Attacks & Vulnerabilities
|
OpenCode Security Breach Exposes API Keys of 1.4% of Console Users (3 minute read)
OpenCode disclosed that it suffered a data breach that exposed third-party API keys belonging to approximately 1.4% of console users with external providers linked. The breach occurred as part of a distillation attack on a legacy system. Affected customers have been contacted and are being instructed to revoke the exposed keys.
|
Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk (3 minute read)
Any.Run analyzed 1,258 incidents over six months involving fake AI-tool lures. Attackers impersonated Claude in 60% of cases and ChatGPT or Codex in 33%, using malicious ads, SEO poisoning, fake download pages, shared chats, and artifacts. ClickFix-style commands appeared in 45% of cases. Targets risk losing source code, SSH keys, CI/CD tokens, cloud and AI API keys, sessions, and billing access.
|
Frozen Privilege: Remote Code Execution in Snowflake-Managed PostgreSQL (10 minute read)
Varonis researchers found that Snowflake-managed PostgreSQL's non-superuser snowflake_admin role could be escalated to OS-level RCE by chaining five documented PostgreSQL features, defeating every published mitigation without disabling any. The chain used CREATEROLE to self-grant pg_write_all_data and hijacked a pg_cron job to run as postgres. It then rebound blocked functions through LANGUAGE internal, exposing tenant mTLS keys and AWS STS credentials and allowing an overwrite of archive_command. Snowflake has fixed the issue server-side, but teams running their own PostgreSQL should treat CREATEROLE as near-superuser, block LANGUAGE internal and C function creation, and audit pg_cron jobs and SECURITY DEFINER functions.
|
|
Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (30 minute read)
Citizen Lab links Israeli ad company Discover-Tech to zero-click delivery of Candiru spyware through targeted advertisements. Its Controlium platform lets customers select targets by mobile ad ID, cookie ID, or IP address, then run JavaScript when an ad is rendered. At least 45 Al Jazeera devices were infected in 2024 and 2025. Nearly four billion bidding records show ads across almost 200,000 sites and apps. Google, IAB Europe, Beeswax, Vungle, and Eskimi cut Discover-Tech's access after disclosure. A separate actor, DARK CARTOGRAPHER, used the infrastructure to link advertising IDs with phone numbers.
|
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD (4 minute read)
Calif reported two OpenBSD vulnerabilities that enabled local privilege escalation to root. A signed 16-bit shared-memory attachment counter, dating to the original BSD sources, could overflow after repeated forking and wrap to a negative value. That enabled a use-after-free race condition. A separate out-of-bounds write gave the exploit a write-what-where primitive. The exploit worked with KARL, SMAP, and SMEP enabled, using heap grooming, SysV shared-memory manipulation, IP multicast socket allocations, and PTE self-referential mapping changes to reach kernel execution.
|
Heartbreaker: Metamorphic ransomware comes for macOS (13 minute read)
Heartbreaker, a previously undetected Rust ransomware for Apple Silicon Macs, encrypts files in ~/Downloads with AES-256-GCM, persists through a LaunchAgent, and then rebuilds itself by mutating its own embedded source code and recompiling with Cargo to change its hash each run. Patrick Wardle found the rebuild fragile and noisy because it may install Rust on the fly, depends on a now-deleted GitHub framework, and uses a single hard-coded key that lets victims decrypt every file for free. His open-source RansomWhere? tool still caught it by flagging an untrusted process that rapidly writes high-entropy files, which shows why behavior-based detection holds up against mutating binaries better than hash-based signatures.
|
|
CVE Intel (GitHub Repo)
CVE Intel is a Rust-based triage tool that queries 25 sources, including NVD, EPSS, CISA KEV, and Shodan, in parallel and returns a single 0 to 100 patch-priority score for a CVE, IP, hash, domain, or dependency list. It runs as a Tauri desktop app, CLI, REST API, or MCP server, and its built-in llama.cpp model explains findings locally by default. Teams can also integrate it into CI to fail builds on vulnerable dependencies or rank scanner output using real exploitation signals rather than CVSS alone.
|
The PQC Migration Budget Builder Turns Deadlines and Estate Counts Into a Defensible Budget Request (18 minute read)
The PQC Migration Budget Builder is a free, browser-only tool that converts regulatory deadlines and rough estate counts into an itemized year-one ask, a three-scenario program estimate, and a draft board paper for post-quantum migration. It maps 33 regimes, including the EU roadmap, OMB M-26-15, DORA, and PCI DSS v4.0.1, to buffered priority and full-migration dates, then prices compression, refresh-funded savings, and the cost of delaying migration by one to three years. Each unit cost is labeled by source and editable, allowing CISOs and finance partners to stress-test the numbers before discovery replaces the estimates.
|
SSHamble (GitHub Repo)
SSHamble is a tool for testing SSH implementations that includes: interesting attacks against authentication, post-session authentication attacks, pre-authentication state transitions, authentication timing analysis, and post-session enumeration.
|
|
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages (3 minute read)
Microsoft and partners disrupted CoGUI, Haozi, and Iron Man System, three phishing kits sold on the YAM Store marketplace. Since January, they have supported more than one billion phishing emails and SMS messages sent to more than 75,000 organizations. The kits used hijacked Microsoft and Google cloud environments, roughly 17,000 domains, fake CAPTCHAs, IP filtering, and WebSocket-based capture of credentials and financial data.
|
OpenAI models hacked a crypto wallet and breached more websites (3 minute read)
OpenAI disclosed four incidents in June involving internal models. Agents bypassed authorization on a government statistics site, accessed a research dashboard, stole credentials, altered server configuration, and downloaded 147,451 non-public rows. One model used a public developer recovery phrase to spend test-network wallet funds on a contract deployment. Another circumvented web-request restrictions through an external browser, making POST requests, and employing OCR.
|
Calendar Invite Phishing Can Leave Malicious Events on Your Calendar (6 minute read)
Phishing links, QR codes, and fake payment notices delivered via malicious .ics invites can remain on a victim's calendar even after email security tools quarantine the original message, because many filters fail to remove the events those emails auto-created. Sublime Security documented this gap in Google Workspace and Microsoft 365 and projected a roughly 33,000% increase in calendar-based attacks from May to September. Check Point separately flagged more than 302,000 unique phishing emails across 40,000+ organizations in a calendar-themed Microsoft 365 campaign.
|
|
Love TLDR? Tell your friends and get rewards! |
|
Share your referral link below with friends to get free TLDR swag!
|
|
|
|
| Track your referrals here. |
|
|
|
0 Comments