TLDR INFORMATION SECURITY 2025-10-28

Register for VibeSecCon (free)

HOW WE BUILT AN EXPLOIT FOR SESSIONREAPER, CVE-2025-54236 IN MAGENTO 2 & ADOBE COMMERCE

Pentest-Tools researchers developed a working exploit for CVE-2025-54236 "SessionReaper," an unauthenticated vulnerability in Magento 2's ServiceInputProcessor that allows customer account takeover through session manipulation. The exploit leverages a Magento\Customer\Model\Session\Proxy object's setCustomerId function to inject arbitrary customer IDs into PHP sessions, enabling attackers to impersonate any customer by crafting malicious session cookies. Organizations should patch immediately and monitor for unauthorized attempts to manipulate sessions targeting Magento installations.

DOMEWATCH LEAK EXPOSED PERSONAL DATA OF CAPITOL HILL APPLICANTS

A security researcher reported an unencrypted and non-password-protected database containing PII of over 7,000 applicants to the research firm Safety Detectives. The data includes names, phone numbers, email addresses, and security clearance status or level. 469 records listed individuals with “top secret” federal security clearance, which could expose those individuals to phishing risks.

QNAP WARNS OF CRITICAL ASP.NET FLAW IN ITS WINDOWS BACKUP SOFTWARE

QNAP issued a warning to customers to patch a critical ASP.NET Core vulnerability that affects the company's NetBak PC Agent software for backing up data to a QNAP NAS (Network Attached Storage). This vulnerability could allow an authenticated attacker to gain unauthorized access to sensitive data, modify server files, or perform a denial-of-service on the device. QNAP recommends that users either reinstall the NetBak PC Agent or manually update the ASP.NET Core install on their PCs.

THE LINUX BOOT PROCESS: FROM POWER BUTTON TO KERNEL

This deep dive explains the Linux boot sequence from CPU reset through various modes, including firmware handoffs, bootloader operations, kernel decompression, and memory setup with paging. It covers mode transitions, interrupt handling, GDT and IDT configuration, and kASLR, which randomizes kernel memory locations to prevent exploits. kASLR enhances security by randomizing kernel addresses, but can be disabled with nokaslr for debugging.

SCAMMERS TRY TO TRICK LASTPASS USERS INTO GIVING UP CREDENTIALS BY TELLING THEM THEY'RE DEAD

CryptoChameleon cybercriminal group targets LastPass users with phishing emails claiming "Legacy Request Opened (URGENT IF YOU ARE NOT DECEASED)" that trick victims into entering master passwords on fake sites by exploiting legacy access scenarios when family members request deceased users' accounts. The campaign uses domain spoofing, fabricated support case details, and phone calls to direct victims to attacker-controlled URLs designed to harvest credentials for cryptocurrency theft. Organizations should implement phishing-resistant MFA for password managers, educate employees about this specific "Legacy Request" subject line, and establish policies requiring additional authentication factors beyond master passwords for account access.

VIBECODING AND THE ILLUSION OF SECURITY

AI-powered coding, often called "vibecoding," claims to enable fast and seemingly secure development of features like two-factor authentication (2FA). However, this method often only creates the illusion of security, missing essential protections such as rate limiting and strong account lockout mechanisms. Attackers can easily bypass superficial safeguards, especially if limits depend on factors like IP addresses. Large language models (LLMs) tend to generate code that appears convincing, but without clear guidance, critical security measures are frequently overlooked or implemented incorrectly.

employee switches departments or devices. Rippling's new IAM

grounds identity in real-time employee data instead - enabling automatic updates without manual provisioning or custom scripts. See how it works in tomorrow's webinar [11]. Stay until the end for a chance to win a $500 gift card!

PDF_OBJECT_HASHING

PDF Object Hash is a method for identifying similarities between PDFs based on their structure rather than content, akin to imphash or ja3 hashes. It involves extracting object types and hashing them to cluster similar documents and detect overlaps. Recent updates to the parsing scripts improve accuracy, especially for irregular or corrupted PDFs.

SPIDERFOOT

SpiderFoot is an open source intelligence (OSINT) automation tool. It integrates with just about every data source available and utilises a range of methods for data analysis, making that data easy to navigate.

IRREGULAR (PRODUCT LAUNCH)

Irregular builds AI security labs to test the cybersecurity of advanced models like ChatGPT and Claude. It develops tools, testing methods, and scoring frameworks, collaborating with top AI companies to ensure the secure and responsible deployment of AI.

MEM3NT0 MORI – THE HACKING TEAM IS BACK!

Kaspersky uncovered Operation ForumTroll, a sophisticated espionage campaign using personalized phishing emails that exploit CVE-2025-2783, a Chrome sandbox escape vulnerability affecting Windows Inter-Process Communication (IPC) pseudo handles. The operation deployed "Dante" spyware by Memento Labs, targeting Russian entities through zero-day exploits and evasion techniques such as WebGPU validation and COM hijacking. Security teams should monitor for Base64 folders in %LocalAppData%, enhance email filtering for personalized phishing, and update Chrome to version 134.0.6998.177/178 or later to mitigate the sandbox vulnerability.

FULL STUDENT DATABASE OF MOIS-AFFILIATED RAVIN ACADEMY LEAKED

A comprehensive student database from Ravin Academy, a US Treasury-designated MOIS front organization used to recruit cyber operatives, has been leaked just days before its annual Tech Olympics event in Tehran. The exposed records contain complete personal information of trainees enrolled in what appears to be legitimate cybersecurity education, but serves as a talent pipeline for Iranian state-sponsored cyber operations against foreign governments and domestic dissidents. Organizations should monitor for individuals with Ravin Academy connections and note that the operational security failure demonstrates vulnerabilities in Iranian intelligence recruitment infrastructure.

YOU HAVE ONE WEEK TO OPT OUT OR BECOME FODDER FOR LINKEDIN AI TRAINING

LinkedIn will soon collect public profile data from users in the EU, UK, Canada, Switzerland, the EEA, and Hong Kong to train AI models and share it with Microsoft affiliates for ad targeting. Users in these regions have until October 27 to opt out, or their details—including posts and activity—will be included, except for private messages.

SEE STORAGE CONTROL IN ACTION

CRITICAL MICROSOFT WSUS FLAW EXPLOITED IN WILD AFTER INSUFFICIENT PATCH

Microsoft issued urgent out-of-band patches to fully address CVE-2025-59287, a critical vulnerability in WSUS that allows remote code execution with SYSTEM privileges, following active exploitation after the release of a proof-of-concept and the initial patch on October 14 proved inadequate.

GLOBALCVE (WEBAPP)

A unified, open-source hub for global vulnerability intelligence.

CONFIGURE MICROSOFT INTUNE FOR INCREASED SECURITY

A collection of settings for Microsoft Intune for securing tenants, devices, and data.