Next.js Security Vulnerability: Middleware Bypass (CVE-2025-29927) Daily Security Review podcast

9:19

In this episode, we take an in-depth look at the newly discovered CVE-2025-4664 vulnerability in Google Chrome’s Loader component. This high-severity security flaw is affecting not only Chrome but also other Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi. The issue lies in insufficient policy enforcement within the browser’s Loader, enabling attackers to manipulate the referrer-policy and leak sensitive cross-origin data, potentially leading to full account takeovers. We discuss the technical details of the exploit, focusing on how attackers leverage the Link header to set the referrer-policy to unsafe-url, thus capturing full URLs with sensitive query parameters, such as OAuth tokens and session identifiers. These parameters, once intercepted, can give attackers unauthorized access to user accounts. The podcast also addresses the confirmed existence of active exploits "in the wild" and why immediate patching is crucial, particularly after Google’s emergency update for Chrome. With CVE-2025-4664 now included in CISA’s Known Exploited Vulnerabilities Catalog, the urgency of addressing this issue becomes even more pressing. We will also cover recommended mitigation strategies, including the need for secure HTTP headers, real-time traffic monitoring, and third-party resource audits to prevent exploitation attempts. Join us as we break down this critical vulnerability and provide actionable advice on how to stay secure in light of CVE-2025-4664.…

Daily Security Review

1
Scattered Spider Targets UK and US Retailers: The Growing Threat to Major Brands 11:52

16 hours ago11:52

11:52

In this episode, we dive deep into the recent wave of cyberattacks plaguing major UK retailers such as Marks & Spencer, Co-op, and Harrods, with a special focus on the threat group behind them: Scattered Spider (also known as UNC3944, Muddled Libra, and several other aliases). We'll explore how this loosely coordinated cybercriminal group has expanded its operations from targeting casinos to now focusing on the retail sector, including a growing presence in the US market. Scattered Spider’s unique blend of sophisticated social engineering tactics, including vishing, phishing, and MFA bypass strategies, has made them a formidable threat to retailers worldwide. Their use of the DragonForce ransomware—aimed at encrypting critical systems—has already disrupted operations, with significant impacts on M&S and Co-op, from stolen customer data to operational shutdowns. We'll also discuss the group's evolving tactics, such as rapid phishing domain rotation and "Rickrolling" as a means of evading detection, as well as their ability to operate even after arrests in late 2024. With retail under constant threat, we’ll highlight expert recommendations for bolstering defenses, from strengthening IT help desk protocols to improving MFA and phishing detection systems. Join us for a critical analysis of how Scattered Spider is reshaping the landscape of cybersecurity threats in retail and how organizations can take action to prevent falling victim to these increasingly sophisticated attacks.…

Daily Security Review

1
Proofpoint Acquires Hornetsecurity for $1B: A New Era in Microsoft 365 Security 10:18

19 hours ago10:18

10:18

In a major move within the cybersecurity space, Proofpoint has announced the acquisition of Hornetsecurity for over $1 billion. This deal significantly strengthens Proofpoint’s foothold in Microsoft 365 security, while expanding its reach into the small and mid-sized business (SMB) market through Hornetsecurity’s extensive network of managed service providers (MSPs) in Europe. In today’s episode, we break down how this acquisition enhances Proofpoint’s portfolio of AI-powered security solutions, including Hornetsecurity’s flagship product, 365 Total Protection. We dive into the strategic impact on SMBs and MSPs, explore the growing need for human-centric security, and discuss how this acquisition sets Proofpoint up for dominance in the Microsoft 365 security space. Plus, we analyze the ongoing trend of consolidation in the cybersecurity industry and what it means for the future of cybersecurity innovation.…

Daily Security Review

1
Exploited in the Wild: SAP NetWeaver Zero-Days Hit Fortune 500 22:55

3 days ago22:55

22:55

In this episode, we dive into the active exploitation of two critical zero-day vulnerabilities in SAP NetWeaver—CVE-2025-31324 and CVE-2025-42999. Threat actors have been leveraging these flaws since January 2025 to gain unauthenticated access, upload malicious web shells, and ultimately achieve remote code execution by chaining an insecure deserialization bug. With over 2,000 vulnerable SAP NetWeaver servers exposed online—including deployments at more than 20 Fortune 500 and Global 500 companies—the impact is massive. We break down how the attack chain works, the tools being deployed (like Brute Ratel), and what this says about modern supply chain security. We also examine the role of Chinese threat actor Chaya_004 and the response from the U.S. government, including CISA’s mandate for federal agencies to patch by May 20. Plus, we discuss SAP’s mitigation guidance and the broader implications of enterprise software zero-days in an increasingly hostile cyber threat landscape. Tune in to understand why this campaign could be one of the most consequential enterprise breaches of 2025—and what security teams must do now.…

