Attacks & Vulnerabilities
|
Critical Cisco ISE Vulnerabilities Allow Remote Code Execution (2 minute read)
Cisco announced fixes for two critical (CVSS 10/10) vulnerabilities in its Identity Services Engine (ISE) and ISE Passive Identity Connector, which could allow unauthenticated remote code execution (RCE). The first vulnerability is caused by a lack of input validation, which allows unauthenticated attackers to submit crafted API requests and execute arbitrary code with root privileges. The second vulnerability is caused by a lack of file validation, which could allow an attacker to store malicious files in arbitrary directories on the device.
|
Hackers Turn ScreenConnect Into Malware Using Authenticode Stuffing (2 minute read)
Cybersecurity firm G DATA is warning users of ConnectWise's ScreenConnect remote monitoring and management (RMM) software about a new malware campaign that utilizes ScreenConnect installers with a malicious configuration embedded in the authenticode certificate. The malicious installer is configured to have the title “Windows Update,” change the background to a Windows Update image, and connect to an attacker-controlled server. ConnectWise has revoked the certificates used in these binaries.
|
|
Marketplace Takeover: How We Could've Taken Over Every Developer Using a VSCode Fork; Putting Millions at Risk (7 minute read)
Security researchers have discovered a critical vulnerability in open-vsx.org, the open-source VS Code extensions marketplace used by over 8 million developers across popular editors such as Cursor, Windsurf, and VSCodium. The flaw allowed attackers to steal admin credentials through a CI pipeline issue, enabling them to publish malicious updates to every extension on the marketplace and potentially compromise millions of developer machines. The vulnerability was responsibly disclosed in May and patched after multiple iterations over several weeks.
|
5 Years, 160 Comments, and the Vulnerability That Refused to Die (8 minute read)
Jonathan Leitschuh discovered an old vulnerability in SnakeYAML that could enable remote code execution through unsafe deserialization. The maintainer initially closed the report as “Won't Fix,” claiming a safe constructor made the code safe. After a lengthy discussion, PoCs, data, and a nearly hour-long call, Leitschuh convinced the maintainer to use the secure constructor by default and make insecure behavior opt-in, marking a win for secure defaults in SnakeYAML 2.0.
|
|
Bonfy (Product Launch)
Bonfy provides AI governance solutions that detect and prevent risks in enterprise content, ensuring secure and compliant use of generative AI across organizations.
|
Obfusk8 (GitHub Repo)
Obfusk8 is a C++17 header-only library designed to obfuscate binaries through a complex set of compile-time and runtime techniques.
|
YARA-X is Stable (2 minute read)
The YARA team has officially announced the first stable release of YARA-X and moved the original YARA project into maintenance mode.
|
|
Iranian Hackers are Trying to Create a Psychological War in Cyberspace (2 minute read)
A new report by cybersecurity agency DomainTools alleges that the Iranian-backed CyberAv3ngers group is shifting its operations to focus on misinformation and psychological warfare. The CyberAv3ngers have been active since 2023, and while they have been tied to confirmed intrusions, they have also claimed targets that have been debunked. According to the report, the group has refined cyber activity “into a fully realized propaganda apparatus” with the goal of not just breaching systems but “to control the narrative surrounding those breaches.”
|
Windows killed the Blue Screen of Death (2 minute read)
Microsoft is replacing Windows' iconic Blue Screen of Death with a Black Screen of Death nearly 40 years after its introduction. The change is part of the Windows Resiliency Initiative following the CrowdStrike outage that affected 8.5 million devices. Microsoft calls it a "simplified UI" but hasn't acknowledged the significance of ending this computing era.
|
|
|
Love TLDR? Tell your friends and get rewards!
|
|
Share your referral link below with friends to get free TLDR swag!
|
|
|
|
|
Track your referrals here.
|
|
Want to advertise in TLDR? 📰
If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to advertise with us.
Want to work at TLDR? 💼
Apply here or send a friend's resume to jobs@tldr.tech and get $1k if we hire them!
If you have any comments or feedback, just respond to this email!
Thanks for reading,
Prasanna Gautam, Eric Fernandez & Sammy Tbeile
|
|
|
|
