TLDR INFORMATION SECURITY 2025-11-14

has had on security and efficiency.

Watch now

OVER 67,000 FAKE NPM PACKAGES FLOOD REGISTRY IN WORM-LIKE SPAM ATTACK

Cybersecurity researchers uncovered a massive spam campaign flooding npm with over 67,000 fake packages dubbed "IndonesianFoods." The worm-like attack, active since early 2024, exploits dormant JavaScript files requiring manual execution to bypass security scanners. Attackers likely monetize the campaign through the Tea protocol by artificially inflating impact scores to earn cryptocurrency tokens, while creating a self-replicating network that strains registry infrastructure and pollutes search results.

CL0P RANSOMWARE LISTS NHS UK AS VICTIM, DAYS AFTER WASHINGTON POST BREACH

The Cl0p ransomware group claimed the NHS UK as a victim on November 11, days after breaching The Washington Post by exploiting CVE-2025-61882, a critical remote code execution vulnerability (CVSS 9.8) in Oracle E-Business Suite versions 12.2.3-12.2.14. The vulnerability was exploited beginning August 2025 before Oracle's October 4 emergency patch, with attacks accelerating after Scattered Lapsus$ Hunters leaked proof-of-concept code on October 3, enabling Cl0p and FIN11 to conduct synchronized data-exfiltration campaigns against hundreds of organizations. Organizations running Oracle EBS must immediately apply the October 2025 patch, conduct forensic reviews dating back to August, and monitor for connections to suspicious IP addresses 200.107.207.26 and 185.181.60.11.

SUSPECTED FORTINET ZERO DAY EXPLOITED IN THE WILD

CREATING A “TWO-FACE” RUST BINARY ON LINUX

A “two-face” binary is a binary that contains a malicious program designed to run on a target host and a benign binary that executes on any other host. To ensure that the malicious program runs only on the target host, it is encrypted with a key derived from the target's disk partition UUIDs. The author of this article developed a twoface Rust binary to implement this process, which also includes defenses to prevent detection of the decrypted binary.

CONFIGURING THE AWS WAF ANTI-DDOS MANAGED RULE GROUP FOR YOUR RESOURCES AND CLIENTS

AWS WAF provides an Anti-DDOS managed rule group to detect and mitigate HTTP DDOS events. By default, the rule group uses a JavaScript challenge for all GET requests with low or medium suspicion and blocks all GET requests with high suspicion of contributing to DDoS attacks. This post provides ways to customize the rule group for scenarios where clients don't support the JavaScript challenge, clients can't use the WAF client integration, non-challengeable requests overwhelm resources, and when challengeable requests overwhelm resources before they're blocked.

PRACTICAL LLM SECURITY ADVICE FROM THE NVIDIA AI RED TEAM

The NVIDIA AI Red Team has observed three common vulnerabilities in the implementation of AI systems. The first vulnerability involves directly executing LLM-generated code, which could lead to remote code execution in the case of direct or indirect prompt injection. The second vulnerability is related to insufficient access controls in RAG data sources, which could allow a user to read data they are not privileged to read or write data to the data store. The third vulnerability is related to active content rendering of LLM outputs, which could lead to information leakage via images or other network requests.

door to secure, responsible AI adoption. Watch the webinar

WIN11DEBLOAT

Win11Debloat is a PowerShell script that removes preinstalled apps, disables telemetry, and performs various other changes to customize, declutter, and improve the Windows 11 user experience.

SWEET SECURITY (PRODUCT LAUNCH)

Sweet Security offers AI-powered security solutions for real-time threat detection and response across cloud and AI environments. The platform uncovers shadow AI, misconfigurations, risky access, and prevents prompt injection and abnormal model behavior.

SHANNON

Shannon is an AI pentester whose goal is to break your web app before someone else does. It autonomously hunts for attack vectors in your code, then uses its built-in browser to execute real exploits, such as injection attacks and auth bypass, to prove the vulnerability is actually exploitable.

MOZILLA FIREFOX GETS NEW ANTI-FINGERPRINTING DEFENSES

Mozilla has announced that, beginning in the recently released Firefox 145, further fingerprinting blocking will be implemented, dropping the percentage of user trackability to 20%. The specific enhancements block requests to discover installed fonts, hardware details, number of processor cores, multi-touch support, and dock/taskbar dimensions. The enhancements will initially be rolled out for users in Private Browsing who set their Enhanced Tracking Protection to Strict.

NHS SUPPLIER ENDS PROBE INTO RANSOMWARE ATTACK THAT CONTRIBUTED TO PATIENT DEATH

Synnovis has completed an exhaustive 18-month investigation into a crippling ransomware attack in June 2024 that affected nearly a million NHS patients, severely disrupted London pathology services and leading to a patient's death. The probe struggled with fragmented data. While no ransom was paid and systems were replaced, many patients must still wait for official notification if their data was compromised.

GOOGLE SUES TO DISRUPT CHINESE SMS PHISHING TRIAD

Google filed a lawsuit in the Southern District of New York against 25 individuals connected to Lighthouse, a Chinese phishing-as-a-service toolkit that has compromised over 1 million victims across 120 countries by spoofing USPS, toll road operators, e-commerce sites, and financial institutions via SMS. The operation captures payment card data through fake mobile sites and then exploits the legitimate Apple Pay and Google Pay enrollment processes by tricking victims into providing one-time authentication codes, enabling attackers to load stolen cards onto mobile wallets they control. Security teams should monitor SMS gateways for brand impersonation, educate users to verify unexpected payment requests through official channels, and watch for unusual mobile wallet enrollment patterns that could indicate credential theft.

ELON MUSK'S X BOTCHED ITS SECURITY KEY SWITCHOVER, LOCKING USERS OUT

Elon Musk's X platform disrupted user access by mishandling a switch from twitter.com to x.com for two-factor authentication using security or passkeys, with many users becoming locked out, caught in error loops, and unable to re-enroll.

GOOGLE PAID OUT $458,000 AT LIVE HACKING EVENT

Google awarded $458,000 in bounty rewards at the ESCAL8 bugSWAT event after 38 top security researchers reported 107 vulnerabilities across AI, Android, and Google Cloud.