The Daily Index — Monday, April 28, 2025

GENERAL

TLDR InfoSec

Learn more about SentinelOne Cloud Security

Summary unavailable

go.sentinelone.com

TLDR InfoSec

SAP ZERO-DAY VULNERABILITY UNDER WIDESPREAD ACTIVE EXPLOITATION

SAP Netweaver software has an unrestricted file upload vulnerability identified by CVE-2025-31324. After querying internet server search engines Shodan and Censys, Onapsis estimates that about 10,000 SAP instances are potentially vulnerable. It is a CVSS 10 vulnerability, remotely exploitable through HTTP unauthenticated, that allows for complete system compromise.

cyberscoop.com · 3 min

TLDR InfoSec

NOVEL UNIVERSAL BYPASS FOR ALL MAJOR LLMS

A new technique called "Policy Puppetry” can bypass safety guardrails in all major generative AI models. The attack involves crafting prompts that appear as policy files, tricking AI systems into interpreting them as instructions that override safety alignments. This universal vulnerability demonstrates fundamental flaws in AI model training and security.

hiddenlayer.com · 8 min

TLDR InfoSec

CROSS-SITE WEBSOCKET HIJACKING EXPLOITATION IN 2025

Cross-Site WebSocket Hijacking is a vulnerability that arises from WebSockets being unprotected by the Same Origin Policy, allowing malicious sites to connect to targeted sites impersonating the user. Modern browsers have implemented security features that make CSWSH harder to exploit, such as Chrome's SameSite=Lax default cookie and Firefox's Total Cookie Protection. However, proper Origin validation during the server-side WebSocket handshake is the most reliable defense, as browser settings can change, and Chrome still permits CSWSH under certain conditions.

blog.includesecurity.com · 9 min

TLDR InfoSec

USING AI TO ANALYSE CYBER INCIDENTS

This post shows how to use AI to create a timeline of the April 2025 Marks & Spencer cybersecurity incident, which impacted contactless payments and click-and-collect services, ultimately escalating to a suspension of online orders by April 25. The timeline details the progression from initial reports on April 19th to April 26th, documenting customer experiences, official communications, and media coverage with timestamps. Although M&S has not confirmed the nature of the attack, the company's response involved taking processes offline and consulting cybersecurity experts, causing operational disruptions across over 1,000 stores and a temporary 5% drop in their share price.

links.tldrnewsletter.com · 7 min

TLDR InfoSec

IO_URING IS BACK, THIS TIME AS A ROOTKIT

ARMO researchers exposed a critical security gap where Linux runtime security tools fail to detect malware using the io_uring interface. Their proof-of-concept rootkit, "Curing," bypasses traditional system call monitoring, affecting tools such as Falco and Microsoft Defender. While some vendors have implemented fixes, most security solutions remain vulnerable to this evasion technique.

armosec.io · 10 min

TLDR InfoSec

JERICHO SECURITY (PRODUCT LAUNCH)

Jericho enables organizations to run AI Agent-based, hyper-realistic, personalized attack simulations to train employees to identify real-world threats, track their progress, and escalate difficulty and rewards based on completion.

jerichosecurity.com

TLDR InfoSec

SOUTH KOREAN COMPANIES TARGETED BY LAZARUS VIA WATERING HOLE ATTACKS, ZERO-DAYS

North Korean APT Lazarus targeted six South Korean organizations in finance, IT, semiconductors, software, and telecommunications through Operation SyncHole. They employed watering hole attacks and exploited zero-day vulnerabilities in security software, targeting Cross EX and Innorix Agent for online banking and government sites. The attack utilized malware such as ThreatNeedle, wAgent, SignBT, and CopperHedge for reconnaissance and access maintenance, while Lazarus further developed tools to evade detection.

securityweek.com · 2 min

TLDR InfoSec

“YOU WOULDN'T STEAL A CAR” ANTI-PIRACY CAMPAIGN MAY HAVE USED PIRATED FONTS

The anti-piracy campaign "You Wouldn't Steal a Car" appears to have used XBand Rough, a knockoff of the FF Confidential font. This ironic discovery highlights the complex nature of typeface copyright law, where typeface designs have limited protection but font files can be copyrighted as software.

arstechnica.com · 5 min

TLDR InfoSec

NORTH KOREAN IT WORKERS SEEN USING AI TOOLS TO SCAM FIRMS INTO HIRING THEM

In coordination with US authorities and third parties, Okta has tracked the behaviors and usage of GenAI by DPRK workers. Okta found that North Korean workers are utilizing GenAI tools at all stages in the process, from drafting resumes, to deepfake interviews, and even utilizing GenAI to maintain multiple jobs at the same time.

therecord.media · 2 min

TLDR InfoSec

LATTICA EMERGES FROM STEALTH WITH FHE PLATFORM FOR AI

Lattica emerged with a platform that utilizes fully homomorphic encryption (FHE) for AI to process encrypted data without requiring decryption.

securityweek.com · 2 min

TLDR InfoSec

FBI SEEKS HELP TO UNMASK SALT TYPHOON HACKERS BEHIND TELECOM BREACHES

The FBI is seeking help to identify the Chinese Salt Typhoon hackers who breached U.S. and global telecom providers, accessing the private communications of government officials.

bleepingcomputer.com · 2 min

TLDR InfoSec

ROMHACK 2025 CONFERENCE CALL FOR PAPERS

RomHack 2025 is seeking presentations from individuals with a strong information security (infosec) background who wish to share interesting topics.

cfp.romhack.io · 1 min