Search the archive

MICROSOFT LINKS STORM-1175 TO GOANYWHERE EXPLOIT DEPLOYING MEDUSA RANSOMWARE

Microsoft linked Storm-1175 to exploiting a critical flaw in Fortra GoAnywhere, enabling Medusa ransomware deployment.

APPLE TURNED THE CROWDSTRIKE BSOD ISSUE INTO AN ANTI-PC AD

Apple released an eight-minute commercial mocking last year's CrowdStrike update that caused a Windows Blue Screen of Death and affected millions of PCs to show how Apple's operating system prevents such kernel-level issues.

GOOGLE AI MODE FINALLY MADE AVAILABLE ACROSS EUROPE

Google's AI Mode search feature, launched across Europe in 35 languages after regulatory delays, is now facing antitrust lawsuits from publishers who claim the AI-powered search summaries use their content without consent and reduce traffic to their sites.

SEE HOW IT WORKS

DATA BREACH AT DOCTORS IMAGING GROUP IMPACTS 171,000 PEOPLE

Doctors Imaging Group, a Florida-based radiology provider, reported a breach where hackers accessed their network for several days in November 2024. Over 171,000 people had personal and medical data compromised, including Social Security and account numbers.

REDIS WARNS OF CRITICAL FLAW IMPACTING THOUSANDS OF INSTANCES

The Redis security team has released patches for a new critical (CVSS 10/10) vulnerability that could allow attackers to gain remote code execution. The vulnerability is caused by a 13-year-old use-after-free vulnerability that can be exploited by authenticated threat actors using a specially crafted Lua script. Redis recommends that administrators patch their servers and, to secure their instances further, they can enable authentication, disable Lua scripting and other unnecessary commands, launch Redis as a non-root user, and enable Redis logging.

THE SALESLOFT-DRIFT BREACH: ANALYZING THE BIGGEST SAAS BREACH OF 2025

The biggest SaaS security incident in 2025 exploited the integration between Salesloft and Drift, compromising over 700 companies. Attackers abused OAuth tokens and SaaS-to-SaaS connections to move laterally, bypassing traditional security defenses and harvesting sensitive credentials. The supply chain nature of the breach allowed a single compromise to spread rapidly across interconnected apps like Salesforce and Gmail, amplifying its impact.

FANTASTIC AWS POLICIES AND WHERE TO FIND THEM

AWS presents a large surface of IAM policies that are available across principal policies, resource policies, AWS Resource Access Manager, resource control policies, and IAM Identity Center permission sets. This post provides a listing and explanation of many of these policies, as well as introducing a new tool called iam-collect. iam-collect can download all IAM policies across every account in an organization for analysis and also provides a set of agent instructions that can be used with an LLM to explore the data further.

FLIPSWITCH: A NOVEL SYSCALL HOOKING TECHNIQUE

FlipSwitch is a novel Linux rootkit technique that bypasses kernel 6.9's new syscall dispatch mechanism by directly patching machine code in the x64_sys_call function rather than overwriting the traditional sys_call_table. The technique locates specific call instructions within the kernel dispatcher and modifies their 4-byte offsets to redirect syscalls to malicious functions, demonstrating how attackers adapt to kernel hardening measures. This research highlights the ongoing arms race between Linux kernel security improvements and rootkit evolution. Elastic has provided YARA signatures to detect this proof-of-concept implementation.

AN IN-DEPTH RESEARCH-BASED WALK-THROUGH OF AN UNINITIALIZED LOCAL VARIABLE STATIC ANALYZER

Cybervelia researchers developed a Binary Ninja engine-based static analyzer that detects uninitialized local variables (ULVs) in stripped binaries by reconstructing stack layouts, tracking read-before-write patterns through Medium-Level IL analysis, and implementing interprocedural taint propagation to trace data flows across function calls. The tool addresses the challenge that modern compiler optimizations obscure ULVs in binaries, despite improved source-level detection, by utilizing techniques such as neighbor-offset heuristics for size inference and proximity-based coverage analysis to identify genuine vulnerabilities. The analyzer integrates IDA Pro symbol importing and Intel PIN execution tracing to reduce false positives and focus on actually executed code paths, demonstrating that ULV detection remains relevant even in modern binaries with recent Linux kernel vulnerabilities serving as examples.

your team. Goodbye firewall alerts, hello smart prioritization.

