TLDR INFORMATION SECURITY 2025-06-27

Access Management Summit 2025

CRITICAL CISCO ISE VULNERABILITIES ALLOW REMOTE CODE EXECUTION

Cisco announced fixes for two critical (CVSS 10/10) vulnerabilities in its Identity Services Engine (ISE) and ISE Passive Identity Connector, which could allow unauthenticated remote code execution (RCE). The first vulnerability is caused by a lack of input validation, which allows unauthenticated attackers to submit crafted API requests and execute arbitrary code with root privileges. The second vulnerability is caused by a lack of file validation, which could allow an attacker to store malicious files in arbitrary directories on the device.

HACKERS TURN SCREENCONNECT INTO MALWARE USING AUTHENTICODE STUFFING

Cybersecurity firm G DATA is warning users of ConnectWise's ScreenConnect remote monitoring and management (RMM) software about a new malware campaign that utilizes ScreenConnect installers with a malicious configuration embedded in the authenticode certificate. The malicious installer is configured to have the title “Windows Update,” change the background to a Windows Update image, and connect to an attacker-controlled server. ConnectWise has revoked the certificates used in these binaries.

GLASGOW COUNCIL SERVICES REMAIN OFFLINE A WEEK AFTER CYBER ATTACK

Glasgow City Council suffered a cyberattack on June 19 via IT supplier CGI's third-party servers, disrupting online services including planning applications, payments, and pension portals. Customer data may have been stolen, but the confirmation has not yet been made.

CYBERCRIMINALS ABUSE OPEN-SOURCE TOOLS TO TARGET AFRICA'S FINANCIAL SECTOR

Threat actor CL-CRI-1014 has been targeting African financial institutions since July 2023. The attackers use open-source tools (PoshC2, Chisel, and Classroom Spy) and forge file signatures to establish network access. The group operates as initial access brokers, selling compromised financial institution access on darknet markets.

MARKETPLACE TAKEOVER: HOW WE COULD'VE TAKEN OVER EVERY DEVELOPER USING A VSCODE FORK; PUTTING MILLIONS AT RISK

Security researchers have discovered a critical vulnerability in open-vsx.org, the open-source VS Code extensions marketplace used by over 8 million developers across popular editors such as Cursor, Windsurf, and VSCodium. The flaw allowed attackers to steal admin credentials through a CI pipeline issue, enabling them to publish malicious updates to every extension on the marketplace and potentially compromise millions of developer machines. The vulnerability was responsibly disclosed in May and patched after multiple iterations over several weeks.

5 YEARS, 160 COMMENTS, AND THE VULNERABILITY THAT REFUSED TO DIE

Jonathan Leitschuh discovered an old vulnerability in SnakeYAML that could enable remote code execution through unsafe deserialization. The maintainer initially closed the report as “Won't Fix,” claiming a safe constructor made the code safe. After a lengthy discussion, PoCs, data, and a nearly hour-long call, Leitschuh convinced the maintainer to use the secure constructor by default and make insecure behavior opt-in, marking a win for secure defaults in SnakeYAML 2.0.

EXCLUSIVE FOR TLDR READERS: GET 40% OFF FOR A (VERY) LIMITED TIME.

BONFY (PRODUCT LAUNCH)

Bonfy provides AI governance solutions that detect and prevent risks in enterprise content, ensuring secure and compliant use of generative AI across organizations.

OBFUSK8

Obfusk8 is a C++17 header-only library designed to obfuscate binaries through a complex set of compile-time and runtime techniques.

YARA-X IS STABLE

The YARA team has officially announced the first stable release of YARA-X and moved the original YARA project into maintenance mode.

IRANIAN HACKERS ARE TRYING TO CREATE A PSYCHOLOGICAL WAR IN CYBERSPACE

A new report by cybersecurity agency DomainTools alleges that the Iranian-backed CyberAv3ngers group is shifting its operations to focus on misinformation and psychological warfare. The CyberAv3ngers have been active since 2023, and while they have been tied to confirmed intrusions, they have also claimed targets that have been debunked. According to the report, the group has refined cyber activity “into a fully realized propaganda apparatus” with the goal of not just breaching systems but “to control the narrative surrounding those breaches.”

QILIN RANSOMWARE ATTACK ON NHS SUPPLIER CONTRIBUTED TO PATIENT FATALITY

The NHS confirmed a patient died following Qilin's ransomware attack on pathology provider Synnovis. A delayed blood test result due to disrupted services contributed to the death. The attack affected multiple London NHS trusts, harming 170 patients in total. This represents a rare confirmed link between ransomware and patient mortality.

WINDOWS KILLED THE BLUE SCREEN OF DEATH

Microsoft is replacing Windows' iconic Blue Screen of Death with a Black Screen of Death nearly 40 years after its introduction. The change is part of the Windows Resiliency Initiative following the CrowdStrike outage that affected 8.5 million devices. Microsoft calls it a "simplified UI" but hasn't acknowledged the significance of ending this computing era.

EX-STUDENT CHARGED OVER HACKING UNIVERSITY FOR CHEAP PARKING, DATA BREACHES

Birdie Kingston, a 27-year-old former Western Sydney University student, was arrested for hacking the university since 2021, stealing over 100GB of data, altering academic records, and demanding $40,000 in cryptocurrency ransom.

MICROSOFT CONFIRMS FAMILY SAFETY BLOCKS GOOGLE CHROME FROM LAUNCHING

Microsoft Family Safety has a bug that temporarily prevents some Windows devices from opening browsers like Google Chrome after updates, with Microsoft recommending enabling 'Activity reporting' as a workaround until a fix is released.

MAN WHO HACKED ORGANIZATIONS TO ADVERTISE SECURITY SERVICES PLEADS GUILTY

Nicholas Kloster, a Kansas City man, admitted to hacking multiple organizations to promote his cybersecurity services and faces up to five years in prison and a $250,000 fine.