Some software updates pack in a number of features and changes, while others fundamentally overhaul the experience of using the device in question. iOS 18.5 is neither: This is a minor update, but that's to be expected. WWDC is next month, where Apple will almost assuredly announce iOS 19.But iOS 18.5 isn't an empty update. Once you install it on your iPhone, you will notice some changes—and some of the changes you don't notice are the most important of all. Here's everything that's new in the latest iOS update:An easy way to disable contact photos in MailWith iOS 18.2, Apple upgraded the Mail app. For some, the changes made the Mail app more organized and efficient to use. For others, it was bloated and confusing. Contact photos didn't help. The idea is that if you have a contact photo for a sender, it'll appear in the left side of the message in your inbox. However, if you don't have such a photo, Mail will use an image from Apple's stock library. Taste is subjective, but, frankly, these stock icons just don't look good. Luckily, you can disable them, but you'd never know that unless you're someone who loves diving through your Settings app. iOS 18.5 fixes that with an easy option right in the Mail app itself. Lifehacker's Khamosh Pathak explained the change in more depth here. It just got more difficult to bypass Screen Time settingsApple's Screen Time feature is a great tool for parents—and, I can only image, a pain for kids. Parents can set a passcode to lock Screen Time settings, and ensure that kids can't access aspects of their iPhone their parents don't want them to. Of course, passcodes are an infamously futile restriction, as savvy kids will always figure out how to break in. While Apple's isn't reinventing the passcode wheel with iOS 18.5, it is making Screen Time a bit more secure. Once you update, you'll receive a notification whenever the Screen Time passcode is used on a child's device. That won't stop your kids from figuring out your Screen Time passcode, but it will nip their fun in the bud pretty quickly.I imagine the kids will figure out some workaround to this feature in the future. But, for now, you have an additional tool to help ensure the restrictions stay in place. A new "Pride Harmony" wallpaper Credit: Apple In anticipation of Pride Month, Apple is rolling out a new "Pride Harmony" wallpaper for its various devices. The wallpaper features colors of the rainbow that adjust their positions as you move, lock, or unlock your iPhone or iPad. Apple also has a new Pride Edition Sport Band, which features a similar color scheme. Apple says its goal with the Pride Harmony design is to "celebrate the strength and beauty of LGBTQ+ communities around the world." It's easy to be cynical about corporate pride, but considering the times we live in, it's cool to see Apple continuing to be as openly supportive of the LGBTQ+ community as it has been in recent years. (Tim Cook's donations aside.)"Buy with iPhone" now available on third-party devicesWhen you buy something on the Apple TV's TV app (say that three times fast), you have the option to approve that purchase with your iPhone. With iOS 18.5, that feature is coming to the TV app on non-Apple devices. That way, you don't need to make the purchase on the TV app of another Apple device before being able to watch on your third-party device. Carrier-provided satellite features are now available on the iPhone 13 seriesSince 2023, Apple has officially supported satellite communications for all iPhones starting with the 14 series. If you're out without cell services, you can connect to a satellite to reach out to the authorities for help—or even just text a friend. Following this latest update, however, iPhone 13 users will be able to take advantage of satellite features as well. Apple Vision Pro app gets a bug fixThe update also fixes an issue with the Apple Vision Pro app, where the app may sometimes display a black screen. Security updatesiOS 18.5's sleeper feature is the security boost it provides your iPhone. In all, the update patches over 30 bugs. Luckily, Apple isn't aware of any exploits for these vulnerabilities, which means hackers have likely not used these flaws to target iPhone users. That said, the safest course of action is to update your iPhone as soon as possible, in case someone does figure out how to use these flaws against you. Plus, there are some non-hacking vulnerabilities here you should patch. FaceTime's mute button, for example, might not actually work, which should be more than enough reason to update to iOS 18.5. (Be careful when talking smack while on a FaceTime call.)You can see the full list of updates here. Source: https://lifehacker.com/tech/everything-new-in-ios-185?utm_medium=RSS #update #your #iphone #make #sure #facetime039s #mute #button #actually #works

