Search the archive

MICROSOFT PAID OUT $17 MILLION IN BUG BOUNTIES IN PAST YEAR

Microsoft paid $17 million in bug bounties to 344 security researchers across 59 countries in the past year, its highest annual payout since 2018.

A RIVAL TEA APP FOR MEN IS LEAKING ITS USERS' PERSONAL DATA AND DRIVER'S LICENSES

The TeaOnHer dating app exposed 53,000 users' private data, including selfies and driver's licenses, due to exposed admin credentials, highlighting the security risks of copycat applications that rapidly gain popularity without proper security controls.

CONFIDENTIAL INFORMANTS EXPOSED IN LOUISIANA SHERIFF'S OFFICE HACK

The Medusa ransomware gang reportedly stole over 90GB of data from the East Baton Rouge Sheriff's Office in 2024. A sample of the data includes sensitive information on confidential informants, including names, dates of birth, and SSNs. The breach also included data on seized devices, surveillance operations, sock puppet accounts, polygraph results, and internal affairs.

SONICWALL INVESTIGATES 'CYBER INCIDENTS,' INCLUDING RANSOMWARE TARGETING SUSPECTED 0-DAY

SonicWall is probing recent ransomware attacks on its Gen 7 firewalls, potentially exploiting a zero-day in SSL VPNs. Even with MFA enabled, attackers bypassed controls, deployed ransomware, and quickly pivoted to internal systems. SonicWall has urged customers to disable SSL VPN and use mitigation steps ASAP while waiting for official patches.

HACKER USED A VOICE PHISHING ATTACK TO STEAL CISCO CUSTOMERS' PERSONAL INFORMATION

A hacker used a voice phishing (“vishing”) call to trick a Cisco representative, gaining access to their third-party CRM system and stealing Cisco.com users' personal data: names, organizations, addresses, emails, phone numbers, and more. The company did not disclose how many users this sophisticated social engineering breach affected.

INVERSEPROMPT: TURNING CLAUDE AGAINST ITSELF, ONE PROMPT AT A TIME (­­­CVE-2025-54794 & CVE-2025-54795)

Elad Beber discovered two high-severity vulnerabilities in Anthropic's Claude Code during its Research Preview phase. CVE-2025-54794 (CVSS 7.7) allows path restrictions to be bypassed through naive prefix validation, enabling access to files outside the intended working directory. CVE-2025-54795 (CVSS 8.7) enables command injection via inadequate input sanitization, allowing arbitrary code execution without user confirmation by breaking out of allowed commands like “echo”. Anthropic has patched both vulnerabilities.

FROM THE TOP 20 OPEN SOURCE COMPONENT VULNERABILITIES: RETHINKING THE CHALLENGES OF OPEN SOURCE SECURITY GOVERNANCE

Open source security governance is challenged by widespread reliance on vulnerable libraries, lack of standardized management, insecure defaults, and unclear ownership. This post dives into how effective governance requires proactive policies, measurable capabilities, and continuous attention beyond just tool-based vulnerability scans to deal with known and unknown risks in dependencies.

EXPLOITING ZERO DAYS IN ABANDONED HARDWARE

Trail of Bits researchers exploited two discontinued home network devices (Netgear WGR614v9 router and BitDefender Box V1) at DistrictCon's Junkyard competition, achieving remote root access through chained vulnerabilities, including UPnP authentication bypass, buffer overflows, and firmware downgrade attacks. The research highlights how end-of-life hardware becomes a persistent security risk when manufacturers stop releasing updates, leaving vulnerabilities permanently unpatched. Both devices were initially designed to protect home networks, but became easy targets due to years without security updates.

ENTRAGOAT

EntraGoat is a deliberately vulnerable Microsoft Entra ID infrastructure that simulates real-world identity security misconfigurations and attack vectors. It introduces intentional vulnerabilities in your environment to provide a realistic learning platform for security professionals. EntraGoat features multiple privilege escalation paths and focuses on black-box attack methodologies.

FABLE SECURITY (PRODUCT LAUNCH)

Fable uses AI to monitor real-time employee behavior signals and provides interventions such as chats and video briefings tailored to individual risk moments. It aims to educate users and reduce human-related cybersecurity threats in enterprises.

DOUBLETEAM

DoubleTeam is a Python listener that uses socat, tmux, and threading to launch a new tmux window on each connection, listen on multiple ports, and automatically resume listening upon spawning the new window.

AI SITE PERPLEXITY USES “STEALTH TACTICS” TO FLOUT NO-CRAWL EDICTS

A recent report from Cloudflare stated that Perplexity is deliberately circumventing robots.txt and utilizing evasion techniques to avoid web application blocks. The researchers identified that when Perplexity's crawlers encounter Cloudflare's blocks or a robots.txt file, they cycle through a list of IPs not in Perplexity's published IP ranges and shuffle ASNs to avoid blocks. Other sites such as Forbes, Reddit, and Wired have also leveled similar accusations at Perplexity.

