Critical Rails Bug Threatens to Derail Vulnerable Servers
An attacker could write arbitrary files and read sensitive files via images uploaded to the Rails Active Storage ImageMagick integration, possibly positioning a threat actor for lateral movement.
Excerpt from the primary source: Dark Reading
Who is affected
Security professionals
What you should do · Be aware
No immediate action is indicated. Share this with the relevant teams and watch for updates.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials.
Source reporting says attackers are already exploiting this, so exposed affected systems are at immediate risk.
Treat this as an emergency.
French bank confirms cyber heist, hackers suspected to have stolen an estimated $133 million
Crédit Mutuel Arkéa said in a press notice that the attackers were able to make transfers using the bank’s own account after compromising an unnamed supplier.
Cyberattack disrupts blood storage refrigeration systems in France
France's national blood service has confirmed that a cyberattack targeting a refrigeration equipment provider raised temperature and defrost settings at three of its facilities, threatening stored blood products.
NIKKE PC game launcher hacked to spread remote access, data-stealing malware
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data.