A vulnerability has been exposed in Asus' DriverHub utility that makes it vulnerable to remote code execution attacks. Thankfully, the vulnerability has been patched and has not been used in any known hacks. Source: https://www.tomshardware.com/tech-industry/cyber-security/flaw-in-asus-driverhub-makes-utility-vulnerable-to-remote-code-execution #flaw #asus #driverhub #makes #utility #vulnerable #remote #code #execution

Two years after partnering with OpenAI to automate marketing and customer service jobs, financial tech startup Klarna says it's longing for human connection again.Once gunning to be OpenAI CEO Sam Altman's "favorite guinea pig," Klarna is now plotting a big recruitment drive after its AI customer service agents couldn't quite hack it.The buy-now-pay-later company had previously shredded its marketing contracts in 2023, followed by its customer service team in 2024, which it proudly began replacing with AI agents. Now, the company says it imagines an "Uber-type of setup" to fill their ranks, with gig workers logging in remotely to argue with customers from the comfort of their own homes."From a brand perspective, a company perspective, I just think it’s so critical that you are clear to your customer that there will be always a human if you want," admitted Sebastian Siemiatkowski, the Swedish fintech's CEO.That's a pretty big shift from his comments in December of 2024, when he told Bloomberg he was "of the opinion that AI can already do all of the jobs that we, as humans, do." A year before that, Klarna had stopped hiring humans altogether, reducing its workforce by 22 percent.A few months after freezing new hires, Klarna bragged that it saved $10 million on marketing costs by outsourcing tasks like translation, art production, and data analysis to generative AI. It likewise claimed that its automated customer service agents could do the work of "700 full-time agents."So why the sudden about-face? As it turns out, leaving your already-frustrated customers to deal with a slop-spinning algorithm isn't exactly best practice.As Siemiatkowski told Bloomberg, "cost unfortunately seems to have been a too predominant evaluation factor when organizing this, what you end up having is lower quality."Klarna isn't alone. Though executives in every industry, from news media to fast food, seem to think AI is ready for the hot seat — an attitude that's more grounded in investor relations than an honest assessment of the tech — there are growing signs that robot chickens are coming home to roost.In January of last year, a survey of over 1,400 business executives found that 66 percent were "ambivalent or outright dissatisfied with their organization’s progress on AI and GenAI so far." The top issue corporate bosses cited was AI's "lack of talent and skills."It's a problem that evidently hasn't improved over the year. Another survey recently found that over 55 percent of UK business leaders who rushed to replace jobs with AI now regret their decision.It's not hard to see why. An experiment carried out by researchers at Carnegie Mellon University stuffed a fake software company full of AI employees, and their performance was laughably bad — the best AI worker finished just 24 percent of the tasks assigned to it.When it comes to the question of whether AI will take jobs, there seem to be as many answers as there are CEOs excited to save a buck.There are gray areas, to be sure — AI is certainly helping corporations speed up low-wage outsourcing, and the tech is having a verifiable effect on labor market volatility — just don't count on CEOs to have much patience as AI starts to chomp at their bottom line.Share This Article Source: https://futurism.com/klarna-openai-humans-ai-back #company #regrets #replacing #all #those #pesky #human #workers #with #just #wants #its #humans #back

I am someone who is borderline obsessed with monitoring my health and fitness data. I use a smart scale, a calorie- and nutrient-tracking app, smart workout equipment, and my beloved Apple Watch to create a picture of my overall physical well-being that is as complete as possible. The only time I take my Apple Watch off is when I'm dressing up to go somewhere nice and even then, it pains me deeply. Just imagine the heart rate and calorie-burning data I'm missing out on while I waltz around in my fancy dress. It's sickening. All of these apps and devices work in concert to keep tabs on my every heartbeat and footstep, but there is a notable exception. I am usually against linking my Apple Watch to apps that track my workouts, as this has caused headaches in the past by double-importing data into my food-tracking app and daily Apple Health summary—this defeats the purpose of the monitoring altogether by significantly inflating my burned calories and total active minutes. Today, reluctantly, I linked my Apple Watch to my Peloton Bike, expecting it to cause the same problems—but it only impressed me. Now, I'm a believer in linking these two devices. I'll tell you why, plus how to do it. How to link