JURY “SENDS A MESSAGE” ON APP PRIVACY IN RULING AGAINST META

A jury found Meta guilty of illegally invading the privacy of women who shared their health data with the period tracking app Flo by deliberately harvesting it without consent. This verdict may set a landmark precedent in setting boundaries for how far tech firms can go in collecting personal data for use in targeted advertising. Meta has denied any wrongdoing and is “exploring all legal options.”

SONATYPE UNCOVERS GLOBAL ESPIONAGE CAMPAIGN IN OPEN SOURCE ECOSYSTEMS

Sonatype uncovered a global espionage campaign led by North Korea's Lazarus Group that uses malware-laced open source packages on npm and PyPI to infiltrate developer environments. Over 234 malicious packages targeted at least 36,000 victims, aiming to steal secrets and open persistent backdoors across critical digital infrastructure.

PANDORA CYBER ATTACK EXPOSES CUSTOMER DATA VIA THIRD-PARTY VENDOR

Pandora confirmed a cyber attack through a third-party vendor that exposed customer names, phone numbers, and email addresses (but not financial data).

THE HEAT WASN'T JUST OUTSIDE: CYBER ATTACKS SPIKED IN SUMMER 2025

Summer 2025 saw a major spike in cyber attacks with ransomware groups heavily targeting healthcare, retail breaches at Louis Vuitton and Belk, and widespread exploitation of critical Microsoft SharePoint vulnerabilities in espionage campaigns.

PBS CONFIRMS DATA BREACH AFTER EMPLOYEE INFO LEAKED ON DISCORD SERVERS

PBS confirmed a data breach exposing corporate contact information of 3,997 employees and affiliates after the data was leaked and circulated on Discord servers by PBS Kids fans apparently motivated by curiosity rather than malicious intent.

Learn more and see Ringfencing in action

NEW PLAGUE LINUX MALWARE STEALTHILY MAINTAINS SSH ACCESS

Plague is a stealthy Linux malware that had evaded detection for over a year. It acts as a malicious PAM module, using layered obfuscation techniques and environment tampering to avoid detection. The Plague backdoor also scrubs the `SSH_CONNECTION` and `SSH_CLIENT` environment variables and redirects `HISTFILE` to `/dev/null`.

NORTHWEST RADIOLOGISTS DATA BREACH HITS 350,000 IN WASHINGTON

Northwest Radiologists suffered a data breach between January 20 and 25 that exposed the personal information of 350,000 Washington State residents. Compromised data includes names, addresses, Social Security numbers, medical records, and health insurance details. The company has secured its systems, notified authorities, and is offering free credit monitoring to affected individuals.

PYTHON-POWERED MALWARE SNAGS HUNDREDS OF CREDIT CARDS, 200K PASSWORDS, AND 4M COOKIES

Vietnamese cybercriminals using PXA Stealer have infected more than 4,000 victims across 62 countries, stealing 200,000 passwords, credit card data, and 4 million browser cookies. The malware abuses legitimate software like Microsoft Word and PDF readers for sideloading attacks, then sells the stolen data on Telegram marketplaces such as Sherlock.

EXPLOITING SELF-XSS USING DISK CACHE

Security researchers have developed a novel technique to exploit self-XSS vulnerabilities by combining login CSRF attacks with browser disk cache manipulation. The attack works by forcing victims to log into attacker-controlled accounts, then using browser history navigation (`history.go(-2)`) to access cached victim data from previous sessions. Organizations can defend against this attack vector by implementing `Cache-Control: no-store` headers on sensitive endpoints to prevent disk cache exploitation.

OUR JOURNEY FROM FRAGILE SSH TO ZERO-TRUST CONNECTIONS

A Redditor shares their journey building an open-source alternative to tools like Vercel and Railway. Initially, users would bring their own servers and provide keys in the UI. However, due to privacy and security concerns, dflow added the ability to purchase servers via AWS, along with a free promo program that was quickly abused. They later discovered that they could use Tailscale to allow servers to dynamically join their network with one command, or even automatically as part of their Dockerfile, without the need to exchange SSH keys.

BREAKING NVIDIA TRITON: CVE-2025-23319 - A VULNERABILITY CHAIN LEADING TO AI SERVER TAKEOVER

Newly discovered critical vulnerabilities in NVIDIA's Triton Inference Server allow remote attackers to gain full system control. The flaws (CVE-2025-23319, CVE-2025-23320, and CVE-2025-23334) could enable AI model theft, data exposure, and network infiltration. NVIDIA has released patches, and users are advised to update to the latest version immediately.

