Berlin Hit Twice as Adobe Stores Backdoored

Berlin's government is dealing with a second wave of fallout from a cyberattack that compromised two of its ministries in mid-August, according to The Record.

Hackers hit the ministries responsible for urban development and housing, and for transport and climate protection. After disconnecting the affected systems from the wider government network on 14 August, officials now face a fresh problem: the attackers have published a second batch of stolen credentials online.

The Rhysida ransomware group claimed responsibility in late August, saying it had taken 5.79 terabytes of data including contracts, emails, passwords and classified files. Berlin's data protection authority confirmed that the leak contains personal information about public employees and may include data belonging to ordinary Berlin residents — names, addresses, dates of birth, bank details, email addresses, phone numbers, and copies of documents submitted to the administration.

Berlin has not paid the ransom. "The State of Berlin will not be blackmailed," Chief Digital Officer Florian Hauer said.

Germany's Federal Office for Information Security (BSI) separately warned about a related campaign it connected to the same criminal group. Attackers are setting up fake CAPTCHA verification pages that trick visitors into manually running malicious commands on their own computers — a technique sometimes called TerminalFix.

What you should do: If you submitted documents or personal information to Berlin city services, monitor your bank accounts and email for unusual activity. If you receive unexpected messages claiming to be from Berlin authorities asking you to click a link or verify details, treat them as suspicious until confirmed through an official channel.

North Korea-linked hackers have built a sophisticated surveillance toolkit targeting Linux systems at automotive and media organisations in South Korea, according to SecurityWeek.

The framework hides inside HAProxy — a widely used tool that manages web traffic across servers — by compiling the backdoor directly into HAProxy's own source code. From there, it intercepts traffic and harvests credentials without triggering standard monitoring tools. Think of it as a security camera that has been rewired to report to the wrong address, while still showing normal footage to the guard watching the feed.

The toolkit includes an SSH keylogger (a tool that silently records login credentials), a remote access tool that checks in with attacker servers every 12 hours, and a staging component that deploys further malware only after confirming it is on the right target. Researchers at Rapid7 believe the campaign has been running since at least late 2024. Attack patterns link it to APT37 and Lazarus, both North Korean state-aligned groups.

What you should do: If your organisation runs Linux-based web infrastructure, ask your IT team to audit HAProxy configurations for unexpected modifications or unusual outbound connections.

CVE ID not confirmed in source — check the original advisory before acting.

What Adobe Commerce / Magento is: Adobe Commerce, built on the open-source Magento platform, is the software that powers the checkout, product catalogue, and payment processing for thousands of online shops worldwide.

What it is: A zero-day (a flaw with no patch available yet) vulnerability nicknamed StyleSmuggler allows attackers to inject malicious PHP code — the programming language Magento uses behind the scenes — through the platform's template system. No user interaction is required for the attack to succeed.

Who's at risk: Any merchant running Adobe Commerce or Magento versions 2.4.7, 2.4.8, or 2.4.9, including those who applied the July and August 2026 security patches.

CVSS: Not yet scored — treat as Critical until confirmed.

Root cause: Magento's template engine fails to adequately sanitise input passed through a site's styling properties. An attacker exploits this by deliberately generating a payment failure report, which causes Magento to execute injected code when the platform sends a "Payment Transaction Failed Reminder" email. The flaw exists because the email-rendering process trusts template content that should be treated as untrusted input.

Attack vector: An attacker submits a crafted request that triggers a payment failure on the targeted store. Magento generates an error report and queues a notification email. When Magento processes that email — including if delivery fails — it executes the attacker's injected PHP code. A Rust-written backdoor is then installed on the server, disguised as a system process name such as [kworker/u:8:0] or fc-cache, and begins communicating with an attacker-controlled server while masquerading as routine NTP (time synchronisation) network traffic.

Detection strategies: Watch for unexpected bursts of "Payment Transaction Failed Reminder" emails from your Magento installation. Look for unfamiliar process names such as [kworker/u:8:0] or fc-cache on your server, particularly ones making outbound connections. Review server logs for unusual NTP traffic patterns — legitimate NTP traffic does not carry system information like hostnames or memory usage.

Recommended actions:

1. Apply Adobe's scheduled Patch Tuesday update on 8 September 2026 and monitor Adobe's official advisory for a specific StyleSmuggler fix.
2. Until a patch is available, consider blocking outbound connections from your Commerce server to unknown external IPs at the firewall level.
3. Alert your hosting provider or server administrator to the active exploitation and ask them to review process lists and outbound traffic immediately.

The UK's National Cyber Security Centre (NCSC) has published a guide on shadow AI — the use of AI tools that employees adopt without their employer's knowledge or approval, according to the NCSC blog.

One survey cited in the piece found that 71% of employees use AI tools their employer has not approved. The risk is straightforward: when you paste work data into a consumer AI service, that data may be stored, retained, or used to train the service — outside any security controls your organisation has in place.

The NCSC's advice is practical: before using any AI tool for a work task, ask whether it is on your employer's approved list. If you are not sure, ask. If no approved option exists for your needs, raise it with your IT or security team rather than improvising. The goal is not to stop using AI — it is to use it without handing your company's sensitive data to an unknown third party.

The BSI advisory referenced in today's Berlin breach story is an operational warning rather than a new regulation or mandate. No new government directives, data protection authority rulings, or legislative changes affecting cybersecurity compliance were announced in the last 24 hours.