SecurityWeek Roundup: phpBB Flaw, WordPress Supply-Chain Attack and More
Summary
SecurityWeek’s roundup covers a critical phpBB flaw, a WordPress plugin supply-chain attack, malicious JetBrains plugins stealing AI keys, other security issues, and recent actions by AWS, Apple and the US DOT.
Key points
- A phpBB authentication bypass affects versions up to 3.3.16 and 4.0.0-a2; the article advises upgrading to 3.3.17 or the latest master branch.
- A supply-chain attack involving OptinMonster, TrustPulse and PushEngage scripts is believed to have affected more than 1.2 million WordPress sites, creating rogue administrator accounts and a hidden backdoor.
- At least 15 malicious JetBrains Marketplace plugins, with nearly 70,000 installs, reportedly steal AI service API keys and send them in plaintext to an attacker-controlled server.
- A Google Cloud Config Connector issue can let a Kubernetes namespace user escalate to Organization Owner; Google classified it as working as intended and left it unpatched.
- Apple firmware update 1B211 patches CVE-2025-20701, which could allow a nearby attacker to access the microphone of certain unpaired Beats devices seeking connections.
- Researchers linked the Popa Android TV box botnet to proxy provider NetNut; NetNut and Alarum Technologies disputed the researchers’ allegations.
- The US DOT closed its investigation into Delta’s response to the 2024 CrowdStrike outage without penalties, finding the airline provided adequate passenger support.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering vulnerability disclosures, supply-chain compromise, malicious plugins, cybercrime, and security policy developments.
- Impact
- Reported incidents included a phpBB authentication bypass enabling user impersonation and administrative access; Chrome extensions capable of exposing browser-session data; a supply-chain attack affecting more than 1.2 million WordPress sites; malicious JetBrains Marketplace plugins exfiltrating developer API keys; and a data leak affecting Madison Square Garden and Knicks-related individuals and customers. The roundup also covered a microphone-access vulnerability in Beats Studio Buds, a reported botnet-to-proxy-provider link disputed by the companies involved, a Google Cloud Config Connector privilege-escalation issue, and the closure of the Department of Transportation’s investigation into Delta’s CrowdStrike outage response.
MITRE ATT&CK
T1098 · Account ManipulationThe injected payload reportedly created rogue administrator accounts on affected WordPress sites.T1195.002 · Compromise Software Supply ChainAttackers compromised an UpdraftPlus instance and CDN key to inject malicious scripts into OptinMonster, TrustPulse, and PushEngage plugin CDN scripts.
CVE
Threat Actors
ShinyHuntersThe article reports that ShinyHunters published Madison Square Garden data, including Knicks-related and customer information, to pressure victims.Velvet AntThe article identifies Velvet Ant as a China-nexus actor that compromised an organization’s segregated network, using footholds and backdoored components for credential theft and persistent access.
Vendors
Alarum TechnologiesResearchers linked the large Popa Android TV box botnet — used for residential proxy traffic in ad fraud and scraping — to NetNut, operated by publicly traded Israeli company Alarum Technologies.Amazon Web ServicesAWS unveils ContinuumAppleApple releases Beats firmware fixing unauthenticated mic accessAwesome MotiveAttackers injected malicious JavaScript into Awesome Motive’s OptinMonster, TrustPulse, and PushEngage WordPress plugin CDN scripts.GoogleGoogle acknowledged the issue internally as P1/S1 but later classified it as “working as intended” and left it unpatched.JetBrainsJetBrains Marketplace plugins steal developer AI keysNetNutResearchers linked the large Popa Android TV box botnet — used for residential proxy traffic in ad fraud and scraping — to NetNut, operated by publicly traded Israeli company Alarum Technologies.
Products
Beats Studio BudsBeats Studio Buds firmware update 1B211 patches CVE-2025-20701, which allowed nearby attackers to listen via the microphone on unpaired devices actively seeking connections.Google Kubernetes Config ConnectorGCP Config Connector enables org-wide IAM owner takeoverJetBrains MarketplaceJetBrains Marketplace plugins steal developer AI keysMaxAICritical vulnerabilities in SiderAI (Spyder) and MaxAI (MaXSS) agentic side-panel Chrome extensions can allow malicious websites to trigger arbitrary extension actions, including hidden tab screenshots, AI memory dumps,OptinMonster1.2 million WordPress sites compromised in OptinMonster supply chain attackphpBB10-year-old phpBB flaw enables session hijackingPushEngageAttackers injected malicious JavaScript into Awesome Motive’s OptinMonster, TrustPulse, and PushEngage WordPress plugin CDN scripts.SiderAICritical vulnerabilities in SiderAI (Spyder) and MaxAI (MaXSS) agentic side-panel Chrome extensions can allow malicious websites to trigger arbitrary extension actions, including hidden tab screenshots, AI memory dumps,TrustPulseAttackers injected malicious JavaScript into Awesome Motive’s OptinMonster, TrustPulse, and PushEngage WordPress plugin CDN scripts.UpdraftPlusThe breach stemmed from a compromised UpdraftPlus instance and CDN key.WordPress1.2 million WordPress sites compromised in OptinMonster supply chain attack