Google Project Zero demonstrated a novel technique to remotely leak memory addresses without memory safety violations by exploiting pointer-keyed data structures in Apple's NSKeyedArchiver serialization. The attack works by crafting specific NSDictionary objects with carefully chosen NSNumber keys to control hash bucket placement, then using the serialized ordering of an NSNull singleton (whose hash is its memory address) to determine its location in the shared cache. While theoretical and requiring a deserialize-reserialize attack surface, this technique demonstrates how pointer-based hashing in keyed data structures can leak addresses even without timing attacks. Organizations should audit serialization endpoints and consider using keyed hash functions instead of raw pointer addresses for object hashing.
2025.10.06·
googleprojectzero.blogspot.com·13 min read·TLDR InfoSec
Signal's Sparse Post Quantum Ratchet (SPQR) is part of a new "Triple Ratchet" protocol that combines its existing Double Ratchet with quantum-resistant ML-KEM cryptography to protect against future quantum computing threats while maintaining forward secrecy and post-compromise security. The implementation uses erasure coding and state machines to efficiently transmit large ML-KEM keys (over 1,000 bytes) in small chunks, includes a graceful downgrade mechanism for backward compatibility during rollout, and employs formal verification using ProVerif and F* to ensure protocol correctness. Security professionals should note that this represents a practical approach to post-quantum migration, which preserves existing security guarantees while introducing quantum resistance. The protocol automatically upgrades conversations without requiring user intervention.
Modern kernel privilege escalation attacks have shifted from traditional control flow methods like ROP to more stealthy, stable data-only attacks that bypass Control Flow Integrity (CFI), prompting the development of advanced defense systems like VED (Vault Exploit Defense). Novel techniques, such as DirtyPipe, cred-jar heap spray, and pipe primitives, exploit weaknesses in kernel memory handling to corrupt authentication data or page buffers, directly overwriting critical structures, including credential jars and pipe buffers, while evading detection by typical CFI solutions. VED counters these threats through multiple integrity measures, including shadow data tracking, hash monitoring, slab poisoning, and specialized protections for core patterns and pipe buffers, aiming to detect stealthy modifications and strengthen kernel security against increasingly sophisticated data-centric exploits while minimizing performance impact.
When you're running your AI workloads locally, cyber adversaries can target both the physical devices and the models you're running or training. Learn how to mitigate risk [12] by using secure AI PCs and smart endpoint security. Read the ebook by Dell, Intel, CrowdStrike
Gulp is a Python-based incident response platform that accelerates security analysis through high-speed data ingestion from multiple sources, SIGMA rule querying across thousands of detection rules simultaneously, and collaborative investigation features with zoomable timelines for event visualization. The tool leverages OpenSearch and Elastic Common Scheme (ECS) formatting for compatibility while providing scalable multiprocessing capabilities that can grow with organizational needs. Security teams can use Gulp to ingest, query rapidly, and collaboratively analyze security events in a unified platform explicitly designed for incident response workflows.
MokN provides identity protection based on honeypots, with ultra-realistic decoy access points, including VPNs and email servers, that replicate the organization's environment. If an attacker attempts to log in to one of these honeypots using a stolen identity, the security team is alerted and can take appropriate action.
GreyNoise detected a 500% surge in scanning activity targeting Palo Alto Networks login portals on October 3, with over 1,285 IP addresses (93% suspicious and 7% malicious) conducting coordinated reconnaissance that mirrors previous Cisco ASA scanning patterns and shares TLS fingerprints linked to Netherlands infrastructure, potentially signaling upcoming vulnerability disclosures since historical patterns show Palo Alto scan spikes often precede new flaw announcements within six weeks.
CometJacking affects Perplexity's Comet AI browser by allowing attackers to use a malicious link to inject hidden prompts and steal sensitive user data, such as emails and calendars, by exploiting the browser's own access. Experts warn that this demonstrates the broader risks of AI-driven browsers and have urged stricter agent prompt security to prevent future data theft campaigns
Wealthsimple was faced with the common dilemma of having a small security team tasked with reviewing code written by a much larger engineering team in a highly regulated environment. It introduced Semgrep AI to create custom fixes for the specific code under review, augmenting its security team. Semgrep remembers previous decisions on findings and uses that information to auto-triage future findings
2025.10.06·
engineering.wealthsimple.com·3 min read·TLDR InfoSec
Nearly 800 free VPN apps have serious security flaws, including old Heartbleed bugs, excessive permissions for surveillance, and missing privacy info, posing risks for BYOD policies that should focus on app allowlisting and data protection over just VPN security.