Daily Security Review

1
Checkout Chaos: Inside the £3.5 Million-a-Day M&S Cyber-Shutdown 16:19

3 days ago16:19

16:19

The recent ransomware attack on Marks & Spencer (M&S) is a sobering example of the evolving cyber threat landscape confronting the retail industry. In this episode, we unpack how one of the UK's most iconic retailers fell victim to a sophisticated cybercriminal group known as Scattered Spider. This group, recognized for its advanced social engineering tactics, reportedly infiltrated M&S systems, stole customer data, and encrypted critical VMware ESXi infrastructure—disrupting store operations, wiping out millions in online revenue, and shaking investor confidence. We dive deep into how threat actors like Scattered Spider gain initial access—leveraging phishing, SIM swapping, MFA fatigue, and vishing—to breach even mature IT environments. The attackers exploited Active Directory and targeted virtual infrastructure, maximizing both disruption and ransom leverage. We also explore the anatomy of modern ransomware campaigns and how social engineering remains the single most effective tool in a hacker’s playbook. Beyond the breach, we discuss why retail is now the fourth most targeted sector, what technical and organizational defenses could have prevented this, and the regulatory consequences businesses face after a data leak. From the need for modern Active Directory security to the importance of incident response and breach notification protocols, this episode offers a comprehensive analysis—and practical takeaways—for CISOs, IT leaders, and security professionals across all industries.…

Daily Security Review

1
Targeted iOS Attacks: The Zero-Days Apple Had to Patch Fast 10:09

3 days ago10:09

10:09

In this episode, we break down Apple’s massive May 2025 security update blitz—a sweeping patch release that spanned iOS, macOS, iPadOS, tvOS, visionOS, and watchOS. The urgency? Two zero-day vulnerabilities, CVE-2025-31200 (Core Audio) and CVE-2025-31201 (Core Media), were already under active exploitation in what experts are calling “extremely sophisticated, targeted attacks.” We’ll dig into the technical details of these zero-days, explore who might be behind the attacks, and explain how they allowed malicious audio and media files to potentially execute arbitrary code on unpatched Apple devices. Beyond the zero-days, Apple’s updates patched over 30 serious vulnerabilities affecting components such as WebKit, CoreGraphics, AirDrop, and the Kernel. We’ll also examine new revelations: A side-channel attack dubbed SysBumps that bypasses kernel-level protections on Apple Silicon Macs Security enhancements in the Notes app aimed at preventing unauthorized access And the first-ever security update for Apple’s C1 modem—a possible sign of increasing focus on baseband-level threats. We also spotlight the researchers and red teams from around the world—including India, Korea, and China—whose findings were acknowledged in Apple’s advisories. If you're an Apple user, security analyst, or IT admin, this is a critical episode: we’ll tell you what’s been patched, what’s still concerning, and what you should do next.…

Daily Security Review

1
Texas vs Google: The $1.4 Billion Wake-Up Call for Data Privacy Violations 10:35

4 days ago10:35

10:35

In this episode, we unpack the groundbreaking $1.4 billion privacy settlement between Google and the state of Texas—now the largest of its kind in U.S. history. This isn't just about numbers; it's about how data privacy enforcement is shifting dramatically at the state level in the absence of federal legislation. We dive deep into the Texas Capture or Use of Biometric Identifier Act (CUBI), the cornerstone of this case, and explain how it mandates informed consent before companies can collect biometric data like voiceprints and facial geometry. You'll learn how Google’s alleged misuse of biometric data—combined with misleading claims about browser "incognito mode"—landed it in legal hot water. We also explore the growing global trend toward comprehensive data protection laws, including new regulations in India, Vietnam, and the Middle East, and how U.S. states are stepping in to fill the federal privacy gap. And if you've ever relied on "private browsing" for anonymity, think again—this episode reveals what incognito mode does and doesn’t protect you from. From biometric surveillance to browser misconceptions, we break down what this settlement means for consumers, companies, and the future of data governance—and why Texas has become the unlikely champion of digital privacy enforcement.…

