Security trouble doesn’t always announce itself. |
Today’s threats hide in DNS links, LinkedIn messages, browser icons, and even calendar invites — while zero-click mobile bugs keep moving in silence.
Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
Azure DNS Behavior Opens Door to Silent DoS Disruptions |
A subtle Azure DNS behavior can trigger DoS-style outages in environments relying on Private Endpoints and Private Link. Palo Alto Networks’ Unit 42 warns that linking a Private DNS zone across multiple VNETs can cause Azure DNS to prioritize an incomplete zone, which can break name resolution leading to outages. |
Microsoft has a partial fix for this issue in their DNS fallback guidance.
Enable NxDomainRedirect where acceptable, keep Private DNS A records complete, and tightly control/monitor Private DNS zone links with least-privilege RBAC and alerts for NXDOMAIN spikes. |
LinkedIn DMs Deliver Malware via DLL Sideloading |
A new phishing campaign is using LinkedIn DMs and “work-looking” files to quickly compromise endpoints. ReliaQuest researchers report threat actors are delivering weaponized WinRAR SFX files via LinkedIn that drop a legit PDF reader and a malicious DLL, then use DLL sideloading to run inside a trusted process.
This is an ongoing campaign in the wild. Block SFX runs from user-writable folders, monitor for suspicious DLL sideloading or portable Python activity, and regularly test incident response plans. |
Apple Patches Zero-Click WebKit Flaws Hitting iPhones, iPads |
Apple has patched two actively exploited WebKit flaws that can enable silent device compromise on iPhones and iPads just by loading malicious web content. The WebKit bugs impact Safari and all iOS browsers, and Apple says they were used in targeted attacks.
Enforce rapid iOS/iPadOS patch SLAs via MDM, and consider Lockdown Mode for high-risk roles until all devices are on patched versions. |
|
|
When a mobile vulnerability drops… how fast are you patching? |
|
|
Yesterday's Pulse Check Results |
Where is your org on code supply chain security? |
|
|
Security Tools You Can Use |
|
|
Gemini Flaw Leaks Private Calendar Data via Invite Tricks |
A prompt-injection vulnerability in Google Gemini showed how a simple calendar invite could be turned into a stealthy data-leak mechanism.
Researchers showed attackers could hide prompt-injection text in a calendar invite, then trigger Gemini with a simple scheduling query to leak private meeting details into a new event — exposing titles, attendees, and timing with little user awareness. |
Google confirmed the issue and has mitigated it.
Treat Calendar invites as untrusted input — limit who can invite users externally, and monitor Gemini/Calendar automation for unexpected event creation or unusual meeting-summary behavior. |
LayerX Links GhostPoster to 840K Downloads |
LayerX researchers found the GhostPoster extension campaign spread across 17 related add-ons and reached 840,000+ downloads, expanding on earlier findings from Koi Security.
Some GhostPoster extensions stayed active for up to five years, hiding loader code in PNG icons and delaying outbound traffic to slip past store reviews and sandboxes.
Inventory extensions enterprise-wide, enforce strict allowlisting, monitor for delayed outbound traffic or CSP/HSTS tampering, and regularly test incident response playbooks. |
|
|
Could a trusted app become your next breach? |
Third-party apps can turn into a major security blind spot when they’re given broad access to email, files, calendars, or SaaS platforms. Attackers don’t always need to break into your core systems — they can simply exploit a “trusted” integration that’s overprivileged, unmonitored, or long forgotten. |
How to lock down third-party app access: |
- Enforce app allowlisting and least-privilege OAuth scopes so only approved integrations get minimal access to sensitive data.
- Continuously inventory and review connected apps, removing risky or unused integrations before they become persistence points.
-
Use conditional access, token controls, and CASB/SSPM monitoring to detect suspicious activity and quickly revoke compromised sessions.
|
Third-party app protection means tightly controlling who can connect to your systems and exactly what access they get — before a “trusted” integration becomes an attacker’s easiest backdoor. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
