TLDR INFORMATION SECURITY 2025-05-08

Get the Guide: AI Security Posture Management for Dummies

CRITICAL LANGFLOW RCE FLAW EXPLOITED TO HACK AI APP SERVERS

Langflow offers a visual programming tool for building LLM-powered workflows using LangChain components. An unauthenticated RCE vulnerability where Langflow's /api/v1/validate/code endpoint, which is designed to validate user-submitted code, runs any code with no sandboxing or sanitization. CISA has now reported that this vulnerability is being actively exploited and has given federal agencies until May 26 to upgrade the software or add mitigations such as placing the software behind a firewall.

SECOND OTTOKIT VULNERABILITY EXPLOITED TO HACK WORDPRESS SITES

Threat actors have been observed exploiting a new vulnerability in the OttoKit WordPress plugin. The vulnerability could allow unauthenticated attackers to connect to impacted sites that have never enabled or used an application password due to a lack of proper authentication checks in the create_wp_connection() function. Attackers have been observed attempting to exploit the vulnerability to create an admin user account through the automation/action endpoint.

UNSOPHISTICATED HACKERS TARGETING ICS/SCADA SYSTEMS: CISA

Unsophisticated hackers are increasingly targeting industrial control systems in the energy and transportation sectors. Federal agencies recommend removing internet connections, changing default passwords, securing remote access, segmenting networks, and maintaining manual operation capabilities to protect critical infrastructure.

SECURE CROSS-ACCOUNT ACCESS IS TRICKY. FOUR COMMON DANGEROUS MISCONCEPTIONS

IAM role trust policies are the best-practice foundation for cross-account access. However, many users misunderstand the security implications associated with them. When creating role trust policies, users should keep in mind the risk of lateral movement in both their account and the account that they're trusting and therefore be aware that other principals could potentially use the role then those specified in the policy and could potentially gain access to other roles that the policy is not applied to. Many users also mistake the security importance of the management/payer account and allow trust policies to flow between less secure and more secure accounts within an organization.

ORGSEC GUIDE

The OrgSec Guide structures essential topics for effectively running a successful security program. It includes a compilation of resources, checklists, and addresses in DevSecOps, endpoint and product security, GRC, IAM, infrastructure, operational and cloud security, security operations, and AI.

DETECT CONTAINER ESCAPE VULNERABILITIES WITH OSQUERY

This guide explains how to use Osquery to detect container escape vulnerabilities in real-time by monitoring suspicious system calls and container activities. It presents three practical SQL queries that can be scheduled to run at 30-second intervals to detect namespace pivots, CVE-2024-21626 style escapes, and containers attempting to access the host kernel or metadata services. The guide also covers deployment steps, performance tuning tips, and integration options with logging platforms like Uptycs, Fleet, Splunk, and Loki.

APKTOOL-MCP-SERVER

apktool-mcp-server provides a fully automated MCP server built on top of apktool to analyze Android APKs using LLMs.

APPSIGNAL (PRODUCT LAUNCH)

AppSignal can identify abnormal behavior that could signal vulnerabilities and misconfigurations while enabling developers to identify performance issues and errors.

TOUTI CRACKER

Touti Cracker is a cross-platform educational tool that demonstrates ethical password recovery through brute-force techniques. It offers a fun, neon-styled UI with powerful features like Hashcat automation, registry backup, and password list generation.

PASSKEYS FOR NORMAL PEOPLE

Even with MFA, seasoned professionals like Troy Hunt can still be victims of phishing attacks. In this article, Hunt demonstrates how to set up passkeys on various sites for either an authentication method or an MFA factor, depending on the site's support. Hunt also demonstrates how to store passkeys in either 1Password or a Yubikey to make them available on other devices.

THE RUSSIAN OPEN SOURCE PROJECT THAT WE CAN'T LIVE WITHOUT

The widely used easyjson Golang JSON deserialization library is owned, maintained, and controlled by the VK Group. Russian state-owned entities control the VK Group, and it has leadership that is subject to US and EU sanctions. There is high potential for exploitation as the package is widely used in CNCF projects such as Helm, Istio, and Kubernetes.

EUROPOL SHUTS DOWN SIX DDOS-FOR-HIRE SERVICES USED IN GLOBAL ATTACKS

Europol has dismantled six DDoS-for-hire services used for thousands of cyberattacks globally. The platforms (cfxapi, cfxsecurity, neostress, jetstress, quickdown, and zapcut) offered user-friendly interfaces for launching attacks for as little as €10.

SOFTWARE CODE OF PRACTICE: BUILDING A SECURE DIGITAL FUTURE

The UK launched the voluntary Software Security Code of Practice to establish cyber security baselines for technology vendors with 14 baseline principles on SBOMs, patching, default MFA, and more.

POWERSCHOOL HACKER NOW EXTORTING INDIVIDUAL SCHOOL DISTRICTS

PowerSchool warns that a hacker from a previous cyberattack is extorting schools for ransom, threatening to release stolen student and teacher data if not paid.

LOCKBIT RANSOMWARE GANG HACKED, VICTIM NEGOTIATIONS EXPOSED

The LockBit ransomware gang's dark web panels were hacked, exposing sensitive data like negotiation messages, plaintext passwords, and bitcoin addresses.