TLDR INFORMATION SECURITY 2025-10-10

See the difference and start shipping faster

SONICWALL: 100% OF FIREWALL BACKUPS WERE BREACHED

HACKERS EXPLOIT AUTH BYPASS IN SERVICE FINDER WORDPRESS THEME

WordPress security firm, Wordfence, is warning users of the Service Finder premium WordPress theme of a critical (CVSS 9.8/10) vulnerability. The vulnerability is an authentication bypass vulnerability that allows attackers to bypass authentication and log in as administrators. Although a patch was released in July, Wordfence is reporting a sharp uptick in exploitation starting in September.

GITHUB COPILOT CHAT FLAW LEAKED DATA FROM PRIVATE REPOSITORIES

A vulnerability in GitHub Copilot Chat allowed attackers to combine Content Security Policy bypass with remote prompt injection to leak sensitive data from private repositories, including AWS keys and zero-day vulnerabilities. The attack exploited hidden HTML comments and GitHub's Camo proxy system by creating a dictionary of pre-generated Camo URLs for each alphabet character, allowing data to be exfiltrated when victims clicked on malicious URLs. GitHub addressed the issue on August 14 by preventing Camo from being used to leak sensitive user information.

CYBERCRIME OBSERVATIONS FROM THE FRONTLINES: UNC6040 PROACTIVE HARDENING RECOMMENDATIONS

UNC6040 is a financially motivated threat group that uses voice phishing (vishing) to trick employees into authorizing malicious Salesforce Data Loader applications, enabling large-scale data theft from corporate Salesforce instances. The attackers impersonate IT support personnel to manipulate victims into granting OAuth access to fake connected apps, then systematically exfiltrate sensitive data using legitimate Salesforce tools. Organizations should implement phishing-resistant MFA, restrict API access to approved applications only, enforce network-based login restrictions, and deploy real-time detection rules that monitor for suspicious OAuth authorizations followed by bulk data exports.

ORACLE E-BUSINESS SUITE ZERO-DAY EXPLOITED IN WIDESPREAD EXTORTION CAMPAIGN

A threat actor linked to the CL0P group exploited a previously unknown vulnerability in Oracle E-Business Suite, stealing sensitive data from targeted organizations and launching a mass extortion email campaign. Attackers leverage sophisticated multi-stage Java payloads and compromised third-party accounts. Although Oracle issued critical emergency patches to mitigate the risk, this is still being actively exploited.

IMPLEMENTING USAGE AND SECURITY REPORTING FOR AMAZON ECR

Amazon Elastic Container Registry (ECR) provides both repository and image-level usage and security scan information. This walkthrough provides sample code for generating centralized reports to aggregate this data across both images and repositories. The walkthrough also includes information for setting up Athena tables and queries to analyze the data.

MICROSOFT: WINDOWS BACKUP NOW AVAILABLE FOR ENTERPRISE USERS

Microsoft's Windows Backup for Organizations is an enterprise-grade backup tool that backs up Windows settings, preferences, and Microsoft Store apps to Exchange Online cloud storage, simplifying Windows 10 to Windows 11 migrations. The feature is opt-in and disabled by default, requiring IT administrator configuration through backup and restore policy settings on Entra-joined devices. Microsoft encrypts the backed-up data but retains access for troubleshooting and legal compliance purposes under strict management oversight.

BROKEN AUTHORIZATION IN APIS: INTRODUCING AUTOSWAGGER

Intruder's Autoswagger is a free open-source tool that automatically scans APIs for authorization vulnerabilities by parsing OpenAPI/Swagger documentation to identify endpoints lacking proper authentication checks. The tool discovered critical security flaws across major organizations during bug bounty testing, including exposed credentials, customer data, and database access at companies like Microsoft, multinational tech firms, and beverage corporations. Autoswagger highlights how self-documenting APIs increase attack surface by providing attackers with detailed endpoint information, making these simple authorization weaknesses easier to exploit at scale.

ARTEMIS

Artemis is a tool from CERT Polska, Poland's computer emergency response team. It is a modular vulnerability scanner with automatic report-generation capabilities.

KURT GOT GOT

Fly.io's CEO, Kurt Mackey, fell victim to a sophisticated phishing attack that compromised their company's Twitter account. Fly.io's core infrastructure remained safe due to robust, phishing-resistant authentication. The incident exploited generational gaps and social engineering rather than technical flaws.

ITALIAN BUSINESSMAN'S PHONE REPORTEDLY TARGETED WITH PARAGON SPYWARE

Francesco Gaetano Caltagirone, a well-known Italian businessman, was notified by WhatsApp that his phone was targeted with Paragon spyware, extending the scandal in Italy beyond journalists and activists to business leaders. Caltagirone is the first businessman on the list of victims. The news comes after Paragon cut ties with the Italian government amid growing controversy.

CALIFORNIA ENACTS LAW GIVING CONSUMERS ABILITY TO UNIVERSALLY OPT OUT OF DATA SHARING

California Governor Gavin Newsom signed a law requiring browsers to make it easier for Californians to opt out of allowing third-party data sharing. The California Consumer Privacy Act (CCPA) requires websites to allow Californians to opt out of data sharing, but it also mandates that browsers universally support this. Previously, this had to be done using third-party extensions.

AZURE OUTAGE BLOCKS ACCESS TO MICROSOFT 365 SERVICES, ADMIN PORTALS

A Microsoft Azure Front Door CDN outage caused widespread access issues to Microsoft 365 services and admin portals across Europe, Africa, and the Middle East for several hours.

FAKE TIKTOK AND WHATSAPP APPS INFECT ANDROID DEVICES WITH CLAYRAT SPYWARE

ClayRat is an Android spyware targeting Russian users that spreads through fake popular apps on Telegram, stealing personal data, taking photos, making calls, and self-propagating by sending malicious messages.

SEN. PETERS TRIES ANOTHER APPROACH TO EXTEND EXPIRED CYBER THREAT INFORMATION-SHARING LAW

Senator Gary Peters introduced the Protecting America from Cyber Threats (PACT) Act to replace the expired Cybersecurity and Information Sharing Act of 2015, renaming it to avoid confusion with the CISA agency amid Republican concerns about social media censorship.