The Daily Index — Thursday, May 8, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

SECOND OTTOKIT VULNERABILITY EXPLOITED TO HACK WORDPRESS SITES

Threat actors have been observed exploiting a new vulnerability in the OttoKit WordPress plugin. The vulnerability could allow unauthenticated attackers to connect to impacted sites that have never enabled or used an application password due to a lack of proper authentication checks in the create_wp_connection() function. Attackers have been observed attempting to exploit the vulnerability to create an admin user account through the automation/action endpoint.

securityweek.com · 2 min

TLDR InfoSec

UNSOPHISTICATED HACKERS TARGETING ICS/SCADA SYSTEMS: CISA

Unsophisticated hackers are increasingly targeting industrial control systems in the energy and transportation sectors. Federal agencies recommend removing internet connections, changing default passwords, securing remote access, segmenting networks, and maintaining manual operation capabilities to protect critical infrastructure.

thecyberexpress.com · 3 min

TLDR InfoSec

SECURE CROSS-ACCOUNT ACCESS IS TRICKY. FOUR COMMON DANGEROUS MISCONCEPTIONS

IAM role trust policies are the best-practice foundation for cross-account access. However, many users misunderstand the security implications associated with them. When creating role trust policies, users should keep in mind the risk of lateral movement in both their account and the account that they're trusting and therefore be aware that other principals could potentially use the role then those specified in the policy and could potentially gain access to other roles that the policy is not applied to. Many users also mistake the security importance of the management/payer account and allow trust policies to flow between less secure and more secure accounts within an organization.

token.security · 5 min

TLDR InfoSec

ORGSEC GUIDE

The OrgSec Guide structures essential topics for effectively running a successful security program. It includes a compilation of resources, checklists, and addresses in DevSecOps, endpoint and product security, GRC, IAM, infrastructure, operational and cloud security, security operations, and AI.

luisfontes19.github.io · 1 min

TLDR InfoSec

DETECT CONTAINER ESCAPE VULNERABILITIES WITH OSQUERY

This guide explains how to use Osquery to detect container escape vulnerabilities in real-time by monitoring suspicious system calls and container activities. It presents three practical SQL queries that can be scheduled to run at 30-second intervals to detect namespace pivots, CVE-2024-21626 style escapes, and containers attempting to access the host kernel or metadata services. The guide also covers deployment steps, performance tuning tips, and integration options with logging platforms like Uptycs, Fleet, Splunk, and Loki.

uptycs.com · 5 min

TLDR InfoSec

APPSIGNAL (PRODUCT LAUNCH)

AppSignal can identify abnormal behavior that could signal vulnerabilities and misconfigurations while enabling developers to identify performance issues and errors.

appsignal.com

TLDR InfoSec

PASSKEYS FOR NORMAL PEOPLE

Even with MFA, seasoned professionals like Troy Hunt can still be victims of phishing attacks. In this article, Hunt demonstrates how to set up passkeys on various sites for either an authentication method or an MFA factor, depending on the site's support. Hunt also demonstrates how to store passkeys in either 1Password or a Yubikey to make them available on other devices.

troyhunt.com · 6 min

TLDR InfoSec

THE RUSSIAN OPEN SOURCE PROJECT THAT WE CAN'T LIVE WITHOUT

The widely used easyjson Golang JSON deserialization library is owned, maintained, and controlled by the VK Group. Russian state-owned entities control the VK Group, and it has leadership that is subject to US and EU sanctions. There is high potential for exploitation as the package is widely used in CNCF projects such as Helm, Istio, and Kubernetes.

huntedlabs.com · 5 min

TLDR InfoSec

EUROPOL SHUTS DOWN SIX DDOS-FOR-HIRE SERVICES USED IN GLOBAL ATTACKS

Europol has dismantled six DDoS-for-hire services used for thousands of cyberattacks globally. The platforms (cfxapi, cfxsecurity, neostress, jetstress, quickdown, and zapcut) offered user-friendly interfaces for launching attacks for as little as €10.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

SOFTWARE CODE OF PRACTICE: BUILDING A SECURE DIGITAL FUTURE

The UK launched the voluntary Software Security Code of Practice to establish cyber security baselines for technology vendors with 14 baseline principles on SBOMs, patching, default MFA, and more.

ncsc.gov.uk · 2 min

TLDR InfoSec

POWERSCHOOL HACKER NOW EXTORTING INDIVIDUAL SCHOOL DISTRICTS

PowerSchool warns that a hacker from a previous cyberattack is extorting schools for ransom, threatening to release stolen student and teacher data if not paid.

bleepingcomputer.com · 3 min

TLDR InfoSec

LOCKBIT RANSOMWARE GANG HACKED, VICTIM NEGOTIATIONS EXPOSED

The LockBit ransomware gang's dark web panels were hacked, exposing sensitive data like negotiation messages, plaintext passwords, and bitcoin addresses.

bleepingcomputer.com · 2 min