Daily Security Review

1
Marbled Dust's Zero-Day Exploit: Unveiling a Türkiye-linked Espionage Campaign Against Kurdish Forces 9:40

4 days ago9:40

9:40

In April 2024, a sophisticated cyber espionage campaign orchestrated by the Türkiye-linked hacker group, Marbled Dust, began exploiting a previously unknown zero-day vulnerability in the Output Messenger platform—a self-hosted enterprise chat application. This vulnerability (CVE-2025-27920) resides in the Output Messenger Server Manager and allows attackers to upload malicious files, such as GoLang-based backdoors, facilitating extensive data exfiltration. The primary targets of this campaign are individuals and entities affiliated with the Kurdish military in Iraq, aligning with Marbled Dust's ongoing geopolitical focus. This podcast dives deep into the technical aspects of the attack, which begins with authenticated access to the vulnerable Output Messenger platform. Once inside, the threat actors exploit the directory traversal flaw to upload malicious scripts to the system’s startup folder, ensuring persistence through GoLang backdoors. We’ll explore how the group's new capabilities represent a shift in their technical prowess—signifying a departure from their prior reliance on known vulnerabilities and DNS manipulation to the use of a true zero-day exploit. We will also break down the security implications of such attacks, shedding light on the criticality of regular software patching, especially for enterprise applications that may not be as heavily scrutinized as other more popular platforms. The podcast will also cover Marbled Dust’s historical tactics, their continued evolution, and the need for enhanced security practices—especially in regions with high geopolitical stakes like the Middle East. How can organizations better secure their internal messaging systems and implement the necessary countermeasures? Tune in to get the full analysis and recommendations for defending against such sophisticated cyber espionage tactics.…

Daily Security Review

1
TeleMessage Exploit: Inside the Messaging Flaw That Hit Coinbase and CBP 14:14

4 days ago14:14

14:14

In this episode, we dissect CVE-2025-47729, a critical vulnerability in TeleMessage , a message archiving app recently thrust into the spotlight due to its use by former National Security Advisor Mike Waltz. Following Waltz’s controversial tenure—marked by the "Signalgate" leak and the subsequent appearance of TeleMessage on his phone—researchers uncovered a major flaw: a lack of end-to-end encryption between the app and its archive server. Hackers have exploited this flaw in the wild, accessing unencrypted chat logs—including internal communications from Coinbase and a list of Customs and Border Protection employees. The breach has raised red flags at the federal level, with CISA adding CVE-2025-47729 to its Known Exploited Vulnerabilities (KEV) catalog, mandating urgent action from federal agencies. We explore: How TeleMessage works and why it was adopted in sensitive government contexts What independent code analysis revealed about its flawed encryption model What was stolen—and what wasn’t—in the confirmed breaches Smarsh’s response and the suspension of TeleMessage services Why CISA is effectively advising users to stop using the app altogether Whether you’re in cybersecurity, compliance, or just concerned about how message archiving can become a liability, this episode lays out the facts—and the failures—behind the latest messaging app security scandal.…

Daily Security Review

1
Backdoored by ‘Cheap’ AI: How Fake npm Packages Compromised Cursor IDE 25:18

5 days ago25:18

25:18

A new supply chain attack has emerged—this time targeting macOS users of the Cursor AI code editor through rogue npm packages. In this episode, we break down how threat actors published malicious modules—sw-cur, sw-cur1, and aiide-cur—promising cheap access to Cursor's AI features. Once installed, these packages function as backdoors, stealing credentials, modifying critical application files like main.js, disabling updates, and granting persistent remote access. We’ll discuss how the attackers used social engineering tactics around “cost savings” to compromise trust, the technical breakdown of the malware’s behavior, and what this means for developers and enterprises relying on modern IDEs. With over 3,200 downloads before detection, this campaign represents a significant escalation in supply chain threats. Join us as we explore: The mechanics of the backdoor and how persistence was achieved The risks of lateral movement in enterprise CI/CD environments What this attack says about the future of developer-focused malware Real-world remediation steps and how to protect your development environments Whether you're a developer, CISO, or security researcher, this episode will give you a sharp look into a growing and deeply concerning attack vector.…

