TLDR INFORMATION SECURITY 2025-07-18

Watch now →

WATCH OUT, ANOTHER MAX-SEVERITY, MAKE-ME-ROOT CISCO BUG ON THE LOOSE

Cisco patched a critical 10/10 severity bug (CVE-2025-20337) in its Identity Services Engine. The bug allowed unauthenticated remote attackers to execute arbitrary code with root privileges. Due to insufficient input validation, the vulnerability affects ISE releases 3.3 and 3.4. No workarounds exist. Immediate patching is essential, as exploits are expected soon.

UAP CONFIRMS RANSOMWARE ATTACK, PERSONAL DATA AND EMAIL CORRESPONDENCE EXPOSED

Clive Palmer's United Australia Party (UAP) posted a notice on its website that it suffered a data breach due to a ransomware attack. The party has stated that any individual who has interacted with the party may have had their data exposed, but it cannot conclusively determine which individuals were affected or what data was stolen. The stolen data may include email addresses, phone numbers, identity records, banking records, employment history, and any emails or attachments sent to or received from the party.

NEW TELEMESSAGE SGNL FLAW IS ACTIVELY BEING EXPLOITED BY ATTACKERS

TeleMessage SGNL, a Signal clone used by US government agencies, has an exposed /heapdump endpoint (CVE-2025-48927) that dumps 150MB memory snapshots containing usernames, passwords, and session data with no authentication required. Attackers are actively exploiting this flaw - CISA added it to the KEV catalog on July 14 and mandated federal agencies patch or stop using the software by July 22. Over 11 IPs have directly targeted this vulnerability, while 2,000+ IPs have scanned Spring Boot Actuator endpoints in the past 90 days, indicating widespread reconnaissance activity.

THE LINUXSYS CRYPTOMINER

This post dives into Linuxsys, a cryptominer exploiting CVE-2021-41773 in a long-running campaign since 2021. Attackers use compromised legitimate websites for stealthy malware distribution and evasion, and the vulnerability remains actively exploited with dozens of daily attempts.

WHY IS PREVENTATIVE SECURITY SO DIFFICULT?

Security teams should shift from endless vulnerability scanning and detection to preventative tools that stop issues at the source, like using supply chain security tools instead of just identifying vulnerabilities after deployment. Most security vendors focus on data collection and pattern detection rather than systemic prevention, leaving organizations to fix the identified problems manually. The strategy requires getting engineering teams to adopt preventative controls early in development workflows, rather than overwhelming them with vulnerability reports and SLAs that force reactive responses.

AUTOMATED FUNCTION ID DATABASE GENERATION IN GHIDRA ON WINDOWS

This post demonstrates how to automate function identification in stripped Windows binaries using Ghidra's Function ID databases, which work similarly to IDA Pro's FLIRT signatures to match known library functions against decompiled code. The approach involves extracting object files from static libraries (.lib files), importing them into Ghidra projects, and generating function signature databases that automatically rename generic function labels with actual library function names like OpenSSL functions. This technique significantly accelerates reverse engineering by eliminating manual function analysis, allowing security researchers to focus on vulnerability discovery rather than spending time identifying what each function does.

DOTENVX

Powered up dotenv that reduces the blast radius of secrets by splitting secrets management into two distinct components: an encrypted secrets file and a separate decryption key.

ICOUNTER (PRODUCT LAUNCH)

The iCOUNTER platform can act as an early warning system that identifies threats specific to the customer and its ecosystem, while also providing intelligence that enables rapid containment and recovery after an attack has taken place.

LINWINPWN

linWinPwn is a bash script that wraps a collection of Active Directory tools for enumeration, vulnerability checks, object modifications, and password dumping.

GOOGLE FINDS CUSTOM BACKDOOR BEING INSTALLED ON SONICWALL NETWORK DEVICES

Hackers (UNC6148) are compromising end-of-life SonicWall Secure Mobile Access appliances using leaked administrator credentials. The attackers install "Overstep" backdoor malware that deletes log entries, hindering forensic investigation, which means the attack method and vulnerabilities exploited remain unknown.

TRUMP ADMINISTRATION TO SPEND $1B ON OFFENSIVE HACKING OPERATIONS

As part of Trump's One Big Beautiful Bill, $1B has been allocated for offensive hacking operations. These funds can be used for carrying out attacks using 0-days and installing spyware, but also for everyday expenses such as infrastructure and intelligence gathering. Critics note that the bill slashes funding from defensive operations such as the CISA, potentially leaving the U.S. unable to defend itself.

VMWARE FLAWS THAT EARNED HACKERS $340,000 AT PWN2OWN PATCHED

Broadcom has patched VMware vulnerabilities from Pwn2Own Berlin 2025, where researchers earned $340,000+ exploiting critical bugs in ESXi and Workstation, allowing code execution.

POLICE SHUT DOWN 100 SERVERS TIED TO RUSSIAN NONAME057(16), ARREST 2

Operation Eastwood, a coordinated international law enforcement effort led by Europol, shut down over 100 servers belonging to the Russian pro-Putin DDoS group NoName057(16), arrested two individuals, and issued seven international arrest warrants targeting the group's 4,000+ members who conducted politically motivated attacks against Ukrainian and NATO-supporting websites.