InfoSecBulletin Cybersecurity for mankind
The Clop ransomware gang claims to have breached Oracle’s internal systems and has listed the company on its dark web leak site.
This is part of a large extortion campaign that takes advantage of a serious zero-day vulnerability in Oracle E-Business Suite (EBS), dubbed CVE-2025-61882.
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
Security experts report that Clop affiliates started using this vulnerability as early as August 2025, before Oracle issued a fix in October 2025.
The exploit chain specifically targets the OA_HTML/SyncServlet endpoint to bypass authentication, followed by malicious XSLT template injection via OA_HTML/RF.jsp to execute arbitrary commands.
This “pre-auth” nature allowed attackers to compromise servers without valid credentials, granting them full control over sensitive ERP data.
cybersecuritynews reported, evidence from Clop’s leak site shows a “PAGE CREATED” status for ORACLE.COM, listed with major companies like MAZDA.COM, HUMANA.COM, and the Washington Post.
The Oracle Corporation listing hints that the company may have suffered from its own software issue.
Victims report receiving extortion emails from addresses like support@pubstorm[.]com, threatening the release of financial and personal records if ransom demands are not met.
