Alright team, it's been a pretty packed 24 hours in the cyber world! We've got some critical RCE vulnerabilities under active exploitation, a deep dive into North Korean "quishing" tactics, and a major regulatory crackdown on AI-generated deepfakes. Let's get into it:

Critical RCE Vulnerabilities Under Active Exploitation ⚠️

- HPE OneView (CVE-2025-37164), a privileged IT infrastructure management platform, has a maximum-severity RCE flaw (CVSS 10.0) that's actively being exploited. Patching is critical as compromise grants centralised control over an organisation's infrastructure.
- The React2Shell vulnerability (CVE-2025-55182), affecting React frameworks like Next.js, allows unauthenticated RCE in default configurations. Vercel, a key maintainer, coordinated a massive industry response, paid out $1M in bug bounties for WAF bypasses, and has blocked over 6 million exploit attempts since disclosure.
- China-linked threat actors were exploiting three VMware ESXi hypervisor escape zero-days (CVE-2025-22224, -22225, -22226) for over a year before VMware publicly disclosed them in March 2025. Initial access was via a compromised SonicWall VPN, leading to VM escape and RCE on the hypervisor.
- Trend Micro Apex Central for Windows has a critical RCE flaw (CVE-2025-69258, CVSS 9.8) allowing unauthenticated remote attackers to load malicious DLLs with SYSTEM privileges. Two other DoS flaws (CVE-2025-69259, -69260) were also patched.

🌑 Dark Reading | https://www.darkreading.com/vulnerabilities-threats/maximum-severity-hpe-oneview-flaw-exploited
🤫 CyberScoop | https://cyberscoop.com/vercel-cto-security-react2shell-vulnerability/
📰 The Hacker News | https://thehackernews.com/2026/01/trend-micro-apex-central-rce-flaw.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/09/china_esxi_zerodays/

North Korean Hackers Adopt "Quishing" Tactics 🎣

- The FBI has warned that North Korean state-sponsored threat actors, specifically the Kimsuky group (APT43), are using malicious QR codes ("quishing") in spear-phishing campaigns.
- These QR codes redirect victims to attacker-controlled pages (e.g., fake Microsoft 365, Okta, VPN portals) to steal credentials and session tokens, effectively bypassing MFA and traditional enterprise security controls.
- The tactic leverages unmanaged mobile devices, which often lack the same EDR and network inspection capabilities as corporate machines, making it a high-confidence, MFA-resilient identity intrusion vector.

📰 The Hacker News | https://thehackernews.com/2026/01/fbi-warns-north-korean-hackers-using.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/09/pyongyangs_cyberspies_are_turning_qr/

Fake AI Chrome Extensions Steal User Data 🤖

- Malicious Google Chrome extensions, masquerading as legitimate AI tools from "AItopia" (e.g., "ChatGPT for Chrome with GPT-5..."), have stolen LLM conversations and browser data from over 900,000 users.
- These extensions exfiltrated sensitive data like proprietary source code, business strategies, confidential research, full URLs from all tabs, and search queries to command-and-control servers.
- This "prompt poaching" highlights the growing attack surface of LLM-powered applications and the risk of installing extensions from unknown sources, even if they appear "Featured" in the Chrome store.

🌑 Dark Reading | https://www.darkreading.com/cloud-security/fake-ai-chrome-extensions-steal-900k-users-data

Grok AI Deepfake Controversy and Data Privacy ⚖️

- Elon Musk's Grok AI has faced severe backlash for generating sexualised deepfakes, including of children, leading to calls from UK government officials, US senators, and EU regulators for action.
- UK ministers are weighing a ban on X (formerly Twitter) and its AI tools under the Online Safety Act, while US senators have urged Google and Apple to remove the X and Grok apps from their stores for violating terms of service.
- X has limited image generation to paying subscribers, but critics argue this monetises illegal content and doesn't solve the underlying issue, with reports suggesting the feature remains accessible to free users.
- Separately, the California Privacy Protection Agency (CPPA) fined data broker Datamasters $45,000 for selling sensitive health information (e.g., Alzheimer's patients) and other personal data without proper registration, ordering them to cease sales in California.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/09/grok_image_generation_uk/
🗞️ The Record | https://therecord.media/lawmakers-call-on-app-stores-to-remove-grok-x
🤫 CyberScoop | https://cyberscoop.com/senators-ask-apple-google-remove-x-after-grok-ai-sexual-deepfakes/
🗞️ The Record | https://therecord.media/ccpa-fines-data-broker-selling-lists-alzheimers

CISA Sunsets Emergency Directives & NSA Leadership Changes 🏛️

- CISA has retired 10 emergency directives issued between 2019 and 2024, citing successful implementation or redundancy due to the comprehensive Known Exploited Vulnerabilities (KEV) catalog. This reflects an evolving approach to federal cybersecurity.
- Tim Kosiba has been appointed as the new Deputy Chief of the National Security Agency (NSA), following a previous candidate's withdrawal due to political pressure. Kosiba brings over three decades of government experience to the role.

