The Daily Index — Wednesday, August 6, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

SONICWALL INVESTIGATES 'CYBER INCIDENTS,' INCLUDING RANSOMWARE TARGETING SUSPECTED 0-DAY

SonicWall is probing recent ransomware attacks on its Gen 7 firewalls, potentially exploiting a zero-day in SSL VPNs. Even with MFA enabled, attackers bypassed controls, deployed ransomware, and quickly pivoted to internal systems. SonicWall has urged customers to disable SSL VPN and use mitigation steps ASAP while waiting for official patches.

theregister.com · 3 min

TLDR InfoSec

HACKER USED A VOICE PHISHING ATTACK TO STEAL CISCO CUSTOMERS' PERSONAL INFORMATION

A hacker used a voice phishing (“vishing”) call to trick a Cisco representative, gaining access to their third-party CRM system and stealing Cisco.com users' personal data: names, organizations, addresses, emails, phone numbers, and more. The company did not disclose how many users this sophisticated social engineering breach affected.

techcrunch.com · 2 min

TLDR InfoSec

INVERSEPROMPT: TURNING CLAUDE AGAINST ITSELF, ONE PROMPT AT A TIME (CVE-2025-54794 & CVE-2025-54795)

Elad Beber discovered two high-severity vulnerabilities in Anthropic's Claude Code during its Research Preview phase. CVE-2025-54794 (CVSS 7.7) allows path restrictions to be bypassed through naive prefix validation, enabling access to files outside the intended working directory. CVE-2025-54795 (CVSS 8.7) enables command injection via inadequate input sanitization, allowing arbitrary code execution without user confirmation by breaking out of allowed commands like “echo”. Anthropic has patched both vulnerabilities.

cymulate.com · 10 min

TLDR InfoSec

FROM THE TOP 20 OPEN SOURCE COMPONENT VULNERABILITIES: RETHINKING THE CHALLENGES OF OPEN SOURCE SECURITY GOVERNANCE

Open source security governance is challenged by widespread reliance on vulnerable libraries, lack of standardized management, insecure defaults, and unclear ownership. This post dives into how effective governance requires proactive policies, measurable capabilities, and continuous attention beyond just tool-based vulnerability scans to deal with known and unknown risks in dependencies.

insbug.medium.com · 6 min

TLDR InfoSec

EXPLOITING ZERO DAYS IN ABANDONED HARDWARE

Trail of Bits researchers exploited two discontinued home network devices (Netgear WGR614v9 router and BitDefender Box V1) at DistrictCon's Junkyard competition, achieving remote root access through chained vulnerabilities, including UPnP authentication bypass, buffer overflows, and firmware downgrade attacks. The research highlights how end-of-life hardware becomes a persistent security risk when manufacturers stop releasing updates, leaving vulnerabilities permanently unpatched. Both devices were initially designed to protect home networks, but became easy targets due to years without security updates.

blog.trailofbits.com · 10 min

TLDR InfoSec

FABLE SECURITY (PRODUCT LAUNCH)

Fable uses AI to monitor real-time employee behavior signals and provides interventions such as chats and video briefings tailored to individual risk moments. It aims to educate users and reduce human-related cybersecurity threats in enterprises.

fablesecurity.com

TLDR InfoSec

AI SITE PERPLEXITY USES “STEALTH TACTICS” TO FLOUT NO-CRAWL EDICTS

A recent report from Cloudflare stated that Perplexity is deliberately circumventing robots.txt and utilizing evasion techniques to avoid web application blocks. The researchers identified that when Perplexity's crawlers encounter Cloudflare's blocks or a robots.txt file, they cycle through a list of IPs not in Perplexity's published IP ranges and shuffle ASNs to avoid blocks. Other sites such as Forbes, Reddit, and Wired have also leveled similar accusations at Perplexity.

arstechnica.com · 2 min

TLDR InfoSec

JURY “SENDS A MESSAGE” ON APP PRIVACY IN RULING AGAINST META

A jury found Meta guilty of illegally invading the privacy of women who shared their health data with the period tracking app Flo by deliberately harvesting it without consent. This verdict may set a landmark precedent in setting boundaries for how far tech firms can go in collecting personal data for use in targeted advertising. Meta has denied any wrongdoing and is “exploring all legal options.”

therecord.media · 2 min

TLDR InfoSec

SONATYPE UNCOVERS GLOBAL ESPIONAGE CAMPAIGN IN OPEN SOURCE ECOSYSTEMS

Sonatype uncovered a global espionage campaign led by North Korea's Lazarus Group that uses malware-laced open source packages on npm and PyPI to infiltrate developer environments. Over 234 malicious packages targeted at least 36,000 victims, aiming to steal secrets and open persistent backdoors across critical digital infrastructure.

sonatype.com · 2 min

TLDR InfoSec

PANDORA CYBER ATTACK EXPOSES CUSTOMER DATA VIA THIRD-PARTY VENDOR

Pandora confirmed a cyber attack through a third-party vendor that exposed customer names, phone numbers, and email addresses (but not financial data).

hackread.com · 2 min

TLDR InfoSec

THE HEAT WASN'T JUST OUTSIDE: CYBER ATTACKS SPIKED IN SUMMER 2025

Summer 2025 saw a major spike in cyber attacks with ransomware groups heavily targeting healthcare, retail breaches at Louis Vuitton and Belk, and widespread exploitation of critical Microsoft SharePoint vulnerabilities in espionage campaigns.

bleepingcomputer.com · 2 min

TLDR InfoSec

PBS CONFIRMS DATA BREACH AFTER EMPLOYEE INFO LEAKED ON DISCORD SERVERS

PBS confirmed a data breach exposing corporate contact information of 3,997 employees and affiliates after the data was leaked and circulated on Discord servers by PBS Kids fans apparently motivated by curiosity rather than malicious intent.

bleepingcomputer.com · 2 min