ParkMobile settled a class action lawsuit over its 2021 data breach, which affected 22 million users, by offering victims a meager $1 in-app credit (dispensed as four 25-cent discounts) that must be manually claimed with a promo code and expires in October 2026.
The Trinity of Chaos ransomware group, associated with Lapsus$, Scattered Spider, and ShinyHunters, launched a TOR leak site exposing 39 major firms, including Google, Cisco, and Stellantis, after exploiting Salesforce vulnerabilities via vishing and stolen OAuth tokens, threatening to release over 1.5 billion records if ransoms aren't paid.
Hackers from the Crimson Collective claim to have breached Red Hat's private GitHub repositories, stealing 570GB of data, including customer documents, security tokens, and certain details about major organizations' IT environments. Red Hat hasn't confirmed the breach or responded to extortion demands yet, but sample files are circulating already.
Motility Software Solutions suffered a ransomware attack that impacted over 766,000 individuals and exposed sensitive data, including Social Security and driver's license numbers. The company detected the breach in August and notified authorities, offering one year of identity protection to victims. Attackers claimed to have stolen 4.3 terabytes of information, but there's no evidence of misuse so far.
RemoteCOM, a company that sells monitoring software for individuals on parole and probation, was hacked. The attacker stole personal data from ~7,000 parole officers and ~14,000 individuals whom the software had monitored. The hacker indicated that the software was one of the easiest they had hacked.
AWS Certificate Manager (ACM) does not offer VPC endpoints, so any cloud resources that want to utilize it must have access to the service. An attacker can also connect an instance to ACM in the attacker's account and use the nsComments field to exfiltrate free-form data. The post concludes with an exploration of other AWS services that can be used in this way, such as SAML provider metadata and Lambda functions.
AWS CDK requires users to bootstrap each environment, either manually or via the 'cdk bootstrap' command, which creates the necessary roles. These roles are configured by default to trust the current account's root principal. This can lead to a vulnerability when a SaaS provider requests an ARN from the user, which it provides to its proxy role to load data from the user's account. If the user provides the SaaS provider with an ARN from their own account, it will be implicitly trusted, exposing the SaaS provider's environment to the user.
The MatrixPDF toolkit exploits users' trust in PDF files by embedding JavaScript and fake prompts to bypass Gmail's security filters and automatically fetch malicious payloads from external sites. The attack works through two methods: exploiting Gmail's preview function with blurred content prompting users to "Open Secure Document," or using PDF-embedded JavaScript that automatically connects to payload URLs when opened in desktop readers. Security professionals should implement robust attachment sandboxing, restrict personal email access on corporate devices, deploy endpoint detection for suspicious file behavior, and enhance security awareness training that emphasizes zero trust for all file types, including PDFs.
Starting Oct 6, Cybermon 2025 is a 4-week secure coding challenge where dev teams battle AI-era vulnerabilities through hands-on challenges. Boost your security program's engagement by defeating a Cybermon, earn badges, and win prizes. Join the main event or host a company tournament [13]! To get started, contact Secure Code Warrior
Databricks launched "Data Intelligence for Cybersecurity," an AI-driven platform that addresses the critical issue of security data sprawl by unifying fragmented telemetry from multiple security tools into a single governed foundation. The platform leverages Databricks' Lakehouse architecture with "Agent Bricks" for building AI-powered threat analysis agents, offering conversational dashboards and natural language queries that early adopters, such as Arctic Wolf and Palo Alto Networks, report have improved detection rates while reducing costs. Security professionals should evaluate this platform as a potential complement to existing SIEM tools, particularly for organizations struggling with data fragmentation across multiple security vendors.
