Read Time:5 Second
Cybercriminals are increasingly leveraging Atlantis AIO, which automates credential stuffing attacks across more than 140 platforms
Daily Archives: March 25, 2025
The AI Fix #43: I, for one, welcome our new robot overlords!
Read Time:30 Second
In episode 43 of The AI Fix, our hosts discover a robot that isn’t terrifying, a newspaper shuns journalists in favour of AI, Graham watches a robot dog learn to stand, an AI computer programmer develops a familiar attitude, and New York tries to stop its humans arming their robots.
Graham worries about AI vomit, a Norwegian man is falsely accused of murder by ChatGPT, and Mark looks at why we’re suddenly surrounded by news about robots.
All this and much more is discussed in the latest edition of “The AI Fix” podcast by Graham Cluley and Mark Stockley.
varnish-7.6.1-5.fc42
Read Time:13 Second
FEDORA-2025-b7f0c55e00
Packages in this update:
varnish-7.6.1-5.fc42
Update description:
Security: This update includes fix for VSV00015 aka CVE-2025-30346. Upstream considers this a low risk problem. For details, refer to https://varnish-cache.org/security/VSV00015.html.
USN-7371-1: FreeRDP vulnerabilities
Read Time:37 Second
Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory
operations. If a user were tricked into connecting to a malicious server, a
remote attacker could possibly use this issue to cause FreeRDP to crash,
resulting in a denial of service. (CVE-2024-32458)
Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory
operations. A remote attacker could possibly use this issue to cause
FreeRDP clients and servers to crash, resulting in a denial of service.
(CVE-2024-32459)
It was discovered that FreeRDP incorrectly handled certain memory
operations. If a user were tricked into connecting to a malicious server, a
remote attacker could possibly use this issue to cause FreeRDP to crash,
resulting in a denial of service. (CVE-2024-32659, CVE-2024-32660)
NIST Warns of Significant Limitations in AI/ML Security Mitigations
Read Time:5 Second
NIST has urged more research and emphasis on developing mitigations for attacks on AI and ML systems
China-Linked Weaver Ant Hackers Exposed After Four-Year Telco Infiltration
Read Time:5 Second
Sygnia has uncovered Weaver Ant, a Chinese threat actor that spied on telecommunications networks for years
Dark Web Mentions of Malicious AI Tools Spike 200%
Read Time:4 Second
Kela researchers detect a 200%+ increase in dark web chatter about malicious AI tools
Report on Paragon Spyware
Read Time:1 Minute, 43 Second
Citizen Lab has a new report on Paragon’s spyware:
Key Findings:
Introducing Paragon Solutions. Paragon Solutions was founded in Israel in 2019 and sells spyware called Graphite. The company differentiates itself by claiming it has safeguards to prevent the kinds of spyware abuses that NSO Group and other vendors are notorious for.
Infrastructure Analysis of Paragon Spyware. Based on a tip from a collaborator, we mapped out server infrastructure that we attribute to Paragon’s Graphite spyware tool. We identified a subset of suspected Paragon deployments, including in Australia, Canada, Cyprus, Denmark, Israel, and Singapore.
Identifying a Possible Canadian Paragon Customer. Our investigation surfaced potential links between Paragon Solutions and the Canadian Ontario Provincial Police, and found evidence of a growing ecosystem of spyware capability among Ontario-based police services.
Helping WhatsApp Catch a Zero-Click. We shared our analysis of Paragon’s infrastructure with Meta, who told us that the details were pivotal to their ongoing investigation into Paragon. WhatsApp discovered and mitigated an active Paragon zero-click exploit, and later notified over 90 individuals who it believed were targeted, including civil society members in Italy.
Android Forensic Analysis: Italian Cluster. We forensically analyzed multiple Android phones belonging to Paragon targets in Italy (an acknowledged Paragon user) who were notified by WhatsApp. We found clear indications that spyware had been loaded into WhatsApp, as well as other apps on their devices.
A Related Case of iPhone Spyware in Italy. We analyzed the iPhone of an individual who worked closely with confirmed Android Paragon targets. This person received an Apple threat notification in November 2024, but no WhatsApp notification. Our analysis showed an attempt to infect the device with novel spyware in June 2024. We shared details with Apple, who confirmed they had patched the attack in iOS 18.
Other Surveillance Tech Deployed Against The Same Italian Cluster. We also note 2024 warnings sent by Meta to several individuals in the same organizational cluster, including a Paragon victim, suggesting the need for further scrutiny into other surveillance technology deployed against these individuals.
IngressNightmare: Four Critical Bugs Found in 40% of Cloud Systems
Read Time:4 Second
Wiz Security finds four critical RCE vulnerabilities in the Ingress NGINX Controller for Kubernetes
ZDI-25-176: (0Day) CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability
Read Time:17 Second
This vulnerability allows local attackers to escalate privileges on affected installations of CarlinKit CPC200-CCPA devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-2762.