your Apple Watch and Peloton deviceOn your Peloton app, select your Profile (on the right of the menu at the bottom of the home screen), then find the hamburger menu on the top right of your profile screen. Selecting that will bring you to a page called More and right there, under Add-Ons, you'll find Apple Watch. Credit: Lindsey Ellefson Tap that, grant the permissions in Apple Health when prompted, hit Set up, and you'll see three choices: Connect to Health App, Share Your Location, and Track Your Movement. For our purposes, with the Bike and other at-home workout equipment, you'll just toggle on that first one, but if you want your outdoor runs tracked privately, toggle on the second one, and if you want your pace for indoor runs and walks recorded, hit the third one, too. From there, I just opened the Watch app on my phone to double-check that the Peloton app was included in the apps installed on the device. I scrolled to the bottom of the Watch app, selected Peloton from the list under Installed on Apple Watch, and toggled on Show App on Apple Watch. Why I enjoy the link between the Apple Watch and PelotonAfter that, I hopped on my stationary bike and started up a workout. I opened up the Workout app on my watch and selected "indoor cycle," then opened the Peloton app on the watch. It showed me a blank screen with just a few words telling me to start a workout on the bike, so I did. Suddenly, the watch screen changed and began showing my heart rate. More interestingly, a small heart-rate tracker appeared on the upper left on my Peloton touch screen along with a power bar showing what "zone" I was in based on my heart rate. (My Peloton "power zones" are customized to my fitness level because I took the FTP test offered through the bike, which you should also do.) There's already plenty of information available on the screen, like cadence, resistance, and output, but I didn't find this distracting. It was actually pretty helpful to get a sense of what "zone" I was in. I only selected a 10-minute workout, so I didn't expect to be wiped out, but it was nice to gauge how much I was pushing myself so I could work to get the most out of those 10 minutes. When the class was over, I opened the Lanebreak app on the bike. Lanebreak is a virtual game offered by Peloton that I absolutely love and play every day, so I was interested in seeing if the heart rate monitor would pop up on the screen during a level, too. It did! After my five-minute cooldown Lanebreak level ended, I opened the Workout app on the watch again to mark down that I was done, like I always do. To my surprise, the Peloton app actually overrode it; the Workout app had stopped tracking my indoor cycle session as soon as the Peloton app took over. That made me nervous because I was afraid that the workout wouldn't be reflected in my Apple Health daily summary or Activity Rings, but when I opened that up on my phone, there they were: Two "indoor cycle" workouts under Sessions. Where they'd normally have the green Apple Workout logo next to them, they had the Peloton logo. They were tracked and categorized just like an indoor cycle session I would normally monitor using my watch. They counted toward the Move and Exercise portions of my Activity Rings and all. I opened my nutrition-tracking app to make sure the burned calories hadn't been double-entered. They hadn't! The Peloton App succeeds where other apps have failed: It doesn't make tracking your movement across various apps and devices a convoluted mess. Finally, I opened the Peloton app to look at the summary of my workouts. They usually include estimates of your burned calories and output, plus which muscles you worked and how long you were at it, but now, they included more detailed breakdowns of how long I spent in each heart rate zone and provided more information on my total output. What is the benefit of linking these devices?Like I said, the Peloton app tracked the same things my Apple Watch would track on its own using the Workout function: My heart rate, my burned calories, and the duration of my workout. So, you might wonder, what's the point of linking the bike (or Peloton Tread or Row) to the watch at all? There are a few benefits that are evident here. First, it was convenient to see my heart rate and power zone reflected on the Peloton screen. I didn't have to glance down at my wrist to see my heart rate like I usually do; I could stay focused on the screen, which is important for safety, and pace myself in real time to make sure I stayed in the zone I wanted to be in. Second, linking the Apple Watch and Peloton device enables you to see something called you "strive score." This is a personal metric that helps you understand and visualize how hard you worked during a class or ride, and it's based on a combination of your heart rate and how long you spent in each of Peloton's seven "power zones." (Lower zones correspond with a lower