Oracle E-Business Suite Exploit, Kido Nursery Attack and Passkey Trade-offs

Summary

The hosts discuss active exploitation of an Oracle E-Business Suite vulnerability, an extortion attack on UK nursery chain Kido that led to two arrests, and the benefits and implementation challenges of passkeys.

Key points

• The hosts say an Oracle E-Business Suite vulnerability, identified in the transcript as CVE 202561882, was exploited before a patch was issued; they also mention active proofs of concept.
• The described exploit chain involves an XML request, server-side request forgery, CRLF injection and path traversal, enabling unauthorized remote code execution.
• The hosts attribute extortion attempts targeting corporate executives to the group they name as “Klopp”; they say a patch is available but unpatched targets remain.
• Two 17-year-olds were arrested after an attack on British nursery chain Kido. The hosts say the extortion involved publishing children’s photos and parents’ contact details and calling parents; the material was later pulled and the attempts stopped.
• The hosts describe passkeys as using a public key stored by the service and a private key kept on the user’s device, and recommend using them where available.
• They note passkey limitations, including uneven support, difficulty moving credentials between ecosystems, challenges for enterprise auditing and a potential risk if a provider’s synchronization service is compromised.

MITRE ATT&CK

Threat Actors

Vendors

Related Articles

• BHIS Discusses Reported Gemini Containment Failure and AI Security RisksBlack Hills Information SecurityKlopp
• Scanner-Evading JavaScript Campaign Targets 953 Online Stores, Mostly Magentothehackernews.comT1190
• Weekly Recap: PHP2Shell RCE Flaws Draw Millions of Exploitation Attemptsthehackernews.comT1190
• PHP2Shell Exploitation Reaches Working Shells on Honeypotssecurityweek.comT1190
• Node2Shell Brotli Flaw Prompts Patches Across Microsoft, Node.js and Pythonsecurityweek.comT1190