A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways

🔸Pillar Security researchers discovered a new supply chain attack called "Rules File Backdoor" that compromises AI-generated code by injecting malicious instructions into configuration files used by Cursor and GitHub Copilot. This attack remains virtually invisible to developers and security teams, allowing malicious code to silently propagate through projects.

- The source code is leaked. (we don't know what's inside of the source code, so please open it with caution, inside of a vm preferably)
- The source code is compact PHP code.
- we still don't know if the hacker exploited a 0-day vulnerability or not.
- The person behind this, leaked all the moderator's emails as well as the internal moderation board (although only the older stuff, since they moved to discord)
- He said he won't leak the user pass data (weren't they hashed?!?!)
- He said he has cleaned the source code a bit, but there are still some secrets (e.g. environment variables?) left that will need replacement
- He said "he won't be leaking any DB" and that he doesn't want to hurt the actual users blah blah blah, but yeah who knows, he might sell it later or something, we don't know