TLDR INFORMATION SECURITY 2025-12-15

Get the free guide

FIELDTEX DATA BREACH IMPACTS 238,000

Fieldtex Products, a US medical supply and contract sewing provider, reported unauthorized access to its systems in mid-August that exposed protected health information for about 238K individuals, including names, addresses, dates of birth, insurance IDs, plan details, and gender. Akira ransomware has claimed responsibility, saying it stole over 14 GB of corporate, employee, customer, and financial data.

DATA BREACH AT CREDIT CHECK GIANT 700CREDIT AFFECTS AT LEAST 5.6 MILLION

A hacker accessed 700Credit's systems and stole personal data, including names, addresses, dates of birth, and Social Security numbers for at least 5.6 million people whose details were collected by US auto dealerships between May and October. The company is notifying victims by mail. Michigan's attorney general has urged affected individuals to use credit freezes or monitoring to reduce their risk of fraud.

HOME DEPOT EXPOSED ACCESS TO INTERNAL SYSTEMS FOR A YEAR, SAYS RESEARCHER

Security researcher Ben Zimmermann discovered an exposed GitHub access token belonging to a Home Depot employee that granted access to hundreds of private source code repositories, cloud infrastructure, and critical systems, including order fulfillment and inventory management, for approximately one year. Despite multiple attempts to privately disclose the issue via email and LinkedIn to Home Depot's CISO, Zimmermann received no response until TechCrunch contacted the company, highlighting the absence of a vulnerability disclosure or bug bounty program. Home Depot revoked the token's access following media outreach, but has not confirmed whether logging capabilities exist to determine if unauthorized parties accessed internal systems during the exposure period.

HOW WE GOT HIT BY SHAI-HULUD: A COMPLETE POST-MORTEM

Shai-Hulud 2.0 is a malicious npm supply-chain worm that abuses install-time scripts to run hidden malware on developer machines, steal credentials with tools like TruffleHog, and then exfiltrate them to attacker-controlled GitHub repositories using obfuscation techniques such as multi-layer base64 encoding. With stolen tokens, it can mass-clone private code, attempt destructive git operations, and, if npm publish credentials exist, automatically republish trojanized versions of popular packages, rapidly propagating through the JavaScript ecosystem. Recommendations to prepare against it include disabling npm scripts by default, adopting pnpm's safer defaults and minimum package age, enforcing branch protection everywhere, and moving to short-lived CI-based publishing via OIDC to eliminate long-lived secrets on developer laptops.

A LOOK AT AN ANDROID ITW DNG EXPLOIT

Google Project Zero analyzed in-the-wild DNG image exploits targeting Samsung's Quram image parsing library (CVE-2025-21042), discovered through suspicious files uploaded to VirusTotal that were distributed via WhatsApp and exploited Samsung's com.samsung.ipservice process when images were automatically scanned. The vulnerability allowed out-of-bounds writes through malformed DNG opcode parameters, which attackers leveraged to corrupt heap metadata, bypass ASLR through crafted MapTable operations that leaked library addresses, construct JOP chains, and ultimately achieve system() command execution to deploy spyware—all without control flow integrity mitigations like PAC/BTI present in the Quram library. Samsung silently patched the vulnerability in April by adding bounds checks to prevent plane index overflows. The case demonstrates how image format specifications provide powerful exploitation primitives that enable single-bug exploits to achieve interactionless remote code execution and access to all media store contents, capabilities that would likely have been prevented by MTE deployment.

CAPABILITIES ARE THE ONLY WAY TO SECURE AGENT DELEGATION

Traditional IAM systems are inadequate for securing AI agent delegation because they verify identity rather than track authority derivation across dynamic task chains, creating the Confused Deputy problem where agents possess ambient permissions without understanding their origin or intended scope. Capability-based authorization systems address this by treating authority as cryptographically-signed tokens that are explicitly passed between agents, monotonically attenuated at each delegation hop, bound to holder keys for proof of possession, and automatically expire when tasks complete. This model prevents prompt injection attacks from escalating to data exfiltration by ensuring agents can only exercise the specific, constrained authority delegated to them rather than role-based permissions, making injection attempts succeed at the language layer but fail at the authorization layer.

a Leader.

LUMIA SECURITY (PRODUCT LAUNCH)

Lumia Security provides a network-level security and governance platform that gives enterprises visibility and control over how employees and autonomous agents use AI tools. It understands AI interactions' intent and context, continuously evaluates risk, and enforces policies across thousands of AI applications.

BLACKARCH

BlackArch Linux is an Arch Linux–based penetration testing distribution for penetration testers and security researchers. The repository contains 2,880 tools. You can install tools individually or in groups. BlackArch Linux is compatible with existing Arch installations.

KALI LINUX 2025.4 RELEASED WITH 3 NEW TOOLS, DESKTOP UPDATES

Kali Linux 2025.4 introduces three new penetration testing tools (bpf-linker, evil-winrm-py, and hexstrike-ai) alongside major desktop environment upgrades, including GNOME 49 with complete transition to Wayland and removal of X11 support. The release includes expanded Kali NetHunter support for Android 15/16 devices with Wifipumpkin3 preview for rogue access point attacks, enhanced VM guest utilities support for VirtualBox, VMware, and QEMU, and distribution changes requiring BitTorrent for Live image downloads due to increased file sizes. Users can upgrade existing installations via apt commands or download fresh ISO images. The update focuses on improving both security testing capabilities and user experience across desktop environments.

NEW REACT VULNS LEAK SECRETS, INVITE DOS ATTACKS

THE US DIGITAL DOXXING OF H-1B APPLICANTS IS A MASSIVE PRIVACY MISSTEP

The US State Department mandated that H-1B visa applicants and their H-4 dependents set all social media profiles to public starting December 15, ostensibly to screen for national security threats through “online presence reviews” that assess hostility toward US institutions, effectively forcing digital exposure on over a million technology workers and their families. This policy creates severe security risks by providing foreign adversaries with free organizational intelligence on defense contractors, chip makers, and AI labs, exposing workers to spear-phishing, SIM swapping, recruitment exploitation, and extortion tactics while turning legitimate employees into attack vectors through publicly available personal data that can be scraped and weaponized for deepfake impersonations and social engineering. The mandatory public exposure normalizes government-mandated privacy erosion while ironically creating the intelligence security risks it aims to prevent, as sophisticated threat actors using fake accounts remain hidden while legitimate applicants become vulnerable targets with their professional affiliations, family connections, and personal vulnerabilities exposed to hostile nation-state surveillance operations.

KEY BARRIER TO ONLINE FRAUD CAN BE BYPASSED FOR PENNIES

Researchers from the University of Cambridge have determined that SMS numbers, which are commonly used by services to verify account activation and combat fraud, can be readily purchased, typically for less than 30 cents each. Costs varied by country, with the UK and Russia selling for 10 cents at the lower end, and Australia and Japan selling for $3-$5 at the higher end. The cost could also vary by service, with throwaway numbers for WhatsApp costing more than those for X.

SMALL NUMBERS OF NOTEPAD++ USERS REPORTING SECURITY WOES

Three organizations reported security incidents in which Notepad++ processes initiated access, allowing threat actors to gain hands-on keyboard activity and potentially exploit the application's update mechanism.

TRAINS CANCELLED OVER FAKE BRIDGE COLLAPSE IMAGE

COUPANG DATA BREACH TRACED TO EX-EMPLOYEE WHO RETAINED SYSTEM ACCESS

South Korea's largest retailer, Coupang, traced a 33.7 million customer data breach to a former employee who retained system access after leaving in 2024.