⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
Weekly recap highlights ShareFile threat, Citrix Bleed 2 ransomware, and AI coding attacks.
This week's security recap covers several significant threats, including a credible external threat to Progress ShareFile's Storage Zone Controllers, urging customers to shut them down. The Jscrambler npm package was compromised, distributing a Rust-based information stealer targeting developer secrets across multiple operating systems. Microsoft detailed GigaWiper, a new destructive backdoor with wiper capabilities, potentially linked to an Iran-nexus threat actor. Additionally, a large-scale operation named SHELLSTORM exploited 27 WordPress plugin CVEs to deploy web shells on over 1.4 million domains.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThis week's threats illustrate how attackers simultaneously exploit unpatched software, compromised developer toolchains, and vulnerable third-party plugins to maximize impact across organizations. The Jscrambler npm compromise demonstrates that supply chain attacks targeting developer environments can silently exfiltrate secrets before any defender notices. The SHELLSTORM campaign exploiting 27 WordPress CVEs across 1.4 million domains underscores the danger of leaving known vulnerabilities unpatched at scale. Together, these incidents show that vulnerability management must span not just internal systems but also open-source dependencies, CMS plugins, and vendor-managed infrastructure like ShareFile Storage Zones — because attackers are actively chaining these gaps.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — GigaWiper
- malware — BLUERABBIT