadian driver’s licenses on the dark web this week, in what investigative journalist Brian Krebs has linked to a likely breach at identity-verification firm IDScan.net.

    A Large, Verified Identity Document Cache

    The documents surfaced on an identity-theft service called Nexus, while a threat actor simultaneously promoted the same data on a Russian-language cybercrime forum, claiming to hold identification documents for more than 170 million individuals. According to Krebs, a blank search on Nexus returned approximately 153 million driver’s license results, of which only around 1.1 million were Canadian, alongside more than 10 million identification cards, over 3 million travel documents and international IDs, and roughly 580,000 medical cards.

    Krebs reported that after confirming his own driver’s license, and those of other individuals, appeared on the platform, he concluded the documents were likely siphoned from IDScan.net, a Louisiana-based identity-verification provider whose services include ID fraud prevention, access management, age verification, ID-activated door locks and mobile ID scanners. The company says it performs more than 21 million verifications per month across more than 20,000 locations for clients spanning automotive, banking, gaming, education, transportation, hospitality, law enforcement, retail and security industries.

    FBI Investigation and Shutdown

    The Nexus platform was taken offline shortly after Krebs published his findings. Separately, the FBI opened an investigation into the suspected IDScan breach after determining that some of the exposed driver’s licenses belonged to its own agents. IDScan.net had not issued a public statement on the incident as of this writing.

    What Organizations Should Take From It

    NCC Group senior adviser Tim Rawlins said the incident underscores that identity systems should be designed on the assumption that identity evidence will eventually be compromised. “A genuine-looking document cannot remain sufficient proof of identity indefinitely,” Rawlins said, adding that organizations should inventory what identity data they hold, establish clear retention and deletion policies, and set contractual requirements with identity vendors covering logging, data segregation, incident notification and independent assurance. He also recommended monitoring for abnormal bulk access to identity systems, including unusual service-account and API activity.

  • HPE Patches Over 150 Flaws in Aruba AOS-CX Switches, Including Critical RCE Bugs

    HPE Patches Over 150 Flaws in Aruba AOS-CX Switches, Including Critical RCE Bugs

    Hewlett Packard Enterprise has released patches addressing more than 150 vulnerabilities in ArubaOS-CX (AOS-CX), the operating system used across its Aruba Networking enterprise switch line, including a group of critical-severity remote-code-execution flaws.

    A Critical Flaw Affecting Unauthenticated Attackers

    According to HPE’s advisory, nearly two dozen individual issues are tracked collectively under CVE-2026-73749, which carries a CVSS score of 9.8. The flaws stem from improper processing of malformed input sent to an unnamed service within AOS-CX, HPE’s database-centric switch operating system. HPE says an unauthenticated attacker could exploit the defects by sending specially crafted packets to the vulnerable service, achieving remote code execution with elevated privileges.

    The updates, released for AOS-CX versions 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190 and 10.10.1181, also resolve 22 high-severity vulnerabilities that could enable denial-of-service conditions, additional remote code execution, arbitrary command execution, cross-site scripting, authentication bypass, privilege escalation and information disclosure. Eleven remaining medium-severity issues cover access-control bypass, information disclosure, arbitrary file reads, denial-of-service and privilege escalation.

    No Known Exploitation, but Broad Exposure

    HPE says the majority of the vulnerabilities were found internally by its own security team and that it is not aware of any of them being exploited in the wild. As an interim mitigation, the company recommends restricting AOS-CX command-line and web-based management interfaces to a dedicated Layer 2 segment or VLAN, controlling access with firewall policies at Layer 3 and above, and maintaining accounting controls to track and log user activity and resource usage.

    Because AOS-CX switches sit at the network layer beneath cameras, access-control panels and other connected security devices in many enterprise deployments, unpatched management-interface exposure on this class of device can translate into risk for physical security systems that depend on the same network fabric, underscoring why prompt patching of core switching infrastructure matters beyond the IT network itself.

  • ‘StyleSmuggler’ Zero-Day Exploited to Backdoor Adobe Commerce and Magento Stores

    ‘StyleSmuggler’ Zero-Day Exploited to Backdoor Adobe Commerce and Magento Stores

    Threat actors are actively exploiting a zero-day vulnerability in Adobe Commerce and Magento to plant backdoors on online stores, according to research from cybersecurity firm Sansec. The flaw, which Sansec has named StyleSmuggler, affects Magento versions 2.4.7, 2.4.8 and 2.4.9, including stores already running the July and August 2026 security patches.