Zania is an AI-powered GRC platform that uses autonomous, domain-specific AI agents to automate security governance, risk, and compliance tasks. Its agents continuously collect evidence, test controls, assess vendors, evaluate internal risks, and accurately answer vendor questionnaires, delivering end-to-end compliance management.
Criminals have been utilizing vulnerable industrial cellular routers to mass-send SMS phishing attacks ("smishing") since 2023. Security researchers found over 18,000 of these devices, easily accessible due to outdated firmware. These routers, mainly used for industrial purposes, help spread phishing links across countries by exploiting weak security or misconfigurations, making detection and shutdown difficult.
The Clop ransomware group sent extortion emails to Oracle E-Business Suite customers claiming to have breached their systems and stolen data, framing the attack as a business transaction while threatening to publish stolen information if ransom demands aren't met. Oracle confirmed awareness of the extortion emails and identified potential exploitation of vulnerabilities addressed in their July 2025 critical patch update, though researchers have not yet verified if actual breaches occurred. Organizations should immediately apply Oracle's July 2025 security patches, verify their patch status, monitor for signs of compromise, and establish incident response procedures while being cautious of emails sent from hundreds of compromised third-party accounts used to bypass spam filters.
Bishop Fox researchers discovered four critical zero-day vulnerabilities in the $20 YoLink Smart Hub v0382 that allow remote attackers to bypass authentication, intercept unencrypted credentials and Wi-Fi passwords via MQTT, and remotely control other users' devices, including smart locks, through predictable device IDs. The vulnerabilities (CVE-2025-59449, CVE-2025-59448, CVE-2025-59451, and CVE-2025-59452) affect the ESP32-based hub, which serves as a central gateway for home security devices, potentially enabling physical access to users' homes, as no patches are currently available from the manufacturer, YoSmart. Security professionals should immediately disconnect affected hubs from critical networks, avoid using them for physical access control, implement network segmentation to isolate IoT devices, and consider replacing them with vendors that provide regular security updates until patches become available.
Renault UK warned customers of a data breach via a third-party cyberattack, emphasizing the need for improved supply chain security, regular vendor audits, and customer awareness of phishing risks.
The 2025 Security Awareness Report [4] provides essential benchmarks to measure program maturity, reduce risk, and embed security into your culture. This year's findings spotlight social engineering, AI misuse, and workforce challenges as top human risks.
Broadcom has patched two high-severity VMware NSX vulnerabilities (CVE-2025-41251 and CVE-2025-41252) reported by the NSA, both involving username enumeration flaws in password recovery mechanisms that allow unauthenticated attackers to identify valid usernames for potential brute-force attacks. These vulnerabilities affect VMware NSX, a critical networking virtualization solution widely used in enterprise private and hybrid cloud environments, making them attractive targets for state-sponsored hackers and ransomware groups that frequently exploit VMware products. Security professionals should immediately apply the available patches and review their VMware infrastructure for other recent vulnerabilities, as this follows a pattern of actively exploited VMware zero-days throughout 2025, including those used by Chinese state actors and disclosed at security conferences.
Volvo has reported that a hack of a third-party IT company, Miljödata, impacted it. The attackers breached the company's Adato support system for rehabilitation and Novi support system for HHR personnel notes. The Volvo Group stated that the incident impacted its employees' names and SSNs.
Security researchers discovered a wormable vulnerability in the Bluetooth Low Energy (BLE) Wi-Fi configuration interface used by several Unitree robots, which could result in remote code execution. Unitree robots utilize an initial BLE connection to facilitate the setup of a Wi-Fi connection. However, the encryption keys for the packets that the robot accepts were published on X. The researchers discovered that if an attacker encrypts the word “unitree” with these keys, the robot will allow them to inject arbitrary code masquerading as the Wi-Fi SSID and password, which will then be executed when the robot tries to connect to Wi-Fi.
1 in 5 websites built on "vibe coding" platforms (no-code/low-code tools) expose sensitive secrets, with 25,000 leaked API keys found across 130,000 scanned sites, including a surge in AI platform credentials (72% Google Gemini, 14% OpenAI) and 16,000+ Firebase backend keys. The root cause is non-technical users following tutorials that embed API keys directly into client-side code without understanding the security implications, creating opportunities for credential theft and unauthorized service usage. Security teams should implement continuous threat exposure management (CTEM) to monitor citizen developer activities, while platforms need pre-publish secret scanning and better secret management features to prevent these exposures.
