TLDR INFORMATION SECURITY 2025-10-07

_Choose Zero-Trust with ThreatLocker_

ORACLE SECURITY ALERT ADVISORY - CVE-2025-61882

Oracle issued an emergency security alert for CVE-2025-61882, a critical remote code execution vulnerability in Oracle E-Business Suite that can be exploited over the network without authentication credentials. The vulnerability is already being actively exploited by threat actors. Oracle has discovered specific indicators of compromise, including IP addresses, command-line payloads, and file hashes associated with exploitation attempts. The IOCs reference exploit tools with naming conventions suggesting involvement by groups such as Scattered Spider, Lapsus$, and CL0P, indicating that this vulnerability is being weaponized by ransomware and extortion groups for immediate attacks.

UNITY HAS FOUND A SECURITY VULNERABILITY THAT HAS SAT DORMANT FOR ALMOST A DECADE: ‘TAKE IMMEDIATE ACTION TO PROTECT YOUR GAMES & APPS'

Unity warns developers about a vulnerability identified since version 2017.1 that exposes users to unsafe file loading and local file inclusion attacks, varying by OS. Developers need to either recompile and redistribute their apps to fix this issue or use a patching tool that applies updates without recompilation. However, this tool does not support Linux builds or applications with tamper-proofing or anti-cheat features enabled.

RANSOMWARE ATTACK ON OHIO COUNTY IMPACTS OVER 45K RESIDENTS, EMPLOYEES

Ransomware attackers stole data in a cyberattack on Union County in Ohio, impacting 45k of the county's 71k residents. The stolen data includes Social Security numbers, driver's license numbers, financial account information, fingerprint data, medical information, and passport numbers.

PHOENIX: ROWHAMMER THAT WORKS ON DDR5

Phoenix is a Rowhammer attack that bypasses DDR5 protections by reverse-engineering Target Row Refresh (TRR) and exploiting timing windows where defenses weaken. The attack uses dummy memory accesses to trick TRR before executing targeted strikes that can read/write arbitrary memory, steal RSA keys, or escalate Linux privileges within 5 seconds to 7 minutes. It demonstrates that DDR5's protections can still be evaded by sophisticated timing attacks that manipulate memory through carefully crafted access patterns.

MCP TOOLS: ATTACK VECTORS AND DEFENSE RECOMMENDATIONS FOR AUTONOMOUS AGENTS

Elastic Security Labs provides a comprehensive overview of different attacks and defenses for MCP tools. Elastic provides a prompt for an LLM to detect malicious functions in an MCP server, covering security risks ranging from traditional vulnerabilities to tool poisoning, orchestration injection, rug-pull redefinitions, name collisions, and passive influence. Elastic recommends that users utilize sandboxed environments for MCP, adhere to the principle of least privilege, restrict MCP servers to only trusted sources, require human approval for sensitive operations, and monitor all prompts and code.

IMDS ABUSED: HUNTING RARE BEHAVIORS TO UNCOVER EXPLOITS

Wiz Research developed a data-driven threat hunting methodology to detect anomalous Instance Metadata Service (IMDS) usage by identifying processes that rarely access IMDS but suddenly query sensitive endpoints, such as IAM credentials, leading to the discovery of active exploitation of two zero-day SSRF vulnerabilities. The team uncovered CVE-2025-51591 in Pandoc (HTML-to-PDF conversion via malicious iframe tags) and a ClickHouse SSRF vulnerability where attackers abused SQL "SELECT * FROM url" functions to access cloud metadata services across AWS and GCP environments. This approach demonstrates how behavioral anomaly detection can reveal novel attack vectors targeting cloud infrastructure, emphasizing the importance of enforcing IMDSv2 and implementing least-privilege access controls to mitigate credential theft and lateral movement risks.

Dropzone AI

CADDY

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS.

IAMHOUNDDOG

IAMhounddog is a tool that helps pentesters quickly identify privileged principals and second-order privilege escalation opportunities in unfamiliar AWS environments.

TOKENEX

Tokenex is a library that provides a unified interface for obtaining and refreshing credentials from various cloud providers and authentication systems. Tokenex supports AWS, GCP, Azure, OCI, Generic, K8sSecret, OAuth2AC, and OAuth2CC.

TOTOLINK X6000R: THREE NEW VULNERABILITIES UNCOVERED

There are three critical vulnerabilities in TOTOLINK X6000R routers (CVE-2025-52905, CVE-2025-52906, and CVE-2025-52907) that allow unauthenticated attackers to execute arbitrary commands and bypass security controls via the router's web interface. The vulnerabilities stem from inadequate input sanitization in the cstecgi.cgi endpoint, with the blocklist failing to filter hyphen characters, and enabling argument injection, command injection, and arbitrary file manipulation attacks. TOTOLINK has released patched firmware (V9.4.0cu.1498_B20250826). Users are strongly advised to update immediately as these flaws could allow attackers to gain root access, intercept traffic, and pivot to other network devices.

SIGNAL STATEMENT ON GERMANY

The latest German Chat Control proposals would require scanning of every message, photo, and video on a person's device. Signal has announced that it will discontinue services in Germany, and possibly across Europe, if these controls are passed, arguing that regardless of whether messages are scanned before or after encryption, the controls negate the premises of end-to-end encryption.

SCATTERED LAPSUS$ HUNTERS OFFERING $10 IN BITCOIN TO 'ENDLESSLY HARASS' EXECS

The cybercrime group Scattered Lapsus$ Hunters is paying individuals $10 in Bitcoin to pressure executives of alleged breach victims via email, aiming to coerce them into making ransom payouts. The group, linked to attacks via a Salesforce integration, published targets' details and set a payment deadline. Salesforce and Google have stated that the attacks aren't linked to a compromise of Salesforce itself, and law enforcement is investigating the gang.

PAM. Register

RACHEL TOBAC: WARN YOUR FAMILY ABOUT SORA2

Security professionals should educate their families about Sora 2 and the importance of online skepticism.

ZERODAY.CLOUD

Wiz has announced a new hacking competition with a total reward pool of $4.5 million where participants can earn up to $300,000 per exploit for demonstrating vulnerabilities against widely used cloud software.

RED HAT DATA BREACH ESCALATES AS SHINYHUNTERS JOINS EXTORTION

Red Hat's data breach worsened as Crimson Collective and ShinyHunters launched a leak site, threatening to release 570GB of stolen data, including reports from Walmart, HSBC, and the Department of Defense, unless the ransom is paid by October 10.