    How the Attack Works

    StyleSmuggler lets attackers inject PHP code into Magento’s template system by abusing the platform’s “styles” properties, evading detection in the process. Sansec describes a two-stage attack: the malicious code is first injected by generating a payment failure report, and Magento then executes that code when it sends out its standard “Payment Transaction Failed Reminder” email. No user interaction is required for the exploit to succeed.

    Once triggered, the exploit deploys a backdoor written in Rust that connects to a command-and-control server and waits for further instructions. Sansec says the malware disguises its C&C communication as NTP server replies and transmits host information, including an agent ID, hostname, username, memory and disk usage, operating system version, uptime, root-access status and the implant’s version, along with the store’s public IP address.

    Timeline and Detection

    Sansec says it first found the campaign on Sept. 4 at 22:40 UTC and reproduced the exploit chain on clean installations within hours. The initial backdoor disguised itself as a process named “kworker/u:8:0”; a second variant that emerged on Sept. 6 disguises itself as “fc-cache.”

    Because the exploit abuses a legitimate Magento email notification, Sansec recommends store operators watch for unexpected bursts of payment-failure reminder emails as a detection signal, while cautioning that legitimate declined payments can trigger the same notification. Adobe was expected to ship its regular monthly Patch Tuesday updates on Sept. 8, but as of this writing it was unclear whether that release would address StyleSmuggler specifically.

  • North Korean Hackers Deploy Stealthy Linux Backdoor Hidden Inside HAProxy

    North Korean Hackers Deploy Stealthy Linux Backdoor Hidden Inside HAProxy

    A North Korea-aligned threat actor has been using a new Linux-based espionage toolkit to target automotive and media organizations in South Korea, according to research published by Rapid7. The framework is designed for long-term, stealthy surveillance rather than smash-and-grab data theft.

    A Backdoor Compiled Into the Load Balancer Itself

    At the center of the toolkit is a custom HAProxy plugin the researchers call the “ted” backdoor, compiled directly into a HAProxy 2.8.12 instance running in the victim’s environment. Rather than running as a separate malicious process, it hooks into HAProxy’s native filter API, internal memory pools, event scheduler and HTTP parser, letting it intercept and inject traffic while genuine load-balancing operations continue normally, which helps it evade routine monitoring.

    The broader framework also includes trojanized versions of common Linux utilities, including agetty, atd, crond, polkitd and sshd, along with a curl-based remote access tool the researchers call CurlRAT and an SSH keylogger that doubles as a staging server. CurlRAT polls its command-and-control server roughly every 12 hours and can decrypt and execute stored commands, write new configuration payloads to disk, or spawn a full interactive shell.

    Initial Access and Attribution

    Rapid7 says the attackers first gained access to an edge server by exploiting a vulnerability in a groupware login portal, then used the SSH keylogger to harvest credentials for lateral movement into internal systems. Once installed, the ted backdoor let attackers redirect or serve malicious content to selected visitors browsing through the compromised load balancer, using low-cost commodity domains designed to blend in with legitimate traffic, in one case mimicking a Naver static-content domain.

    Rapid7 says the toolkit has likely been in use since late 2024, based on the release date of the first HAProxy version it was compiled against. Attack infrastructure and techniques observed overlap with watering-hole methods previously used by APT37 and Lazarus, and the campaign’s timeframe overlaps with Operation SyncHole, a watering-hole campaign against South Korean firms attributed to Lazarus in 2025 — pointing toward a North Korean state-linked actor, though Rapid7 stops short of formal attribution to a specific named group.

  • Researcher ‘Nightmare Eclipse’ Drops Three Zero-Day Exploits for CrowdStrike, Nvidia and Avast

    Researcher ‘Nightmare Eclipse’ Drops Three Zero-Day Exploits for CrowdStrike, Nvidia and Avast

    A security researcher who goes by the handle Nightmare Eclipse, also known as Chaotic Eclipse, Infinite Nightmare and MSNightmare, published three new zero-day proof-of-concept exploits within a single week, targeting security and driver software from Avast, CrowdStrike and Nvidia.