SETUPHIJACK

SetupHijack is a tool that exploits race conditions and insecure file handling in Windows installer and update processes.

FILIGRAN (PRODUCT LAUNCH)

Filigran unifies threat intelligence, attack surface, and security risk analysis, featuring OpenCTI and OpenBAS for intelligence operations and adversary emulation.

INTRODUCING CODEMENDER: AN AI AGENT FOR CODE SECURITY

CodeMender is a new AI-driven agent developed by Google DeepMind to discover, patch, and prevent software vulnerabilities automatically. The tool addresses threats and proactively secures existing code, enabling developers to build safer software with reduced time spent on manual vulnerability management.

KLOPATRA: EXPOSING A NEW ANDROID BANKING TROJAN OPERATION WITH ROOTS IN TURKEY

Klopatra is a sophisticated new Android banking trojan operated by Turkish-speaking cybercriminals that utilizes commercial-grade Virbox protection and native code libraries to evade detection. The malware targets users in Spain and Italy through fake IPTV apps, exploits Android Accessibility Services for complete device control, and employs both overlay attacks and Hidden VNC capabilities to conduct fraudulent operations while victims are asleep. With over 3,000 compromised devices across two main botnets, Klopatra represents a significant evolution in mobile malware sophistication, demonstrating how threat actors are adopting professional-grade obfuscation techniques typically seen in desktop malware.

‘YOU'LL NEVER NEED TO WORK AGAIN': CRIMINALS OFFER REPORTER MONEY TO HACK BBC

A BBC reporter was contacted via Signal by a “reach out manager” from the Medusa ransomware gang, who offered 25% of the ransom if they gained access to the reporter's corporate device. The reporter played along to gather more information about the gang's tactics, documenting increased pressure from the ransomware actor. Eventually, the actor grew impatient, sending multiple 2FA requests before the reporter could alert the BBC security team, leading to a disconnection from the network.

APPLE PULLS ICEBLOCK FROM THE APP STORE

The ICEBlock app described itself as “Waze but for ICE sightings” and allowed users to report sightings of ICE officials anonymously. AG Pam Bondi stated that Apple removed the app from the App Store after it was requested to be removed because it presents a threat to law enforcement officials, which ICEBlock developer Joshua Aaron has denied, stating it is patently false.

report

GOOGLE'S AI BOUNTY PROGRAM PAYS BUG HUNTERS UP TO $30K

Google has launched a bug bounty program focused on AI security, rewarding up to $30,000 for discovering vulnerabilities that could cause rogue actions or exploit AI systems through issues such as unauthorized account access or data leaks.

DOCKER MAKES HARDENED IMAGES CATALOG AFFORDABLE FOR SMALL BUSINESSES

Docker launched unlimited access to its Hardened Images catalog for small businesses, offering pre-verified container images with near-zero CVEs, up to 95% reduced attack surface, and a 7-day patch SLA through an affordable subscription model.

OPENAI: THREAT ACTORS USE US TO BE EFFICIENT, NOT MAKE NEW TOOLS

OpenAI's October threat report indicates that cyber adversaries primarily leverage AI to enhance their existing hacking techniques, with groups from China, North Korea, and cybercriminal organizations utilizing ChatGPT for malware creation, spear phishing, and reconnaissance activities.

_Choose Zero-Trust with ThreatLocker_

ORACLE SECURITY ALERT ADVISORY - CVE-2025-61882

Oracle issued an emergency security alert for CVE-2025-61882, a critical remote code execution vulnerability in Oracle E-Business Suite that can be exploited over the network without authentication credentials. The vulnerability is already being actively exploited by threat actors. Oracle has discovered specific indicators of compromise, including IP addresses, command-line payloads, and file hashes associated with exploitation attempts. The IOCs reference exploit tools with naming conventions suggesting involvement by groups such as Scattered Spider, Lapsus$, and CL0P, indicating that this vulnerability is being weaponized by ransomware and extortion groups for immediate attacks.