🗞️ The Record | https://therecord.media/cisa-sunsets-10-emergency-directives
📰 The Hacker News | https://thehackernews.com/2026/01/cisa-retires-10-emergency-cybersecurity.html
🗞️ The Record | https://therecord.media/timothy-kosiba-nsa-new-deputy-chief

CrowdStrike Acquires SGNL for Identity Security 🔒

- CrowdStrike has acquired identity security startup SGNL for $740 million, aiming to bolster its Falcon cloud security platform with "context-aware authorization" for human, machine, and AI agent identities.
- This acquisition addresses the increasing threat of identity-based attacks and the proliferation of non-human identities, providing dynamic privilege management and real-time access evaluation.
- The deal highlights the growing importance of identity as a primary control plane in major security platforms, moving beyond just detection to being in the path of access.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/crowdstrikes_740m_sgnl_deal_proves/

France-Russia Prisoner Swap Involving Alleged Cybercriminal 🌍

- France released Daniil Kasatkin, a Russian basketball player accused by the US of aiding ransomware negotiations for a major cybercrime outfit impacting 900 victims, in exchange for French conflict researcher Laurent Vinatier, imprisoned in Russia.
- This "Putinswap" highlights the geopolitical dimension of cybercrime, where alleged cybercriminals can become bargaining chips in international diplomacy.
- Kasatkin had been in French custody since June 2025, wanted by US officials for his alleged role in ransomware attacks between 2020-2022.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/09/alleged_russian_ransom_payment_negotiator/

#CyberSecurity #ThreatIntelligence #Vulnerabilities #RCE #ZeroDay #Kimsuky #APT43 #Phishing #Quishing #AI #Deepfake #DataPrivacy #RegulatoryCompliance #CISA #NSA #IdentitySecurity #CrowdStrike #Geopolitics #Ransomware

CrowdStrike acquires identity protection startup SGNL for $740 million, aiming to enhance AI-driven identity security as cyber threats grow more sophisticated.
#YonhapInfomax #CrowdStrike #SGNL #Acquisition #IdentitySecurity #ArtificialIntelligence #Economics #FinancialMarkets #Banking #Securities #Bonds #StockMarket
https://en.infomaxai.com/news/articleView.html?idxno=99042

So "Zero Standing Privileges" is really just a different way of saying "Just in time privilege escalation" yes?

I hate marketing.

#crowdstrike #sgnl #stopusingvaguemarketingterms

Mich beschleicht das Gefühl, dass jeder mausclick über #zscaler nach #crowdstrike geschickt wird, dort in eine Warteschlange gerät und noch mal mit KI und danach manuell geprüft wird, dann wieder zurück über #tata und #VPN zum Arbeitsplatz geschickt wird, damit das Programm schon 40 Sekunden später startet.
Manchmal habe ich das dann gleich 4 mal offen, weil nicht einmal eine Mini Animation Feedback gibt dass der click erfolgreich war.
#zukunftistjetzt #dystopisch

@InfobloxThreatIntel what are 'legit' binaries, how can they be malware with sim checksums and stuff? #binary defense #edr #crowdstrike

Wenn IT-Sicherheit zum Risiko wird: Das Phänomen der Cyber-Seneszenz

Sicherheit wurde zum Umsatzmodell einer schnell wachsenden Branche, die darauf angewiesen ist, dass Software schwach bleibt.

https://www.all-about-security.de/wenn-it-sicherheit-zum-risiko-wird-das-phaenomen-der-cyber-seneszenz/

#itsecurity #cybersecurity #hackers #crowdstrike #nis2 #dora

(Не) безопасный дайджест New Year Edition: пивной ИБ-кризис, бессердечный скам, ИИ наивные и опасные

В 2025-м произошло много интересных ИБ-инцидентов и новостей. Традиционно в канун Нового года попросили нашего начИБ Алексея Дрозда (aka @labyrinth ), поделиться его личным топом самых запомнившихся ИБ-событий года.

https://habr.com/ru/companies/searchinform/articles/979816/

#утечка #дайджест #инсайдер #asahi #crowdstrike #инцидентыиб

美企推動AI策略，2025年為此裁員近5.5萬人

中央通訊社 2025-12-23 10:22:00 CST

#Hiring Senior Enterprise #Security Engineer in #London - referrals and reposts appreciated 🙏 you get to work with the amazing Kevin Dawson Rachid Amouche 🪄
As a Senior Enterprise Security Engineer, you will be a foundational architect of Navan’s security posture, directly safeguarding our corporate infrastructure, sensitive financial data, and global user base. This is a highly hands-on, configuration-driven role that requires working directly with systems that power our security program in a modern, cloud-native environment.

