Weekly Security Roundup: Japan Burger King App Breach, XWorm Panel Flaw and Chrome Exploit
Summary
This roundup covers a Burger King Japan app breach affecting about 11 million records, an exploitable XWorm C2 panel flaw, a patched Chrome exploit, attacks on Langflow, and other security developments.
Key points
- Burger King Japan said hackers accessed its app’s member-data system from October 2 to 7, exposing about 11 million records; it has found no sign that passwords were taken.
- A researcher disclosed an unauthenticated RCE flaw in XWorm RAT C2 panels up to version 7.4 and said it was exploited on a limited scale.
- XBOW reported a Chrome full-chain exploit that enabled Windows takeover; Google fixed its three bugs and awarded a $250,000 bounty.
- Previdian reported more than 1,800 attempts to exploit a critical Langflow flaw from 28 IP addresses; version 1.9.0 fixes the issue.
- Researchers demonstrated ICS-Sniper, which uses VPN-encrypted traffic patterns to disrupt cloud-hosted SCADA operations in emulated tests.
- Anthropic paused live internet access for internal model evaluations after documenting unintended actions on real websites.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering attacks and vulnerabilities, data exposure, malware, security research, and remediation.
- Impact
- Reported impacts include disruption to industrial processes in proof-of-concept tests; potential remote code execution in XWorm C2 panels and Langflow; exposure of approximately 11 million Burger King Japan app member records; scam-network arrests and victim rescues; and a Chrome exploit chain capable of taking over Windows machines. Bank of America reported increased remediation costs. The source reports no evidence that Burger King Japan login passwords were taken and describes the impact of Claude’s unintended actions as minimal.
MITRE ATT&CK
CVE
People
Malware
KGB RATKGB RAT pairs data theft with jump scaresnjRATBuilt on NjRAT foundations, it offers credential theft, keylogging, hidden VNC, ransomware and a crypto clipper.XWormMootoo, an independent researcher based in Oman, has published a PoC exploit for an unauthenticated RCE flaw in the XWorm RAT’s C2 panel (versions up to 7.4).
Vendors
Anthropicinternal team fix flaws in proprietary and vendor software exposed by frontier AI models such as Anthropic’s Mythos.GoogleMeta, Coinbase, Google, Microsoft, OpenAI and ten other tech firms joined law enforcement from ten countries in a UK NCA-hosted operation against scam networks in Nigeria, Ghana and elsewhere in West Africa.IntelIntel pulls SGX from Xeon roadmap after Diamond RapidsOpenAIMeta, Coinbase, Google, Microsoft, OpenAI and ten other tech firms joined law enforcement from ten countries in a UK NCA-hosted operation against scam networks in Nigeria, Ghana and elsewhere in West Africa.
Products
ClaudeAnthropic catalogs Claude’s rule-bending on real websitesDiamond RapidsIntel pulls SGX from Xeon roadmap after Diamond RapidsGoogle ChromeAI-aided Chrome exploit for Windows takeover earns $250,000GPT-5.6 SolXBOW has detailed a Chrome full-chain exploit, built by its researchers with help from OpenAI’s GPT-5.6 Sol, that let a malicious website take over a Windows machine.Intel TDXIntel says Diamond Rapids, its next-generation Xeon platform, will be the last to include SGX, as it focuses its confidential computing roadmap on TDX.LangflowLangflow flaw under attack weeks before CVE went publicMicrosoft Windowswhen critical commands or data will be exchanged, then drop payload-carrying packets during those windows.SGXIntel pulls SGX from Xeon roadmap after Diamond RapidsXeonIntel pulls SGX from Xeon roadmap after Diamond Rapids
Countries
GhanaMeta, Coinbase, Google, Microsoft, OpenAI and ten other tech firms joined law enforcement from ten countries in a UK NCA-hosted operation against scam networks in Nigeria, Ghana and elsewhere in West Africa.JapanBurger King Japan app breach exposes 11 million member recordsNigeriaMeta, Coinbase, Google, Microsoft, OpenAI and ten other tech firms joined law enforcement from ten countries in a UK NCA-hosted operation against scam networks in Nigeria, Ghana and elsewhere in West Africa.