The threat landscape is shifting fast, Digital Defenders. |
This week brings an actively exploited browser zero-day, silent CI/CD command injection, AI clusters under siege, long-dwell ransomware hiding in plain sight, and insider risks closer than you think.
Strap in — there’s a lot beneath the surface. |
|
| Here’s what you need to know: |
|
|
Emergency Chrome Patch Targets Actively Exploited Zero-Day |
Google issued an emergency Chrome update after confirming active exploitation of a new V8 zero-day vulnerability.
CVE-2025-13223 lets attackers trigger heap corruption via malicious HTML, prompting urgent warnings as more than two billion users remain exposed. |
Source: Growtika/Unsplash |
The patch is rolling out across all major platforms, with Google withholding specific technical details for now, and Chromium-based browsers like Edge, Brave, and Opera also requiring updates.
Update all browsers immediately and strengthen defenses by limiting risky web access, enforcing browser isolation, and monitoring endpoints for suspicious script or memory activity. |
Glob CLI Flaw Enables Silent Command Execution in CI Pipelines |
Researchers discovered a glob CLI command-injection flaw that lets attackers run arbitrary commands through maliciously crafted filenames.
CVE-2025-64756 affects glob versions 10.2.0–11.0.3 and threatens CI/CD workflows that handle untrusted files, putting millions of weekly users at risk. A patch has been released for the vulnerability.
Update to the patched glob version and strengthen CI/CD security by removing shell-based patterns, validating all filenames, isolating untrusted jobs, enforcing least-privilege, and continuous monitoring. |
ShadowRay 2.0 Campaign Hijacks AI Clusters via Ray Flaw |
A fast-expanding ShadowRay 2.0 campaign is exploiting CVE-2023-48022 in Ray to compromise exposed AI clusters and repurpose them for large-scale cryptomining.
Researchers warn that over 230,000 Ray servers are now exposed giving the threat actor a massive attack surface to exploit via Ray’s unauthenticated Jobs API for remote code execution, stealthy mining, and cluster-wide propagation. This is an ongoing attack in the wild.
Update and lock down Ray deployments, restrict public exposure, enforce least-privilege controls, and continuously monitor clusters for abnormal activity. |
|
|
When it comes to supply-chain abuse in CI/CD, your biggest weakness is… |
|
|
Yesterday's Pulse Check Results |
If your core cloud provider went down for 6 hours… what happens? |
|
|
Security Tools You Can Use |
|
|
Fake CAPTCHA Click Triggers Long-Dwell Akira Ransomware Breach |
A single fake CAPTCHA click triggered a 42-day Akira ransomware breach that slipped past nearly all security alerts.
The attack started with a ClickFix lure on a compromised automotive site, giving Howling Scorpius remote access for credential theft, lateral movement, and cloud backup destruction — activity missed for weeks due to EDR misconfigurations and weak detection rules. |
This incident highlights a broader problem: strong tools can’t offset poor alert tuning or weak identity and monitoring controls.
Strengthen defenses by tightening identity controls, segmenting critical systems, hardening endpoints and backups, and tuning detection rules. |
How HR Can Help Stop Insider Threats Before They Escalate |
A growing number of breaches now originate from within organizations, making HR a critical — yet often overlooked — line of defense against insider threats.
Because HR oversees hiring, access changes, employee behavior, and offboarding, the team is well-positioned to catch insider risks early — especially among contractors, remote hires, privileged roles, and departing staff.
Strengthen HR–IT coordination to monitor behavioral and access anomalies, enforce strict offboarding, and apply extra scrutiny to contractors, remote hires, and privileged roles. |
| |
AI and IoT are converging to transform how industries operate, from predictive analytics to real-time decision-making.
Join AI + IoT: The Future of Industrial Intelligence on December 4, 2025, at 1:00 PM ET, presented by RTInsights in partnership with SAS and TD SYNNEX. Learn how industrial and energy leaders are integrating AIoT to accelerate efficiency, improve security, and maintain a competitive edge in today’s fast-changing market. Be part of the future of industrial innovation.
|
|
|
Lock Down Your CI/CD Pipeline |
CI/CD pipelines are a fast-growing attack surface, with threat actors increasingly targeting build systems to inject malicious code or steal secrets. Because pipelines touch source code, credentials, and production infrastructure, a single compromise can silently corrupt your entire software supply chain. |
Source: Fotis Fotopoulos/Unsplash |
How to secure your CI/CD pipelines end-to-end: |
-
Enforce least-privilege access and scan for hardcoded secrets to reduce credential exposure and prevent attackers from escalating within the pipeline.
-
Require verified dependencies and generate SBOMs to ensure component integrity and protect against dependency hijacking or unexpected changes.
-
Enable build isolation and monitor pipeline behavior continuously to contain tampering attempts and detect suspicious activity early.
|
Securing your CI/CD pipeline is essential to safeguarding your entire engineering ecosystem. With strong access controls, automated checks, and continuous monitoring, teams can detect and contain silent compromises before they escalate. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