heart rate and higher zones correspond with a higher one.) Credit: Lindsey Ellefson Be warned: You have to toggle on the strive score separately, which I didn't know at first, so my 10-minute ride doesn't have one, but my Lanebreak level does. Doing this is simple: From that same More menu in your profile, hit Settings and scroll all the way to the bottom. Toggle on Track and Display Strive Score and then choose whether in-class participants can see it or not. I was annoyed that the only strive score I got for the day was a measly 2.2 on my five-minute cooldown, but that only inspires me to, well, strive for a higher one tomorrow. Overall, there is no downside to linking your Apple Watch and Peloton device, which isn't always true when it comes to other fitness apps. In fact, you can get even more comprehensive workout data by doing it and I, for one, think it's awesome. Source: https://lifehacker.com/health/connect-apple-watch-to-peloton-bike?utm_medium=RSS #how #and #why #connect #your #apple #watch #peloton

May 13, 2025Ravie LakshmananSupply Chain Attack / Blockchain Cybersecurity researchers have discovered a malicious package on the Python Package Index (PyPI) repository that purports to be an application related to the Solana blockchain, but contains malicious functionality to steal source code and developer secrets. The package, named solana-token, is no longer available for download from PyPI, but not before it was downloaded 761 times. It was first published to PyPI in early April 2024, albeit with an entirely different version numbering scheme. "When installed, the malicious package attempts to exfiltrate source code and developer secrets from the developer's machine to a hard-coded IP address," ReversingLabs researcher Karlo Zanki said in a report shared with The Hacker News. In particular, the package is designed to copy and exfiltrate the source code contained in all the files in the Python execution stack under the guise of a blockchain function named "register_node()." This unusual behavior suggests that the attackers are looking to exfiltrate sensitive crypto-related secrets that may be hard-coded in the early stages of writing a program incorporating the malicious function in question. It's believed that developers looking to create their own blockchains were the likely targets of the threat actors behind the package. This assessment is based on the package name and the functions built into it. The exact method by which the package may have been distributed to users is currently not known, although it's likely to have been promoted on developer-focused platforms. If anything, the discovery underscores the fact that cryptocurrency continues to be one of the most popular targets for supply chain threat actors, necessitating that developers take steps to scrutinize every package before using it. "Development teams need to aggressively monitor for suspicious activity or unexplained changes within both open source and commercial, third-party software modules," Zanki said. "By stopping malicious code before it is allowed to penetrate secure development environments, teams can prevent the kind of destructive supply chain attacks." Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE     Source: https://thehackernews.com/2025/05/malicious-pypi-package-posing-as-solana.html #malicious #pypi #package #posing #solana #tool #stole #source #code #downloads

It feels like a minor problem, I'll admit it. But you know when you check into a hotel and have to spend the next fifteen minutes connecting all your Apple devices to the network? Starting from your iPhone, then moving to your iPad, and then your Mac? Well, it looks like Apple understands your pain. According to a new report from Bloomberg's Mark Gurman, iOS 19 will include a new feature that will automatically connect multiple devices to the same public Wi-Fi network after you log in with just one of them.That's convenient for a couple of reasons. Beyond just keeping you from having to cycle through all your devices, it can also reduce the amount of paperwork you have to fill out. When signing into wifi at a location with public access, like a gym, café, hotel, or the airport, you'll often be asked to fill out a web form. These will usually ask for some information, but can also include captchas, or even unique codes that limit how much data you can access on a per-device basis.This new system means you'll only have to fill out the form once. Once you get through a web form, the wifi login and details will sync automatically between all your connected Apple devices, just like they do right now for a regular wifi network. Of course, this hasn't been 100% confirmed yet, and there are still a few questions to answer. How will this work for wifi networks that limit that amount of devices you can connect to them, for instance? Still, Gurman has a credible track record of leaking software and hardware changes currently on Apple's roadmap, so we'll likely see more on this in due time. iOS 19 is expected to be announced at WWDC in June, and according to the rumors, will come with a pretty big redesign for iPhones, iPads, and Macs. Source: https://lifehacker.com/tech/ios-19-will-make-it-easier-to-sign-into-public-wifi-on-multiple-devices?utm_medium=RSS #ios #will #make #easier #sign #into #public #wifi #multiple #devices

