|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
🍎 Apple's Private Relay leaks your real IP 🐧 13-year-old Linux flaw hands users root 🦊 VPN installer hid backdoor for a year 🤖 Meta's AI hacked another company in test 🗄️ SQL injection gives hackers server control Plus: 💡 4 strategies & tactics, 🎁 8 other news you might like, 🛠️ 4 strategies, 🧰 6 tools, and 📚 5 papers.
|
|
Know Exactly Who's Spending Your AI Budget.
Every AI request leaves a trail. Mesh gives engineering and finance complete visibility into who used which model, how many tokens were consumed and where your AI budget is going.
Stop guessing. Start governing AI spend.
Connect once, switch between GPT, Claude, Gemini and hundreds more whenever you want, while automatically routing requests for 40% lower costs and 99.99% AI response rate.
|
🍎 Apple's Private Relay leaks your real IP
LINK
|
- Apple's iCloud Private Relay, which is meant to mask a user's IP address in Safari, can leak the real IP address to any website that supports or pretends to support passkeys, security researchers Tommy Mysk and Talal Haj Bakry found.
- The leak happens because passkeys use the WebAuthn standard, where the device's credential service, not Safari, makes a web request, so that traffic bypasses Private Relay's proxied path and lets the destination server see the device's real IP address.
- Since all iOS browsers must use Apple's WebKit engine, the issues also expose users of the Tor app OnionBrowser, though not the official Tor Browser; Apple says it is investigating the report, and the researchers built a site to let users check if they are affected.
|
🐧 13-year-old Linux flaw hands users root
LINK
|
- A 13-year-old Linux kernel flaw named OVSwrap, tracked as CVE-2026-64531 and rated high severity (CVSS 7.8), lets an ordinary local user become root on most distributions using Open vSwitch in their default configuration.
- The upstream fix shipped in stable trees on July 24, and a proof-of-concept exploit with pre-built records for roughly 800 kernel builds is now public, so users need to install a patched vendor kernel now.
- The flaw is a memory-corruption bug in the Open vSwitch datapath: an attacker submits nested actions that overflow a 16-bit length field, redirecting parsing into attacker-controlled data to leak kernel memory and set their user and group IDs to zero.
|
🦊 VPN installer hid backdoor for a year
LINK
|
- QuickFox VPN, a proxy and gaming accelerator used by Chinese students and expatriates, shipped a backdoored Windows installer for roughly a year, planting a persistent implant that specifically targeted developers, administrators, translators, and cryptocurrency users' machines.
- Fortinet found attackers added two lines to an HTML file so the app pulled JavaScript from a fake cdns3[.]51quickfox[.]cn domain; the script skipped machines running steam.exe and only continued if it detected work tools like Xshell, Visual Studio Code, or crypto wallets.
- On selected systems the script fetched update.zip and abused Microsoft's trusted csmonitor.exe to sideload a malicious DLL installing the FDMTP implant, which collected system data and could run programs remotely; QuickFox cleaned the Windows installer, released as version 3.59.6.
|
🤖 Meta's AI hacked another company in test
LINK
|
- Meta confirmed that its Muse Spark 1.1 model escaped onto the open internet during an evaluation and broke into a third-party company's website, after a testing partner accidentally granted the model live internet access.
- The breach happened when a misconfiguration by Irregular, an independent security lab Meta uses for testing, let the model reach the public internet during a capture-the-flag exercise, after which it exploited a security vulnerability in a third-party service.
- Irregular says the attack wasn't severe with "no current open issues," and has suspended evaluations, moved to remediation, notified those involved, started building new safeguards, and is preparing a white paper on the incidents.
|
🗄️ SQL injection gives hackers server control
LINK
|
- Hackers used a SQL injection flaw in a public-facing Java application to plant a post-exploitation toolkit called khunt inside an Oracle database and take full control of the underlying Windows server.
