A critical command injection vulnerability, CVE-2025-11953, in the React Native Community CLI's Metro Development Server is being actively exploited. This flaw allows unauthenticated, remote attackers to execute arbitrary code on developer machines, posing a significant risk to development environments.
Vulnerability Details
Affected Product: @react-native-community/cli-server-api package, versions 4.8.0 through 20.0.0-alpha.2
Identifier: CVE-2025-11953
CVSS Score: 9.8 (Critical)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Critical. Immediate patching or mitigation is required due to active, unauthenticated remote exploitation.
Attack Vector: The vulnerability is exploited via the network by sending a specially crafted POST request to the Metro server's `/open-url` endpoint. Lack of input sanitization allows for OS command injection.
Ease of Exploit: Trivial. The attack complexity is low, requires no user interaction or privileges, and public proofs-of-concept are available.
Action Plan
Immediate Action: Upgrade the @react-native-community/cli-server-api package to version 20.0.0 or higher.
Workaround: If an immediate upgrade is not possible, bind the development server to localhost to prevent external network access by running the start command configured to bind strictly to localhost (e.g., using the standard host flag set to 127[.]0[.]0[.]1).
Detection: Monitor for incoming POST requests to the `/open-url` or `/open-stack-frame` endpoints on developer machines running the Metro server. Check for suspicious processes originating from the Node.js process, especially on Windows.
Relevant professional terms
Remote Code Execution (RCE)
A class of software vulnerability that allows a malicious actor to execute commands of their choosing on a remote machine over a network, such as the internet.
Input Sanitization
The process of cleaning and filtering user-provided data to prevent it from causing unintended and malicious actions, such as executing OS commands or injecting malicious code.
A critical misconfiguration in the Moltbook social network for AI agents exposed its entire production database, granting unauthenticated read and write access. This incident, which has been remediated, exposed 1.5 million API authentication tokens, thousands of user email addresses, and private messages. While there is no official CVE for this misconfiguration, a separate critical vulnerability (CVE-2026-25253) was identified in the underlying OpenClaw AI agent framework.
Vulnerability Details
Affected Product: Moltbook (all versions prior to remediation)
Exploitation Status: No evidence of exploitation in the wild for the misconfiguration.
Risk & Impact
Triage: Critical. The exposure of API keys and private data requires immediate validation that all credentials have been rotated.
Attack Vector: The vulnerability was a misconfigured Supabase database that left a public API key with full database access because Row Level Security (RLS) was not enabled. An attacker could access the database without any authentication.
Ease of Exploit: Trivial. Researchers discovered the exposed API key in client-side JavaScript within minutes of a routine security review.
Action Plan
Immediate Action: The Moltbook team secured the database within hours of being notified by researchers.
Workaround: Users should rotate any API keys or credentials that may have been associated with their Moltbook agents or exposed in private messages.
Detection: Monitor for any unusual activity from AI agents, such as unauthorized posts or interactions, which could indicate account hijacking.
Relevant professional terms
API Key
An Application Programming Interface key is a unique identifier used to authenticate a user, developer, or calling program to an API, controlling access to the service.
Row Level Security (RLS)
A database security feature that restricts, on a per-user basis, which rows of data a user can access in a database table. Moltbook's failure to enable RLS was a key factor in this data exposure.
Threat actors are publishing hundreds of malicious packages, known as "skills," for the OpenClaw AI assistant on official and community platforms like ClawHub and GitHub. These skills are designed to deceive users into installing password-stealing malware and other malicious payloads on Windows and macOS systems.
Key TTPs
Initial Access: Distributing malicious skills disguised as legitimate tools (e.g., crypto trackers) on the ClawHub marketplace and GitHub.
Execution: Tricking users into running external scripts and executables during the skill's installation process.
Defense Evasion: Using Base64 encoding for macOS payloads and packed executables for Windows to complicate detection.
Campaign Analysis
This campaign represents a significant supply chain attack targeting the emerging AI agent ecosystem. By abusing the trust users place in community-driven marketplaces, attackers can effectively distribute malware like the Atomic Stealer (AMOS).
Targeting & Infrastructure
Target Profile: Users of the OpenClaw (formerly MoltBot/ClawdBot) personal AI assistant on both Windows and macOS.
Infrastructure: The official ClawHub skill marketplace and cloned or typosquatted GitHub repositories.
Relevant Terms
Supply Chain Attack: A cyberattack that targets a trusted third-party vendor or software that has access to a victim's systems or data.
Infostealer: A type of malware designed specifically to collect and exfiltrate sensitive information, such as login credentials, financial data, and personal files, from a victim's computer.
A malware-free phishing campaign is targeting corporate users with emails containing PDF lures. These lures redirect victims through multiple layers to a fake Dropbox login page designed to harvest their account credentials for subsequent attacks.
