TLDR INFORMATION SECURITY 2025-08-27

Supersolution Every Business Can Afford_

ROWHAMMER ATTACK CAN BACKDOOR AI MODELS WITH ONE DEVASTATING BIT FLIP

ONEFLIP is a Rowhammer-based attack that can insert backdoors into AI models by flipping just a single bit in DRAM memory during inference. The attack targets vulnerable weights in the final classification layer of neural networks, allowing attackers to craft imperceptible trigger patterns that cause catastrophic misclassification (such as making self-driving cars misidentify stop signs as speed limit signs) while maintaining normal model accuracy for other inputs. It requires access to a white-box model and co-location on the target machine with DDR3/DDR4 memory, making it particularly concerning for multi-tenant cloud platforms and AI inference servers.

CISA WARNS OF ACTIVELY EXPLOITED GIT CODE EXECUTION FLAW

A new arbitrary code execution flaw in Git is being actively exploited. The vulnerability stems from Git mishandling carriage return characters in configuration files, which can lead to incorrect submodule path resolution. Attackers can exploit this vulnerability by publishing repositories with submodules that end in a carriage return (\r) and creating a crafted symlink with a malicious hook set up.

HEALTHCARE SERVICES GROUP DATA BREACH IMPACTS 624,000

A cyberattack on Healthcare Services Group exposed the personal data of over 624,000 people, including Social Security numbers and financial info, in late 2024. No identity theft has been reported, but victims have been offered free credit monitoring.

AGENTIC BROWSER SECURITY: INDIRECT PROMPT INJECTION IN PERPLEXITY COMET

An indirect prompt injection vulnerability in Perplexity Comet allows attackers to embed malicious instructions in webpage content, hijacking AI assistants and stealing sensitive data across authenticated sessions. The attack exploits Comet's inability to distinguish between user instructions and untrusted webpage content, allowing attackers to extract OTPs, access banking accounts, and perform unauthorized actions without the user's knowledge. Defenders should implement clear separation between user commands and webpage content, require explicit user confirmation for sensitive actions, and isolate agentic browsing from regular browsing sessions.

ENUMERATING AWS THE QUIET WAY: CLOUDTRAIL-FREE DISCOVERY WITH RESOURCE EXPLORER

DataDog discovered a now-patched enumeration technique for AWS that evades CloudTrail logging. AWS Resource Explorer is a service that provides a web-search-like interface for discovering resources in an account. The researchers found that the ListResources API call was previously categorized as a data event and, therefore, did not log to CloudTrail by default. AWS reclassified the call as a management event, which logs to CloudTrail by default, after DataDog alerted it to this technique.

TRACKING MALICIOUS CODE EXECUTION IN PYTHON

This article discusses techniques that cyber attackers use to hide malicious code execution in Python, focusing on the obfuscation of dangerous functions such as exec and eval. It explains how attackers bypass security tools using methods such as homoglyphs, built-in modules, variable reassignment, import tricks, and code obfuscation (e.g., with base64). The article introduces a static analysis library that detects these tricks, highlighting that tracking such abuses is challenging. It emphasizes the importance of combining automated analysis with human review for effective defense.

ULTIMATELSASSDUMPER

UltimateLsassDumper guides users through eight LSASS dumping techniques: Task Manager automation, rundll32-comsvcs minidump, MiniDumpWriteDump API, handle duplication, PssCaptureSnapshot, SilentProcessExit registry tweaks, and entire memory read using ReadProcessMemory. It explains methods with code examples, comparing benefits like avoiding child processes, disk writes, and detection. It also discusses modern mitigations such as LSA Protection (PPL) and Credential Guard (VBS/VTL), with bypass options via vulnerable drivers, PPL bypasses, and downgrades.

EVE

Eve is a Jamf exploitation toolkit used to interact with either cloud hosted or locally hosted Jamf Pro tenants using API calls.

SBOMQS

Sbomqs is a tool for evaluating SBOM quality, ensuring compliance, and managing your software supply chain security. From quality scoring to compliance validation, component analysis to vulnerability tracking - Sbomqs provides everything you need to work with SBOMs effectively.

WHY SIEM RULES FAIL AND HOW TO FIX THEM: INSIGHTS FROM 160 MILLION ATTACK SIMULATIONS

The Picus Blue Report 2025 analyzed 160 million attack simulations and found organizations detect only 1 out of 7 attacks, with 50% of failures attributed to log collection issues, including source coalescing, unavailable log sources, and network disruptions. Additional failure causes include rule misconfigurations (13%) and performance bottlenecks (24%) from resource-heavy rules and inefficient queries that overwhelm systems. Organizations must implement continuous validation through breach and attack simulation to test rules against evolving TTPs, optimize log collection pipelines, and tune detection thresholds to close critical security gaps.

BLISTERING WYDEN LETTER SEEKS REVIEW OF FEDERAL COURT CYBERSECURITY, CITING ‘INCOMPETENCE,' ‘NEGLIGENCE'

Senator Ron Wyden demanded that Chief Justice Roberts authorize an independent cybersecurity review of federal courts following allegations that Russian hackers had stolen sealed case data from systems with vulnerabilities that had been left unfixed for five years. Wyden criticized the judiciary's failure to implement mandatory cybersecurity requirements, slow adoption of phishing-resistant multifactor authentication, and a pattern of stonewalling congressional oversight about previous breaches. The letter highlights systemic cybersecurity failures in the handling of critical government infrastructure, including classified national security documents and sealed criminal investigations.

SALESLOFT BREACHED TO STEAL OAUTH TOKENS FOR SALESFORCE DATA-THEFT ATTACKS

Hackers breached the sales automation platform Salesloft to steal OAuth and refresh tokens via its Drift chat agent integration with Salesforce. Salesloft's SalesDrift platform connects the Drift AI chat agent with a Salesforce instance, allowing organizations to sync conversations, leads, and support cases into their CRM. Salesloft determined that this breach only impacted customers who use the Drift-Salesforce integration and has worked with Salesforce to revoke all active sessions and refresh tokens for the Drift application.

FCC REMOVES 1,200 VOICE PROVIDERS FROM TELEPHONE NETWORKS IN MAJOR ROBOCALL CRACKDOWN

The FCC blocked 1,200 voice service providers from U.S. phone networks for failing to comply with STIR/SHAKEN caller authentication requirements and robocall mitigation protocols.

GOOGLE TO VERIFY ALL ANDROID DEVELOPERS IN 4 COUNTRIES TO BLOCK MALICIOUS APPS

Google, aiming to prevent malicious apps and enhance security, will require all Android app developers in Brazil, Indonesia, Singapore, and Thailand to verify their identities by September 2026.

FRENCH RETAILER AUCHAN CYBERATTACK - THOUSANDS OF CUSTOMERS' PERSONAL DATA EXPOSED

Auchan suffered a cyberattack that exposed the loyalty program data of hundreds of thousands of customers, prompting alerts, phishing warnings, and a response to its second major breach in nine months.