InfoSecBulletin Cybersecurity for mankind
The Clop ransomware gang claims to have breached Oracle’s internal systems and has listed the company on its dark web leak site.
This is part of a large extortion campaign that takes advantage of a serious zero-day vulnerability in Oracle E-Business Suite (EBS), dubbed CVE-2025-61882.
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Apple Patches 28 Security Flaws in macOS, iOS, and iPadOS
DoNot (APT-C-35) Targeting Bangladesh Military Personnel
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVD in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Fortinet Fixes Multiple Flaws in FortiWeb, FortiManager, and FortiClient
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
Security experts report that Clop affiliates started using this vulnerability as early as August 2025, before Oracle issued a fix in October 2025.
The exploit chain specifically targets the OA_HTML/SyncServlet endpoint to bypass authentication, followed by malicious XSLT template injection via OA_HTML/RF.jsp to execute arbitrary commands.
This “pre-auth” nature allowed attackers to compromise servers without valid credentials, granting them full control over sensitive ERP data.
cybersecuritynews reported, evidence from Clop’s leak site shows a “PAGE CREATED” status for ORACLE.COM, listed with major companies like MAZDA.COM, HUMANA.COM, and the Washington Post.
The Oracle Corporation listing hints that the company may have suffered from its own software issue.
Victims report receiving extortion emails from addresses like support@pubstorm[.]com, threatening the release of financial and personal records if ransom demands are not met.