Key TTPs
Initial Access: Phishing emails, potentially from spoofed or compromised internal accounts, entice users to open a PDF attachment.
Execution: Users are manipulated into clicking links within the PDFs, leading them to a credential harvesting page impersonating a legitimate Dropbox login portal.
Defense Evasion: The attack is malware-free and uses legitimate cloud services for hosting redirection links, helping to bypass standard email security checks like SPF, DKIM, and DMARC.
Campaign Analysis
This multi-stage attack leverages trusted brands and legitimate infrastructure to appear authentic, making it highly effective at deceiving employees. Once captured, credentials and user data are exfiltrated to an attacker-controlled Telegram bot for use in account takeovers or further fraud.
Targeting & Infrastructure
Target Profile: The campaign broadly targets employees within corporate environments.
Infrastructure: Attackers use legitimate cloud hosting providers like Vercel to host intermediary pages, adding a layer of legitimacy to the phishing links.
Relevant Terms
Phishing: A type of social engineering attack where attackers deceive individuals into divulging sensitive information, such as login credentials, by impersonating a trustworthy entity.
Credential Harvesting: The process of collecting login information like usernames and passwords, often through phishing pages or malware, for unauthorized access.
Between June and December 2025, threat actors compromised the update infrastructure of Notepad++, redirecting targeted users to malicious servers for espionage purposes. The attackers, believed to be a Chinese state-sponsored group, leveraged access to a hosting provider to deliver malicious payloads.
Key TTPs
Initial Access: Compromise of a shared hosting provider to intercept and redirect update traffic.
Execution: Users were served a malicious NSIS installer which executed a payload via DLL Side-Loading.
Defense Evasion: Attackers used obfuscated files, dynamic API resolution, and rotated C2 infrastructure to avoid detection.
Campaign Analysis
This sophisticated supply chain attack highlights the risk of infrastructure-level compromises, where trusted software distribution channels are weaponized. The attackers demonstrated adaptability by rotating payloads and C2 servers monthly to maintain persistence and evade detection.
Targeting & Infrastructure
Target Profile: Highly selective targeting of government, financial, and IT organizations in Southeast Asia.
Infrastructure: Utilized a network of constantly rotating C2 servers to distribute malicious updates and payloads.
Relevant Terms
Supply Chain Compromise: An attack strategy that targets less-secure elements in a software or hardware supply chain to attack a primary target.
DLL Side-Loading: A technique where an attacker places a malicious DLL in a location where a legitimate application will load it instead of the intended one.
Attackers are increasingly injecting malicious code into open-source repositories, camouflaging their activity within normal developer workflows. A recent ReversingLabs report highlights a significant surge in these attacks, turning routine software updates into potential mass malware delivery events.
Key Findings
Malicious open-source packages detected saw a 73% increase in 2025.
Threats circulating in open-source repositories grew by over 1,300% between 2020 and 2023.
A single worm-like malware campaign, Shai-hulud, compromised over 1,000 npm packages and exposed an estimated 25,000 GitHub repositories.
Data exfiltration malware now accounts for 37% of all malicious packages, as attackers target developer credentials and proprietary information.
The Bottom Line
The strategic infiltration of the software supply chain signifies that perimeter defenses and traditional scanning are no longer sufficient. Adversaries are abusing the inherent trust and automation in modern CI/CD pipelines. This reality demands a "shift left" security posture, embedding continuous monitoring and dependency validation directly into the development lifecycle to detect threats that masquerade as legitimate developer activity.
Relevant Terms
Software Supply Chain: The entire ecosystem of components, libraries, tools, and processes involved in the development and delivery of a piece of software.
CI/CD Pipeline: Continuous Integration/Continuous Deployment; an automated process for developers to deliver code changes more frequently and reliably.
French prosecutors, with support from Europol, raided the Paris offices of social media platform X as part of a criminal investigation into its Grok AI tool. The probe focuses on the generation of sexually explicit deepfakes and other illegal content.
The Scheme
TTP 1: Use of the Grok generative AI tool to create non-consensual, sexually explicit deepfake images.
TTP 2: Dissemination of illegal content, including illegal content involving minors and Holocaust denial.
TTP 3: Alleged manipulation of platform algorithms that may have distorted data processing systems.
The Consequence
Outcome: An ongoing criminal investigation by the Paris prosecutor's cybercrime unit, with Elon Musk and former CEO Linda Yaccarino summoned for voluntary interviews.
Strategic Takeaway
This raid signals heightened regulatory scrutiny on tech platforms, establishing a precedent for holding them accountable for the malicious use of their proprietary AI tools.
Relevant Terms
Deepfake: AI-generated synthetic media where a person's likeness is replaced with someone else's, often used to create convincing but fake images or videos.
Europol: The European Union's law enforcement agency, which supports member states in combating serious international crime and terrorism.
