Search the archive

experts: see a custom demo

TAMPEREDCHEF MALWARE SPREADS VIA FAKE SOFTWARE INSTALLERS IN ONGOING GLOBAL CAMPAIGN

TamperedChef (aka BaoLoader) distributes JavaScript backdoors through fake software installers signed with fraudulent certificates from shell companies in the US, Panama, and Malaysia. Delivered via malvertising and SEO poisoning targeting searches for PDF editors and product manuals, the malware establishes persistence through scheduled tasks that execute obfuscated JavaScript, which beacons encrypted system data to C2 servers, with primary infections concentrated in US healthcare, construction, and manufacturing sectors. Security teams should implement application allowlisting, monitor for suspicious scheduled tasks executing JavaScript payloads, validate code-signing certificates against threat intelligence, and restrict access to product manuals through authorized channels only.

SOLARWINDS PATCHES THREE CRITICAL SERV-U VULNERABILITIES

SolarWinds patched three critical vulnerabilities in the Serv-U 15.5.2.2.102 file transfer solution that allow attackers with admin privileges to execute arbitrary code: CVE-2025-40549 (path restriction bypass), CVE-2025-40548 (broken access control), and CVE-2025-40547 (logic error). All three flaws are rated medium severity on Windows due to platform-specific differences in privilege and path handling. Organizations using Serv-U should immediately upgrade to version 15.5.3, especially given SolarWinds' history of exploited vulnerabilities with seven flaws already in CISA's KEV catalog.

ANOTHER SALESFORCE-LINKED DATA BREACH HAS SHINYHUNTERS' FINGERPRINTS ALL OVER IT

Salesforce reported a new data breach likely involving the ShinyHunters group, who may have accessed customer data through Gainsight apps connected to Salesforce. Upon discovery, Salesforce revoked access tokens and removed the affected apps. Although no vulnerability was found in Salesforce itself, Google analysts linked the incident to prior token-related attacks.

APPLICATION CONTAINMENT: HOW TO USE RINGFENCING TO PREVENT THE WEAPONIZATION OF TRUSTED SOFTWARE

Ringfencing extends application allowlisting by enforcing granular containment policies on approved software, controlling file access, registry modifications, inter-process communication, and network activity to prevent “living off the land” attacks that weaponize legitimate tools like PowerShell, Office macros, or scripting engines. The technique blocks lateral movement, data exfiltration, and ransomware encryption by restricting applications to only their necessary functions, preventing them from spawning unauthorized child processes or accessing sensitive directories. Implement ringfencing in phases, starting with high-risk applications, use simulation mode to identify legitimate use cases before enforcement, combine with application allowlisting and storage controls, and continuously monitor the unified audit for policy violations.

WHEN UPDATES BACKFIRE: RCE IN WINDOWS UPDATE HEALTH TOOLS

Researchers at Eye Security uncovered a remote code execution flaw in Microsoft's Update Health Tools (KB4023057), traced to abandoned Azure blob storage. Attackers could trigger unintended code execution on vulnerable devices by exploiting predictable blob names and weak message security. Microsoft confirmed the issue, transferred ownership of the exposed blobs, and improved protections in newer tool versions, mitigating risks for most users.

IMDS ABUSED: HUNTING RARE BEHAVIORS TO UNCOVER EXPLOITS

The Instance Metadata Service (IMDS) is a server that runs on cloud VMs (like AWS EC2) to provide short-lived credentials to applications running on them. To detect potential IMDS abuse, establish a baseline of which services frequently access IMDS and then monitor for applications that either access sensitive IMDS paths or access IMDS more frequently than usual. This post applies this methodology to hunting for a vulnerability in pandoc and Clickhouse.

steady the ship. Hear their stories

SECURE (PRODUCT LAUNCH)

Secure.com provides AI-powered Digital Security Teammates (DSTs), autonomous agents that integrate with existing security tools, investigate and triage incidents, automate compliance tasks, and escalate issues.

