This article examines a security flaw in the Facebook JavaScript SDK that can lead to account takeovers. It highlights the use of an insecure random number generator and a cross-site scripting vulnerability in the Customer Chat plugin, enabling attackers to exploit message validation mechanisms.

A campaign exploiting the CVE-2024-36401 vulnerability in GeoServer has been discovered, allowing attackers to monetize victims' internet bandwidth through the deployment of legitimate software development kits (SDKs) or modified apps. The stealthy approach enables criminals to profit without distributing traditional malware while targeting an expanding number of publicly accessible GeoServer instances. Palo Alto Networks offers protective measures against such threats.