Tracking Threats, Incidents, and Vulnerabilities
Tracking Threats, Incidents, and Vulnerabilities
Pwn2Own Ireland 2025: Hackers exploited 22 zero-days, earning $267,500. Key highlights include the Samsung Galaxy S25 hacked using five flaws. $20,000 awarded for hacking a QNAP TS-453E. Contest ends with more vulnerabilities to be targeted.
Security Vulnerability in AI Browsers: OpenAI's Atlas and Perplexity's Comet browsers are susceptible to AI sidebar spoofing attacks, allowing hackers to deceive users into executing harmful instructions. Researchers from SquareX demonstrated that malicious extensions can overlay a fake AI sidebar, leading users to phishing sites, compromising Google accounts, or executing harmful commands. Users are advised to restrict sensitive activities on these browsers due to their current security weaknesses.
TL;DR: Microsoft 365 Copilot allowed data exfiltration via mermaid diagrams through an indirect prompt injection, fetching sensitive information (e.g., emails) and encoding it in a clickable “login button.” Clicking the button sent the data to an attacker's server. The vulnerability was confirmed and subsequently patched by Microsoft.
Researchers demonstrated that cars can act as a security risk under BYOD policies, as attackers can compromise an employee’s smartphone by spoofing a vehicle’s Bluetooth signal. Once the phone is infected, the attacker can access corporate networks when the phone connects at work, enabling data theft and lateral movement. The attack used cheap, easily accessible hardware and exploited overlooked connectivity between devices. Security experts stress the importance of holistic mobile device management, network segmentation, and addressing gaps between different security systems, as most breaches stem from simple oversights rather than sophisticated attacks.
https://www.darkreading.com/vulnerabilities-threats/car-byod-risk
Researchers found that many satellite communications, including sensitive data from cell phone carriers and militaries, are transmitted unencrypted. A study from UCSD and the University of Maryland revealed that half of the analyzed signals were vulnerable, allowing interception of communications like calls and texts. The researchers used a simple $750 setup to collect this data, warning that companies underestimated potential threats to satellite security. Fixed vulnerabilities have since been confirmed for some affected organizations.
AI-powered ransomware presents a significant threat to businesses, demonstrated by the collapse of KNP Logistics after a ransomware attack exploiting weak passwords. AI techniques like generative adversarial networks (GANs) enhance password cracking, making traditional defenses ineffective. Organizations must adopt robust security measures, including password managers, employee training, and multi-factor authentication, to mitigate these risks. The evolution of AI in cybercrime necessitates a reevaluation of security protocols to combat increasingly sophisticated attacks.
https://www.theregister.com/2025/10/16/machine_learning_meets_malware/
New Pixnapping attack on Android devices can steal 2FA codes from Google Authenticator in under 30 seconds. It exploits hardware vulnerabilities in GPUs and Android APIs without needing special permissions. The attack bypasses traditional app security, can capture sensitive data from various apps, and has both Google and Samsung addressing the issue. Users are urged to update devices and monitor app behavior to mitigate risks.
Legit recently reported a critical vulnerability in GitHub Copilot Chat that allowed exfiltration of secrets and code from private repos via remote prompt injection, leading to unauthorized access and code suggestions. GitHub has since fixed this vulnerability.
Intel and AMD's Trusted Execution Enclaves (TEEs) are foundational for cloud security but are vulnerable to physical attacks, as shown by researchers who revealed two new exploits: Battering RAM and Wiretap. These attacks exploit deterministic encryption used in TEEs, allowing attackers to view or manipulate encrypted data. Battering RAM enables active decryption and manipulation, while Wiretap permits passive decryption. Both exploits highlight significant design flaws in TEE security, raising concerns as cloud services rely on these protections. Solutions would require fundamental changes to encryption methods, which are currently unclear.
Kerberoasting is a persistent vulnerability in Microsoft’s Active Directory that exploits weak service account passwords, allowing attackers to crack them offline. Despite being a known issue for over a decade, it remains prevalent due to legacy systems and insufficient mitigation efforts by Microsoft. This flaw enables lateral movement within corporate networks and has been linked to ransomware attacks, highlighting the need for stronger security measures and abandonment of outdated cryptographic practices.
https://blog.cryptographyengineering.com/2025/09/10/kerberoasting/
XSS (Cross-Site Scripting) vulnerabilities remain prevalent despite being known for 25 years, with Microsoft mitigating over 970 cases from January 2024 to mid-2025. Researchers report vulnerabilities across various Microsoft platforms, emphasizing the need for secure coding practices and proactive validation. MSRC evaluates XSS severity based on its potential impact on customer security, focusing on exploitability and data sensitivity. Future blog posts will explore defensive strategies against XSS attacks, advocating for continuous engagement with security researchers.
BobDaHacker describes how he found and reported several security vulnerabilities in the McDonald's app and internal systems. Initially, he discovered client-side validation issues that allowed users to exploit reward points. Subsequent investigations revealed serious flaws, including weak password protections, exposed API keys, and unauthorized access to employee information. After struggles to report these issues due to a lack of a proper security contact, he eventually contacted HQ by mentioning random employee names. McDonald's addressed many issues following his reports, but the process revealed a need for better security protocols and reporting channels.
https://bobdahacker.com/blog/mcdonalds-security-vulnerabilities
EU launches EUVD to improve vulnerability tracking, aimed at enhancing resilience in cybersecurity against reliance on US databases like NVD and CVE, addressing recent funding and operational gaps. ENISA promotes collaboration with existing systems for actionable insights. Effective risk management requires contextualization and integration with broader frameworks. The EUVD's success depends on community engagement and avoiding fragmentation in threat intelligence reporting.
https://www.reversinglabs.com/blog/euvd-vulnerability-database-ecosystem
macOS vulnerability CVE-2025-31250 allows apps to spoof permission prompts, misleading users into granting access to the wrong application. Correctly patched in macOS Sequoia 15.5, earlier versions like Ventura and Sonoma remain unaddressed. The flaw arises from incorrect handling in the TCC framework's request logic, permitting consent responses for one app while displaying prompts for another. While exploiting this requires user interaction, it poses significant risks, particularly for high-access applications like Microphone and Camera. Apple has responded slowly to the issue, but recent updates appear to address the vulnerability, enhancing overall security.
BYOVD (Bring Your Own Vulnerable Driver) attacks exploit vulnerabilities in legitimate drivers to bypass security measures, allowing attackers to manipulate kernel-level resources directly. These attacks can disable security systems and enable encryption or data theft, notably used by the Cuba ransomware group, which has caused significant financial damage. Effective mitigation strategies include updating old operating systems, auditing kernel drivers, implementing strict permissions for driver loading, and using behavioral monitoring tools. Regular simulations of such attacks can help organizations validate their defenses.
https://cymulate.com/blog/defending-against-bring-your-own-vulnerable-driver-byovd-attacks/
