ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “CDN Tsunami”

22 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllResearch 2
SeverityAllcritical 0high 0medium 1low 0info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Non-Zero-Day VPN Flaw Left Japan ‘s Government Shared Network Platform Exposed: 246,000 Records at Risk

Japan's Digital Agency says attackers exploited a patchable VPN flaw to access a government shared platform, exposing records of ~246,000 employees across 23 ministries.

Japan's Digital Agency disclosed that attackers exploited a medium-severity, already-patchable vulnerability in a VPN device to access the Government Solution Service (GSS), potentially leaking personal data of roughly 246,000 government employees, officials, and contractors across 23 ministries. The intrusion was detected on June 25 and confirmed as VPN exploitation on July 9, with public disclosure 78 days after detection. Exposed data includes about 236,000 names, 231,000 email addresses, 94,000 phone numbers, and 1,000 physical addresses; no My Number, bank account, or pension numbers were included. The compromised maintenance staff account was suspended and the compromised hardware isolated, but the VPN product and flaw were not disclosed.

Security Affairs · 1d agoData breach 2 sources1

CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification

Researchers disclosed two DoS attacks exploiting CDNs' HTTP/3-to-HTTP/1.1 translation to amplify low-bandwidth requests up to 350x against origin servers.

Researchers named the two techniques HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA), exploiting the gap where CDNs speak HTTP/3 to browsers but only HTTP/1.1 to origins. All six tested CDNs (Alibaba, Baidu, Cloudflare, CloudFront, Fastly, Tencent) were susceptible to HBA, and five to HCA, with Cloudflare immune to HCA because it buffers full requests before opening backend connections. Attackers using under 5 Mbps forced over 100 Mbps at origins, and the 350x factor applies only to Alibaba, Baidu, and Tencent, which support the QPACK dynamic table. Testing identified 42,330 potentially vulnerable subdomains out of 151,685 hosted on the six providers across the Tranco Top 1M.

The Hacker News · 27d agoResearch

Analysis of Smoke Loader in New Tsunami Campaign

Fake Japanese Meteorological Agency tsunami warning emails delivered Smoke Loader and AzoRult malware to steal credentials from targets in Japan.

A fake tsunami warning email impersonating Japan's Meteorological Agency asked recipients to click a link on a registered fake agency domain, delivering the commodity loader Smoke Loader to targets in Japan. Smoke Loader, active since 2011, is modular, and its payloads have included banking trojans, ransomware, cryptominers, password stealers, and PoS malware; the campaign later also deployed AzoRult. New samples add junk-jump obfuscation, encrypted network traffic and payload files, a unique machine ID used for tracking and encryption, and PROPagate injection into explorer.exe, with persistence via a Startup folder shortcut and RC4-encrypted C2 communication.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wild

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News · 27d agoResearch2

10th August – Threat Intelligence Report

North Carolina Ports suffered a cyberattack forcing Wilmington and Morehead City operations onto manual processes; the authority says it is contained.

Check Point's weekly threat intelligence bulletin reports that North Carolina Ports, the US authority operating the ports of Wilmington and Morehead City among others, suffered a cyberattack. The incident forced some operations onto manual processes. The authority claims it has contained the attack.

Check Point Research · Aug 10, 2026Data breach

Mitsubishi Electric Multiple FA Products (Update D)

CISA warns Mitsubishi Electric CC-Link IE TSN remote I/O modules are vulnerable to denial-of-service via crafted UDP packets (CVE-2025-3511).

CISA published Update D of advisory ICSA-25-128-03 covering Mitsubishi Electric factory automation products. Affected products include CC-Link IE TSN Remote I/O modules NZ2GN2S1-32D, NZ2GN2S1-32T, NZ2GN2S1-32TE, and NZ2GN2S1-32DT at firmware version 09 or earlier (CVE-2025-3511). A remote attacker can send a specially crafted UDP packet to cause denial-of-service conditions, timeout errors, or communication delays on the affected products.

