8 OUT OF 10 BANKS IN BELGIUM HATE THIS ONE WEIRD EID RCE

Summary from the TLDR InfoSec newsletter

Researchers discovered critical vulnerabilities in Connective's eID signing extension, used by most Belgian banks and government agencies, that allowed malicious sites to silently extract smart card data and recover eID PINs due to missing origin binding. Furthermore, the extension's GET_READERS command permitted arbitrary relative DLL loading, enabling drive-by remote code execution if a victim simply downloaded a disguised PDF/DLL polyglot. Nitro fully mitigated these flaws by July 22. Defenders should verify all deployed Connective clients are updated past this date to enforce origin checks and block vulnerable library commands.