|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
🎭 Hijacked Reddit account spread malware 📧 Cisco email flaw lets attackers run code 🇯🇵 VPN flaw exposes Japan government records 🔓 Vite flaw exposes cloud secrets 🔐 Device breaks Intel, AMD memory encryption Plus: 💡 6 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.
|
|
Your AI budget tripled. See real usage patterns with Harmonic.
AI spend is now a major P&L line item—but most teams can't show what it's producing.
Harmonic Security maps AI activity to use cases and teams, revealing real productivity, shelfware, data risk, and adoption trends across approved and unapproved tools.
Give your board the data behind the return.
|
🎭 Hijacked Reddit account spread malware
LINK
|
- A hacker hijacked the verified u/hbomax account on Reddit to push malware at Windows and Mac users, exploiting the account's trusted status to bypass the skepticism people normally apply to internet ads, according to Hudson Rock and Adam Networks.
- The attacker circulated 46 fake ads, many leading to a fraudulent site at hbomaxx[.]us offering three months of free HBO Max, which triggered a ClickFix-style attack, instructions disguised as CAPTCHA or error screens that trick users into running malware themselves.
- On macOS the attack delivered malware that steals browser passwords, cookies, wallet data, and login credentials from password managers during a 48-hour blitz that also pushed fake Claude and Codex apps; Reddit said it paused the affected ads and is investigating.
|
📧 Cisco email flaw lets attackers run code
LINK
|
- Attackers are actively exploiting a critical flaw (CVSS 9.8) in Cisco Secure Email Gateway appliances, tracked as CVE-2026-76461, that lets them remotely gain substantial access to sensitive information with no login, privileges, or user interaction.
- To pull it off, attackers send specially crafted emails containing malicious SQL statements that get executed, ultimately running commands with root privileges on the underlying operating system of both virtual and physical appliances.
- Cisco released an emergency software update with no other workarounds and urges immediate installation, plus renewing credentials and cryptographic materials, reviewing mail logs for the malicious SQL statements listed as indicators of compromise, and checking network logs for suspicious uploads to external IPs.
|
🇯🇵 VPN flaw exposes Japan government records
LINK
|
- Japan's Digital Agency has disclosed a data breach that may have exposed around 246,000 record rows of personal information belonging to government employees, after an attacker broke into a VPN device used by the Government Solution Service (GSS).
- The agency did not name the VPN product or the specific flaw, but said the bug carried a medium severity rating and was not a zero-day, and the attacker used it to break in and gain unauthorized access to the GSS system.
- Exposed data covers government employees, public officials, and associated businesses, but not the general public, My Number IDs, bank-account details, or pension numbers; no actual misuse was detected, though the agency warned of elevated impersonation and phishing risk.
|
🔓 Vite flaw exposes cloud secrets
LINK
|
- Attackers are mass-scanning the internet for exposed Vite development servers and using them to steal AWS and Azure cloud credentials and configuration files from vulnerable deployments.
- The campaign exploits CVE-2026-39364, a high-severity file-access bypass in Vite versions 7.1.0 through 7.3.2 and 8.x before 8.0.5, letting an unauthenticated attacker append parameters like ?raw or ?import&raw to an HTTP GET request so the server ignores its filtering and returns restricted files in plaintext.
- F5 saw over 800 attacks and roughly 32,000 events in a month, mostly from US, Belgian, and Dutch sources hiding behind Google Cloud IPs; it advises updating Vite, blocking port 5173 and suspicious /@fs/ requests, and rotating all reachable secrets.
|
🔐 Device breaks Intel, AMD memory encryption
LINK
|
- Researchers unveiled DDRop, a $159 hardware device that breaks the confidential-computing guarantees of Intel TDX and AMD SEV-SNP by tampering with DDR5 memory writes to let a protected virtual machine read stale data.
- The proof-of-concept, published on GitHub with hardware designs and firmware, uses a custom DDR5 RDIMM interposer between the CPU and memory to trigger parity failures that silently discard selected writes, requiring privileged host control and brief physical access to install.
- Because these memory-encryption designs verify secrecy but not that a cache line is the freshest version, attackers could copy plaintext between pages, inject malicious page-table entries on TDX, force debug mode, or forge attestation; the durable fix needs freshness checks, so limit physical access and monitor firmware changes meanwhile.
|
|
Your agents work while you sleep
Give a Skydive agent an ongoing responsibility and they’ll handle it on schedule, every time.
Have them prep your morning report, research new leads, monitor customer feedback, or keep projects moving overnight. You wake up, the work is already done.
Other
news & articles you might like
-
Linux kernel zcopyreaper vulnerability lets local attackers gain root privileges
LINK
-
AWS Systems Manager Agent vulnerability allows attackers to bypass port-forwarding restrictions
LINK
-
Hackers exploit Marimo RCE to steal AWS credentials and reach Bastion Host in 8 seconds
LINK
-
Hackers exploit FortiGate SSL-VPN flaw to breach Thai ISP and deploy MeshCentral backdoor
LINK
-
U.S. CISA adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog
LINK
-
Hackers use autonomous AI agents to harvest thousands of credentials in under 6 hours
LINK
-
Hackers actively exploiting Gitea n-day RCE vulnerability in the wild to hijack instances
LINK
|
|
🛠️ Trending tools
|
Halo: an API-first platform that detects deepfakes and synthetic media across text, image, and audio, helping fraud and trust teams block attacks.
LINK
|
|
MonoCloud for Startups: handles authentication and Cedar-based authorization for users, APIs, and AI agents, letting you control, audit, and revoke access, free for a year
LINK
|
|
Execlave: enforces runtime policies, kill switches, and audit logs on autonomous AI agents in under 20ms, mapping to SOC 2, EU AI Act, and ISO 27001 compliance
LINK
|
|
flounder: an autonomous security auditor using AI to review code, research bugs, build exploits, and verify findings through execution.
LINK
|
|
telegram-bot-dumper: a forensic tool that extracts and downloads data from Telegram bots using their tokens, with a web interface.
LINK
|
|
Keydris: middleware for MCP servers that authorizes agent tool calls against policies, keeping credentials on the server so agents never access them.
LINK
|
|
|
|
📚 Trending research papers
|
JavaScript security scanning works far better when AI reviews code snippets, with a fine-tuned model catching 60% of vulnerabilities versus near-zero for traditional rule-based tools, though accuracy varies by flaw type.
LINK
|
|
Encrypted account recovery lets you regain access to locked vaults through a threshold of trusted contacts reconnecting, even if you've forgotten everything including the vault existed, while hiding who your helpers actually are.
LINK
|
|
Backdoor safety tests can badly understate the real risk, since the same tainted training data can range from 3% to 80% success depending only on which poisoned examples an attacker picks.
LINK
|
|
Citation laundering shows an attacker who controls one source in an AI answer engine can force a wrong answer falsely credited to a trusted source, spiking error rates from near zero to ~68%.
LINK
|
|
Hidden sentence-structure backdoors can be secretly planted inside a pretrained language model so they carry over into whatever apps get built on top, and they slip past common security checks, exposing a supply-chain risk for teams adopting shared models.
LINK
|
|
|
|
|
Our AI Academy has 330+ step-by-step tutorials on ChatGPT, Claude, Perplexity, and every tool that matters. No fluff — just practical workflows you can use at work. Try it free for 7 days.
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