KANVAS

Kanvas is an Incident Response (IR) case management tool with an intuitive, Python-based desktop interface.

INTRODUCING SRA VERIFY – AN AWS SECURITY REFERENCE ARCHITECTURE ASSESSMENT TOOL

SRA Verify is an open-source security assessment tool that validates AWS environments against the Security Reference Architecture through automated checks across CloudTrail, GuardDuty, Config, Security Hub, and other services. The tool maps directly to AWS SRA recommendations and helps organizations verify that their multi-account security implementations align with AWS best practices. Teams can use the GitHub repository for infrastructure-as-code examples to remediate identified gaps.

DEPTECTIVE

Deptective is a tool that automatically determines the native dependencies required to run any given program or command.

APT36: A PHISHING CAMPAIGN TARGETING INDIAN GOVERNMENT ENTITIES

APT36 (Transparent Tribe), a Pakistan-linked threat group, is conducting a sophisticated phishing campaign against Indian government entities using typo-squatted domains that mimic official portals to harvest credentials and bypass Kavach MFA. The operation employs real-time OTP harvesting with C2 infrastructure hosted on Pakistani servers and coordinated domain registrations, indicating state-sponsored backing. Organizations should immediately block identified IOCs, including the domains mgovcloud[.]in and virtualeoffice[.]cloud, as well as associated IP addresses.

NORTH KOREA SENT ME ABROAD TO BE A SECRET IT WORKER. MY WAGES FUNDED THE REGIME

North Korea sends thousands of IT workers abroad to secure remote jobs at Western companies using hundreds of fake identities, generating $250-600 million annually for the state. The workers use stolen identities from European citizens to apply for US and European tech jobs, often resulting in multiple North Koreans unknowingly hired by the same company. An estimated 85% of earnings are sent back to fund the regime. Security firms report interviewing dozens of suspected North Korean IT workers who use AI face-swapping technology and work from locations where it's never daytime during supposed US business hours.

GENE SEQUENCING GIANT ILLUMINA SETTLES FOR $9.8M OVER PRODUCT VULNERABILITIES

Gene sequencing company Illumina agreed to pay $9.8 million to settle Justice Department accusations that it sold cybersecurity-vulnerable genomic sequencing systems to federal agencies between 2016 and 2023. The company allegedly lacked proper security programs and falsely claimed its software met cybersecurity standards.

PWN2OWN HACKING CONTEST PAYS $1M FOR WHATSAPP EXPLOIT

Meta is co-sponsoring Pwn2Own Ireland 2025 (Oct 21-24), offering $1M for zero-click WhatsApp RCE exploits - registration closes on October 16.

GOOGLE SAYS ITS AI-BASED BUG HUNTER FOUND 20 SECURITY VULNERABILITIES

Google's AI bug hunter, "Big Sleep," discovered its first 20 security vulnerabilities in open-source software such as FFmpeg and ImageMagick.

PROTON FIXES AUTHENTICATOR BUG LEAKING TOTP SECRETS IN LOGS

Over the weekend, a Redditor discovered that Proton's new Authenticator app for iOS was logging TOTP secrets to the local device.

Download the full report from Flashpoint

CL-STA-0969 INSTALLS COVERT MALWARE IN TELECOM NETWORKS DURING 10-MONTH ESPIONAGE CAMPAIGN

Chinese state-sponsored threat actor CL-STA-0969 conducted a 10-month espionage campaign that targeted Southeast Asian telecom networks. The campaign used custom malware, including AuthDoor, GTPDOOR, and ChronosRAT, to enable remote control and location tracking. The group deployed advanced evasion techniques, including DNS tunneling and traffic routing through compromised mobile operators, while maintaining high operational security. There was no evidence of data exfiltration despite the attackers installing multiple backdoors and scanning tools across critical telecommunications infrastructure.

CRITICAL ALERT: AKIRA RANSOMWARE SURGE TARGETS SONICWALL FIREWALLS

Akira ransomware attacks targeting SonicWall SSL VPN connections have surged since July. Exploiting CVE-2024-40766 (CVSS 9.3) and unpatched SonicOS devices with disabled MFA, attackers rapidly escalate from VPN access to system encryption within hours, affecting hundreds of thousands of devices across multiple SonicWall generations. Organizations must immediately patch to the latest firmware, enable MFA on all VPN accounts, and restrict firewall management access to trusted IP ranges.

ATTACKERS EXPLOIT LINK-WRAPPING SERVICES TO STEAL MICROSOFT 365 LOGINS

Cloudflare's Email Security team observed a new campaign in which threat actors abuse link-wrapping services from Proofpoint and Intermedia to phish users for Microsoft 365 credentials. Attackers abused Proofpoint link-wrapping in various ways, including multi-tiered redirect abuse with URL shorteners via compromised accounts. In the Intermedia campaign, threat actors sent a message impersonating a “Zix” secure message notification or a Teams notification that would redirect users to a fake login page to harvest Teams credentials.