UNITY HAS FOUND A SECURITY VULNERABILITY THAT HAS SAT DORMANT FOR ALMOST A DECADE: ‘TAKE IMMEDIATE ACTION TO PROTECT YOUR GAMES & APPS'

Unity warns developers about a vulnerability identified since version 2017.1 that exposes users to unsafe file loading and local file inclusion attacks, varying by OS. Developers need to either recompile and redistribute their apps to fix this issue or use a patching tool that applies updates without recompilation. However, this tool does not support Linux builds or applications with tamper-proofing or anti-cheat features enabled.

RANSOMWARE ATTACK ON OHIO COUNTY IMPACTS OVER 45K RESIDENTS, EMPLOYEES

Ransomware attackers stole data in a cyberattack on Union County in Ohio, impacting 45k of the county's 71k residents. The stolen data includes Social Security numbers, driver's license numbers, financial account information, fingerprint data, medical information, and passport numbers.

PHOENIX: ROWHAMMER THAT WORKS ON DDR5

Phoenix is a Rowhammer attack that bypasses DDR5 protections by reverse-engineering Target Row Refresh (TRR) and exploiting timing windows where defenses weaken. The attack uses dummy memory accesses to trick TRR before executing targeted strikes that can read/write arbitrary memory, steal RSA keys, or escalate Linux privileges within 5 seconds to 7 minutes. It demonstrates that DDR5's protections can still be evaded by sophisticated timing attacks that manipulate memory through carefully crafted access patterns.

MCP TOOLS: ATTACK VECTORS AND DEFENSE RECOMMENDATIONS FOR AUTONOMOUS AGENTS

Elastic Security Labs provides a comprehensive overview of different attacks and defenses for MCP tools. Elastic provides a prompt for an LLM to detect malicious functions in an MCP server, covering security risks ranging from traditional vulnerabilities to tool poisoning, orchestration injection, rug-pull redefinitions, name collisions, and passive influence. Elastic recommends that users utilize sandboxed environments for MCP, adhere to the principle of least privilege, restrict MCP servers to only trusted sources, require human approval for sensitive operations, and monitor all prompts and code.

IMDS ABUSED: HUNTING RARE BEHAVIORS TO UNCOVER EXPLOITS

Wiz Research developed a data-driven threat hunting methodology to detect anomalous Instance Metadata Service (IMDS) usage by identifying processes that rarely access IMDS but suddenly query sensitive endpoints, such as IAM credentials, leading to the discovery of active exploitation of two zero-day SSRF vulnerabilities. The team uncovered CVE-2025-51591 in Pandoc (HTML-to-PDF conversion via malicious iframe tags) and a ClickHouse SSRF vulnerability where attackers abused SQL "SELECT * FROM url" functions to access cloud metadata services across AWS and GCP environments. This approach demonstrates how behavioral anomaly detection can reveal novel attack vectors targeting cloud infrastructure, emphasizing the importance of enforcing IMDSv2 and implementing least-privilege access controls to mitigate credential theft and lateral movement risks.

Dropzone AI

CADDY

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS.

IAMHOUNDDOG

IAMhounddog is a tool that helps pentesters quickly identify privileged principals and second-order privilege escalation opportunities in unfamiliar AWS environments.

TOKENEX

Tokenex is a library that provides a unified interface for obtaining and refreshing credentials from various cloud providers and authentication systems. Tokenex supports AWS, GCP, Azure, OCI, Generic, K8sSecret, OAuth2AC, and OAuth2CC.