Perched on a sun-drenched slope in Bend, Oregon, the Tetherow Overlook House by Hacker is a masterclass in architectural harmony with its environment. Designed as both a personal retreat and a cultural space, the 7,600-square-foot home merges bold form with a serene sense of place, drawing directly from the dramatic topography and textures of Central Oregon’s high desert. The structure unfolds along a sandy bluff, revealing itself through a series of staggered platforms that mirror the land’s natural contours. Rather than dominating its environment, the home gently embeds itself into the terrain, using angular concrete and carefully faceted walls to echo the jagged character of nearby volcanic formations. At the heart of the design are three primary volumes – each wrapped in a uniform skin of coarse wooden slats – that delineate the home’s core functions. These textured structures contain the garage and studio, sleeping quarters, and dining area. Their rhythm and placement offer a shifting spatial experience as one moves between enclosed interiors and open-air zones, where the landscape and sky feel at arm’s reach. Entry into the home begins at the site’s highest elevation, where the approach is marked by a courtyard and a dramatic steel pivot door tucked beneath a cantilevered bedroom wing. Inside, a subtle palette of materials – stone, wood, and metal – extends from room to room and blurs the boundary between interior and exterior. Every element has been chosen to reinforce the residence’s connection to its environment while maintaining a backdrop that complements the owners’ extensive collection of modern art. The exterior design is both rugged and refined. The weathered timber cladding, continuous across walls and windows, pays homage to the region’s fire-scarred forests and weather-beaten tree snags. Carved planes and chamfered edges lend the building a raw monumentality, reflecting the eroded yet resilient geology that surrounds it. To protect against the harsh desert sun and wind, varying types of shelter are factored into the design. The house’s internal organization plays with levels and layers, creating visual and physical flow through its varied floor heights. The living areas unfold in sequence: a lounge, kitchen, and sunken sitting room step down in concert with the hillside. The dining space, elevated slightly above the kitchen, occupies a separate box that projects outward like a lookout post, offering panoramic views of the desert beyond. Above, the top floor serves as a tranquil private domain, featuring a primary suite, guest accommodations, and a workspace, all arranged around a light-filled gallery that overlooks the social spaces below. A refined wooden screen flanks the staircase, providing a visual filter between zones while echoing the vertical exterior cladding. Descending further, a secluded lower level is embedded into the slope, offering a quiet haven for recreation and relaxation with its own entertainment zone and spa area. For more information on the Tetherow Overlook House or Hacker, visit hackerarchitects.com. Photography by Jeremy Bittermann. Source: https://design-milk.com/tetherow-overlook-is-a-sculptural-retreat-in-oregons-high-desert/?utm_source=rss&utm_medium=rss&utm_campaign=tetherow-overlook-is-a-sculptural-retreat-in-oregons-high-desert #tetherow #overlook #sculptural #retreat #oregons #high #desert

Marks and Spencer (M&S) has confirmed that customer data was stolen during the Easter DragonForce ransomware attack on its server infrastructure and will be prompting all online customers to reset their account passwords as a precautionary move. The attack unfolded three weeks ago and is thought to have been the work of a white-label affiliate of DragonForce – possibly the notorious Scattered Spider operation, which uses social engineering tactics to conduct its intrusions. The stolen tranche of data is understood to include contact details email addresses, postal addresses and phone numbers; personal information including names and dates of birth; and data on customer interactions with the chain, including online order histories, household information, and ‘masked’ payment card details. M&S added that customer reference numbers, but not payment information, belonging to holders of M&S credit cards or Sparks Pay cards – including former cardholders – may also have been taken. “We have written to customers today to let them know that unfortunately, some personal customer information has been taken,” said