No holiday breaks for hackers, Digital Defenders. |
Ransomware that erases backups. Zero-days that crash core systems. Malware that steals secrets with AI’s help. The attacks aren’t slowing down… and neither can the defenders.
Before we jump into the news… We’re running a quick survey on how teams defend against injection attacks. Your input will help shape future coverage—and it takes less than a minute to complete. |
|
| Here’s what you need to know: |
|
|
Silent Takeover: Nvidia AI Tool Bug Hits Windows, Linux, MacOS |
A critical flaw in Nvidia’s NeMo Curator platform (CVE-2025-23307) could let attackers execute malicious code and escalate privileges on Windows, Linux, and macOS systems.
The improper input validation flaw affects all versions before 25.07, with a CVSS score of 7.8, posing a risk of compromise, tampering, and data loss in AI deployments. |
Although requiring local access, its low complexity makes it a potential danger. Nvidia has released a fix for the vulnerability in version 25.07.
To reduce exposure, organizations should patch, restrict local access, and tighten controls to limit lateral movement in hybrid AI environments. |
Kea DHCP Under Fire: One Packet, Total Disruption |
A high-severity flaw in ISC’s Kea DHCP server (CVE-2025-40779) lets attackers crash DHCPv4 with a single crafted packet.
Affecting versions 2.7.1–2.7.9, 3.0.0, and 3.1.0, the CVSS 7.5 flaw enables unauthenticated DoS attacks that can disrupt IP assignments, potentially leading to widespread outages and business disruptions for enterprises relying on DHCP. The company has released a patch.
Security teams should upgrade to Kea 3.0.1 or later, test DHCP failover clusters, and monitor after upgrading to ensure resilience before attackers strike. |
Zero Day Threat Hits FreePBX Admin Panels |
Attackers are exploiting a zero day vulnerability in FreePBX 16/17, specifically in Endpoint Manager, to gain remote code execution via exposed admin panels.
Exploits enable unauthenticated PBX takeover. Systems exposed on ports 80/443 face the highest risk, making immediate lockdown essential until a permanent fix is released. FreePBX released a statement recommending limiting access to "only known trusted hosts."
Admins should block external ACP access, apply the Edge update, scan for compromise, and verify lockdown by testing ACP from an untrusted network. | |
|
How strong is your input validation? |
|
|
Yesterday's Pulse Check Results |
Where’s your biggest exposure? |
|
|
Security Tools You Can Use |
-
Who’s selling your identity right now? Incogni forces data brokers to delete your personal information… before scammers can exploit it.
-
What’s hiding in your network? ManageEngine uncovers flaws you can’t see—until attackers do.
- Which device is your weakest link? NinjaOne MDM shows you, then locks it down before it’s a problem.
|
|
|
Microsoft Exposes Storm-0501’s Cloud Data-Wiping Attacks |
Microsoft reports Storm-0501 has moved ransomware to the cloud, using a “steal-and-destroy” model that exfiltrates data before wiping backups and resources.
By eliminating recovery options, this tactic forces ransom or loss—starting with MFA-lacking AD accounts synced to Entra ID, then escalating to exfiltration via AzCopy, and wiping vital cloud backups. |
Microsoft urges MFA, strict least privilege, and resource locks with immutability protections.
Security teams should immediately audit high-privilege accounts to ensure they’re cloud-native and protected with strong MFA. |
Malware in NX Tool Steals Secrets via AI Scans |
Over 1,400 developers discovered that recent NX build tool releases contained a post-install script that exfiltrated sensitive data. The malware silently created GitHub repositories named s1ngularity-repository, dumping API keys, wallet files, npm credentials, and environment variables into public commits.
Using Claude or Gemini CLIs, the attack evades detection to steal data, endangering code and credentials. NX has pulled the versions, but users must delete rogue repositories, upgrade to 21.4.1 or later, and rotate secrets.
Proactively defend by auditing post-install scripts in CI/CD to catch hidden malware before production. |
|
|
Code Injection Flaws Open Doors for Attackers |
Injection attacks are among the most frequently exploited flaws, allowing attackers to steal data, escalate privileges, or seize control of systems… often with just a single malicious input.
AI-driven exploit kits enable attackers to scan and target flaws at scale, making even minor oversights potentially catastrophic. Input validation and defense against injection attacks must be core security priorities. |
How to shut down injection threats: |
-
Use prepared statements to block SQL injection.
- Sanitize input by stripping or escaping dangerous characters.
- Whitelist valid input and reject all other input.
-
Deploy a WAF to detect and block common injection payloads.
- Log and monitor unusual input patterns in real time.
- Leverage secure frameworks with built-in validation.
|
Strong input validation is a frontline defense against more severe attacks. Layering these practices shrinks your attack surface and keeps critical systems resilient against evolving injection threats. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
