TL;DR
A new DDRop hardware attack compromises Intel TDX and AMD SEV-SNP confidential computing by silently dropping memory writes. Japan's Digital Agency suffered a VPN breach exposing ~numerous personnel records. Red Heron exploited Gitea RCE to compromise 13 organizations across six countries.
Executive Summary
- DDRop, a new hardware attack, breaks memory protections in Intel TDX and AMD SEV-SNP confidential computing environments by dropping memory writes, forcing processors to read stale encrypted data.
- Japan's Digital Agency confirmed a VPN vulnerability breach affecting approximately 246,000 personnel records containing personal information of government employees.
- Red Heron, a suspected Chinese threat actor, rapidly exploited a Gitea RCE vulnerability to compromise 13 organizations across six countries in a coordinated campaign.
- An attacker maintained persistent root-level access to 3BB, one of Thailand's largest broadband providers, using the legitimate MeshCentral remote management tool.
- WordPress introduced automated security reviews for all plugin releases to block high-risk updates before distribution, strengthening supply-chain defenses.
Top Threats Today
1. DDRop Hardware Attack Breaks Confidential Computing Protections
Severity: HIGH Affected: Technology
Researchers have disclosed DDRop, a hardware attack that breaks memory protection in Intel TDX and AMD SEV-SNP confidential computing by silently dropping writes to a server's memory [1]. This forces the processor to continue reading old encrypted data as if it were current, undermining the confidentiality guarantees these technologies are designed to provide [1]. The attack requires an attacker with physical or privileged access to the memory subsystem ⚠[1].
Sources:[1] The Hacker News
Recommended Action
- Assess whether confidential computing instances are deployed in environments where physical access controls are in place
- Monitor vendor security advisories from Intel and AMD for hardware-level mitigations or microcode updates
- Review deployment architectures to limit exposure of sensitive workloads until patches are available
2. Japan Government VPN Breach Exposes 246,000 Personnel Records
Severity: HIGH Affected: Government
Japan's Digital Agency discovered a data breach via a VPN vulnerability that may have exposed approximately 246,000 record rows containing personal information of government employees [1]. The vulnerability is tracked as CVE-2026-20079 [1].
Sources:[1] BleepingComputer
Recommended Action
- Contact affected government personnel to notify them of potential exposure
- Review VPN access logs for unauthorized activity during the breach window
- Apply available patches for CVE-2026-20079 and conduct a security audit of VPN infrastructure
3. Red Heron Rapidly Exploits Gitea RCE Across Six Countries
Severity: HIGH Affected: Technology
A suspected Chinese threat actor tracked as Red Heron has exploited a recently disclosed Gitea RCE vulnerability to compromise internet-facing instances as part of a multi-national campaign [1]. Red Heron scanned 1,386 Gitea instances across seven countries and successfully compromised 13 organizations across six countries ⚠[1]. The rapid exploitation of the vulnerability indicates minimal delay between disclosure and weaponization.
Sources:[1] The Hacker News
Recommended Action
- Immediately patch all internet-facing Gitea instances to the latest version
- Review audit logs for signs of unauthorized access or command execution since the vulnerability disclosure date
- Isolate or take offline any unpatched Gitea instances pending remediation
- Monitor for indicators of compromise from Red Heron's campaign infrastructure
4. Thailand ISP Breached via Legitimate Remote Management Tool
Severity: HIGH Affected: Telecom
An attacker operated inside the network of 3BB, one of Thailand's largest broadband providers, and maintained remote control of internal machines using MeshCentral, a legitimate remote management tool [1]. Threat intelligence firm Hunt.io uncovered the intrusion by examining internal security telemetry [1]. The attacker gained root-level access to subscriber infrastructure.
Sources:[1] The Hacker News
Recommended Action
- Audit all remote management tool access logs and isolate accounts showing suspicious activity
- Force password resets for all administrative accounts used to manage remote tools
- Segment remote management infrastructure from production subscriber networks
- Implement multi-factor authentication for all remote access sessions
5. Telegram Desktop HTML Export Flaw Enables JavaScript Injection
Severity: MEDIUM Affected: Technology
A flaw in Telegram Desktop allows a bot's message to plant hidden JavaScript inside chats that users export to HTML files, according to security researchers at ExPatch [1]. The message appears ordinary in the Telegram interface but executes the hidden script when the exported HTML is opened in a browser [1]. The vulnerability was published on September 12 [1].
Sources:[1] The Hacker News
Recommended Action
- Advise users to avoid exporting HTML chat files from untrusted sources until a patch is released
- Monitor for Telegram Desktop updates and apply promptly once available
- Review exported HTML files in a sandboxed environment before opening in a browser
Today’s Action Checklist
- ☐ URGENT: Patch or isolate all internet-facing Gitea instances to prevent RCE exploitation by Red Heron
- ☐ URGENT: Apply emergency patches for CVE-2026-20079 (Japan VPN flaw) if your organization uses affected VPN infrastructure
- ☐ HIGH: Review remote management tool access (MeshCentral, RDP, SSH) for unauthorized activity and enforce MFA
- ☐ HIGH: Monitor vendor advisories from Intel and AMD for DDRop mitigations if deploying confidential computing
- ☐ MEDIUM: Update Telegram Desktop and counsel users to avoid opening HTML exports from unverified sources