TLDR INFORMATION SECURITY 2025-04-28

and Agentic AI, in one unified platform.

With SentinelOne, AI isn't just a buzzword—it's the unifying force and underlying strategy that gives you holistic autonomous protection.

Learn more about SentinelOne Cloud Security

PLANET TECHNOLOGY INDUSTRIAL SWITCH FLAWS RISK FULL TAKEOVER – PATCH NOW

Multiple Critical Vulnerabilities have been identified in Planet Technology's industrial switches. CVE-2025-46275 and CVE-2025-46271 allow complete control of the router, while CVE-2025-46273 reveals hard-coded communication credentials between the NMS and managed devices, enabling remote interception and configuration changes. There are also vulnerabilities affecting specific switches. Researchers also found lax security practices, including the use of default or weak credentials for MQTT and MongoDB.

SAP ZERO-DAY VULNERABILITY UNDER WIDESPREAD ACTIVE EXPLOITATION

SAP Netweaver software has an unrestricted file upload vulnerability identified by CVE-2025-31324. After querying internet server search engines Shodan and Censys, Onapsis estimates that about 10,000 SAP instances are potentially vulnerable. It is a CVSS 10 vulnerability, remotely exploitable through HTTP unauthenticated, that allows for complete system compromise.

NOVEL UNIVERSAL BYPASS FOR ALL MAJOR LLMS

A new technique called "Policy Puppetry” can bypass safety guardrails in all major generative AI models. The attack involves crafting prompts that appear as policy files, tricking AI systems into interpreting them as instructions that override safety alignments. This universal vulnerability demonstrates fundamental flaws in AI model training and security.

CROSS-SITE WEBSOCKET HIJACKING EXPLOITATION IN 2025

Cross-Site WebSocket Hijacking is a vulnerability that arises from WebSockets being unprotected by the Same Origin Policy, allowing malicious sites to connect to targeted sites impersonating the user. Modern browsers have implemented security features that make CSWSH harder to exploit, such as Chrome's SameSite=Lax default cookie and Firefox's Total Cookie Protection. However, proper Origin validation during the server-side WebSocket handshake is the most reliable defense, as browser settings can change, and Chrome still permits CSWSH under certain conditions.

USING AI TO ANALYSE CYBER INCIDENTS

This post shows how to use AI to create a timeline of the April 2025 Marks & Spencer cybersecurity incident, which impacted contactless payments and click-and-collect services, ultimately escalating to a suspension of online orders by April 25. The timeline details the progression from initial reports on April 19th to April 26th, documenting customer experiences, official communications, and media coverage with timestamps. Although M&S has not confirmed the nature of the attack, the company's response involved taking processes offline and consulting cybersecurity experts, causing operational disruptions across over 1,000 stores and a temporary 5% drop in their share price.

IO_URING IS BACK, THIS TIME AS A ROOTKIT

ARMO researchers exposed a critical security gap where Linux runtime security tools fail to detect malware using the io_uring interface. Their proof-of-concept rootkit, "Curing," bypasses traditional system call monitoring, affecting tools such as Falco and Microsoft Defender. While some vendors have implemented fixes, most security solutions remain vulnerable to this evasion technique.

CLOUD SNITCH

Cloud Snitch is a tool inspired by Little Snitch for macOS that visualizes AWS account activity with a focus on security and exploration. It's able to map activities, filter by AWS region, principal, IP addresses, etc, and also highlight any errors in prominent colors so that issues can be surfaced more easily.

JERICHO SECURITY (PRODUCT LAUNCH)

Jericho enables organizations to run AI Agent-based, hyper-realistic, personalized attack simulations to train employees to identify real-world threats, track their progress, and escalate difficulty and rewards based on completion.

SCARY-STRINGS

Flag potentially dangerous API calls in source code, a.k.a.. lines containing scary strings from a security perspective.

SOUTH KOREAN COMPANIES TARGETED BY LAZARUS VIA WATERING HOLE ATTACKS, ZERO-DAYS

North Korean APT Lazarus targeted six South Korean organizations in finance, IT, semiconductors, software, and telecommunications through Operation SyncHole. They employed watering hole attacks and exploited zero-day vulnerabilities in security software, targeting Cross EX and Innorix Agent for online banking and government sites. The attack utilized malware such as ThreatNeedle, wAgent, SignBT, and CopperHedge for reconnaissance and access maintenance, while Lazarus further developed tools to evade detection.

“YOU WOULDN'T STEAL A CAR” ANTI-PIRACY CAMPAIGN MAY HAVE USED PIRATED FONTS

The anti-piracy campaign "You Wouldn't Steal a Car" appears to have used XBand Rough, a knockoff of the FF Confidential font. This ironic discovery highlights the complex nature of typeface copyright law, where typeface designs have limited protection but font files can be copyrighted as software.

NORTH KOREAN IT WORKERS SEEN USING AI TOOLS TO SCAM FIRMS INTO HIRING THEM

In coordination with US authorities and third parties, Okta has tracked the behaviors and usage of GenAI by DPRK workers. Okta found that North Korean workers are utilizing GenAI tools at all stages in the process, from drafting resumes, to deepfake interviews, and even utilizing GenAI to maintain multiple jobs at the same time.

LATTICA EMERGES FROM STEALTH WITH FHE PLATFORM FOR AI

Lattica emerged with a platform that utilizes fully homomorphic encryption (FHE) for AI to process encrypted data without requiring decryption.

FBI SEEKS HELP TO UNMASK SALT TYPHOON HACKERS BEHIND TELECOM BREACHES

The FBI is seeking help to identify the Chinese Salt Typhoon hackers who breached U.S. and global telecom providers, accessing the private communications of government officials.

ROMHACK 2025 CONFERENCE CALL FOR PAPERS

RomHack 2025 is seeking presentations from individuals with a strong information security (infosec) background who wish to share interesting topics.