Apple has released Beats Firmware Update 1B211 to address CVE-2025-20701, a high-severity eavesdropping vulnerability (rated 8.8 out of 10) affecting its Beats Studio Buds wireless earbuds. This flaw, stemming from improper authentication in the firmware of Bluetooth-related chips manufactured by Airoha Systems, allowed attackers within Bluetooth range to impersonate previously paired devices and intercept audio from the earbud's microphone. The patch is automatically delivered when the earbuds are paired with an iPhone, iPad, or Mac. This vulnerability was initially disclosed 12 months prior by Insinuator researchers Dennis Heinze and Frieder Steinmetz, and other manufacturers like Jabra, Bose, and JBL have also issued updates for their affected devices. Beyond eavesdropping, the broader Airoha vulnerabilities could enable attackers to retrieve call history, contacts, and initiate calls, depending on the specific device. This issue is part of a wider landscape of Bluetooth vulnerabilities, including WhisperPair, which affects Google Fast Pair-enabled devices from manufacturers such as Sony, JBL, and Google, allowing for eavesdropping and device geolocation. While such attacks are complex and require continuous proximity, users are advised to disable Bluetooth when not in use to mitigate risks.
A medium-severity information disclosure vulnerability, tracked as CVE-2026-4020 (CVSS score: 5.3), is being actively exploited in the Gravity SMTP WordPress plugin, which is installed on approximately 100,000 sites. This flaw allows unauthenticated attackers to extract sensitive data, including configuration details, API keys (for services like Amazon SES, Google, Mailjet, Resend, and Zoho), secrets, and OAuth tokens. The vulnerability stems from a REST API endpoint at `/wp-json/gravitysmtp/v1/tests/mock-data` that unconditionally returns true for its ``permission_callback`,` enabling any unauthenticated visitor to access it. By appending the `?page=gravitysmtp-settings` query parameter, the endpoint returns a 365 KB JSON system report containing extensive information such as PHP version, web server details, database type and version, WordPress version, active plugins and themes, and all configured API keys. Attackers can leverage this exposure to send emails on behalf of the site or plan further attacks. A patch was released in version 2.1.5 of the plugin, and bad actors have been exploiting this defect since early May 2026, with exploit attempts spiking dramatically around June 6, 2026, resulting in over 17 million blocked attempts by Wordfence from various IP addresses including 45.148.10.95 and 193.32.162.60. Site owners using vulnerable versions should update to 2.1.5 or later immediately, assume compromise, rotate all exposed credentials, and review server logs for suspicious requests originating from the identified attacker IP addresses.
Cisco has released security updates addressing two vulnerabilities, CVE-2026-20181 and CVE-2026-20190, impacting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). CVE-2026-20181 is a critical (CVSS 9.1) remote code execution vulnerability stemming from insufficient user-supplied input validation, allowing an authenticated attacker with administrative credentials to gain user-level access to the underlying operating system, elevate privileges to root, and potentially cause a denial-of-service condition in single-node deployments. CVE-2026-20190 is a high-severity (CVSS 7.5) information disclosure vulnerability caused by improper authorization checks, which could allow an attacker to access sensitive information, including hashed credentials. Cisco is currently unaware of any public exploitation of these vulnerabilities. Affected versions require specific patches: for CVE-2026-20181, ISE 3.3 requires Patch 11, ISE 3.4 requires Patch 6, and ISE 3.5 requires Patch 4 (August 2026); for CVE-2026-20190, ISE 3.4 requires Patch 6, and ISE 3.5 requires Patch 3, while versions earlier than 3.3 and 3.3 are not vulnerable to this specific CVE. Migration to a fixed release is necessary for versions earlier than 3.3.
The Gentlemen ransomware-as-a-service (RaaS) operation, active since March 2025 and attributed to Alexander Andreevich Yapaev (aka hastalamuerte), employs a sophisticated suite of endpoint detection and response (EDR) killers for its affiliates, having claimed 504 victims primarily in Southeast Asia, South America, and Western Europe. This arsenal is built around the in-house GentleKiller framework, which features eight variants designed to mimic legitimate products and abuse vulnerable drivers via the bring your own vulnerable driver (BYOVD) technique, targeting over 400 processes across 48 distinct security programs. GentleKiller utilizes a shared defense-evasion layer, impersonating security vendors with fake version information, copied certificates, and icons, and protects its binaries with packers like Enigma or Themida. Specific drivers abused include "eb.sys" (Kaspersky), "nseckrnl.sys" (FACEIT Anti-Cheat), "GameDriverX64.sys" (Valorant), `"stpm_old.sys"` or `"stpm_new.sys"` (Javelin), "dmx.sys" (WatchDog), `"360netmon_wfp.sys"` (Network Blocker), "IMFForceDelete.sys" (Cleaner), and "PoisonX.sys" (G11), with "PoisonX.sys" also used to kill CrowdStrike Falcon EDR. The operation also integrates third-party tools like HexKiller ("googleApiUtil64.sys"), ThrottleBlood ("ThrottleBlood.sys"), and HavocKiller ("havoc.sys"), and rapidly operationalizes newly disclosed BYOVD proof-of-concept exploits. Additionally, The Gentlemen uses OxideHarvest (aka buildx641), a Rust-based credential stealer targeting numerous web browsers. This centralized EDR-killer suite lowers the entry barrier for affiliates, making The Gentlemen a technically agile RaaS group. A related CERT/CC advisory highlights a Secure Boot bypass vulnerability in UEFI applications from vendors like Acer, AMD, ASUS, ECS, Getac, GIGABYTE, Toshiba, and Uniwill, also leveraging BYOVD, which can be mitigated by updating the UEFI Forbidden Signature Database (DBX).
A Klue OAuth breach has facilitated the "Icarus" threat actors in stealing Salesforce CRM data from multiple organizations, leading to an ongoing extortion campaign. The attack involved compromising Klue's backend systems to steal OAuth tokens, which were then used with automated Python scripts to query Salesforce's REST API. Threat actors conducted reconnaissance via the '/services/data/v59.0/sobjects' endpoint before exfiltrating data using '/services/data/v59.0/query'. Stolen data includes CRM-related information such as business contacts, sales communications, price quotes, and competitive intelligence, with cybersecurity firm Huntress confirming their Salesforce data was exfiltrated. Salesforce has since disabled the Klue Battlecards integration, and Klue has disabled integrations with platforms including HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack. Organizations are advised to review Salesforce and related SaaS logs for activity originating from IP addresses 138.226.246.94, 212.86.125.24, 213.111.148.90, and 94.154.32.160, revoke and rotate OAuth tokens, terminate active sessions, and review Salesforce logs for unusual API activity.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