AZURE-SENTINEL

Cloud-native SIEM for intelligent security analytics for your entire enterprise.

PINACT

pinact is a CLI to edit GitHub Workflow and Composite action files and pin versions of actions and reusable workflows.

IRANIAN APT HACKS HELPED DIRECT MISSILE STRIKES IN ISRAEL AND THE RED SEA

Imperial Kitten (aka Tortoiseshell/TA456) conducted cyber reconnaissance on maritime Automatic Identification System (AIS) tracking data days before Houthi missile strikes on Red Sea shipping in February 2024, demonstrating direct correlation between IRGC-linked cyber espionage and kinetic targeting operations. Amazon's threat intelligence indicates this represents an evolution in hybrid warfare where cyber operations provide target reconnaissance for physical attacks, with the traditional boundaries between digital and kinetic operations dissolving. Security teams should monitor for anomalous access to critical infrastructure location/tracking systems, implement enhanced logging and behavioral analytics on these systems, and coordinate with physical security teams to correlate cyber reconnaissance patterns with potential kinetic threat indicators.

OBSCURE MCP API IN COMET BROWSER BREACHES USER TRUST, ENABLING FULL DEVICE CONTROL VIA AI BROWSERS

SquareX researchers exposed a hidden MCP API (chrome.perplexity.mcp.addStdioServer) in the Comet browser that enables embedded extensions to execute arbitrary local commands without user consent, thereby bypassing decades of established browser security principles. The API is accessible via Comet's Agentic extension, triggered by perplexity.ai, creating a catastrophic third-party risk where a single XSS vulnerability or a compromised Perplexity employee could grant attackers complete device control over all Comet users. Security teams should audit AI browser deployments, demand API disclosure from vendors, require third-party security audits, and ensure users can disable embedded extensions that are currently hidden from extension dashboards.

HOW THE CLASSIC ANIME 'GHOST IN THE SHELL' PREDICTED THE FUTURE OF CYBERSECURITY 30 YEARS AGO

Set decades ahead of its time, "Ghost in the Shell" envisioned a world where cyber-attacks, government-sanctioned hackers, and AI-driven threats are commonplace. It foresaw issues like digital privacy risks, behavioral cyber-profiling, and tech-enabled abuse, ideas that now define modern cybersecurity.

EUROPE IS SCALING BACK GDPR AND RELAXING AI LAWS

ATTACKERS ARE USING “SNEAKY 2FA” TO CREATE FAKE SIGN-IN WINDOWS THAT LOOK REAL

A Phishing-as-a-Service kit called “Sneaky 2FA” enables Browser-in-the-Browser attacks that create fake login pop-ups with convincing address bars using HTML/CSS.

DISGRUNTLED IT WORKER PULLS MASSIVE CYBER STUNT IN HOUSTON

A fired IT contractor, upset about his dismissal, re-entered the Houston Waste Management network, reset 2,500 passwords, and locked thousands of staff out across the US.

has had on security and efficiency.

Watch now

RONDODOX BOTNET MALWARE NOW HACKS SERVERS USING XWIKI FLAW

The RondoDox botnet is exploiting a flaw in the XWiki SolrSearch endpoint, using crafted HTTP GET requests to inject base64-encoded Groovy payloads that download and execute malware. The campaign appears to reuse previously identified infrastructure, meaning existing IOC blocklists should effectively mitigate the threat.

WHATSAPP SECURITY FLAW EXPOSES 3.5B USERS' DATA FROM ‘BASIC PUBLICLY AVAILABLE INFORMATION'

Austrian researchers discovered that all 3.5B WhatsApp users can be enumerated at a rate of 100M users per hour. The researchers used the WhatsApp Web interface to bulk add users and phone numbers and were able to extract phone numbers for all users, profile photos for 57% of users, and profile text for 27%. Meta implemented rate limiting to address this issue, but also stated that the data exposed was basic publicly available information.

