Patch and prevention led the day. A critical flaw in Microsoft’s identity platform was fixed after researchers showed how crafted tokens could impersonate admins across tenants, as covered by The Hacker News. Meanwhile, Europe’s weekend airport disruptions traced to a ransomware hit on a shared ground‑handling system, underscoring supply‑chain risk across tightly coupled operations, according to BleepingComputer.
Platform and developer controls advance
Researchers detailed how legacy interfaces and token flows can unravel tenant boundaries in cloud identity. Entra ID was affected by a CVSS 10.0 issue involving actor tokens and the deprecated Azure AD Graph API, enabling cross‑tenant user impersonation and potential bypass of MFA and Conditional Access. Microsoft reports the bug was addressed in July with no customer action required, but organizations still using retired APIs face gaps in logging and tenant validation, per The Hacker News. The takeaway: inventory and retire legacy dependencies, review token usage, and tighten forensic visibility around identity calls.
Cloudflare introduced Cap’n Web, a lightweight RPC system for JavaScript runtimes that applies an object‑capability model, supports bidirectional calls, and pipelines promises to reduce round trips. The TypeScript library uses JSON with light encoding and pluggable transports (HTTP, WebSocket, postMessage), aiming to flatten request waterfalls without schema-heavy machinery, according to Cloudflare. By returning unforgeable capabilities rather than granting broad API access, the model can align with least‑privilege patterns in web apps.
Operational privacy and AI governance also saw updates. AWS expanded Contact Lens redaction to seven more languages, removing PII and sensitive data from transcripts and audio while preserving analytics context via placeholders. And CrowdStrike outlined how Falcon Cloud Security detects AI components in CI/CD, correlates build‑time findings with runtime inventory across major cloud AI services, and helps curb shadow AI by tying models and images to deployed workloads.
Advisories and exploitable techniques
ETH Zurich researchers disclosed VMScape, a practical Spectre v2 (branch target injection) exploit that leaks host memory from a default guest VM. Tests on AMD Zen 4 showed steady reads (~32 B/s), bypassing several defenses and affecting Zen 1–5, while newer Intel mitigations largely block this variant. The issue, tracked as CVE‑2025‑40300, already has a Linux kernel patch; enabling SEV/SEV‑SNP or TDX further reduces risk, per Kaspersky. For cloud operators, prompt patching and revisiting isolation assumptions around speculative execution remain prudent.
Separately, a proof‑of‑concept dubbed EDR‑Freeze shows how Windows Error Reporting can be abused from user mode to suspend antivirus and EDR processes. By racing WerFaultSecure’s minidump flow and pausing it mid‑operation, an attacker can leave a target process “frozen” without a driver. Detection should focus on anomalous WER activity targeting sensitive PIDs and correlations with Defender components, as reported by BleepingComputer.
CISA issued guidance after SonicWall identified unauthorized access to a subset of customer preference files in its MySonicWall cloud backups. While embedded credentials were encrypted, exposed metadata could enable device targeting. Customers should verify whether devices are flagged, rotate credentials, apply firmware updates, and follow the vendor’s containment steps, according to CISA. Heightened monitoring for downstream compromise is advised.
Supply-chain outages and breaches
A ransomware attack against external systems provider Collins Aerospace disrupted check‑in and boarding across multiple European airports by impacting the multi‑airline MUSE platform. Heathrow, Brussels, and Berlin were among the worst affected, with manual processing and delays extending into Monday as authorities and operators coordinated recovery, per BleepingComputer. Shared operational systems magnify the blast radius when compromised.
Stellantis confirmed data theft from a third‑party customer service platform, with contact information accessed; claims by an extortion group tie the incident to broader attacks on Salesforce customers leveraging techniques such as voice phishing and OAuth token abuse. The company is notifying affected customers and advising vigilance against phishing, according to BleepingComputer.
The American Archive of Public Broadcasting fixed an IDOR flaw that allowed restricted media downloads by manipulating request parameters. The vulnerability appears to have been exploited for years; the organization deployed a fix within 48 hours of notification and is assessing scope, per BleepingComputer. Robust server‑side authorization checks remain essential for media archives.
On the consumer front, a verified Steam game, Block Blasters, shipped a cryptodrainer that stole cryptocurrency from players and a fundraiser streamer. Investigators detailed droppers, a Python backdoor, and StealC usage, with estimated theft in the six‑figure range. Users are urged to reset passwords and migrate assets to new wallets, according to BleepingComputer.
Targeted campaigns and SEO poisoning
Check Point reports the Iranian‑linked Nimbus Manticore is expanding into Europe’s defense, telecom, and aerospace sectors with fake job lures. Custom tools such as MiniJunk and MiniBrowse support reconnaissance, exfiltration, and long‑term persistence, with recruitment‑themed spear‑phishing aimed at high‑value targets. Recommended defenses include rigorous verification of unsolicited hiring contacts, hardened email gateways, and EDR‑backed investigation, per Check Point.
Unit 42 identified Operation Rewrite, a wide SEO poisoning effort using BadIIS implants that hook IIS pipeline handlers to serve crawler‑optimized pages while redirecting real users to scams and payloads. Variants span native IIS modules, .NET handlers with 404 hijacking, and a PHP front controller, broadening reach across hosting stacks. Indicators and detection guidance are provided by Unit 42.
F6 tracks “ComicForm,” a phishing cluster hitting organizations in Belarus, Kazakhstan, and Russia with archive‑based loaders that drop the FormBook stealer, while NSHC describes “SectorJ149” targeting South Korean manufacturing and energy via script‑based delivery chains leading to Lumma, FormBook, and Remcos. Controls should include stricter attachment policies, scrutiny of scheduled tasks and Defender exclusions, and monitoring for suspicious credential exfiltration over HTTP POST, as documented by The Hacker News.