TOTOLINK X6000R: THREE NEW VULNERABILITIES UNCOVERED

There are three critical vulnerabilities in TOTOLINK X6000R routers (CVE-2025-52905, CVE-2025-52906, and CVE-2025-52907) that allow unauthenticated attackers to execute arbitrary commands and bypass security controls via the router's web interface. The vulnerabilities stem from inadequate input sanitization in the cstecgi.cgi endpoint, with the blocklist failing to filter hyphen characters, and enabling argument injection, command injection, and arbitrary file manipulation attacks. TOTOLINK has released patched firmware (V9.4.0cu.1498_B20250826). Users are strongly advised to update immediately as these flaws could allow attackers to gain root access, intercept traffic, and pivot to other network devices.

SIGNAL STATEMENT ON GERMANY

The latest German Chat Control proposals would require scanning of every message, photo, and video on a person's device. Signal has announced that it will discontinue services in Germany, and possibly across Europe, if these controls are passed, arguing that regardless of whether messages are scanned before or after encryption, the controls negate the premises of end-to-end encryption.

SCATTERED LAPSUS$ HUNTERS OFFERING $10 IN BITCOIN TO 'ENDLESSLY HARASS' EXECS

The cybercrime group Scattered Lapsus$ Hunters is paying individuals $10 in Bitcoin to pressure executives of alleged breach victims via email, aiming to coerce them into making ransom payouts. The group, linked to attacks via a Salesforce integration, published targets' details and set a payment deadline. Salesforce and Google have stated that the attacks aren't linked to a compromise of Salesforce itself, and law enforcement is investigating the gang.

PAM. Register

RACHEL TOBAC: WARN YOUR FAMILY ABOUT SORA2

Security professionals should educate their families about Sora 2 and the importance of online skepticism.

ZERODAY.CLOUD

Wiz has announced a new hacking competition with a total reward pool of $4.5 million where participants can earn up to $300,000 per exploit for demonstrating vulnerabilities against widely used cloud software.

RED HAT DATA BREACH ESCALATES AS SHINYHUNTERS JOINS EXTORTION

Red Hat's data breach worsened as Crimson Collective and ShinyHunters launched a leak site, threatening to release 570GB of stolen data, including reports from Walmart, HSBC, and the Department of Defense, unless the ransom is paid by October 10.

Learn more about PSC in this guide by Flashpoint

DISCORD DISCLOSES DATA BREACH AFTER HACKERS STEAL SUPPORT TICKETS

Discord suffered a data breach on September 20. The Scattered Lapsus$ Hunters threat group compromised a third-party Zendesk customer service system, stealing personal data, including names, government IDs, partial payment information, and support communications from users who contacted Discord's support teams. The attackers demanded a ransom payment and threatened to leak the stolen data, which security experts warn could be valuable for solving cryptocurrency-related crimes, as many scammers use Discord without proper anonymization. Organizations should review their third-party vendor access controls, implement additional monitoring for customer service platforms, and ensure incident response procedures include immediate isolation of compromised third-party systems.

HACKING GROUP CLAIMS THEFT OF 1 BILLION RECORDS FROM SALESFORCE CUSTOMER DATABASES

A hacking group known by several names, including Scattered Spider and ShinyHunters, claims to have stolen approximately a billion records from companies using Salesforce cloud databases. The group is extorting victims with threats to leak stolen data unless ransoms are paid. Multiple major companies are affected. Salesforce denies any breach of its platform or vulnerabilities in its systems.

RESEARCHERS WARN OF SELF-SPREADING WHATSAPP MALWARE NAMED SORVEPOTEL

SORVEPOTEL is a self-propagating malware campaign targeting Brazilian users that spreads through WhatsApp by exploiting social trust and sending malicious ZIP file attachments disguised as receipts or health app files. The attack chain begins with phishing messages from compromised contacts, which leads victims to open Windows shortcut files that execute PowerShell scripts to download payloads from external servers and establish persistence via the Windows Startup folder. Once installed, the malware automatically detects active WhatsApp Web sessions and mass-distributes the malicious ZIP files to all contacts and groups, prioritizing rapid propagation over data theft and frequently resulting in account bans due to spam violations.