TLDR INFORMATION SECURITY 2025-09-12

Wreck hackers, not budgets. Get a demo now

NEW VMSCAPE ATTACK BREAKS GUEST-HOST ISOLATION ON AMD, INTEL CPUS

Researchers from ETH-Zurich have found a new attack that allows an attacker to leak cryptographic keys from an unmodified QEMU hypervisor process running on modern AMD or Intel CPUs. In the attack, a guest user can influence indirect branch prediction in a host user process to leak arbitrary memory at a rate of 32 bytes/second with a byte-level accuracy of 98.7%. AMD has released a security bulletin about the issue. Linux kernel developers have released patches to mitigate the problem.

100,000 IMPACTED BY CORNWELL QUALITY TOOLS DATA BREACH

Cornwell Quality Tools has disclosed a ransomware-driven data breach that impacts over 100,000 people. Hackers accessed sensitive information like Social Security numbers and financial data in December 2024. The Cactus group claimed responsibility and leaked corporate docs, though it's unclear if all of the data was released.

LNER URGES CUSTOMERS TO BE VIGILANT AFTER PASSENGER DETAILS ACCESSED IN CYBER-ATTACK

A cyber-attack on LNER's third-party supplier exposed customers' contact information and some journey records, but no payment or password data. LNER's train services remain unaffected. The company has advised vigilance against suspicious communications and stresses that the breach does not compromise sensitive banking details.

WHAT THE SALESLOFT DRIFT BREACHES REVEAL ABOUT 4TH-PARTY RISK

The SalesLoft Drift breach demonstrates the emerging threat of "fourth-party" risk, where organizations are compromised through their vendor's acquired company (Drift) rather than direct vendor relationships. Attackers exploited legacy OAuth tokens that had been dormant for 18 months since SalesLoft's 2024 acquisition of Drift, allowing access to hundreds of Salesforce instances and Google Workspace accounts. This incident highlights how M&A activities can inherit hidden security risks that extend organizations' attack surfaces far beyond what they can directly assess or control through traditional security measures.

HOW PIXEL AND ANDROID ARE BRINGING A NEW LEVEL OF TRUST TO YOUR IMAGES WITH C2PA CONTENT CREDENTIALS

Google Pixel 10 is the first smartphone to implement C2PA Content Credentials in its native camera app, automatically attaching cryptographically-signed metadata to all photos that documents their creation and editing history. The feature uses hardware-backed security through Tensor G5 and Titan M2 chips to achieve C2PA Assurance Level 2, ensuring tamper-resistant verification while preserving privacy through anonymous attestation and one-time-use cryptographic keys. Google Photos will display this provenance information to help users distinguish between authentic images and AI-generated or edited content, with the capability rolling out gradually to other Android and iOS devices.

THE FRAGILE BALANCE: ASSUMPTIONS, TUNING, AND TELEMETRY LIMITS IN DETECTION ENGINEERING

When developing detection rules, assumptions are inevitably made that may lead to false positives. When tuning an alert for false positives, detection engineers may run up against telemetry limitations that force them to reconsider their initial assumptions. These limitations may lead the team to recreate the rule from a different data source, accept some amount of false positives, aggressively filter the rule and accept a certain amount of potential misses, or altogether scrap the rule.

it never stops. Drata's AI-native Trust Management platform

streamlines the entire GRC workflow. Security questionnaires? Automated. Evidence collection? Continuous. Risk management? Built in.

Get a demo

EVICTION STRATEGIES TOOL

The Eviction Strategies Tool is a tool, maintained by CISA, designed to help incident responders during the containment and eviction phases. It is comprised of a stateless webapp and a database of post-compromise countermeasures mapped to adversary tactics, techniques, and procedures (TTPs).

FACADE: FAST AND ACCURATE CONTEXTUAL ANOMALY DETECTION

FACADE is an enterprise security anomaly detection system made by Google. It uses high-precision deep learning across various applications, including defense against insider threats, ACL recommendations, and account compromise detection.

HUSH SECURITY (PRODUCT LAUNCH)

Hush Security is a platform that eliminates credential-based threats by replacing secrets and vaults with just-in-time, policy-based access for machines, removing the need for credentials entirely.

MICROSOFT ADDS MALICIOUS LINK WARNINGS TO TEAMS PRIVATE CHATS

Microsoft Teams will begin automatically alerting users when they send or receive a private message containing links that have been flagged as spam, phishing, or malware for all Microsoft Defender for Office 365 and Microsoft Teams enterprise customers. The feature will enter preview this month. It will be enabled by default when it reaches general availability in November.

THE US IS NOW THE LARGEST INVESTOR IN COMMERCIAL SPYWARE

The United States has surpassed all other nations in funding commercial spyware, driving a rapidly expanding global market. New research reveals that US investors now dominate this space by channeling money through hedge funds and pension plans into companies involved in spyware surveillance. Current regulations largely fail to address these financial flows, highlighting growing accountability and policy gaps.

KIDS IN THE UK ARE HACKING THEIR OWN SCHOOLS FOR DARES AND NOTORIETY

A surge in UK school cyber breaches is driven by students, who are responsible for over half the incidents. These breaches often result from weak passwords, misplaced logins, or staff security lapses. They usually do it as a dare, revenge, or attention-seeking, though some cases involve sophisticated attacks.

SECURE ALL YOUR CODE, DEPENDENCIES AND INFRASTRUCTURE EFFORTLESSLY, WITH A UNIFIED PLATFORM THAT'S BUILT-IN, NOT BOLTED ON. TRY CODACY FOR FREE

DDOS DEFENDER TARGETED IN 1.5 BPPS DENIAL-OF-SERVICE ATTACK

A European DDoS mitigation service provider was hit by a massive distributed denial-of-service attack that reached 1.5 billion packets per second.

SENATOR BLASTS MICROSOFT FOR 'DANGEROUS, INSECURE SOFTWARE' THAT HELPED PWN US HOSPITALS

Senator Ron Wyden has urged the FTC to investigate Microsoft after a ransomware attack on major US hospitals exposed flaws in Windows security.

CHINESE APT HITS PHILIPPINE MILITARY FIRM WITH NEW EGGSTREME FILELESS MALWARE

EggStreme is a new fileless malware framework used by a China-based APT group to target Philippine military organizations and APAC entities.