Attacks & Vulnerabilities
|
Owner of fashion brands Hobbs and Whistles joins autumn pwned collection (2 minute read)
TFG London, owner of Hobbs, Phase Eight, and Whistles, detected a cyberattack on October 11. Several IT systems remain offline, website functions are limited, and orders placed on or after Sunday may be delayed. TFG has not found evidence that payment data was exposed. It is still checking whether customer data was compromised. Attack method, ransomware involvement, and restoration timing remain undisclosed.
|
Ghostscript Flaw Lets Hackers Hijack Servers via PDF Uploads (2 minute read)
Wordfence discovered a new vulnerability in the Ghostscript interpreter and rendering engine which could allow attackers to achieve remote code execution (RCE) using specially crafted PDFs. For WordPress sites to be vulnerable, an attacker must be able to upload PDFs which are then processed by a vulnerable version of Ghostscript to generate a preview or thumbnail. Other applications that use Ghostscript to generate previews or thumbnails from PDFs may also be vulnerable.
|
|
Playing It SFAPE: Code Execution in Isolated User Mode (16 minute read)
Doyensec found a chain in Windows' SFAPE VBS enclave, used by Defender's Enhanced Phishing Protection and loaded by LSASS. A repeated call to Initialize wrote a fixed 32-bit value without validating the destination. The researchers corrupted the enclave-range check, then used a ClipboardInput race to gain a controlled memset, which led to VTL1 read and write primitives, replacement of the valid-target table, and arbitrary calls to existing VTL1 code through NtContinue. Microsoft fixed CVE-2026-83498 in September's Patch Tuesday and blocked older SFAPE images through the VBS Code Integrity policy.
|
Beyond Valid Credentials: How Exposed AWS Keys are Tested for Bedrock Access (6 minute read)
When attackers obtain AWS credentials, they frequently test them for access to other services of interest like SES, SNS, and Bedrock. Datadog examined three credential harvesting platforms and found that they utilize the ListFoundationModels, InvokeModel, and Converse API to determine access. It also found a script that checked for promotional credits available in the account.
|
Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue (4 minute read)
The DOJ raided more than 40 Texas residences in late September and seized 187 laptops used by North Korean IT workers, while two US facilitators were arrested for helping funnel over $3 million from about 70 companies. A new FBI advisory said the scheme has adapted, with operatives subcontracting jobs to freelancers in South Asia and West Africa and recruiting financially stressed Americans, including active-duty military, to host laptops or sit interviews. Exposed workers have threatened violence or data leaks to extract payment, and some are now chasing identities that qualify for security-cleared roles.
|
|
Lastwall (Product Launch)
Lastwall provides identity security for defense and government organizations. Its IDCommand Suite combines zero-trust architecture, PKI, passwordless authentication, and risk scoring from 200 contextual signals. Quantum Shield secures data in transit with NIST-approved post-quantum cryptography.
|
Security-suite (GitHub Repo)
A comprehensive open-source security tools suite for OSINT reconnaissance, web security testing, API security assessment, and compliance checking with AI-powered analysis.
|
CodeGraph (GitHub Repo)
CodeGraph is a tool to build pre-indexed code knowledge graphs which can be fed to AI agents to speed up code exploration.
|
|
AI Regulation Must Mimic Industrial Revolution Laws (3 minute read)
The UK's AI minister, Kanishka Narayan, is drafting plans for compulsory safety reporting and monitoring for frontier AI, and a potential requirement that labs grant pre-release access to models for review. Narayan compared this to the Industrial Revolution and said frontier labs shouldn't release tools they can't guarantee are safe. Narayan also confirmed that he reached an agreement with Anthropic to provide the AISI preview access to Mythos again.
|
Anthropic Warns Self-Replicating AI Could Spread to Your Smart Devices (2 minute read)
Anthropic warns that small AI models could soon self-replicate across consumer IoT devices, creating distributed botnets capable of running AI workloads. Anthropic distributed Gemma4-26B-A4B onto 15 off-brand Android TV boxes but could not demonstrate self-replication. On the hardware in question, inference would be a slow process, so defenders may be able to respond in time to stop any abuse.
|
Trezor Wallets Also Compromised with Implants (6 minute read)
Hardware hacker Joe Grand found implants in a Trezor One and a Trezor Model T bought from unauthorized sellers, contradicting Trezor's public claim that none of its devices had been compromised, despite Grand reporting the findings in August. The attackers replaced each device's microcontroller with malicious firmware derived from open source that displayed one of a dozen pre-generated seed phrases while passing integrity checks against a copy of the legitimate firmware stored on an external microSD card. Unlike the Ledger implants, which exfiltrated real seeds over a cellular link, these relied on predictable seeds, and Trezor's move to cut authorized resellers suggested the company feared a similar shift into trusted supply channels.
|
|
Racket Infrastructure Compromise (2 minute read)
A crypto miner on a compromised Northwestern University build server exposed Racket's Apple and Windows signing keys, prompting the project to rotate both, have GlobalSign revoke the Windows certificate, and urge macOS users on versions 8.12 through 9.3 to reinstall before Apple revokes its certificate at semester's end.
|
|
Love TLDR? Tell your friends and get rewards! |
|
Share your referral link below with friends to get free TLDR swag!
|
|
|
|
| Track your referrals here. |
|
|
|
0 Comments