13-Year ActiveMQ Bug & AI-Powered Cloud Attacks Expose Hidden Threats

This week's security landscape reveals a troubling pattern: the most dangerous vulnerabilities aren't always the newest ones. Two major stories show how ancient flaws and emerging attack techniques can leave organizations exposed—and why staying vigilant requires looking in unexpected places.

A 13-Year-Old ActiveMQ Flaw Finally Discovered—Thanks to AI

Researchers using Claude AI uncovered a critical vulnerability in Apache ActiveMQ that had been hiding in plain sight for over a decade. The flaw allows attackers to execute arbitrary commands on systems running vulnerable versions of the software. What makes this particularly dangerous is that older versions (6.0.0 to 6.1.1) can be exploited without even needing login credentials, turning a bad situation into a catastrophic one. ActiveMQ is widely used by enterprises for messaging, meaning countless organizations could be affected without knowing it. This discovery underscores a hard truth: even well-established, trusted software can harbor critical vulnerabilities for years.

Read more

APT41 Targets Cloud Infrastructure with Custom Credential-Stealing Malware

A sophisticated threat group known as APT41 has deployed a new Linux-based backdoor specifically designed to steal credentials from cloud environments like AWS, Google Cloud, Azure, and Alibaba Cloud. The malware is stealthy—it evaded detection on every major antivirus engine—and uses legitimate cloud metadata APIs to harvest sensitive credentials, then encrypts and exfiltrates them to attacker-controlled servers. This represents a significant shift in how attackers operate: rather than targeting traditional on-premises infrastructure, they're going after the cloud credentials that now control business-critical systems. Organizations relying heavily on cloud infrastructure need to implement immediate defenses, particularly around metadata API access and outbound network monitoring.

Read more

Stay ahead of threats with GOCO Security at gocosecurity.com