W3 TOTAL CACHE WORDPRESS PLUGIN VULNERABLE TO PHP COMMAND INJECTION

WordPress security company WPScan discovered a vulnerability in the W3 Total Cache plugin that enables unauthenticated attackers to execute code by posting a comment with a malicious payload. A patch is available. WPScan is withholding proof-of-concept details until November 24 to give site owners time to update.

NEXT.JS SECURITY TESTING GUIDE FOR BUG HUNTERS AND PENTESTERS

Deepstrike released a detailed security guide covering common pitfalls in Next.js applications, noting that while the framework includes strong default protections against template injection and XSS, developers can introduce risk through unsafe patterns like dangerouslySetInnerHtml or third-party templating engines. The guide highlights additional attack surfaces, including SSRF via the image optimization pipeline or misconfigured server actions.

SHADOWRAY 2.0: ACTIVE GLOBAL CAMPAIGN HIJACKS RAY AI INFRASTRUCTURE INTO SELF-PROPAGATING BOTNET

ShadowRay 2.0 is a malware campaign targeting Ray, a popular open-source AI framework, to hijack powerful computing clusters and convert them into a global, self-propagating botnet. Attackers exploited legitimate orchestration features within Ray, enabling them to orchestrate compute jobs, steal data, launch DDoS attacks, and autonomously spread across organizations. Attackers quickly weaponized unpatched flaws and misconfigurations in Ray clusters that were mistakenly exposed to the internet.

SUPAPWN: HACKING OUR WAY INTO LOVABLE'S OFFICE AND HELPING SECURE SUPABASE

SupaPwn is a multi-stage exploit chain affecting outdated Supabase environments, where weaknesses in privilege controls, host configurations, and cloud credential handling allowed attackers to escalate far beyond expected tenant-level permissions, even reaching infrastructure belonging to other customers. AI tooling accelerated reconnaissance and exploit development, helping researchers validate the chain quickly. Supabase and Lovable patched all affected systems within a day, limiting impact to a small set of outdated deployments.

Management report_

DETONATORAGENT

DetonatorAgent is a cross-platform Web API for detonating malware on VMs and collecting EDR logs.

AI-POWERED CAPTCHA SOLVER

AI-Powered CAPTCHA Solver is a Python CLI tool that uses LLMs to automatically solve various types of CAPTCHAs using an embedded Selenium browser.

MATE (PRODUCT LAUNCH)

Mate uses AI agents and reasoning models to automate security incident investigation and response in SOCs, reducing false positives and MTTR and enabling the SOC to learn and improve continuously.

CLOUDFLARE OUTAGE ON NOVEMBER 18, 2025

Cloudflare has released its postmortem on the November 18 outage. The incident was traced to a database permissions change that caused oversized Bot Management feature files to be generated. Those files triggered repeated module crashes and widespread 5xx errors. The team initially suspected a DDoS attack, which delayed diagnosis and remediation.

SERVICENOW AI AGENTS CAN BE TRICKED INTO ACTING AGAINST EACH OTHER VIA SECOND-ORDER PROMPTS

ServiceNow's Now Assist AI agents can be manipulated through second-order prompt injection, where instructions passed between agents trigger unintended actions. Attackers can use this to escalate privileges, steal data, or redirect workflows. ServiceNow claims the behavior matches expected agent chaining, but organizations are urged to monitor agent interactions and harden guardrails.

TENS OF THOUSANDS MORE ASUS ROUTERS PWNED BY SUSPECTED, EVOLVING CHINA OPERATION

A major cyber campaign dubbed "Operation WrtHug" has compromised around 50,000 outdated ASUS routers across Taiwan and Southeast Asia by chaining six known vulnerabilities. The activity resembles prior Chinese-linked campaigns. Researchers suspect the operation could support espionage, distinguishing it from traditional botnets by its stealthy data theft behavior.

