Loading story…
Respawn Entertainment confirmed an active security incident in Apex Legends in which a threat actor could remotely control another player’s in-game inputs, including moving characters off the map, disconnecting clients, and forcibly changing player nicknames (commonly to RSPN Admin). Respawn stated its initial investigation found no evidence of remote code execution (RCE), injection, or malware installation on players’ systems, and the company reported the issue was resolved after several hours of ongoing player disruption.
Reporting indicates Respawn patched an exploit believed to be associated with the game’s anti-cheat component, after the behavior was observed impacting multiple players and streamers over the prior week. The incident drew comparisons to a 2024 Apex tournament disruption in which a separate exploit was used to deploy cheating software on participants’ PCs (an event previously claimed by Destroyer2009), but current statements emphasize the 2026 incident did not show signs of code execution on customer machines.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Respawn later patched the exploit that allowed attackers to remotely control players' in-game characters, reportedly deploying the fix through the game's anti-cheat component. The company reiterated that it found no evidence the exploit enabled malware installation or code execution on players' PCs.
Roughly six hours after acknowledging the issue, Respawn said the disruption had been resolved. The company provided few technical details but continued to frame the incident as cheat-related.
On Saturday, Respawn publicly confirmed it was investigating the player-hijacking incident and said its initial investigation found no evidence of remote code execution, code injection, or malware installation on players' systems. The company indicated the issue appeared related to cheating rather than compromise of player PCs.
Over the weekend, Apex Legends players reported that a malicious actor was remotely controlling character inputs, forcing abnormal movement, disconnecting clients, and changing nicknames such as "RSPN Admin." Community discussion suggested possible abuse of server-side administrative or debugging capabilities.
During a North American Apex Legends competition the previous year, hackers compromised players during matches, leading Electronic Arts to postpone the finals. The incident became a point of comparison for later concerns about game security and anti-cheat effectiveness.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcenews.risky.biz
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security teams reported rapid, opportunistic exploitation of newly disclosed **unauthenticated remote code execution (RCE)** flaws, with attackers moving quickly from scanning to compromise. JPCERT/CC documented active compromise following disclosure of **React2Shell** in React Server Components (**CVE-2025-55182**), where multiple threat actors exploited the same exposed environment within days—initially dropping coin miners (e.g., `xmrig`), then deploying additional payloads including the **HISONIC** backdoor, **SNOWLIGHT** downloader, and **CrossC2**, and culminating in actions like cron-based persistence and website defacement. Separately, GreyNoise telemetry cited by BleepingComputer indicated that exploitation of two critical Ivanti Endpoint Manager Mobile (EPMM) RCEs (**CVE-2026-21962**, **CVE-2026-24061**) was heavily concentrated, with a single bulletproof-hosted source IP (193[.]24[.]123[.]42, PROSPERO OOO/AS200593) responsible for **83%** of observed activity and widespread use of OAST-style DNS callbacks consistent with initial-access validation. Several other items in the set were not tied to a single, specific exploitation event. A Help Net Security “week in review” roundup mixed interviews and assorted security items (including mention of an exploited BeyondTrust RCE) without providing a cohesive, single-incident account, while an NCSC-themed weekly highlights post primarily summarized guidance and calls for participation rather than detailing a discrete compromise. A CloudATG “insights” page contained unrelated, older recap and generic security content, and a Risky Business bulletin focused on law-enforcement developments around **IcedID** operators (including an alleged developer faking his death) rather than vulnerability exploitation activity.
Jun 29, 2026
Trend Micro released security updates for multiple **critical vulnerabilities** in **Apex Central** and **Endpoint Encryption PolicyServer**, including unauthenticated remote code execution flaws in Apex Central tracked as `CVE-2025-49219` and `CVE-2025-49220`. Both issues stem from insecure deserialization and improper input validation and carry `CVSS 9.8`, allowing attackers to execute code remotely without authentication. Endpoint Encryption PolicyServer is affected by several severe flaws, including `CVE-2025-49216`, which can let an unauthenticated attacker bypass authentication and obtain administrator-level access, and `CVE-2025-49212`, `CVE-2025-49213`, and `CVE-2025-49217`, which can also lead to remote code execution through crafted inputs and deserialization. Additional issues such as `CVE-2025-49218`, `CVE-2025-49215`, and `CVE-2025-49211` may enable SQL injection and privilege escalation, and Trend Micro warned that chaining the bugs could result in full system compromise; administrators were urged to apply **Apex Central patch `CP B7007`** and **Endpoint Encryption PolicyServer Patch 1 Update 6** immediately.
Jul 24, 2026
**NationStates** confirmed a data breach after an unauthorized user achieved **remote code execution (RCE)** on the game’s production server while testing a newly reported vulnerability. The intruder was described as a long-time community member and prior vulnerability reporter who “crossed a line” by moving beyond authorized testing, enabling access sufficient to copy application code and exfiltrate user data; the site was taken offline for investigation and remediation, and the operator stated it is treating the system and data as compromised because deletion claims cannot be verified. Reporting attributes the root cause to a flaw in the relatively new **“Dispatch Search”** feature (introduced **2025-09-02**), where **insufficient input sanitization** combined with a **double-parsing bug** enabled the exploitation chain leading to RCE. Exposed data reportedly includes **email addresses, MD5 password hashes, IP addresses, browser User-Agent strings**, and potentially some internal messaging content; the disclosures state **no financial or real-world identity data** was involved. NationStates indicated it is rebuilding or hardening infrastructure and security controls and has reported the incident to authorities, while technical analysis details the attack path and mitigations based on primary-source evidence.
Jun 29, 2026