Stay sharp, Digital Defenders.

If it runs in the cloud, hides in code, or lands in your inbox, it’s a potential threat. Today’s risks span AI infrastructure, messaging apps, and deep system backdoors. Assume nothing is safe by default.

Here’s what you need to know:

Zero-Day Download

DHS Launches $100M in Grants to Boost Local Cybersecurity

The Department of Homeland Security and FEMA are offering more than $100 million to help state, local, and tribal governments strengthen cyber defenses. The State and Local Cybersecurity Grant Program will distribute $91.7 million, with at least 80% going to local governments and 25% reserved for rural areas. 

Source: FEMA/DHS

The programs target network upgrades, cyber planning, incident response training, and hiring security personnel. Local governments, often the most vulnerable cyber entities, have faced a surge in ransomware and phishing attacks in recent years. 

Eligible orgs can apply via the FEMA GO portal. Don’t wait until the deadline—early, complete submissions with clear risk-reduction plans have a better chance of funding approval.

NVIDIA Triton Flaw Enables Remote AI Server Takeover

Researchers uncovered a chain of vulnerabilities in NVIDIA’s Triton Inference Server that could let unauthenticated attackers gain full control of AI servers. 

The exploit begins with a Python backend error leak, escalates through abuse of the shared memory API, and can lead to remote code execution. Risks include model theft, data breaches, output manipulation, and deeper network compromise. NVIDIA rolled out a fix in version 25.07, slamming the door on what researchers called a “one-two-three punch” of bugs. 

Organizations running Triton should update immediately and audit exposed instances. Never ignore verbose error messages in production environments—they can be the first link in a serious exploit chain.

Telegram Bot Network Fuels Global Data Theft Scheme

Experts uncovered a worldwide hacking operation that uses Telegram channels to steal and sell personal data. The Python-based PXA Stealer malware hides inside legitimate-looking software such as Haihaisoft PDF Reader and Microsoft Word 2013. 

Once installed, it can grab files from cryptocurrency wallets, online banking accounts, and other sensitive apps. Then, it automatically sends stolen data to private Telegram channels, where it is sold on underground markets like Sherlock.

Experts say to block suspicious Telegram connections, watch for unusual traffic, and be wary of software downloads that come with extra files you weren’t expecting.

Pulse Check

Could your organization detect malicious activity over messaging apps?

Yesterday's Pulse Check Results

Could your coworkers recognize a deepfake voice?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Mozilla Flags Phishing Scam Targeting Add-on Developers

Mozilla is warning add-on developers about a phishing scam that’s trying to swipe AMO account credentials.

Source: Mozilla Foundation

Researchers uncovered Plague, a crafty PAM-based Linux backdoor that allows attackers to bypass authentication, persist through system updates, and maintain a covert SSH connection. It’s been active in the wild since at least 2024, yet multiple samples uploaded to VirusTotal still showed zero detections.

Plague hides its tracks with layered obfuscation, hardcoded passwords, and environment tricks that wipe SSH session clues. Some versions even drop a cheeky quote from the movie Hackers.

Its deep hooks into core authentication make it hard to spot without targeted YARA scans and behavioral monitoring. Defenders should watch for rogue PAM modules and unexpected changes to libselinux.so.8.

Linux ‘Plague’ Backdoor Slips Past Logins and Stays Hidden

Experts discovered that North Korea’s Lazarus Group uploaded fake versions of popular developer tools to open source hubs like npm and PyPI. The malware posed as common tools for debugging, APIs, and command-line tasks.

Once installed, it stole credentials, profiled developer machines, and opened hidden access points inside company systems. The attacks spread quietly through automated build pipelines and affected thousands of environments.

Researchers say open source software is now a key target for state-backed hacking. Don’t install open-source packages blindly. Check publishers and scan for hidden code.

Rabbit season? Duck season? Doesn't matter.

Fortra’s Cloud Data Protection product line extends the capabilities of DLP from endpoint to the cloud, meaning the days of perimeter-based security are over. Organizations are now tasked with securing their multi-cloud environments without impacting their users' productivity.

Fortra’s Cloud Data Protection product line gives you visibility and control of your sensitive data in the cloud while enabling fast, secure access for your employees. Learn more and see a demo.

Security Tip of the Day

Make Identity Security Your Strongest Defense

In cloud-native environments, identity is the real perimeter. Over 90% of cloud accounts use less than 5% of their permissions, creating a huge pool of excess access that attackers can exploit. Stolen credentials are tied to 22% of breaches, making identity security a top priority.

Here’s how to reduce the risk:

Treat every cloud identity like a potential breach point and lock it down before it’s tested.

Meet Our Writer:

Greg Parker

Greg Parker is a cybersecurity and emerging tech writer who explores the intersection of digital risk, human behavior, and innovation across sensing and security technologies.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.