The Signal
Today’s clearest operational risks sit at trust boundaries: a remote-management access path, attacker-controlled application inputs, and an AI workflow component can turn ordinary management or data-handling surfaces into code-execution or endpoint-control concerns. The police action supplies context on the criminal infrastructure that defenders must account for in their daily planning. [1][2][3][4]
Must Know
Identity · Certcc Vulnotes
What happened
ComfyUI-Easy-Use version 1.4.1 and earlier has a vulnerability in save_preview() that lets an unauthenticated attacker overwrite an installed custom node’s Python file. [3]
An attacker can upload a Python file to ComfyUI’s input directory and use save_preview() to replace a custom node’s __init__.py; ComfyUI imports and executes the modified node after restart. [3]
Why it matters
Successful exploitation allows arbitrary Python code and operating-system commands with the privileges of the ComfyUI process. [3]
Cloud · Cyberscoop
What happened
Huntress said an intruder used access to cloud-hosted ScreenConnect panels to push commands to managed endpoints, installing attacker-controlled ScreenConnect copies on at least 288 computers across 48 organizations. [1]
Huntress said about one-third of the machines were reached within 10 minutes and all were reached within approximately 90 minutes. [1]
Why it matters
Huntress said the extension bypassed ScreenConnect user accounts, roles, and MFA by authenticating with a shared access key instead. [1]
Supply Chain · Certcc Vulnotes
What happened
The npm library promzard, versions 4.0.0 and earlier, is vulnerable to remote code execution because context-object keys are interpolated as unsanitized JavaScript source and evaluated. [2]
promzard evaluates a generated function-expression source string with vm.runInThisContext(), allowing attacker-controlled syntax in a context key to execute during evaluation. [2]
Why it matters
An attacker who can influence ctx keys, including through a parsed configuration file, HTTP request, or environment variable, can break out of the function-parameter list and inject arbitrary JavaScript into the Node.js process. [2]
Identity · Cyberscoop
What happened
Police in nine countries, with private-sector partners, dismantled parts of three malware operations linked to ransomware, data theft, intrusions, extortion and fraud, seizing 235 servers and 257 domains and identifying credentials belonging to 6.4 million victims. [4]
CastleRAT, a remote-access trojan, had 120 servers and 39 domains seized; authorities said its anti-detection mechanisms had made it difficult to identify. [4]
Why it matters
The operation targeted a cybercrime-as-a-service market in which toolkit developers sell or rent malware to other actors for intrusions, extortion and fraud; seized credentials were offered for further attacks, including ransomware. [4]
Also Worth Knowing
AI & Agents · Malwarebytes Labs
What happened
Former FBI supervisor Patrick Steven Yaroch pleaded guilty to wire fraud and money laundering after stealing approximately $2.47 million from cryptocurrency wallets linked to FBI investigations. [5]
Identity · Securityaffairs
What happened
On 11 November, bomb-threat emails reached about 6,000 Italian schools; threats were also reported in Northern Ireland, Scotland and Ireland. Searches in Italy found no bombs, and police in Scotland classified investigated cases as hoaxes. [6]
AI & Agents · Helpnetsecurity
What happened
Anthropic released a self-hosted version of Claude Managed Agents, allowing companies to run the agent harness, sandboxes, credentials, and session history in their own cloud or on-premise environment. [7]