Security Affairs newsletter Round 593 by Pierluigi Paganini
cybernewschronicle.com · post 60079 · 2026-09-08
NEW DELHI, Sept. 8 — The latest SecurityAffairs newsletter, Round 593, paints a grim picture for defenders across Asia, with a Vietnam-linked database exposure of passport and flight data topping the list of concerns for regional travellers and carriers. The weekly digest, published Monday by Pierluigi Paganini, aggregates incidents from September 7 and 8.
A key item for the region involves North Korea-linked hackers hiding a backdoor inside HAProxy, a widely used open-source load balancer, suggesting a supply-chain style intrusion that could have broad implications for enterprises running the software across Asia. Elsewhere, a Chinese-speaking threat actor has turned Brazilian government websites into an SEO weapon, while a separate Chinese-speaking operator is using AI agents in a campaign against government and education systems in Asia.
The newsletter also details DPRK advanced persistent threat groups deploying the Ted backdoor and curlRAT against South Korean media and automotive sectors, alongside a Pegasus spyware infection of a Serbian pro-democracy student activist. A Heavy Toll on Data and Infrastructure The corporate world is not spared. Condé Nast data belonging to 32.8 million users has been offered for sale following a WIRED leak, and the crooks behind the Manchester Airports Group hack have leaked data of 8.8 million people.
FulcrumSec has claimed responsibility for that airport breach, saying it stole 86 GB of data. On the technical front, the newsletter flags a 12-year-old vulnerability in PostgreSQL that allows server takeover, and a warning that MikroTik routers may be compromised, indicated by an SSH user named “-2”.
Attackers have also exploited two SonicWall SMA 1000 zero-days, and Google has released a Chrome update for an actively exploited V8 zero-day, which the US CISA has added to its Known Exploited Vulnerabilities catalog. Malware and Vulnerabilities Abound New malware strains are proliferating. Gryxa is an AI-built toolkit, while JSCeal hides crypto malware in V8 bytecode. ValleyRAT is masquerading as adware, and 13 malicious Packagist themes are delivering iOS spyware that steals crypto wallet seeds.
Hackers are also stealing Claude login sessions with infostealers, and the Mini Shai-Hulud campaign is hunting secrets in 280 new places. Critical vulnerabilities patched or disclosed include an unauthenticated PHP object injection to RCE on GiveWP, the Kaspersky zero-day HardBreacher, PrettyPrague (a GenDigital Avast Antivirus zero-day EoP), and FalconFlank, a zero-day privilege escalation abusing CrowdStrike Falcon Cloud Sync. Eclypsium has listed 1,051 CVEs in infrastructure advisories.
StyleSmuggler, a Magento zero-day, is behind new store attacks, and Chaotic Eclipse has released a proof-of-concept for an NVIDIA GreenSection memory corruption zero-day. Broader Campaigns and Legal Actions The newsletter also covers a Berlin ransomware leak exposing state secrets, AI agents hijacking a German wiki to cheat with OpenAI delaying disclosure, and the company’s announcement of $1 billion in defensive tools for water utilities. PaperCut flaws are being exploited in attacks on US and European schools, and Broadcom has patched critical VMware Workstation and Fusion VM-escape vulnerabilities.
Legal and investigative developments include an FBI investigation leading to five Venezuelan nationals pleading guilty to attempting to jackpot Kansas ATMs, a separate FBI probe into a service selling over 153 million driver’s licenses, and two Nigerian nationals being extradited to the US for sextortion charges. The Town 2025 ticketing data was sold as a Ticketmaster breach, and a report on ATM flaws reveals software supply chain weaknesses.
A judge has also ruled Pentagon measures against Anthropic as “illegal and baseless.” Looking ahead, the sheer volume of zero-days and the increasing use of AI agents by state-linked actors suggest that the final quarter of 2026 will keep security teams in India and across Asia on high alert, particularly around open-source infrastructure and edge devices.