In July, BleepingComputer reported that the Akira ransomware operation was exploiting SonicWall SSL VPN devices to breach corporate networks. SonicWall eventually linked the attacks to an improper access control flaw that was patched and disclosed in late 2024. Security firm Arctic Wolf now reports an ongoing campaign against SonicWall firewalls, where threat actors are successfully logging into accounts even when one-time passwords (OTPs) are enabled. Google Threat Intelligence Group suggests that the attackers may have harvested the OTP seeds earlier and waited to use them.
Threat actors have been exploiting APIs on over 572 Milesight industrial cellular routers to send smishing campaigns targeting European users since February 2022, with a primary focus on Belgium. The messages impersonate government services, including CSAM (the central system for identity and access management for the government's online services) and eBox. The attackers leverage CVE-2023-43261 and exposed APIs to remotely send SMS messages without authentication, utilizing routers as a distributed infrastructure across multiple countries to evade detection and enable mass phishing campaigns, with over 40,000 messages sent to Swedish and Italian numbers in a single campaign. Security professionals should audit cellular router configurations for exposed SMS APIs, implement authentication requirements, update firmware to versions beyond the vulnerable 32.x and 41.x versions, and monitor for unusual POST requests to /cgi endpoints. Additionally, they should educate users to scrutinize unsolicited SMS messages that contain shortened URLs or use urgent language.
Insecure APIs are your highest-risk assets. Invicti discovers and scans what others miss, verifies real vulnerabilities at runtime like BOLA/BFLA, and correlates API business logic errors across SAST, SCA, and DAST. Automate validation and remediation with AI-guided fixes—all in one ASPM layer.
The FLARE team has released a new tool called QuantumStrand (qs) as part of its FLOSS suite. qs is a static string analysis tool that extracts tags and presents strings within the hierarchical context of a file's structure.
Descope provides a no-code/low-code external IAM platform that supports user, business customer, partner application, and AI agent identity management, delivering comprehensive visibility and preventing account takeover.
sbomify is a Software Bill of Materials (SBOM) and document management platform that can be self-hosted. The platform provides a centralized location to upload and manage your SBOMs and related documentation, allowing you to share them with stakeholders or make them publicly accessible.
The Cybersecurity Information Sharing Act of 2015 expired on September 30 due to a government shutdown, removing critical liability protections that enabled private sector cybersecurity threat information sharing with the government and peers. Without these legal safeguards, organizations now face potential antitrust violations, FOIA disclosure risks, and loss of trade secret protections when sharing threat intelligence, significantly reducing real-time threat visibility across critical infrastructure sectors. Security professionals should immediately consult with legal counsel before engaging in any threat-sharing activities and may need to revert to pre-2015 bilateral agreements, where available, as the timing for congressional reauthorization remains uncertain.
Phantom Taurus is a Chinese state-sponsored APT group targeting government and telecom organizations across Africa, the Middle East, and Asia for espionage aligned with PRC interests. Evolving from email attacks to database targeting, it utilizes custom tools like the NET-STAR malware suite, which includes three fileless .NET backdoors (IIServerCore, AssemblyExecuter V1/V2), to compromise IIS web servers. It employs evasion tactics such as AMSI and ETW bypasses. Security teams should watch for TTPs such as timestomping, fileless execution within w3wp.exe, and ASPX web shells, including OutlookEN.aspx, while managing threat exposure to detect infrastructure sharing among Chinese APT groups.
2025.10.02·
unit42.paloaltonetworks.com·16 min read·TLDR InfoSec
A critical vulnerability (CVE-2025-10725) has been identified in Red Hat OpenShift AI that allows authenticated attackers to escalate privileges and potentially compromise entire cloud environments. Versions 2.19, 2.21, and RHOAI are affected. Red Hat recommends limiting permissions, especially for system groups, and suggests granting job creation rights only to specific users or groups to minimize risk.