TLDR INFORMATION SECURITY 2025-11-10

US CONGRESSIONAL BUDGET OFFICE HIT BY SUSPECTED FOREIGN CYBERATTACK

The US Congressional Budget Office (CBO) confirmed that it had suffered a cyberattack after detecting unauthorized access to its networks. Officials who discovered the breach are concerned that emails between CBO and congressional offices may have been exposed. A foreign actor is suspected.

DANGEROUS RUNC FLAWS COULD ALLOW HACKERS TO ESCAPE DOCKER CONTAINERS

Three critical vulnerabilities (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881) in the runC container runtime used by Docker and Kubernetes allow attackers to exploit symlink races and bind-mount redirections to gain root-level write access to the host system, bypassing container isolation by manipulating /dev/null, /dev/console, and /proc filesystem mounts during container initialization. The flaws affect all runC versions for CVE-2025-31133 and CVE-2025-52881, while CVE-2025-52565 impacts versions 1.0.0-rc3 and later, with patches available in runC versions 1.2.8, 1.3.3, 1.4.0-rc.3 and above. Security teams should immediately update to patched runC versions, enable user namespaces without mapping host root into containers, implement rootless containers where possible, and monitor for suspicious symlink behaviors that could indicate exploitation attempts.

NEW LANDFALL SPYWARE EXPLOITED SAMSUNG ZERO-DAY VIA WHATSAPP MESSAGES

A threat actor exploited CVE-2025-21042, a critical out-of-bounds write zero-day in Samsung's libimagecodec.quram.so library, to deploy LandFall spyware via malicious .DNG images sent through WhatsApp to Samsung Galaxy users (S22, S23, S24, Z Fold 4, and Z Flip 4) in the Middle East from July 2024 until Samsung patched it in April 2025. The spyware delivered a malformed DNG file with an embedded ZIP archive containing a loader and SELinux policy manipulator, enabling extensive spying such as microphone/call recording, location tracking, and access to photos, contacts, SMS, call logs, files, and browsing history while maintaining persistence and evading detection. Security professionals should ensure devices are updated with April 2025 patches, disable automatic media downloads, enable Android's Advanced Protection or iOS Lockdown Mode for high-risk users, and monitor for similar DNG exploitation patterns, given recent trends of commercial spyware leveraging image vulnerabilities.

BYPASSING ENROLLMENT RESTRICTIONS TO BREAK BYOD BARRIERS IN INTUNE

Administrators can configure Intune to block bring your own device (BYOD) enrollment using the device enrollment restriction, which can prevent attackers from enrolling rogue devices after stealing login credentials. If personal devices are allowed for other operating systems (such as Android), attackers can send the Entra join request as that OS and then check in and complete enrollment as Windows. Otherwise, attackers can manipulate the check in XML to mock a device ID or mock Azure Virtual Desktop.

FROM KEY SPRAWL TO SCALABLE CONTROL: RETHINKING SSH ACCESS

Static SSH keys can present security issues if they are not rotated often enough or shared between teams or with external contractors, and can also add to management overhead. SSH certificates present a more modern alternative in which users present their public key to a centralized CA, which signs a certificate based on it, which can be used for a time limited authentication. This article presents an implementation of SSH certificates using Hashicorp Vault and Boundary.

BUILDING SECURITY IN OPEN SOURCE FOR FINANCIAL SERVICES: OPENSSF AT OPEN SOURCE FINANCE FORUM (OSFF) NYC

OpenSSF sponsored the Open Source in Finance Forum to address critical security challenges in financial services, where 80-90% of modern software supply chains rely on open source software, including 71% of AI components, highlighting emerging risks such as malware hidden in AI model weights, poisoned training data, and identity-based intrusions that now account for 30% of financial sector attacks. The organization is implementing proactive defense measures, including Model Signing v1.0 for AI integrity verification, MLSecOps frameworks for full AI lifecycle security, transparency tools like OpenSSF Scorecard, OSV, and GUAC, plus policy engagement across the US and EU to secure open source from development to deployment. Financial services security professionals should adopt OpenSSF's security frameworks and tools, implement model signing for AI components, establish MLSecOps practices throughout the AI lifecycle, and actively participate in cross-industry collaboration to address supply chain vulnerabilities while connecting maintainers with the organizations that depend on their work.

RESTRICTEDPYTHON

RestrictedPython is a tool that defines a subset of the Python language that allows for running untrusted code.

DESTROYLIST

An up-to-date blacklist of phishing and scam domains, automatically updated by the PhishDestroy system. A reliable threat intelligence source for integration into security systems.

MY AWS ACCOUNT GOT HACKED - HERE IS WHAT HAPPENED

A cloud architect discovered that their personal AWS account was breached when they received a DKIM verification email. They then removed the attacker's access and found that the attacker had created four IAM accounts for backdoor access, launched a large EC2 instance (possibly for cryptomining), created an AWS Organization and a new account, and used Resource Explorer to search for additional access. The post walks the reader through the author's full process, from discovery to incident response to root cause analysis.

WHAT MAKES RANSOMWARE GROUPS SUCCESSFUL?

Ransomware gangs thrive through automation, customization, and advanced tools, rapidly evolving their tactics to outpace defenders. AI accelerates attacks and facilitates phishing, while tailored ransomware operations employ strong encryption and sophisticated extortion tactics. These groups operate like efficient SaaS enterprises, and the recommendation is to focus on defense against attacker techniques and fast, automated responses.

RANSOMVIBING APPEARS IN VS CODE EXTENSIONS

A ransomware-infected VS Code extension, "susvsex," was found on the Visual Studio Marketplace. It utilizes GitHub for command and control, encrypts files, and uploads them for extortion, but its malicious intent was clearly evident. Due to poor coding and a hardcoded decryption key, its threat is currently low. The incident highlights gaps in extension security.

fastest-growing companies. Meet Iru

MICROSOFT UNCOVERS 'WHISPER LEAK' ATTACK THAT IDENTIFIES AI CHAT TOPICS IN ENCRYPTED TRAFFIC

Microsoft has revealed a new attack, called Whisper Leak, that enables attackers to infer the topics of AI chat conversations by analyzing encrypted network traffic patterns, even without accessing the actual data.

QNAP FIXES SEVEN ZERO-DAY FLAWS EXPLOITED AT PWN2OWN

QNAP has released fixes for seven zero-day vulnerabilities discovered by Pwn2Own Ireland researchers in its QTS, QuTS Hero, Hyper Data Protector, Malware Remover, and HBS 3 Hybrid Backup Sync software.

18 ARRESTED IN CRACKDOWN ON CREDIT CARD FRAUD RINGS

Authorities across Europe detained 18 people accused of orchestrating extensive credit card fraud and money laundering networks.