In today’s cybersecurity news…

MANGO discloses data breach

Spanish fashion retailer MANGO disclosed a data breach after one of its external marketing vendors was compromised, exposing customer data including first names, countries, postal codes, emails, and phone numbers. Financial and identity data weren’t affected, and MANGO’s internal systems reportedly remain secure. The company has notified Spain’s data protection authority and set up a support hotline for affected customers. No ransomware group has claimed responsibility. (Bleeping Computer)

Threat group ‘Jewelbug’ infiltrates Russian IT network

Chinese-linked threat group Jewelbug conducted a five-month intrusion targeting a Russian IT service provider, gaining access to code repositories and software build systems. Symantec links Jewelbug to previous activity clusters and notes the group uses stealthy techniques, including cloud services, renamed Microsoft debugging tools, DLL side-loading, and credential dumping. (The Hacker News)

F5 discloses breach tied to nation-state threat actor

CISA issued an emergency directive after F5 disclosed that a nation-state actor had long-term access to its systems, stealing BIG-IP source code and details on undisclosed vulnerabilities. Agencies now have to patch affected F5 products by Oct. 22nd and report deployments by Oct. 29th. The breach was discovered in August and exposed configuration data for some customers but didn’t show supply chain tampering. F5 says it’s expelled the attackers while working with  CrowdStrike and Mandiant. CISA warned the stolen data poses a “significant threat” to federal networks. (CyberScoop) (The Record)

Windows Server updates cause Active Directory issues

Microsoft confirmed that September’s Windows Server 2025 updates are breaking Active Directory synchronization, affecting services like Microsoft Entra Connect Sync. The bug prevents full sync of large AD security groups exceeding 10,000 members. Microsoft issued a registry workaround but warned it could cause system issues if done incorrectly. A permanent fix is in development. The company is also addressing a separate update failure affecting Windows 11 24H2 and Windows Server 2025 when installing from network shares. (Bleeping Computer)

Huge thanks to our sponsor, Vanta

PowerSchool hacker sentenced to 4 years in prison

A Massachusetts man, 19-year-old Matthew Lane, was sentenced to four years in prison for hacking educational software company PowerSchool and demanding a $2.9 million ransom to avoid leaking data on more than 70 million people. Lane was also ordered to pay about $14 million in restitution and a $25,000 fine. The breach, disclosed in January, exposed Social Security numbers, medical data, and special education information for 60 million students and 9 million teachers. Prosecutors sought a seven-year sentence, citing Lane’s history of hacking. (The Record)

Devs are writing ‘secret’ VS Code extensions

Researchers from Wiz Security, working with Microsoft, found that over 500 VS Code and Open VSX extensions from hundreds of publishers exposed API keys, credentials, and tokens. More than 100 of these could have let attackers push malicious updates to users, with auto-updates amplifying the risk of supply chain attacks. High-risk targets included AI platforms, cloud services, and databases. Microsoft has implemented secrets scanning and blocked leaky extensions, working with developers to replace them with sanitized versions.  (The Register)

200,000 Linux systems vulnerable to Secure Boot bypass

Researchers at Eclypsium found that about 200,000 Linux systems from Framework shipped with signed UEFI components vulnerable to Secure Boot bypass. Legitimate diagnostic tools included in the UEFI shells, specifically the “mm” command, can overwrite the gSecurity2 pointer, disabling signature verification and allowing attackers to load unsigned bootkits or rootkits, achieving persistent pre-OS control. Framework is issuing DBX updates to block vulnerable shells, with fixes varying by model. Experts recommend updating UEFI revocation lists, using BIOS passwords, and scanning firmware for vulnerable components. (Security Affairs)

Whisper 2FA behind one million phishing attempts since July

Barracuda researchers say the phishing platform “Whisper 2FA” has driven nearly one million phishing attacks since July, making it one of the most active phishing-as-a-service tools after Tycoon and EvilProxy. The kit uses AJAX to repeatedly harvest credentials and MFA codes in real time, bypassing two-factor authentication. Newer versions include heavy obfuscation, Base64/XOR encoding, and anti-debugging features. Attackers impersonate brands like DocuSign, Adobe, and Microsoft 365, using invoice or voicemail lures. Barracuda calls it evidence of increasingly sophisticated, full-service phishing platforms. (Infosecurity Magazine)