[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbQeOMqVZmYKgx5s1Uo8L86NS_m4r-Ev9EmXntkNGHXM":3},{"article":4,"iocs":56,"watch_terms":68,"solutions":69,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"84496f44-ab6b-428e-9883-ab7a73d7307b","ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body","owncloud-flaw-exploited-to-steal-nuclear-records-from-philippine-research-body-9ef134","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities (KEV) catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in the Philippines. The vulnerability, tracked as CVE-2023-49105 (CVSS score: 9.8), is a case of","A Chinese-speaking threat actor has exploited a critical vulnerability in ownCloud (CVE-2023-49105) to steal sensitive nuclear records from a Philippine research body. The vulnerability, a WebDAV API authentication bypass, allowed the attacker to access files without authentication. The U.S. CISA has added this flaw to its Known Exploited Vulnerabilities catalog.","Chinese actor exploits ownCloud flaw to steal nuclear records from Philippine research body.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fsnowflake-github-actions-flaw-lets.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiZPm0X6hW-nz0AFZIB6eOBMEssN6dF5qeh2EOIBm1-ftaBEqcvJC5M0r_g3j-6Sp9x4sUnxVeOToWN_bFbr6T9flaScRcze4DRga0nqNe3LeQSvZaNPTiZC2C8GUeWWxMmIF1mybwuDaq5ZZummYiynDkf_1evTLKPicf4f2UUUb2d-0MMG6Ix-00ImwFN\u002Fs1600\u002F1000103895.jpg","2026-08-28T15:56:55+00:00","2026-08-28T20:00:15.955554+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"ownCloud","product",{"name":21,"type":22},"Chinese-speaking threat actor","threat_actor",{"name":24,"type":25},"CISA","vendor",{"name":27,"type":19},"LiteSpeed Cache",{"name":29,"type":19},"WordPress",{"name":31,"type":32},"WebDAV","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61,65],{"type":58,"value":59,"context":60},"cve","CVE-2023-49105","ownCloud WebDAV API authentication bypass vulnerability",{"type":62,"value":63,"context":64},"ip","31.58.209.241","IP address hosting custom Python scripts and exfiltrated data",{"type":58,"value":66,"context":67},"CVE-2024-28000","LiteSpeed Cache plugin for WordPress vulnerability",[24,18,27],{"controls":70,"vendors":156},[71,100,128],{"slug":72,"name":73,"problem":74,"products":75},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":101,"name":102,"problem":103,"products":104},"patch-management","Automated patch management","Known holes get closed in days, not months.",[105,113,120],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":101,"product_name":117,"url":118,"description":119},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":55,"name":129,"problem":130,"products":131},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[132,140,148],{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[],{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":173},"unpatched-owncloud-flaw-enables-nuclear-data-theft","Unpatched ownCloud Flaw Enables Nuclear Data Theft","A Chinese-speaking threat actor exploited CVE-2023-49105, a critical WebDAV API authentication bypass in ownCloud, to exfiltrate sensitive nuclear research records from a Philippine government body. The root failure was the organization's inability to apply a known, catalogued patch before attackers could leverage it against critical infrastructure. Authentication bypass vulnerabilities are among the most severe class of flaws because they completely nullify access controls, rendering all downstream security measures ineffective. This incident underscores that unpatched internet-facing file-sharing platforms in sensitive environments represent an unacceptable risk, particularly when the vulnerability is actively tracked by CISA's KEV catalog. State-sponsored threat actors routinely scan for and weaponize known CVEs within days of disclosure, leaving organizations with narrow windows to remediate.",[162,163,164,165,166,167,168,169,170,171,172],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 6: Access Control Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.VM-1: Vulnerabilities are identified and documented","NIST CSF PR.AC-3: Remote access is managed","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CISA KEV Catalog: CVE-2023-49105","ITIL 4: Change Enablement (emergency change procedure)",{}]