TLDR INFORMATION SECURITY 2025-05-02

final installment in WethosAI's groundbreaking webinar series

about separating AI noise from reality. This session goes deeper than ever to reveal the cybersecurity realities behind AI's glamorous façade – and what your organization must know to stay safe and effective.

💺 Save your virtual seat

WINDOWS RDP LETS YOU LOG IN USING REVOKED PASSWORDS. MICROSOFT IS OK WITH THAT

A security researcher discovered a vulnerability where Windows RDP would accept a revoked password without raising any alerts. This vulnerability occurs because when a user logs in using a Microsoft or Azure account, Windows validates the password and then caches it in an encrypted local storage, which is used for all further authentication attempts. Microsoft has responded that this is an intentional design decision to prevent users from getting locked out of a device.

ASCENSION DISCLOSES NEW DATA BREACH AFTER THIRD-PARTY HACKING INCIDENT

Ascension, one of the largest private healthcare systems in the US, is notifying patients that their data was stolen in a breach in December 2024. Ascension stated that the breach was caused by them inadvertently disclosing data to a business partner which the attacker then stole the data from via a vulnerability in third-party software used by the business partner. The disclosed data includes names, addresses, phone numbers, email addresses, dates of birth, race, gender, and Social Security numbers.

EMERA, NOVA SCOTIA POWER RESPOND TO CYBERSECURITY BREACH; INCIDENT RESPONSE TEAMS MOBILIZED

Emera Inc. and Nova Scotia Power reported unauthorized access to their Canadian network. They have isolated the affected systems, engaged cybersecurity experts, and notified law enforcement. No disruption to power operations has occurred.

PWNING THE LADYBIRD BROWSER

Ladybird browser has a bug that allows use-after-free exploitation via a constructor and a malicious handler. Attackers can manipulate the argument buffer to trigger a heap-use-after-free condition, leaking object addresses and potentially achieving code execution by overwriting return pointers. Exploiting this bug involves crafting memory structures to control the renderer and executing malicious code, which requires careful data and pointer manipulation within the browser environment.

MY SIEM-AGNOSTIC CREATIVE PROCESS TO DETECTION ENGINEERING

This post describes a process for understanding a new data source and creating detections for malicious behaviors. The first steps involve reading the documentation to understand the service and brainstorming ideas for what a malicious user might do. Then, examine the logs to determine what is considered regular or anomalous behavior, often utilizing event counts. Finally, plan out what type of detection they will write, write the detection, and then test for success, failure, and edge cases.

VIBE HACKING: FINDING AUTH BYPASS AND RCE IN OPEN GAME PANEL

Eddie Zhang vibe-hacked his way to discovering vulnerabilities in Open Game Panel, including a PHP type juggling authentication bypass and two local file inclusion flaws that enable remote code execution when chained with game configuration files. His "vibe hacking" approach combined AI tools with manual analysis, demonstrating both the potential and limitations of AI-assisted security research.

SANTA

Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors executions and file access to determine whether to allow or deny the execution.

PISTACHIO (PRODUCT LAUNCH)

Pistachio's platform can send simulations and scenarios to employees via email, Microsoft Teams, or Slack. It runs in the background to help them identify and respond to threats in real time. It also observes user behavior and learning patterns, adapting the security education accordingly.

GPGFRONTEND

A free, open-source, robust yet user-friendly, compact, and cross-platform tool for OpenPGP encryption. It stands out as an exceptional GUI frontend for the modern GnuPG (gpg).

HOW US DEFENSE SECRETARY HEGSETH CIRCUMVENTS THE OFFICIAL DOD COMMUNICATIONS EQUIPMENT

This post walks through the various communications equipment that has been available to US Defense Secretary Pete Hegseth since the Obama administration. Hegseth initially would shift his chair to the back of his office to get a better Wi-Fi signal to use the Signal app but later requested a direct line to the public internet be run to a personal computer at his desk with Signal and another app for sending text messages installed. Hegseth also has access to SecDef Cables, which is a communications center dedicated to the office of the Secretary of Defense.

TAG YOUR WAY IN: NEW PRIVILEGE ESCALATION TECHNIQUE IN GCP

A new privilege escalation technique in Google Cloud Platform (GCP) exploits IAM Conditions and tagBindings to elevate access for attackers with low-risk roles. By attaching specific tags to resources, attackers can bypass restrictions and gain elevated privileges without directly modifying IAM policies. Organizations should prioritize securing tag permissions to prevent this overlooked escalation path in GCP.

THE WORDPRESS SECURITY TEAM IS HIDING THAT THEY ARE FAILING TO FIX KNOWN SECURITY ISSUES IN WORDPRESS

WordPress' Security Team is not effectively fixing known security issues, lacking transparency and accountability. Despite claims of a large team, details about their members remain hidden. Some security issues, like SSRF vulnerability, have gone unaddressed for years without clear plans for resolution.

2025 APPLICATION SECURITY BENCHMARK

95–98% of AppSec alerts do not require action and may be harming organizations more than helping.

SCAMMERS USE SPAIN-PORTUGAL BLACKOUT FOR TAP AIR REFUND PHISHING SCAM

Scammers are posing as TAP Air Portugal in fraudulent emails to deceive victims into providing personal and financial information by offering fake refunds for flight issues linked to recent power outages in Spain and Portugal.

APPLE MUST PAY OPTIS $502M IN UK PATENT DISPUTE

Apple has been ordered to pay Optis $502 million in a UK patent dispute over 4G technology used in iPhones and iPads.