⚡ Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers & More
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20131 | Unauthenticated Java Deserialization RCE in Cisco FMC and SCC | 10.0 | 44% | KEVRansomwarePoC | KEV |
| CVE-2026-33017 | Unauthenticated RCE in Langflow AI Workflow Builder | 9.3 | 96% | KEVPoC ×6 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | token-claw.xyz | site and connecting their crypto wallet." The linked site ("token-claw[.]xyz") is a near-identical clone of openclaw.ai rigged with a |
| ipv4 | 185.221.239.162 | n Botnet Exposed via Open Directory — An Open Directory on "185.221.239[.]162:8080" has been found to contain several payloads, includi |
| ipv4 | 203.161.50.145 | — A second exposed open directory discovered on a server (" 203.161.50[.]145 ") associated with APT28 (aka Fancy Bear) has offered ins |
| ipv4 | 5.78.84.144 | are Server — An analysis of an open directory on a server ("5.78.84[.]144") associated with Beast, a ransomware-as-a-service (RaaS) |
From the original article
13 min read at thehackernews.com
Another week, another reminder that the internet is still a mess. Systems people thought were secure are being broken in simple ways, showing many still ignore basic advisories. This edition covers a mix of issues: supply chain attacks hitting CI/CD setups, long-abused IoT devices being shut down, and exploits moving quickly from disclosure to real attacks.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.