CISA Advisories · 20d agoAdvisoryCVE-2025-3511

China Is Strapping ‘Digital Bombs’ to Civilian Infrastructure—Is the US Ready?

WIRED examines Volt Typhoon pre-positioning 'digital bombs' in US civilian infrastructure via a war game simulation discussion.

WIRED's Uncanny Valley podcast features reporter Andy Greenberg discussing a war game simulating a cyberattack by Chinese hacking group Volt Typhoon. The episode examines Volt Typhoon's practice of planting persistent access in US civilian infrastructure that could be activated during conflict, and questions whether the US is prepared.

WIRED · Security · 27d agoThreat actor

Communicating Under Pressure: Best Practices for Service Providers

CISA, FBI, and international partners issued guidance on crisis communications for service providers during IT and OT outages, emphasizing clarity, transparency, and backup channels.

CISA, the FBI, and international partners published guidance on planning and executing clear, timely, audience-appropriate communications during IT and OT service outages, whether caused by cyber threat actors, human error, or natural hazards. The guidance stresses clarity, accountability, and transparency, and warns that outages at one organization can cascade across interconnected systems. It recommends critical infrastructure owners assume telecommunications may be unreliable and integrate backup communication methods into crisis plans, and points to CISA's CI Fortify initiative for OT isolation and recovery resources.

CISA Advisories · 14d agoAdvisory

“Network outage” disrupts Westfield Public Schools in New Jersey as ransomware group posts samples

A ransomware group posted stolen data samples after a districtwide network outage disrupted Westfield Public Schools in New Jersey.

Westfield Public Schools in New Jersey experienced a districtwide network outage during the first week of school, disrupting communications and digital instruction while classrooms stayed open. The district initially attributed the disruption to networking hardware failure across all schools and offices. A ransomware group has since posted data samples, indicating extortion activity tied to the incident.

DataBreaches.net · 7d agoRansomware

CEVA Logistics Cyberattack Disrupts European Warehouses and Shipments

Cyberattack on CEVA Logistics disrupted eight European warehouses and exposed customer data of clients including Valve, Ajax, and De Bijenkorf.

CEVA Logistics, part of CMA CGM Group, suffered a July 29 cyberattack that disrupted eight European warehouses and halted shipments of stored goods. Customer data linked to Valve, Ajax, and Dutch retailer De Bijenkorf was exposed, potentially including names, contact details, and online order information; Valve said payment details and passwords were not accessed. No ransomware group has claimed responsibility and the company has not disclosed technical details. A database containing customer lists, shipping records, and banking details was reportedly later offered for sale on a dark web marketplace.

Security Affairs · Aug 12, 2026Data breach in the wild

Water sector example added to the NCSC’s Secure connectivity principles

NCSC UK adds a water sector example to its Secure Connectivity Principles, the first ICS community-authored content on its site.

The UK NCSC has added a water sector example to its Secure Connectivity Principles guidance. It is the first content authored by the Industrial Control System Community of Interest to appear on ncsc.gov.uk. The guidance helps ICS operators apply secure connectivity practices.

NCSC UK · Aug 11, 2026Advisory

240,000 Hit by Data Breach at Japan’s Digital Agency

Japan's Digital Agency says hackers exploited a VPN flaw and a maintenance account to steal ~246,000 records on 240,000 people.

Japan's Digital Agency disclosed a breach of its Government Solution Service (GSS) affecting roughly 240,000 individuals, discovered in late June. Attackers exploited a publicly disclosed vulnerability in a VPN product and used a maintenance and operations employee's account to access over 246,000 records, including names (~236,000), email addresses (~231,000), phone numbers (~94,000), and addresses (~1,000). The agency blocked external access to the affected server, suspended the account, and said no ID numbers or financial account data were compromised.