M&S chief exec Stuart Machin. “Importantly there is no evidence that the information has been shared and it does not include useable card or payment details, or account passwords, so there is no need for customers to take any action.” Machin added: “To give customers peace of mind, they will be prompted to reset their password the next time they visit or log on to their M&S account and we have shared information on  how to stay safe online. “Everyone at M&S is working around the clock to get things back to normal for our customers as quickly as possible, and we are very sorry for any inconvenience they have experienced. Our stores remain open as they have throughout.” The letter to customers from customer service operations director Jayne Wall – which can be reviewed here – also includes additional standard guidance on how to stay safe online. NordVPN chief technology officer, Marijus Briedis, described M&S’ assertion that the attackers have not yet leaked or shared the stolen data was “overly optimistic” under the circumstances and warned that even if passwords or credit card details were not exposed, the data that was taken was still very useful to cyber criminals. “This type of data can be used in phishing campaigns or combined with other leaked information to commit identity theft,” explained Briedis. “Consumers often underestimate how damaging ‘harmless’ data like order history or email addresses can be in the wrong hands. These M&S hackers could use this data to build highly personalised phishing emails, designed to look identical to what the retailer would send, and these are much harder to spot. “This breach highlights how companies must not only secure financial data, but also treat seemingly less sensitive information – like customer profiles and purchase records – as  critical assets that require protection.” Max Vetter, vice president of cyber at Immersive and a former money laundering investigator with London’s Metropolitan Police, also had harsh words for M&S. “M&S saying that customers could change their passwords “for extra peace of mind” does little to reassure those worried about who has access to their personal information,” he said. “As the fallout from this attack continues, customers want clear assurances about their personal data and what M&S is doing to keep it safe from being published online. “M&S want to appear in control and telling people to be more vigilant, however, telling customers there’s no need to act risks does potentially the wrong message. We recommend all customers reset their password. Zetter reaffirmed the stolen data would be prime material for downstream social engineering and phishing attacks, especially if it is indeed in the hands of Scattered Spider who, he said, “often play a long game”. Meanwhile, disruption from the parallel DragonForce attack on Co-op continues, with the BBC today reporting that stores in the Channel Islands are experiencing particularly acute shortages and are now working with local suppliers to maintain some supplies. In other remote parts of the UK, including the Hebrides in Scotland, residents are similarly contending with disruption to deliveries. On many islands, such as whisky-making hub Islay, where Co-op stores is the only large food retailer operating, these shortages are now extending to supplier of fresh fruit and vegetables. Co-op has also confirmed that data has been stolen, including names, dates of birth and contact information, but not passwords, financial details, or any information on members’ shopping habits or other interactions with the organisation. Timeline: UK retail cyber attacks 22 April 2025: A cyber attack at M&S has caused significant disruption to customers, leaving them unable to make contactless payments or use click-and-collect services. 24 April: M&S is still unable to provide contactless payment or click-and-collect services amid a cyber attack that it says has forced it to move a number of processes offline to safeguard its customers, staff and business. 25 April: M&S shuts down online sales as it works to contain and mitigate a severe cyber attack on its systems. 29 April: The infamous Scattered Spider hacking collective may have been behind the ongoing cyber attack on M&S that has crippled systems at the retailer and left its ecommerce operation in disarray. 30 April: A developing cyber incident at Co-op has forced the retailer to pull the plug on some of its IT systems as it works to contain the attack. 1 May: Co-op tells staff to stop using their VPNs and be wary that their communications channels may be being monitored, as a cyber attack on the organisation continues to develop. 1 May: Harrods confirms it is the latest UK retailer to experience a cyber attack, shutting off a number of systems in an attempt to lessen the impact. 2 May: The National Cyber Security Centre confirms it is providing assistance to M&S, Co-op and Harrods as concerns grow among UK retailers. 7 May: No end is yet in sight for UK retailers subjected to apparent ransomware attacks. Source: https://www.computerweekly.com/news/366623565/MS-forces-customer-password-resets-after-data-breach #mampamps #forces #customer #password #resets #after #data #breach

