Hardware attack breaks Intel/AMD confidential computing; Gitea RCE exploited across six countries

A new DDRop hardware attack compromises Intel TDX and AMD SEV-SNP confidential computing by silently dropping memory writes. Japan's Digital Agency suffered a VPN breach exposing ~numerous personnel records. Red Heron exploited Gitea RCE to compromise 13 organizations across six countries.

DDRop, a new hardware attack, breaks memory protections in Intel TDX and AMD SEV-SNP confidential computing environments by dropping memory writes, forcing processors to read stale encrypted data.

Japan's Digital Agency confirmed a VPN vulnerability breach affecting approximately 246,000 personnel records containing personal information of government employees.

Red Heron, a suspected Chinese threat actor, rapidly exploited a Gitea RCE vulnerability to compromise 13 organizations across six countries in a coordinated campaign.

An attacker maintained persistent root-level access to 3BB, one of Thailand's largest broadband providers, using the legitimate MeshCentral remote management tool.

WordPress introduced automated security reviews for all plugin releases to block high-risk updates before distribution, strengthening supply-chain defenses.

1. DDRop Hardware Attack Breaks Confidential Computing Protections

Severity: HIGH Affected: Technology

Researchers have disclosed DDRop, a hardware attack that breaks memory protection in Intel TDX and AMD SEV-SNP confidential computing by silently dropping writes to a server's memory [1] . This forces the processor to old encrypted data as if it were current, undermining the confidentiality guarantees these technologies are designed to provide [1] . The attack requires an attacker with physical or privileged access to the memory subsystem ⚠ [1] . Sources: [1] The Hacker News

Assess whether confidential computing instances are deployed in environments where physical access controls are in place

Monitor vendor security advisories from Intel and AMD for hardware-level mitigations or microcode updates

Review deployment architectures to limit exposure of sensitive workloads until patches are available

2. Japan Government VPN Breach Exposes 246,000 Personnel Records

Severity: HIGH Affected: Government

Japan's Digital Agency discovered a data breach via a VPN vulnerability that may have exposed approximately 246,000 record rows containing personal information of government employees [1] . The vulnerability is tracked as CVE-2026-20079 [1] . Sources: [1] BleepingComputer

affected government personnel to notify them of potential exposure

Review VPN access logs for unauthorized activity during the breach window

Apply available patches for CVE-2026-20079 and conduct a security audit of VPN infrastructure

3. Red Heron Rapidly Exploits Gitea RCE Across Six Countries

Severity: HIGH Affected: Technology

A suspected Chinese threat actor tracked as Red Heron has exploited a recently disclosed Gitea RCE vulnerability to compromise internet-facing instances as part of a multi-national campaign [1] . Red Heron scanned 1,386 Gitea instances across seven countries and successfully compromised 13 organizations across six countries ⚠ [1] . The rapid exploitation of the vulnerability indicates minimal delay between disclosure and weaponization. Sources: [1] The Hacker News

Immediately patch all internet-facing Gitea instances to the latest version

Review audit logs for signs of unauthorized access or command execution since the vulnerability disclosure date

Isolate or take offline any unpatched Gitea instances pending remediation

Monitor for indicators of compromise from Red Heron's campaign infrastructure

4. Thailand ISP Breached via Legitimate Remote Management Tool

Severity: HIGH Affected: Telecom

Audit all remote management tool access logs and isolate accounts showing suspicious activity

Force password resets for all administrative accounts used to manage remote tools

Implement multi-factor authentication for all remote access sessions

5. Telegram Desktop HTML Export Flaw Enables JavaScript Injection

Severity: MEDIUM Affected: Technology

A flaw in Telegram Desktop allows a bot's message to plant hidden JavaScript inside chats that users export to HTML files, according to security researchers at ExPatch [1] . The message appears ordinary in the Telegram interface but executes the hidden script when the exported HTML is opened in a browser [1] . The vulnerability was published on September 12 [1] . Sources: [1] The Hacker News

Advise users to avoid exporting HTML chat files from untrusted sources until a patch is released

Monitor for Telegram Desktop updates and apply promptly once available

Review exported HTML files in a sandboxed environment before opening in a browser

Today’s Action Checklist

☐ URGENT: Patch or isolate all internet-facing Gitea instances to prevent RCE exploitation by Red Heron

☐ URGENT: Apply emergency patches for CVE-2026-20079 (Japan VPN flaw) if your organization uses affected VPN infrastructure

☐ HIGH: Review remote management tool access (MeshCentral, RDP, SSH) for unauthorized activity and enforce MFA

☐ HIGH: Monitor vendor advisories from Intel and AMD for DDRop mitigations if deploying confidential computing

☐ MEDIUM: Update Telegram Desktop and counsel users to avoid opening HTML exports from unverified sources