🕵️ RESEARCH & DEEP DIVES
Webinar: Forgotten Google Workspace third-party app access can lead to breaches
BleepingComputer and Material Security will host a webinar on how forgotten third-party integrations lead to Google Workspace breaches.- Applies to fast-growing companies using Google Workspace with connected third-party applications.
- Forgotten or overly permissive integrations can retain access to email, files, and contacts long after their original purpose ends.
- Attackers also gain access via social engineering rather than sophisticated exploits.
- Webinar on September 23, 2026 features Rajan Kapoor (Material Security) and Rick Fitzgerald (Fireside Consulting) examining real documented breaches.
- Sessions cover the first hours of a breach and which controls matter most for lean security teams.
Check Point finds covert cross-account ChatGPT data leak via shared JFrog Artifactory service
Check Point Research discovered a covert channel between ChatGPT code-execution containers of different accounts that let an attacker exfiltrate data from a victim's connected Gmail account.- Applies to ChatGPT users with code execution and connected apps such as Gmail, Google Drive, Microsoft Teams, and GitHub.
- A shared internal JFrog Artifactory instance exposed Item Properties API operations not isolated by account, turning package metadata into a cross-account 'shared clipboard'.
- Hidden instructions could be delivered via a malicious prompt, a shared conversation link, or a custom GPT; an ordinary message then triggered attacker tasks invisible in the response.
- In the proof of concept, ChatGPT read the victim's Gmail using existing permissions and relayed data to the attacker's account; conversation history and files could also be exfiltrated.
- OpenAI confirmed the issue was fixed by retiring the internal Artifactory service; the finding was distinct from the Black Hat lockout-based mechanism in the same infrastructure.
Border Patrol's 'Predictive Intelligence Targeting Teams' Analyze Americans' Financial Data to Trigger Traffic Stops
Border Patrol runs secretive predictive policing units called Predictive Intelligence Targeting Teams (PITT) that analyze Americans' financial activity and feed intelligence to local police who pull people over not suspected of any specific crime.- Applies to Americans driving in Border Patrol sectors; identified PITTs operate in the Spokane Sector (Washington, Canada border) and Laredo Sector (Texas, Mexico border).
- PITT analysts review law enforcement-sensitive databases including Americans' financial activity, flagging 'financial activity patterns commonly associated with illicit narcotics activity' in people with no evidence of a crime.
- In one case, a PITT analyst flagged a driver in Montana; local troopers stopped him under an obstructed license plate pretense and charged him with a DUI and possession with intent to distribute.
- The program also uses automatic license plate readers to track targets' movements, per an earlier AP investigation; CBP declined to say what financial data is monitored or whether warrants are obtained.
- Critics say the stops use parallel construction to cloak the real reason, since 'genuine probable cause cannot be synthetically generated'; a 2022 stop of Alek Schott in Texas found nothing after his car was torn apart.
Live Composer WordPress plugin through 2.1.18 vulnerable to PHP object injection
The Live Composer WordPress plugin is vulnerable to PHP object injection via deserialization of untrusted input in versions up to and including 2.1.18.- Affects sites running the Live Composer – Free WordPress Website Builder plugin, versions up to and including 2.1.18.
- Exploitable by authenticated attackers with Contributor-level access or higher via PHP object injection.
- The flaw stems from deserialization of untrusted input.
Hawtio-operator flaw exposes OpenShift Service CA key, enabling arbitrary client certificate minting
A flaw in hawtio-operator lets it act as a signing oracle by misusing the OpenShift Service CA private signing key.- Affects users of hawtio-operator running on OpenShift.
- The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace.
- It uses that key to mint client certificates with an attacker-controlled Subject CN, creating a signing oracle for arbitrary certificates.
Hawtio-operator ClusterRole grants cluster-wide secrets read/write across all namespaces
The hawtio-operator's ClusterRole grants broad secrets permissions across all namespaces, exposing a security flaw.- Applies to Kubernetes clusters running hawtio-operator
- Operator's ClusterRole grants secrets create, get, list, update, watch across all namespaces
- Operator nominally scopes usage via controller-runtime label-selector, but permissions remain cluster-wide
🕵️ RESEARCH & DEEP DIVES
Adobe fixes critical Magento zero-day exploited to backdoor servers — BleepingComputer
Hackers build AI frameworks for widescale credential theft — BleepingComputer
Microsoft: Windows Server 2025 changes causing app crashes — BleepingComputer
Party’s Over for Crypto Scammers Who Went on a Spending Spree After a $240 Million Bitcoin Theft — SecurityWeek
WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls — The Hacker News
What It Took to Reach 1 Billion Build Manifests — The Hacker News
FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials — The Hacker News
Beaver Builder Page Builder through 2.10.3.1 - Unauthenticated Arbitrary Shortcode... — CVE ThreatInt
WPML Multilingual CMS through 4.9.5 - Incorrect Authorization to Authenticated (Su... — CVE ThreatInt
Event Tickets and Registration through 5.27.4 - Missing Authorization to Unauthent... — CVE ThreatInt
Zephyr Project Manager through 3.3.205 - Authenticated (Custom+) Stored Cross-Site... — CVE ThreatInt
Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto a... — CVE ThreatInt
Libxml2: double-free/uaf in libxml2 python bindingsA flaw was found in libxml... — CVE ThreatInt
PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netmanPX4 Autopilot t... — CVE ThreatInt
PX4 Autopilot through 1.17.0 Use-After-Free in load_monPX4 Autopilot through ... — CVE ThreatInt
SiYuan before 3.8.2 Remote Code Execution via ClipboardSiYuan before 3.8.2 tr... — CVE ThreatInt
electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalA... — CVE ThreatInt
Local Privilege Escalation via Misconfigured Sudoers Entry in Horizon Securit... — CVE ThreatInt
XML External Entity (XXE) Injection in CyberELF NanoXMLThe API is prone to XM... — CVE ThreatInt
Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting) — Cloudflare Blog
Mars Security Launches Real-Time Intel-to-Detection Engine That Turns Live Threat Intelligence Into Backtested Detections in Minutes — Cyber Security News
• *Claude Mythos AI