May 13, 2025Ravie LakshmananVulnerability / Threat Intelligence A recently disclosed critical security flaw impacting SAP NetWeaver is being exploited by multiple China-nexus nation-state actors to target critical infrastructure networks. "Actors leveraged CVE-2025-31324, an unauthenticated file upload vulnerability that enables remote code execution (RCE)," EclecticIQ researcher Arda Büyükkaya said in an analysis published today. Targets of the campaign include natural gas distribution networks, water and integrated waste management utilities in the United Kingdom, medical device manufacturing plants oil and gas exploration and production companies in the United States, and government ministries in Saudi Arabia that are responsible for investment strategy and financial regulation. The findings are based on a publicly exposed directory uncovered on attacker-controlled infrastructure ("15.204.56[.]106") that contained event logs capturing the activities across multiple compromised systems. The Dutch cybersecurity company has attributed the intrusions to Chinese threat activity clusters tracked as UNC5221, UNC5174, and CL-STA-0048, the last of which was linked to attacks targeting high-value targets in South Asia by exploiting known vulnerabilities in public-facing IIS, Apache Tomcat, and MS-SQL servers to drop web shells, reverse shells, and the PlugX backdoor. It also noted that an uncategorized China-nexus threat actor is conducting a widespread internet scanning and exploitation campaign against SAP NetWeaver systems. The server hosted at the IP address "15.204.56[.]106" has been found to contain multiple files, including - "CVE-2025-31324-results.txt," which has recorded 581 SAP NetWeaver instances compromised and backdoored with a web shell "服务数据_20250427_212229.txt," which lists 800 domains running SAP NetWeaver likely for future targeting "The exposed open-dir infrastructure reveals confirmed breaches and highlights the group's planned targets, offering clear insight into both past and future operations," Büyükkaya noted. The exploitation of CVE-2025-31324 is followed by the threat actor deploying two web shells that are designed to maintain persistent remote access to the infected systems and execute arbitrary commands. In addition, three different Chinese hacking groups have been observed exploiting the SAP NetWeaver vulnerability as part of efforts to maintain remote access, conduct reconnaissance, and drop malicious programs - CL-STA-0048, which has attempted to establish an interactive reverse shell to "43.247.135[.]53," an IP address previously identified as used by the threat actor UNC5221, which has leveraged a web shell to deploy KrustyLoader, a Rust-based malware that can used to serve second-stage payloads like Sliver, set up persistence, and execute shell commands UNC5174, which has leveraged a web shell to download SNOWLIGHT, a loader that initiates a connection with a hard-coded server to fetch a Go-based remote access trojan named VShell and a backdoor known as GOREVERSE "China-linked APTs are highly likely to continue targeting internet-exposed enterprise applications and edge devices to establish long-term strategic and persistence access to critical infrastructure networks globally," Büyükkaya said. "Their focus on widely used platforms like SAP NetWeaver is a strategic move, as these systems are deeply integrated into enterprise environments and often host unpatched vulnerabilities." SAP Patches New NetWeaver Flaw in May 2025 Patch The disclosure comes days after another China-linked unnamed threat actor dubbed Chaya_004 has also been attributed to the exploitation of CVE-2025-31324 to deploy a Go-based reverse shell called SuperShell. SAP security firm Onapsis said it is "seeing significant activity from attackers who are using public information to trigger exploitation and abuse web shells placed by the original attackers, who have currently gone dark." Further analysis of these attacks has led to the discovery of another critical defect in NetWeaver's Visual Composer Metadata Uploader component. Tracked as CVE-2025-42999 (CVSS score: 9.1), it has been described as a deserialization vulnerability that could be exploited by a privileged user to upload untrusted or malicious content. In light of ongoing active exploitation, customers of SAP NetWeaver are recommended to update their instances to the latest version as soon as possible. Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE     Source: https://thehackernews.com/2025/05/china-linked-apts-exploit-sap-cve-2025.html #chinalinked #apts #exploit #sap #cve202531324 #breach #critical #systems #worldwide