EXPLOITING TRUST: HOW SIGNED KERNEL DRIVERS FUEL MODERN KERNEL LEVEL ATTACKS ON WINDOWS

An emerging pattern in kernel level attacks is to use a signed kernel loader to load a signed second stage kernel driver or reflectively load an unsigned kernel driver. These signed drivers are often signed via the Windows Hardware Compatibility Program (WHCP). The WHCP requires an extended validation (EV) certificate, which is designed to increase the security of the program. However, the EV certificate application process requires little human interaction, and there are dark web sellers of EV code-signing certificates.

KUBERNETES SECURITY FUNDAMENTALS: AUTHORIZATION

Kubernetes handles authorization by utilizing multiple authorization providers in the cluster requested in the order specified to the kube-server as flags on startup. Each provider can explicitly approve or deny the request or respond with “no opinion.” If all providers respond “no opinion,” the request is denied. Providers include AlwaysAllow and AlwaysDeny, which allow or deny every request; Node Authorizer, which restricts the access of the kubelet user; Attribute-Based Access Controls (ABAC), which enables cluster-admins to define authorization rules based on the request's characteristics statically; Role-Based Access Controls (RBAC), which is the most commonly used provider and maps permissions to roles; and Webhook, which is widely used in cloud provider clusters like AKS, GKE, and EKS.

SILENT PUSH CEO ON CYBERCRIME TAKEDOWNS: 'IT'S AN ONGOING CAT-AND-MOUSE GAME'

In this interview, Silent Push CEO Ken Bagnall discusses tracking Funnull, a Philippines-based company providing infrastructure for financial scams that cost US victims $200 million. The firm maps criminal networks for law enforcement but faces challenges when groups adapt to surveillance. Bagnall compares state-tolerated cybercrime to historical privateering, requiring national-level responses.

COMPOSE YOUR WAY WITH PROVIDER SERVICES

Docker Compose has announced the release of Provider services, which enables users to extend the capabilities of Docker Compose files by calling provider plugins that can interact with external services. This post includes an example of how to use the Telepresence traffic manager for a Kubernetes cluster.

ECHO (PRODUCT LAUNCH)

Echo offers CVE-free container base images in a similar space to Chainguard or recently Wiz. Customers simply need to replace their Dockerfile base image with Echo's secure version without any other changes.

PLAYBOOK-NG

Playbook-NG is a stateless web-based application that matches incident findings with countermeasures for adversary containment and eviction. Users can export the results in numerous formats such as JSON, Microsoft Word, Excel, and Markdown. The application does not save information about the users or their inputs. Work is cleared when the user browses off or clears the playbook.

ANTHROPIC SAYS OPENAI ENGINEERS USING CLAUDE CODE AHEAD OF GPT-5 LAUNCH

Anthropic revoked OpenAI's access to the Claude API after discovering ChatGPT engineers were using Claude Code tools ahead of GPT-5's expected launch next week. The incident highlights competitive tensions in AI development, with Anthropic's spokesperson noting that Claude Code has become the “go-to choice for coders everywhere,” including OpenAI's technical staff. Whether OpenAI used Claude Code to enhance GPT-5's coding capabilities remains unclear, but the timing suggests potential competitive intelligence gathering.

SEX TOY MAKER LOVENSE THREATENS LEGAL ACTION AFTER FIXING SECURITY FLAWS THAT EXPOSED USERS' DATA

Lovense fixed two security vulnerabilities that exposed user emails and enabled account takeovers. CEO Dan Liu is considering legal action over disclosure reports, claiming no data was compromised despite the security hole.

WHEN PUBLIC PROMPTS TURN INTO LOCAL SHELLS: ‘CURXECUTE' – RCE IN CURSOR VIA MCP AUTO‑START

Aim Labs has discovered "CurXecute," a high-severity vulnerability (CVE-2025-54135, 8.6 rating) in Cursor IDE that enables remote code execution through prompt injection. While fixed in version 1.3, earlier versions remain vulnerable, and attackers can exploit developer privileges via poisoned MCP data for ransomware, theft, or AI manipulation.

SENATE CONFIRMS SEAN CAIRNCROSS TO BE NATIONAL CYBER DIRECTOR

In a 59-35 Senate vote, Sean Cairncross has been confirmed as the Trump administration's first Senate-approved cyber official.

NEW 'SHADE BIOS' TECHNIQUE BEATS EVERY KIND OF SECURITY

Shade BIOS is a UEFI malware technique that runs entirely in BIOS memory after OS startup, bypassing all security software, and operates as a parallel system.