    Three Exploits, Three Vendors

    The first, dubbed PrettyPrague, targets the sandbox used by Avast Antivirus to spawn a shell with full system privileges, and the researcher says it may also affect other GenDigital products, including AVG and Norton. A GenDigital spokesperson told SecurityWeek the company was made aware of the issue, initiated its security response procedures, and has fixed it.

    The second, FalconFlank, exploits a bug in the Office malicious-macro remediation feature of CrowdStrike Falcon Sensor to escalate privileges. CrowdStrike said it is actively investigating the claims and has advised customers to disable a related Windows policy setting while pointing to guidance in its support portal.

    The third, GreenSection, targets an out-of-bounds memory write affecting a shared global memory section used by multiple Nvidia user-mode display driver components on Windows. Nvidia said it is reviewing the reported behavior through its established security processes.

    Part of a Broader Pattern

    Nightmare Eclipse became known for a series of zero-day exploits targeting Microsoft products before expanding to other vendors. In late August, the researcher released a separate privilege-escalation zero-day affecting a Kaspersky endpoint security product, which Kaspersky patched on Aug. 31. Independent security researcher Kevin Beaumont said he had confirmed that the Avast, CrowdStrike and Kaspersky exploits work as described.

    None of the three latest exploits are confirmed to grant SYSTEM-level access on their own; each requires local code execution as a starting point and functions as a privilege-escalation primitive rather than a full remote compromise chain. All three vendors said they are investigating or have already issued fixes.

  • Rapid Response Monitoring Expands Henderson, Nevada Facility, Plans 75 New Jobs

    Rapid Response Monitoring Expands Henderson, Nevada Facility, Plans 75 New Jobs

    Rapid Response Monitoring Services is expanding its central-station operations in Henderson, Nevada, adding roughly 12,000 square feet of leased space and planning to create 75 full-time jobs at the facility over the next two years.

    Investment in Local Operations

    The expansion includes tenant improvements and a $600,000 capital investment in equipment and facility upgrades. The new hiring is expected to grow the Henderson site’s headcount to approximately 240 employees supporting the company’s nationwide Response Management Platform.

    Founded in 1992 and headquartered in Syracuse, New York, Rapid Response protects more than 4 million subscriber accounts across the United States and Canada, combining monitoring technology, artificial intelligence and trained response specialists to process alarm signals and coordinate emergency response.

    “Nevada represents an important part of Rapid’s long-term growth strategy,” said David Pida, chief financial officer at Rapid Response Monitoring. “As the company expands its operational footprint in the state, Rapid is committed to creating high-quality careers, investing in advanced technology, and building lasting partnerships that contribute to the economic vitality of the communities it serves.”

    A Welcome Addition for the City

    Henderson Mayor Michelle Romero welcomed the continued investment, saying it reinforces the city’s position as a destination for business growth. “Their continued growth strengthens our local economy, creates valuable job opportunities, and reinforces Henderson as a premier destination for business,” Romero said.

  • Overhead Door Corp. Acquires Motion Access, Expanding Horton’s Pedestrian Access Business

    Overhead Door Corp. Acquires Motion Access, Expanding Horton’s Pedestrian Access Business

    Overhead Door Corp. has acquired the assets of Motion Access, an Elk Grove Village, Illinois-based provider of automatic pedestrian door operators, replacement parts, retrofit solutions and rebuilt equipment. Motion Access will continue operating under its existing name as part of Horton Automatics, the premium access brand within Horton Pedestrian Access Solutions, a division of Overhead Door Corp.

    Strengthening Aftermarket and Service Capacity

    Overhead Door said the deal expands Horton’s aftermarket, service and retrofit capabilities for automatic pedestrian door solutions across North America, adding a company that has built its reputation serving automatic door professionals nationwide.

    “Motion Access has earned a reputation as a trusted provider of automatic entrance solutions, and we are excited to welcome their team into the Horton family,” said Kelly Terry, president and CEO of Overhead Door Corp. “This acquisition strengthens our aftermarket and service capabilities, expands our product offering, and reinforces our commitment to delivering innovative solutions and exceptional support to customers throughout North America.”

    Motion Access owners Joseph Madden, Robert Oakley, Gilbert Valencia and Michael Valencia said in a joint statement that finding the right long-term home for the business was one of the most important decisions they had made as owners, and that joining Horton creates new opportunities for employees and customers.