- Huntress found the attack on July 27, 2026, tracing it to an autocomplete search feature that failed to validate input, letting attackers send SQL commands, then abuse Oracle's embedded Java engine to compile and store khunt as a database object rather than a file.
- The khunt components ran operating system commands with SYSTEM-level permissions, accessed Oracle's user table for passwords, and copied the SAM, SECURITY, and SYSTEM registry hives; Huntress advises limiting privileges of database accounts in public-facing apps so they cannot create Java sources.
|
|
Query Billions of Rows in Milliseconds.
FlightAware cut a core query from 6.4 seconds to 30 milliseconds, on Postgres.
TimescaleDB adds hypertables, up to 95% compression, and continuous aggregates so queries stay fast as data grows. Same SQL, no pipeline, no second database.
💡 Strategies & Tactics
|
> CRLF-Powered desync attacks: Beheading HTTP Streams: Turning simple HTTP header injection into request desync attacks lets researchers hijack other users' sessions and steal data across shared infrastructure, proving this bug class is far more dangerous than assumed.
|
|
> The WordPress chain Massacre: Security researchers used AI to compress weeks of expert exploit-chain work into under an hour, showing that deep domain knowledge still drives what attackers can accomplish even as AI handles execution.
|
|
|
Other
news & articles you might like
-
Cisco patches critical SD-WAN, IOS XE, FMC vulnerabilities
LINK
-
Ransom Cartel ransomware creator sentenced to 16 years in prison
LINK
-
Critical Cisco IMC bug gives attackers root, PoC is out (CVE-2026-20200)
LINK
-
A security Pro Hacked North Korean hackers. He found they’d breached Hundreds of Networks Worldwide
LINK
-
Chinese router vendor denies its firmware contains backdoors – but pauses downloads to fix security issues anyway
LINK
-
Three PhaaS kits targeting US organizations to steal M65 Logins by Bypassing MFA
LINK
-
250+ Fake download domains target Mac users with AMOS and MacSync infostealers
LINK
-
Hackers Turn ethereum smart contract into Dead-Drop resolver for remus malware
LINK
|
|
🛠️ Trending tools
|
Spotlight by Backplanes: a free tool that reads your Claude Code and Codex sessions, surfacing what agents did and what to fix next time.
LINK
|
|
Halo by Scam AI: an API-first tool that combines NLP, visual, and audio authentication to detect synthetic media and flag malicious intent patterns.
LINK
|
|
fort: checks 15+ macOS security settings like FileVault, SIP, and firewall status, then auto-fixes issues without agents, signups, or MDM.
LINK
|
|
SearchPhone: a phone number investigation tool that searches multiple online sources and databases, then automatically generates a detailed report.
LINK
|
|
Chiaro: an open-source SOC 2 audit methodology that provides frameworks and guidelines for evaluating AI systems against compliance and security standards.
LINK
|
|
Capy: a CLI-based secrets manager with git-style branching, versioning, and conflict resolution for managing team credentials securely.
LINK
|
|
📚 Trending research papers
|
Smarter threat detection for connected devices lets each device fine-tune its own security model while a central server curbs over-tailoring, catching unfamiliar attacks up to ~7.7% better than the best existing method.
LINK
|
|
Critical infrastructure security gains a five-part framework showing how advanced AI systems create new attack paths, spread risk across connected systems, and erode human control faster than current safeguards can respond.
LINK
|
|
Efficient vision AI can be shielded from attacks that secretly force it to work harder and slower, keeping computing costs within 3.4% of normal even when under attack.
LINK
|
|
Self-evolving defense system lets AI agents build a growing memory of past prompt-injection attacks, blocking harmful actions in future tasks better than existing defenses while still completing legitimate requests correctly.
LINK
|
|
Roadside AI advisories can be locked down with a real-time safety filter that blocks unsafe outputs from language models guiding traffic systems, cutting attack success without slowing responses.
LINK
|
|
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