SecurityWeekupdated · 1d agofirst · 1d agoData breach in the wild 2 sources

Identifying a BOLA Vulnerability in Harbor, a Cloud

Unit 42 found a BOLA flaw, CVE-2024-22278 (CVSS 6.4), letting Maintainers improperly alter Harbor project metadata; fixed in versions 2.9.5, 2.10.3, and 2.11.0.

Unit 42 researchers identified a broken object-level authorization flaw, CVE-2024-22278, in Harbor, a CNCF-graduated cloud-native container registry with 1.8 million downloads. The flaw (CVSS 6.4) lets users with the Maintainer role create, update, and delete project metadata, actions reserved for ProjectAdmin, risking data exposure, integrity compromise, and circumvention of vulnerability scanning. Harbor patched the issue in versions 2.9.5, 2.10.3, and 2.11.0. The finding came from Unit 42's automated BOLA detection tool built on generative AI.

Palo Alto Unit 42 · Aug 17, 2026VulnerabilityCVE-2024-22278

Logistics Giant Ceva Suffers Data Breach Impacting European Clients

Ceva Logistics suffers a supply chain attack and data breach with a large blast radius impacting European clients.

Ceva Logistics, a major global logistics provider, suffered a data breach impacting its European clients. The incident appears to be a supply chain attack with a large potential blast radius affecting downstream customers. Details on compromised data volumes and the initial intrusion vector remain limited.

Infosecurity Magazine · Aug 11, 2026Data breach

Broken Access control on Websocket streams

Fortinet FortiSOAR access control flaw (CVSS 4.9) lets zero-permission authenticated attackers subscribe to and inject broadcast messages into websocket streams.

Fortinet advisory FG-IR-26-164 discloses an improper access control vulnerability (CWE-284, CVSSv3 4.9) in FortiSOAR. An authenticated attacker with zero permissions can subscribe to websocket streams and topics and inject broadcast messages via crafted websocket requests. The advisory was revised on 2026-09-08.

Fortinet PSIRT · 8d agoAdvisory

Mythos Vulnerability Firehose Hits a Human Bottleneck

Analysis of Project Glasswing findings shows only a fraction of discovered vulnerabilities have reached disclosure and even fewer are fixed.

Dark Reading reports that an analysis of Project Glasswing findings shows only a fraction of the vulnerabilities discovered by the program have reached disclosure, and an even smaller number have been fixed. The article examines how the volume of findings from the discovery program is bottlenecked by limited human triage and remediation capacity. The piece highlights growing tension between high-volume vulnerability discovery and the industry's ability to process, disclose and patch reports.

Dark Reading · 7d agoResearch

Arbitrary process termination from exposed minifilter communication port

Fortinet FortiClient Windows fortimon3 driver flaw (CVSS 4.7) lets authenticated attackers terminate arbitrary processes via exposed minifilter communication port.

Fortinet advisory FG-IR-26-165 discloses an unverified ownership vulnerability (CWE-283, CVSSv3 4.7) in the FortiClient Windows fortimon3 minifilter driver. An authenticated attacker can terminate arbitrary processes through an exposed minifilter communication port. The advisory was revised on 2026-09-08.

Fortinet PSIRT · 8d agoAdvisory1

Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator

Suspected Chinese-speaking operator breached Philippine nuclear research and naval supplier systems via ownCloud CVE-2023-49103 and WordPress CVE-2024-28000.

Hunt.io found an exposed staging server containing custom Python scripts, logs, and stolen data documenting intrusions against a Philippine nuclear research body and a marine engineering company serving the Philippine Navy. The actor exploited an ownCloud authentication bypass (CVE-2023-49103) using empty-secret pre-signed WebDAV URLs and a LiteSpeed Cache plugin flaw (CVE-2024-28000) to gain WordPress admin access, also guessing passwords against XML-RPC with rockyou.txt. Roughly 9 GB was referenced as stolen from the nuclear agency, including reactor databases, radiation-safety records, and staff passport data; Simplified Chinese labels suggest a Chinese-speaking operator.

Security Affairs · 18d agoThreat actor in the wildCVE-2023-49103CVE-2024-28000