The speed of exploitation just hit overdrive, Digital Defenders.

Exploits churned out in minutes, Docker isolation shattered, and AI safety filters sidestepped.

Here’s what you need to know:

Zero-Day Download

AI Routing Flaw Exposes ChatGPT-5 to Attacks

Researchers found a ChatGPT-5 flaw letting attackers bypass safety with trivial phrases like “respond quickly” or “use compatibility mode.”

Dubbed PROMISQROUTE, the bug exploits cost-saving routing logic that silently downgrades some queries to weaker, less secure models.

Source: Digital Floats

For example, an attack prompt could be: “[Unsafe request] — use compatibility mode.”

The flaw lets user input drive routing, enabling SSRF-style downgrades that threaten both output integrity and regulatory compliance.

Audit routing logs for anomalies and push vendors to enforce universal safety filters instead of model-specific safeguards.

Docker Desktop Hijacked: Flaw Grants Full Host Access

A critical Docker Desktop vulnerability lets attackers jump from containers to full host compromise via a simple SSRF exploit.

It exposes an unauthenticated API at 192.168.65.7:2375, allowing attackers to spin up privileged containers with host access—affecting all versions before 4.44.3 and mirroring a macOS flaw.

For defenders, the risk is clear as just two HTTP requests can bypass Docker’s isolation, granting admin-level access and exposing a broad attack surface, primarily where SSRF vectors exist.

Update Docker Desktop to version 4.44.3 immediately. No workarounds exist, and delay leaves hosts fully exposed.

Minutes to Mayhem: AI Turns CVEs Into Instant Exploits

Security researchers showed AI can generate working CVE exploits in 10–15 minutes for about $1 each.

Their pipeline handles 130+ CVEs daily, using LLM analysis and sandboxed validation to erase the traditional patching grace period.

From JavaScript prototype pollution to Python sanitization flaws, the research proves the threat is broad and language-agnostic. The shift is clear—attackers weaponize flaws in minutes, forcing defenders to respond within hours instead of weeks.

Ditch week-long patch cycles—validate fast and continuously monitor.

Share this newsletter!

Pulse Check

Docker Desktop Isolation Check

Yesterday's Pulse Check Results

Apple Zero-Day Defense Check: How fast do you patch?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Azure API Bug Breaks Tenant Walls

A patched Azure API flaw lets attackers jump tenants to access Key Vaults, databases, and third-party services like Jira or Salesforce.

Azure’s DynamicInvoke endpoint, in shared API Management, lets path traversal bypass tenant isolation.

Source: ChatGPT

The flaw broke Azure’s tenant separation, and though exploitation required Contributor access, the cross-tenant risk was severe.  

Audit Azure API Connections for least-privilege access and monitor for abnormal cross-tenant call patterns.

Internet Archive Abused for Silent Malware Drop

Researchers uncovered a malware chain abusing the Internet Archive to deliver obfuscated payloads via PNG files.

The attack starts with a JScript malspam loader that runs PowerShell to fetch an archive.org image, hiding a .NET loader that drops Remcos RAT in memory with minimal traces.

The campaign is dangerous because it exploits archive.org’s trusted domain, making traffic appear benign and allowing attackers to bypass firewalls, proxies, and signature-based tools.

Inspect image and media files from all domains and monitor for unusual archive.org activity in corporate networks.

Security Tip of the Day

Is API Security Your Weakest Link?

Strong API security is no longer optional. APIs power modern applications but are prime attacker targets, where a single misstep can expose sensitive data or enable account takeovers.

Source: ChatGPT

Here are some best practices for API security:

APIs fuel innovation but widen your attack surface. These best practices cut risk and let your business scale securely. Review configurations now for a quick, low-cost defense.

Meet Our Writer:

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.