Loki Intelligence — Security Briefs · Published
Daily Security Brief: QNAP Plex2Shell, Bank Heist, WordPress Fix
Today's picture is dominated by active exploitation of exposed software and third-party access, from QNAP NAS devices to a bank incident routed through a service provider. Teams should prioritize patching internet-facing software, reviewing supplier access paths, and checking how update mechanisms behave on their own sites.
Signal 01 · BleepingComputer
QNAP says hackers breaching NAS devices in Plex2Shell attacks
QNAP reports that attackers are breaching NAS devices using a vulnerability chain called Plex2Shell. The company asks users to update Plex Media Server to the latest version in the QNAP App Center.
Why it matters: Apply the vendor update to Plex Media Server on any NAS now, and avoid exposing these devices directly to the internet.
Source: BleepingComputer
Signal 02 · The Hacker News
OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits
OpenAI announced GPT-6 Cyber, a model it describes as stronger at security research tasks, with improved alignment. The headline cites AI-assisted discovery of flaws in Firefox and Linux.
Why it matters: Expect faster vulnerability discovery by both defenders and attackers, so shorten patch cycles and treat AI-assisted findings as an input to your own triage.
Source: The Hacker News
Signal 03 · BleepingComputer
Hackers pull off $133 million French bank heist via service provider
French cooperative bank Crédit Mutuel Arkéa was hit by a cyberattack that enabled fraudulent transactions of up to $133 million. The bank suspended certain systems in response, and the report points to a service provider as the route.
Why it matters: Review what access your suppliers hold, apply strong transaction controls and monitoring to it, and rehearse how you would isolate a provider quickly.
Source: BleepingComputer
Signal 04 · BleepingComputer
CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands
CTM360 describes fake gift card giveaways that impersonate well-known brands and celebrities. The campaigns collect personal data and trigger unwanted subscriptions, using deceptive verification steps and affiliate networks.
Why it matters: Monitor for brand impersonation and give customers a clear way to report fake promotions that use your name.
Source: BleepingComputer
Signal 05 · Cloudflare Security
The post-quantum future of web privacy
Cloudflare examines how quantum computing threatens protocols such as Privacy Pass, which limit abuse while preserving user privacy. It discusses new post-quantum cryptography that may help close that gap.
Why it matters: Start inventorying where your products rely on privacy and anti-abuse cryptography so a post-quantum migration can be planned.
Source: Cloudflare Security
Signal 06 · The Hacker News
Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
A researcher reports that some WordPress sites can still be attacked while installing the fix for an actively exploited flaw, because the update process unpacks its files in a way that leaves a brief exposure.
Why it matters: Treat the update window as a risk: apply the fix promptly, restrict access to the site during updates where feasible, and check for signs of prior compromise.
Source: The Hacker News
Signal 07 · BleepingComputer
Veeam warns of Software Appliance boot failures on AMD EPYC hosts
Veeam warned that Software Appliance virtual machines can fail to boot on hosts with AMD EPYC processors.
Why it matters: Check whether your backup infrastructure runs on affected hosts and verify that restore capability stays intact before making changes.
Source: BleepingComputer
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.