The Daily Index — Thursday, September 11, 2025

GENERAL

TLDR InfoSec

business

Summary unavailable

bitwarden.com

TLDR InfoSec

SESSIONREAPER, UNAUTHENTICATED RCE IN MAGENTO & ADOBE COMMERCE

Adobe released an emergency patch for a critical (CVSS 9.1) vulnerability in all versions of Adobe Commerce and Magento. The vulnerability allows for customer account takeover as well as unauthenticated remote code execution in some circumstances. The attack combines a malicious session with a nested deserialization bug.

sansec.io · 2 min

TLDR InfoSec

CURSOR'S AUTORUN LETS HACKERS EXECUTE ARBITRARY CODE

Cursor's AI-powered code editor ships with Workspace Trust disabled by default, allowing malicious repositories to automatically execute code through crafted ".vscode/tasks.json" files the moment a developer opens a folder, without any user prompts or warnings. Attackers can inject these malicious task files into public repositories, enabling them to compromise developer machines and access sensitive data, including API keys, cloud credentials, and SaaS sessions, simply through the act of browsing a project. Unlike VS Code, which does not auto-run tasks in default configurations, Cursor executes these tasks immediately after opening a project folder, creating a significant supply chain attack vector for the platform's one million users.

csoonline.com · 6 min

TLDR InfoSec

WHEN AI NUKES YOUR DATABASE: THE DARK SIDE OF VIBE CODING

A startup founder's production database was accidentally wiped by an AI coding assistant in Replit, highlighting the dangers of "vibe coding" - the practice of letting AI tools like GitHub Copilot generate code from plain English prompts without proper review. Research shows 45% of AI-generated code contains OWASP Top 10 vulnerabilities, with common issues including hardcoded secrets, weak access controls, and hallucinated dependencies that don't exist or contain security flaws. Security experts warn that "Shadow AI" development bypasses traditional code review processes, requiring organizations to treat AI-generated code like junior developer output with strict scrutiny and governance controls.

csoonline.com · 6 min

TLDR InfoSec

HOW AN ATTACKER'S BLUNDER GAVE US A RARE LOOK INSIDE THEIR DAY-TO-DAY OPERATIONS

Huntress gained unprecedented insight into a threat actor's operations when the attacker accidentally installed their EDR agent after finding them through a Google ad while researching Bitdefender, revealing extensive use of AI tools like Make.com for workflow automation, searches for Evilginx instances, and systematic reconnaissance targeting Nigerian banks and cryptocurrency exchanges. The actor demonstrated sophisticated OPSEC with residential proxies (LunaProxy), anti-detection browsers (Nstbrowser), and security tools (Malwarebytes) while working 12 to 14-hour days conducting research, crafting phishing messages using Google Translate, and accessing over 2,400 compromised identities. Browser history revealed their evolution from manual processes to AI-assisted workflows, including automated Telegram bot integration and the use of stolen cookies with tools like ROADtools for Microsoft Entra token exploitation.

huntress.com · 14 min

TLDR InfoSec

PWN MY RIDE: EXPLORING THE CARPLAY ATTACK SURFACE

Oligo exposes Apple CarPlay's security vulnerabilities, focusing on CVE-2025-24132, a stack buffer overflow in the AirPlay protocol that enables remote code execution with root privileges. They detail how wireless CarPlay exposes vehicles to attacks, mainly because most cars rely on weak Bluetooth pairing. Attackers can exploit poor authentication to extract WiFi credentials and launch RCE attacks. Although Apple patched this in the AirPlay SDK, most car manufacturers haven't implemented these fixes, leaving many vehicles exposed.

oligo.security · 6 min

TLDR InfoSec

AEGIS AI (PRODUCT LAUNCH)

Aegis AI provides email security through reasoning agents, each of which is a custom-built LLM tuned to a specific threat. Once the orchestrating agent recognizes a threat or potential threat, it calls other agents in the network, and these agents then run the analysis, reason with each other, and respond to the orchestrating agent with a verdict.

aegisai.ai

TLDR InfoSec

GOOGLE MISLED USERS ABOUT THEIR PRIVACY AND NOW OWES THEM $425M, SAYS COURT

A court ordered Google to pay $425 million in a class action lawsuit after finding it misled 98 million users about its "Web & App Activity" privacy setting, which was supposed to stop data collection but didn't prevent Google from gathering information through its Firebase analytics system. Despite users thinking their activities were private, Google continued collecting data from apps like Uber, Venmo, and Instagram through a separate system, with internal communications revealing Google was "intentionally vague" about data collection practices to avoid alarming users. This adds to Google's history of privacy violations, including recent settlements totaling over $2 billion for misleading location tracking and incognito mode practices.

malwarebytes.com · 3 min

TLDR InfoSec

THE US GOVERNMENT HAS NO IDEA HOW MANY CYBERSECURITY PROS IT EMPLOYS

The US government lacks accurate data on the number of cybersecurity workers and contractors it employs, due to the messy, incomplete, and unreliable data across agencies. The GAO found that most departments lack standardized reporting and quality controls, and efforts to fix the situation are stalled, leaving workforce planning and effective cybersecurity policy undermined.

theregister.com · 3 min

TLDR InfoSec

FORMER WHATSAPP SECURITY BOSS IN LAWSUIT LIKENS META'S CULTURE TO A “CULT”

Meta's ex-WhatsApp security chief, Attaullah Baig, has sued back, claiming the company ignored and concealed major privacy flaws, allowed over 1,500 engineers uncontrolled data access, and failed to secure and track user data. He asserts Meta retaliated against him for whistleblowing, while Meta counters that he performed poorly and misrepresented ongoing efforts to improve security.

arstechnica.com · 3 min

TLDR InfoSec

US CHARGES ADMIN OF LOCKERGOGA, MEGACORTEX, NEFILIM RANSOMWARE

The U.S. Department of Justice has charged Ukrainian national Volodymyr Viktorovich Tymoshchuk for his role as administrator of the LockerGoga, MegaCortex, and Nefilim ransomware operations that collectively caused hundreds of millions of dollars in damages to victims worldwide.

bleepingcomputer.com · 1 min

TLDR InfoSec

PIXEL 10 FIGHTS AI FAKES WITH NEW ANDROID PHOTO VERIFICATION TECH

Google is integrating C2PA Content Credentials into the Pixel 10 camera and Google Photos to help users distinguish between authentic, unaltered images and those generated or edited with artificial intelligence technology.

bleepingcomputer.com · 1 min

TLDR InfoSec

KILLSEC RANSOMWARE IS ATTACKING HEALTHCARE INSTITUTIONS IN BRAZIL

KillSec Ransomware attacked MedicSolution, a Brazilian healthcare software provider, stealing over 34 GB of sensitive medical data, including lab results, X-rays, and patient records (including minors) from an insecure AWS S3 bucket that was exposed for several months, marking the first notable supply chain incident affecting Brazil's healthcare industry.

securityaffairs.com · 3 min