The shadows are shifting, Digital Defenders. |
This week delivers exposed accounts, LLM misfires, weaponized IoT, stealthy browser flaws, and global cyber crackdowns. Buckle up… some threats are moving beyond the screen. |
|
|
Here’s what you need to know: |
|
|
WhatsApp Flaw Exposes 3.5 Billion User Accounts |
A flaw in WhatsApp’s contact discovery feature let researchers scrape data from 3.5 billion phone numbers.
The vulnerability lets attackers confirm accounts and pull profile photos and status text at massive scale, proving that even low-sensitivity metadata can become dangerous. |
Although Meta has since deployed fixes, the event underscores the ongoing risk of abused convenience features.
Tighten privacy settings, reduce phone-number reliance, enforce strict rate limits, minimize exposed metadata, harden API authentication, monitor for unusual lookup activity, and run regular audits. |
CrowdStrike Finds Bias Undermines DeepSeek-R1 Code Security |
A new CrowdStrike analysis shows DeepSeek-R1 generates far more insecure code when prompts include politically sensitive terms — even when the coding task is unrelated.
Researchers found that prompts referencing Tibet, Falun Gong, or the Uyghurs increased severe vulnerabilities in code by nearly 50%. They also uncovered a built-in “kill switch” and erratic failures that bypass authentication or hard-code secrets, showing how political bias can distort routine development. Test LLMs in real environments, add guardrails and code scanning, segment high-value repos, use model diversity, monitor for anomalous outputs, enforce prompt governance, and audit dependencies. |
Nation-State Hackers Turn Corporate Systems Into Targeting Tools |
A new Amazon Threat Intelligence report shows nation-state groups increasingly leveraging hacked commercial systems — from ship controls to CCTV — to enable real-world military strikes.
Iranian-linked operators used hijacked vessel telemetry and live camera feeds to refine missile targeting, proving routine intrusions can now directly enable kinetic strikes. The takeaway — any internet-exposed device, regardless of perceived importance, can become a battlefield asset, putting even non-geopolitical organizations at risk if their systems provide useful visibility.
Harden exposed IoT and OT systems, enforce strict access controls, use encrypted communication, monitor for abnormal activity, apply anomaly detection, share intelligence, and test defenses with red-team exercises.
|
| |
If an attacker pivoted through an IoT device today, what happens next? |
|
|
Yesterday's Pulse Check Results |
When it comes to supply-chain abuse in CI/CD, your biggest weakness is… |
|
|
Security Tools You Can Use |
-
Streamline AD workflows with PowerShell automation and save 74% today.
- Get ahead of threats by pinpointing the tools that secure your environment.
-
Find weaknesses fast with top-tier vulnerability management tools.
|
|
|
Comet Browser Flaw Enables Hidden Local Command Execution |
A newly uncovered vulnerability in Perplexity’s Comet browser shows hidden, undocumented extensions could run local system commands without users knowing or consenting.
Researchers discovered that Comet’s private MCP API bypasses core browser security, effectively removing the sandbox that prevents arbitrary code execution. |
There are no reports of this being exploited in the wild.
Block or quarantine Comet browser for now, enforce strict app controls, audit endpoints for hidden extensions or command activity, monitor network traffic, apply zero-trust segmentation, vet AI tools for undocumented capabilities, and use outbound allow-listing. |
Allies Sanction Russian Cyber Network Behind Global Attacks |
Western governments have jointly sanctioned Media Land, a Russian bulletproof hosting network accused of enabling ransomware, phishing, and infrastructure attacks across the UK, US, and Australia.
Officials say Media Land’s infrastructure let groups like LockBit and Black Basta operate with near-total anonymity, contributing to £14.7 billion in UK cyber losses last year. The sanctions reflect a broader push to dismantle not just threat actors, but the infrastructure that fuels their campaigns.
Review threat-intel feeds and block known bulletproof hosting ASNs and IP ranges to preempt infrastructure-based attacks before they hit your perimeter. |
|
|
From threat detection to AI security, see how AWS and AWS Partners build trusted, secure solutions—live at AWS re:Invent. |
|
|
How Safe Are Your Connected Devices? |
The surge of smart devices across homes and enterprises has opened a vast, often invisible attack surface. From cameras to HVAC sensors, IoT systems are being weaponized in modern attacks — and many organizations don’t even know what’s connected. Locking down these devices matters now more than ever. |
Source: Andrey Matveev/Unsplash |
How to harden IoT devices: |
-
Segment and control device access: isolate IoT devices on their own networks and enforce zero-trust authentication to limit lateral movement.
-
Maintain visibility and hygiene: keep a continuous inventory of connected devices and ensure firmware is consistently updated to patch vulnerabilities.
- Secure and monitor communications: use encrypted protocols and behavioral monitoring to detect suspicious traffic or signs of compromise.
|
Consistently applying these practices builds cyber resilience, ensuring that no overlooked device becomes the weak link attackers rely on to gain a foothold. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
