Sekoia uncovered weaponized GitHub proof-of-concept repositories that deliver the ChocoPoC Python RAT by hiding malicious behavior inside PyPI dependencies like frint and skytext. The campaign appears aimed at cybersecurity researchers and testers, and it abuses compromised accounts, multiple vulnerable products, and even Mapbox datasets to deploy and exfiltrate data. #ChocoPoC #Sekoia #GitHub #PyPI #frint #skytext #Mapbox #FortiWeb #React2Shell #MongoBleed #PANOS #IvantiSentry #CheckPointVPN #JoomlaSPPageBuilder

Breaches don't always start with a zero-day. An exposed admin panel can get brute-forced, or credentials reused from a previous attack. But when a vulnerability does drop — like MongoBleed earlier this year, which let attackers pull credentials and session tokens from server memory without authentication — anything internet-facing is immediately at risk. With time-to-exploit now down to a

Breaches don't always start with a zero-day. An exposed admin panel can get brute-forced, or credentials reused from a previous attack. But when a vulnerability does drop — like MongoBleed earlier this year, which let attackers pull credentials and session tokens from server memory without authentication — anything internet-facing is immediately at risk. With time-to-exploit now down to a

Intruder analyzed 3,000 attack surfaces and found 60% exposed HTTP panels, 49% risky ports, and 42% internet-facing databases.

Breaches don't always start with a zero-day. An exposed admin panel can get brute-forced, or credentials reused from a previous attack. But when a vulnerability does drop — like MongoBleed earlier this year, which let attackers pull credentials and session tokens from server memory without authentication — anything internet-facing is immediately at risk. With time-to-exploit now down to a

Breaches don't always start with a zero-day. An exposed admin panel can get brute-forced, or credentials reused from a previous attack. But when a vulnerability does drop — like MongoBleed earlier this year, which let attackers pull credentials and session tokens from server memory without authentication — anything internet-facing is immediately at risk. With time-to-exploit now down to a

Read more

Introduction: In the ever-escalating arms race of cybersecurity, offensive security professionals and threat actors frequently rely on shared tools to streamline post-exploitation activities. A recent incident highlights a sophisticated twist in supply chain attacks, where a modified version of a database post-exploitation tool was weaponized against its users. When attackers deployed a poisoned module named ‘mongobleed’ that imported a malicious logging library called ‘slogsec’, they inadvertently executed a backdoor on their own infrastructure, turning the hunters into the hunted.

Hackers are exploiting CVE-2025-14847, aka MongoBleed, a MongoDB vulnerability, to leak sensitive information from server memory.

A severe vulnerability affecting multiple MongoDB versions, dubbed MongoBleed (CVE-2025-14847), is being actively exploited in the wild, with over 80,000 potentially vulnerable servers exposed on the ...

CISA ordered U.S. federal agencies to patch an actively exploited MongoDB vulnerability (MongoBleed) that can be exploited to steal credentials, API keys, and other sensitive data.

Urgent Security Update: Patching “Mongobleed” (CVE-2025-14847) in Percona Server for MongoDB

CVE-2025-14847 (MongoBleed) — A High-Severity Memory Leak in MongoDB

AWS regexp fail, Sjölogistik hade alla säkerhetshål, MongoBleed, Pre-boot attack mot UEFI, och Powershell XSS! 50:42 AWS hackat via regexp bug AWS CodeBuild kasst regexp lämnade viktiga repon vidöppna för konton med snarlika ID! Länkar: wiz.io/ Yuval Avrahami, Nir Ohfeld: CodeBreach - Supply Chain Vuln & AWS CodeBuild Misconfig | Wiz Blog - Wiz Research discovered CodeBreach, a critical vulnerability that risked the AWS Console supply chain. Learn how to secure your AWS CodeBuild pipelines.

MongoBleed exposed 87,000 internet-facing MongoDB databases. Learn who’s at risk, how to patch immediately, and how to secure your data.

A severe vulnerability affecting multiple MongoDB versions, dubbed MongoBleed (CVE-2025-14847), is being actively exploited in the wild, with over 80,000 potentially vulnerable servers exposed on the ...

MongoBleed and a recent OWASP CRS bypass show how parsing problems remain a source of security flaws regardless of programming language. We talk with Kalyani Pawar about how these problems rank against the Top 25 CWEs for 2025 and what it means for relying on LLMs to generate code. Show Notes:

Introduction: A severe vulnerability, dubbed "MongoBleed" (CVE-2025-14847), is actively being exploited in the wild, threatening MongoDB instances globally. This critical flaw allows unauthenticated remote attackers to read uninitialized server memory, potentially leaking database credentials, API keys, session tokens, and sensitive personal data. With a high CVSS score of 8.7 and over 87,000 instances exposed on the internet, immediate action is required to secure affected database servers.