Book a demo

THUNDERBIRD ADDS NATIVE SUPPORT FOR MICROSOFT EXCHANGE ACCOUNTS

Thunderbird 145 now includes native Exchange Web Services (EWS) support, allowing users to add Microsoft Exchange accounts without relying on third-party extensions.

MICROSOFT TO INTEGRATE SYSMON DIRECTLY INTO WINDOWS 11, SERVER 2025

Microsoft announced that it will integrate the popular Sysmon tool directly into Windows 11 and Server 2025 next year.

FIVE EYES JUST MADE LIFE HARDER FOR BULLETPROOF HOSTING PROVIDERS

The US, UK, and Australia jointly sanctioned Media Land, a Russia-based bulletproof hosting provider accused of supporting major ransomware groups, including LockBit, BlackSuit, and Play.

ECHOGRAM FLAW BYPASSES GUARDRAILS IN MAJOR LLMS

EchoGram is a technique that exploits training data gaps in LLM guardrails by injecting “flip tokens” (nonsensical strings, such as “=coffee”) that cause both false positives and bypasses of safety controls in GPT-5.1, Claude, and Gemini. The attack is effective against both LLM-as-judge and classification-based guardrails. Researchers estimate that attackers can replicate the method within three months. Security teams face dual threats - malicious prompts that bypass defenses and legitimate requests being falsely flagged - leading to alert fatigue in critical sectors such as finance and healthcare.

SURVEILLANCE TECH PROVIDER PROTEI WAS HACKED

Protei, a Russian telecom company that develops technology to enable phone and internet companies to conduct web surveillance and censorship, was hacked. The attackers defaced its website and stole 182GB of data, including confidential emails. The threat actor defaced the website with the message “another DPI/SORM provider bites the dust,” referring to the company's sales of deep packet inspection and other internet filtering technologies developed for the Russian lawful intercept system.

PRINCETON UNIVERSITY DATA BREACH IMPACTS ALUMNI, STUDENTS, EMPLOYEES

Princeton University disclosed a data breach after a hacker accessed a database with personal details of alumni, donors, faculty, students, and parents. The attack, traced to a phishing call, compromised information like names, addresses, emails, and donation records, but not passwords or financial data.

HOW I OVERLOOKED THE PROBLEM AND SHOT MYSELF IN THE FOOT

This author disabled and deleted Identity & Access Management (IAM) users before updating associated Terraform state and key policies while migrating from legacy IAM users to SSO in an AWS environment, inadvertently locking access to an AWS KMS key. Terraform applied changes but masked the fact that the EKS cluster continued to use the orphaned key, causing permission failures and locking out key management until AWS Support intervened. Security teams should ensure IAM and key-policy transitions are sequenced and validated, maintain Terraform state accuracy, and treat KMS keys as high-risk break-glass resources during cloud IAM migrations.

THE REALITIES OF CISO BURNOUT AND EXHAUSTION

CISOs are facing a surge in burnout driven by accelerating threats, shrinking budgets, and increasing executive accountability for breaches. The evolving role now spans governance, risk, crisis management, and business strategy, creating sustained cognitive load and operational fatigue that raises organizational and even national-security risk. Security leaders should prioritize realistic resourcing, delegation, mental-health sustainability, and board-level alignment to ensure that essential defensive capabilities do not degrade under chronic pressure.

STEALING MICROSOFT TEAMS ACCESS TOKENS IN 2025

Microsoft Teams stores its auth_cookie in a DPAPI-encrypted value in the Cookie database of the embedded Chromium browser used by Teams. The key used to encrypt the cookie can be retrieved from the Local State file in the Teams cache and used in conjunction with the nonce to decrypt the auth_cookie using AES-256-GCM. This auth_cookie can then be used with GraphSpy to retrieve and send messages on Teams.

human-readable guardrails. Read the blog