    Part of a Broader Pedestrian Access Portfolio

    Horton Pedestrian Access Solutions, which also operates the WonDoor brand, runs multiple manufacturing and service locations and works with more than 200 distribution partners across North America. Lewisville, Texas-based Overhead Door Corp., a subsidiary of Tokyo-based Sanwa Holdings Corp., serves more than 4,500 professional distribution partners across residential, commercial, institutional and industrial access markets.

  • Epson and STOPware Partner on On-Demand Color Visitor Badge Printing

    Epson and STOPware Partner on On-Demand Color Visitor Badge Printing

    Epson and visitor management software provider STOPware have announced a partnership integrating Epson’s ColorWorks on-demand color printing technology with STOPware’s PassagePoint platform, allowing organizations to produce full-color, photo-ready visitor badges in real time at sign-in.

    Color as a Security and Workflow Tool

    The integration pairs Epson’s CW-C4000 and CW-C6000 ColorWorks printers with PassagePoint to generate badges featuring visitor photos, color-coded access levels, department or zone identifiers, branding elements, and QR codes or barcodes for check-in, check-out tracking and access control integration.

    According to the companies, color coding helps front-line staff quickly distinguish visitors, contractors, vendors and temporary staff, and can visually flag which building zones a given badge is authorized to access. Full-color photos on the badge itself are also intended to reduce the risk of badge cloning or reuse.

    “We’re seeing firsthand that on-demand, full-color badge printing can help enable safer and faster access decisions, especially in high-traffic environments like hospitals, schools, corporate campuses or government facilities,” said Michael Weitz, product manager for ColorWorks at Epson America.

    Removing Pre-Printed Badge Inventory

    Because badges are printed on demand rather than drawn from pre-printed stock, organizations using the integration no longer need to maintain separate badge inventories or manually restock supplies, and every badge reflects current visit information and access policy.

    “Visitor badges are a frontline tool in ensuring building safety,” said Debbie Pendleton, chief operating officer of STOPware. “By combining ColorWorks color printing technology with STOPware’s platform, organizations gain instantaneous visual clarity and robust identification without slowing down visitor flow.”

  • CISA Flags Active Exploitation of LiteLLM and Starlette Flaws in First AI-Heavy KEV Batch

    CISA Flags Active Exploitation of LiteLLM and Starlette Flaws in First AI-Heavy KEV Batch

    The Cybersecurity and Infrastructure Security Agency added seven vulnerabilities to its Known Exploited Vulnerabilities catalog on Sept. 2, 2026, based on evidence of active exploitation. Three of the seven affect artificial intelligence and machine learning infrastructure — the first KEV batch in which AI-related components make up nearly half the additions.

    Authentication Bypass in a Widely Used AI Gateway

    The most significant of the AI-related entries is CVE-2026-59822, an improper-authentication flaw in LiteLLM, an open-source proxy server that routes calls to large language model APIs. According to the National Vulnerability Database, versions of LiteLLM prior to 1.84.0 allowed an unauthenticated attacker to submit a fabricated bearer token to the product’s Model Context Protocol Streamable HTTP endpoint, triggering an OAuth2 fallback path that granted access without a valid key. The flaw is fixed in version 1.84.0 and carries a CVSS score of 8.8.

    CISA also added CVE-2026-48710, an HTTP request/response smuggling vulnerability in the Starlette web framework that underlies the popular FastAPI toolkit used to build many AI agent and API services. Because Starlette typically ships as a transitive dependency of FastAPI rather than a direct one, researchers tracking the issue note it rarely appears in software inventories, making dependency lockfile scanning the more reliable way to detect exposure. A third AI-adjacent flaw affects JFrog Artifactory, a package repository manager widely used in AI development pipelines to store and distribute models and dependencies.

    Agentic Infrastructure Becomes a Target

    Security researchers at Microsoft and Wiz say the exploitation activity reflects a broader shift toward targeting AI infrastructure components — including LLM gateways, vector databases and MCP servers — to steal API keys, gain backend access, and monetize compromised hosts, in some cases through cryptocurrency mining.

    Under Binding Operational Directive 26-04, federal civilian agencies must remediate most of the newly added vulnerabilities by Sept. 5, 2026, while the Starlette and LiteLLM flaws carry a Sept. 16, 2026 deadline. CISA continues to recommend that all organizations, not just federal agencies, prioritize patching KEV Catalog entries as part of routine vulnerability management.