TLDR INFORMATION SECURITY 2025-10-24

Read more on the Sublime Security blog

OVER 250 MAGENTO STORES HIT OVERNIGHT AS HACKERS EXPLOIT NEW ADOBE COMMERCE FLAW

Threat actors are actively exploiting CVE-2025-54236 (SessionReaper, CVSS 9.1), a critical nested deserialization vulnerability in Adobe Commerce and Magento that enables remote code execution and customer account takeover via the Commerce REST API, with over 250 attacks recorded in 24 hours. Attackers from five known IP addresses are deploying PHP webshells through ‘/customer/address_file/upload' and probing phpinfo, while 62% of Magento stores remain unpatched six weeks after Adobe's fix was released. Security teams must immediately patch all Adobe Commerce and Magento instances, block the listed attacker IPs (34.227.25.4, 44.212.43.34, 54.205.171.35, 155.117.84.134, and 159.89.12.166), and monitor for unauthorized file uploads, as this is the second critical deserialization flaw in these platforms within two years following CosmicSting (CVE-2024-34102).

CRITICAL MCP SERVER FLAW EXPOSES OVER 3K SERVERS AND THOUSANDS OF API KEYS

Security researchers discovered a critical path traversal vulnerability in Smithery.ai, a popular MCP server hosting service. The researchers discovered that they could exploit a path traversal vulnerability in the dockerBuildPath configuration value to read files outside of their project. The researchers used this vulnerability to find a fly.io API token that granted root access to more than 3k applications.

LG UPLUS REPORTS SUSPECTED DATA BREACH, CLAIMS ACTIVE RESPONSE TO “HACKING”

LG Uplus, one of South Korea's major mobile carriers, reported a data breach. The announcement follows a report from Phrack that a threat actor infiltrated LG Uplus' internal network and seized data from nearly 9k servers, including data of 42,256 accounts and 167 employees.

WHY ORGANIZATIONS ARE ABANDONING STATIC SECRETS FOR MANAGED IDENTITIES

Organizations are transitioning from static secrets (API keys, passwords, and tokens) to managed identities, achieving a 95% reduction in credential management time and a 75% reduction in learning platform-specific authentication. Major cloud providers (AWS IAM Roles, Azure Managed Identities, and GCP Service Accounts) now offer automated, short-lived credential provisioning that eliminates manual rotation and leakage risks. However, legacy systems and third-party APIs still require traditional secret management. Security teams should prioritize discovering existing credentials using NHI (Non-Human Identity) platforms before migration, aiming to reduce their secret footprint by 70-80% while maintaining robust secret management for remaining use cases.

MODDING AND DISTRIBUTING MOBILE APPS WITH FRIDA

Frida enables powerful mobile app modifications by injecting custom agents into running processes. However, distributing these modifications for use by others—especially on non-rooted Android devices—requires embedding Frida's gadget library directly inside the APK. Using a demo app, this post walks through preparing an agent script that always rolls a 'one' in a dice app, compiling it, and patching the APK to include Frida's gadget for autonomous script execution.

COLLECTING IPHONE UNIFIED LOGS VIA MACOS

Unified logs are a forensic resource for iOS that includes granular background activity that can't be obtained in any other forensic artifact. The logs can be collected manually on a Mac via libimobiledevice or automatically using a script written by the author. The author provides suggestions for commercial and open-source tools to read the .logarchive, a structured bundle containing binary .tracev3 files.

SSH-AUDIT

ssh-audit is an open-source Python tool that audits SSH server and client configurations by analyzing cryptographic algorithms, key exchanges, host keys, ciphers, and MACs against security best practices, with support for policy compliance testing and vulnerability detection, including Terrapin (CVE-2023-48795) and DHEat (CVE-2002-20001). The tool provides comprehensive analysis, including RSA/DH key length testing, algorithm recommendations, multi-threaded scanning, and built-in hardening guides for OpenSSH, Ubuntu, Debian, and Rocky Linux platforms. It now flags SHA-1 algorithms as failures, warns about quantum computing resistance, and includes built-in policies accessible via -L/--list-policies with custom policy creation via -M/--make-policy.

KEYCARD (PRODUCT LAUNCH)

Keycard provides an identity and access management platform for AI agents, enabling organizations to assign, track, and control AI agent permissions using cryptography, dynamic tokens, and runtime contextual access policies for secure, scalable agent deployment and visibility.

SAFELINE

SafeLine is a self-hosted Web Application Firewall(WAF)/reverse proxy that protects web apps from attacks and exploits.

META BOOSTS SCAM PROTECTION ON WHATSAPP AND MESSENGER

Meta introduced enhanced scam protections for WhatsApp and Messenger, including screen-sharing warnings during video calls with unknown contacts and on-device behavioral analysis to flag suspicious messages, with optional cloud-based AI review that breaks end-to-end encryption. The company removed over 21,000 fake customer support Facebook pages targeting users through comment monitoring on legitimate airline, travel agency, and bank accounts, part of broader scam trends targeting seniors with fake home remodeling and government debt relief schemes. Security teams should educate users, especially vulnerable populations, about enabling these protections, including Passkeys and Security Checkup features, while noting that cloud-based AI analysis compromises message encryption.

GOOGLE AND CHECK POINT NUKE MASSIVE YOUTUBE MALWARE NETWORK

A coordinated malware campaign on YouTube, known as the Ghost Network, exploited hijacked accounts to post fake tutorials promising cracked software and gaming cheats. These videos lured users into downloading infostealers, which stole credentials and crypto wallets. The operation relied on fake engagement and resilient tactics, leading Google and Check Point to remove over 3,000 malicious videos in a major crackdown.

VIBE CODING'S REAL PROBLEM ISN'T BUGS—IT'S JUDGMENT

AI code generation enables rapid, large-scale software creation, but speed and flawed judgment are the real risks. While AI-made code has vulnerability rates similar to human work, issues like ineffective coding practices and skipped reviews mean more exposure to breaches, so experts urge integrating security directly into AI workflows and cultivating best usage practices.

Huntress blog

MICROSOFT BUILDS ON RECALL WITH GAMING COPILOT — FAILS BASIC PRIVACY TESTS

Microsoft's new Gaming Copilot, built on Recall-like Copilot Vision technology, is being silently deployed to Windows 11 PCs without user consent or onboarding.

CANADA FINES CYBERCRIME FRIENDLY CRYPTOMUS $176M