Posts

🟡 Medium | Source: The Hacker News AI is enabling attackers to compress multi-day attack chains into minutes, using models to craft targeted phishing lures, select victims, and pivot across hosts faster than most security teams can respond. Traditional detection and response runbooks, designed for human-paced adversaries, are struggling to keep up with this shift in tempo. A webinar is being promoted to address how defenders can adapt their tooling and processes to match AI-driven attack speeds. ...

🟡 Medium | Source: Microsoft Security Response Center CVE-2025-23131 is a vulnerability in the Linux kernel’s Distributed Lock Manager (DLM) subsystem that can cause a NULL pointer dereference (NPD) when a positive value is written to the ’event_done’ interface. This type of flaw can lead to a kernel crash, potentially enabling a denial-of-service condition on affected systems. It is relevant to Azure environments running Linux-based virtual machines or services that depend on the kernel’s DLM component. ...

🟡 Medium | Source: Microsoft Security Response Center A vulnerability in the scp utility within OpenSSH versions prior to 10.4 can cause files to be written to a parent directory rather than the intended destination directory during remote-to-remote copy operations. This path traversal-style behaviour could result in files landing in unintended locations, potentially overwriting sensitive files or bypassing directory-based access controls. Microsoft has published this advisory in the context of Azure-hosted systems running affected OpenSSH versions. ...

🟡 Medium | Source: Microsoft Security Response Center A vulnerability in OpenSSH versions prior to 10.4 means that the internal SFTP subsystem only processes the first 9 command-line arguments, silently ignoring any beyond that. This could result in security-relevant arguments — such as those restricting file access or enforcing chroot — being overlooked, potentially weakening the intended security posture of SFTP connections. The issue is particularly relevant in environments where OpenSSH is deployed on Azure virtual machines or services. ...

🟡 Medium | Source: The Hacker News Meta has introduced Muse Image, an AI image generation tool that uses public Instagram photos and reels by default to create AI-generated content. Users can @-mention Instagram accounts to incorporate specific profiles into generated images. The opt-out nature of this feature raises significant privacy and consent concerns for individuals and organisations with public Instagram presences. Security Architect’s Take: Audit your organisation’s public Instagram accounts and review Meta’s privacy settings to opt out of Muse Image training and generation if this conflicts with your data governance or brand protection policies. Consider updating your social media acceptable use policy to address AI-generated content misuse of corporate imagery. ...

🟡 Medium | Source: The Register — Security A thief successfully stole a valuable trophy by posing as a Wi-Fi engineer carrying out legitimate repair work, exploiting the trust that people naturally extend to apparent service technicians. The incident is a real-world demonstration of pretexting — a social engineering technique where an attacker fabricates a convincing scenario to gain unauthorised access. It highlights how physical security can be bypassed simply through confident impersonation of a trusted role. ...

🟡 Medium | Source: The Hacker News A threat actor known as Lurking Lizard has been running a large-scale residential proxy network since at least August 2022, luring victims into downloading fake 7-Zip installers from over 230 lookalike domains. Once installed, the malware silently enrolls the victim’s device as a proxy node, effectively monetising their internet connection and IP address without their knowledge. This is significant because residential proxies are frequently abused to bypass geo-restrictions, conduct credential stuffing, and obscure the origin of other malicious activity. ...

🟡 Medium | Source: AWS What’s New AWS Security Hub has launched Network Scanning, a capability that actively probes your AWS and Azure resources from the internet to confirm genuine public reachability — going beyond theoretical reachability based on firewall rules alone. It identifies exposed IP addresses, virtual machines, load balancers, open ports, and running services, generating findings that Security Hub Exposures then correlates with other risk signals. This gives security teams confirmed attack surface visibility rather than relying solely on configuration analysis. ...

🟡 Medium | Source: The Register — Security Researchers have demonstrated a jailbreak technique against GitHub Copilot that bypasses its safety guardrails by embedding harmful instructions within code rather than natural language prompts. The flaw operates at the workflow level, meaning Copilot’s content filters can be circumvented by framing requests programmatically. This matters because organisations relying on Copilot’s built-in safeguards to prevent misuse may have a false sense of security. Security Architect’s Take: Review your AI acceptable-use policies and do not treat Copilot’s built-in content filters as a sufficient control boundary — consider supplementing with code review tooling, output scanning, and developer awareness training around AI jailbreak risks. ...

🟡 Medium | Source: AWS Security Blog System prompts in generative AI applications often contain sensitive proprietary information such as business logic, tool configurations, and role definitions. This AWS blog post addresses the risk of system prompt leakage — where an LLM is manipulated into revealing these instructions — and outlines architectural mitigations to reduce the impact when it occurs. As organisations deploy more AI-powered applications on AWS, understanding and designing around this risk is increasingly important. ...