10/01/2025-10/08/2025 Severe Figma MCP Vulnerability, Oracle EBS Under Fire as Cl0p Exploits CVE-2025-61882 And More.

1. Severe Figma MCP Vulnerability Lets Hackers Execute Code Remotely — Patch Now

Security researchers disclosed a patched command‑injection vulnerability in the figma-developer-mcp Model Context Protocol (MCP) server that could enable remote code execution. Tracked as CVE-2025-53967 (CVSS 7.5), the flaw arises from unsanitized user input: the server directly interpolates client-supplied URLs and headers into shell command strings, allowing shell metacharacter injection. The bug resides in src/utils/fetch-with-retry.ts, which falls back to executing curl via child_process.exec when fetch fails. An attacker on the same network or via DNS rebinding could exploit this by sending crafted Initialize and JSON‑RPC tools/call requests to trigger arbitrary command execution under the server process. Imperva, which reported the issue in July 2025, called it a design oversight. The project fixed the issue in figma-developer-mcp v0.6.3 (released Sept 29, 2025). Recommended mitigations: avoid child_process.exec with untrusted input and use execFile or safer APIs. The incident underscores rising security risks as AI-driven developer tools are adopted.

2. Redis Patches 13-Year-Old Lua Flaw Enabling Remote Code Execution

Redis has disclosed a critical, 13-year-old vulnerability, CVE-2025-49844 (CVSS 10.0), dubbed “RediShell.” Discovered by Wiz Research, this use-after-free flaw in the Lua scripting engine allows an authenticated attacker to send a malicious script. This script can exploit the garbage collector, break out of the Lua sandbox, and achieve remote code execution on the host.

This grants full system control, enabling data theft, ransomware deployment, or lateral movement within cloud environments. All Redis versions with Lua scripting are affected. Redis has patched the flaw in versions 6.2.20, 7.2.11, 7.4.6, 8.0.4, and 8.2.2. As a workaround, restrict EVAL and EVALSHA commands via ACLs. Given Redis’s widespread use, immediate patching is critical, especially for internet-exposed instances.

3. Oracle EBS Under Fire as Cl0p Exploits CVE-2025-61882 in Real-World Attacks

CrowdStrike attributes the exploitation of a critical Oracle E-Business Suite flaw (CVE-2025-61882, CVSS 9.8) to the Cl0p threat actor, first seen on August 9, 2025. The vulnerability allows unauthenticated remote code execution via malicious XSLT templates and SSRF, CRLF, and HTTP connection reuse techniques. Exploits involve sending crafted HTTP requests to Oracle EBS endpoints like /OA_HTML/SyncServlet and /OA_HTML/RF.jsp, triggering reverse shells and web shell deployment for post-exploitation.

A Telegram channel allegedly shared the exploit while criticizing Cl0p, with binaries referencing LAPSUS$, Scattered Spider, and ShinyHunters—dubbed the “Trinity of Chaos.” Experts note the sharing appears unintentional, though it highlights competition among threat groups.

CISA has added CVE-2025-61882 to its Known Exploited Vulnerabilities catalog and urges agencies to patch by October 27, 2025. Researchers warn Cl0p is using the flaw to exfiltrate data and send extortion emails, urging Oracle EBS users to patch immediately and tighten defenses.

4. Malicious PyPI Package Mimics as SOCKS5 Proxy Tool Attacking Windows Platforms

A sophisticated malicious package named “SoopSocks” (XRAY-725599) has been discovered on the Python Package Index (PyPI). Masquerading as a legitimate SOCKS5 proxy tool, it instead deploys a backdoor targeting Windows systems.
The package has evolved through multiple versions to include advanced deployment mechanisms. Its current iteration uses a compiled Go executable (_autorun.exe) that orchestrates a stealthy installation via a hidden PowerShell window, bypassing security controls.

Once executed, the malware copies itself to a system directory and installs itself as a Windows service named SoopSocksSvc for automatic, persistent execution with elevated privileges. It also creates firewall rules to open port 1080 for TCP and UDP communications. This provides attackers with persistent backdoor access and a covert communication channel, posing a severe threat, especially in organizational environments.