Daily Security Review

1
160,000 Victims Later: The Aspire USA Breach Under Valsoft’s Watch 9:23

5 days ago9:23

9:23

In this episode, we break down the February 2025 data breach that hit Valsoft Corporation, operating under the name AllTrust, through its subsidiary Aspire USA. Over 160,000 individuals are potentially impacted, with exposed data including Social Security numbers, driver’s license information, and financial account details. We explore how the breach unfolded over a three-day window, the steps Aspire took to interrupt an in-progress data transfer, and how long it took to notify affected individuals. We'll also examine the legal implications now facing Valsoft, including multiple law firm investigations and the potential for class action lawsuits. Additionally, we cover what this breach reveals about current cybersecurity practices in companies handling PII and how consumers can protect themselves when their data is exposed. From SOC2 compliance claims to the offer of free credit monitoring, we question whether the company’s response was adequate—or merely reactive. Was this breach preventable? And what can other companies learn from Valsoft’s handling of it? Tune in for a hard look at one of 2025’s most notable PII exposure incidents.…

Daily Security Review

1
rand-user-agent: The NPM Package That Opened a Backdoor 15:04

5 days ago15:04

15:04

In this episode, we break down the recent compromise of the rand-user-agent NPM package—an attack that quietly turned a once-trusted JavaScript library into a delivery mechanism for a Remote Access Trojan (RAT). The attacker exploited the package’s deprecated but still-popular status, publishing malicious versions that never appeared in the GitHub repo. We discuss how the threat actor used obfuscated code, off-screen whitespace tricks, and a Windows-specific PATH hijack to hide their RAT, which established a command-and-control (C2) channel capable of remote shell access, file uploads, and command execution. You’ll also hear how this incident fits into broader trends of CI/CD pipeline poisoning and software supply chain attacks—and what developers, security teams, and enterprises should do to avoid being the next target.…

Daily Security Review

1
PipeMagic, Procdump, and Privilege Escalation: Tracking the Windows CLFS Exploit Chain 19:21

9 days ago19:21

19:21

A zero-day vulnerability in the Windows Common Log File System (CLFS), tracked as CVE-2025-29824 , became the center of a global cybersecurity storm when it was exploited in the wild before Microsoft patched it on April 8, 2025. In this episode, we take a deep dive into how this elevation of privilege exploit allowed attackers to gain SYSTEM-level access and deploy ransomware payloads —including the RansomEXX family —across industries and continents. We’ll break down the exploitation timeline, reveal how the PipeMagic backdoor was used as a launchpad, and analyze how attackers injected malicious payloads into Windows processes like winlogon.exe to dump credentials and maintain persistence. Our discussion also covers attribution insights, with Storm-2460 and actors associated with Play ransomware identified as users of this exploit, underscoring how the tool may have circulated in underground channels before the patch. With insights from Microsoft, Symantec, Kaspersky, and Arctic Wolf, this episode unpacks the technical mechanism , post-exploitation behavior , and defensive recommendations , including why some versions of Windows 11 were immune and what security teams should do to harden their environments moving forward. Whether you're in IT, finance, software, or retail—this episode has vital intel on defending against emerging threats in a rapidly evolving ransomware landscape.…

Daily Security Review

1
Pegasus Spyware, WhatsApp v. NSO Group, and the Global Battle for Data Privacy 21:26

9 days ago21:26

21:26

In this episode, we dive deep into the legal, technical, and geopolitical implications of the U.S. court ruling in WhatsApp v. NSO Group —a landmark case in the global effort to hold spyware developers accountable. The conversation unpacks the court’s decision to award over $167 million in damages to WhatsApp for the unauthorized deployment of Pegasus spyware, highlighting violations of anti-hacking laws and terms of service. We explore how this ruling may impact the resilience of the commercial spyware industry, the potential chilling effect on investors, and the mounting legal pressures facing firms like NSO Group. We also examine the complexities of asserting jurisdiction in cross-border cyber cases, and why evidentiary sanctions—rather than clear precedents—still leave significant gaps in regulating spyware abuse. Beyond the courtroom, we discuss Pegasus's widespread reported use by state actors against journalists, activists, and political figures, and the serious human rights concerns this raises. The episode also connects the dots between spyware and the broader cybersecurity threat landscape, from ransomware to state-sponsored APT groups. Finally, we zoom in on the global regulatory response, spotlighting Indonesia’s newly enacted Personal Data Protection Law and how such frameworks are emerging worldwide to govern digital surveillance, data transfers, and privacy rights. This episode provides critical insight into how law, technology, and human rights intersect in the age of digital surveillance—and what’s next for global cybersecurity policy.…

Daily Security Review

1
How CodeAnt AI is Automating Code Reviews for 50+ Dev Teams 17:37

9 days ago17:37