Your work will be critical in ensuring Navan becomes globally recognized for secure, unparalleled corporate travel and expense management.
What You’ll Do

Threat Detection & Automation: Architect and execute the end-to-end security pipeline, including developing advanced detection logic (TTPs), refining alerting in SIEM platforms, and building robust, efficient automation playbooks in SOAR to reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).
Identity Governance & Access Control: Define and enforce strong IAM principles (e.g., Least Privilege, Zero Trust) and contribute to identity governance platforms to ensure secure authentication, authorization, and access across the enterprise.
Email Security: Strengthen email security by managing alerts and workflows in platforms like Material Security, reviewing post-delivery threats, and improving automated response to suspicious messages and mailbox activity.
Cross-Functional Security Leadership: Proactively partner with Engineering, IT, and Compliance teams to embed security best practices early in the lifecycle and align security controls with business risk objectives.
Process Improvement: Participate actively in incident reviews, contribute to security process improvements, and work with external vendors to align system capabilities and security expectations.

What We’re Looking For

5+ years of hands-on experience in information or enterprise security, preferably within a high-growth tech environment utilizing cloud infrastructure #AWS #Azure #GCP)
You possess deep, up-to-date knowledge of modern attacker tactics, techniques, and procedures (TTPs) and excel at translating complex technical risk into clear business context for a range of stakeholders.
Demonstrated expertise in developing detections, alerting logic, and monitoring improvements using SIEM platforms (e.g., Splunk, Sentinel, Elastic).
Expert comfort interpreting endpoint telemetry and supporting investigations using EDR/XDR technologies (e.g., #CrowdStrike Defender).
Proven ability to build and maintain automation through SOAR workflows (e.g., Phantom, Demisto, XSOAR) to improve investigation and response efficiency.
Demonstrated expertise in Zero Trust principles, modern identity governance, and access management solutions (e.g., Okta, Ping, or Azure AD).
https://www.linkedin.com/jobs/view/4343049441 #jobs #Infosec

CrowdStrike rolls out Falcon AI Detection and Response as AI prompts become the new attack surface

https://fed.brid.gy/r/https://nerds.xyz/2025/12/crowdstrike-falcon-ai-detection-response/

CrowdStrike CEO George Kurtz announced the company's full integration with AWS, positioning CrowdStrike as a leading cloud security platform and highlighting its growing role in national cybersecurity.
#YonhapInfomax #CrowdStrike #AWS #Cybersecurity #GeorgeKurtz #SIEMSolution #Economics #FinancialMarkets #Banking #Securities #Bonds #StockMarket
https://en.infomaxai.com/news/articleView.html?idxno=94001

Insider threats aren’t theoretical anymore—they’re happening inside organizations just like yours.

This week on Cyberside Chats, Sherri and Matt break down major insider cases—from the new CrowdStrike leak and DigitalMint ransomware indictments to Tesla’s multi-year insider problems, and the crackdown on North Korean operatives using stolen identities to get hired.

Attackers are buying, recruiting, and embedding insiders faster than organizations are adapting their defenses.

Watch this week’s full episode for actionable strategies to reduce your organization’s risk.

Watch: https://youtu.be/s7QW_BkkAvM

Listen: https://www.chatcyberside.com/e/when-security-fails-crowdstrike-insider-leaks-and-the-threat-within/?token=80d65859eee83d3963239e2310e4d035

#Ransomware #InsiderThreats #Cybersecurity #CrowdStrike #DigitalMint #Tesla #Cyberaware #Infosec

#Microsoft will #Windows :windows: -Treiber sicherer machen | Security https://www.heise.de/news/Microsoft-will-Windows-Treiber-sicherer-machen-11085721.html #MicrosoftWindows #Crowdstrike

Trong bối cảnh sự cố #CrowdStrike, một nhà phát triển đang xây dựng giải pháp EDR mới với kiến trúc User-Mode, ưu tiên ổn định và tự phục hồi, tránh sập hệ điều hành. MVP sắp hoàn thành. Anh ấy tìm kiếm đầu tư để mở rộng dự án.
#EDR #Cybersecurity #Startup #BảoMật #KhởiNghiệp #Stability

https://www.reddit.com/r/SaaS/comments/1p87rwq/building_a_usermode_edr_alternative/

Le top 5 des actus cybersécurité -26 nov 2025
https://dcod.ch/2025/11/26/le-top-5-des-actus-cybersecurite-26-nov-2025/

#Infosec #Security #Cybersecurity #CeptBiro #Top5 #FailleAPI #WhatsApp #RouteuraAsus #Asus #Gainsight #CrowdStrike #Azure

Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’

https://krebsonsecurity.com/2025/11/meet-rey-the-admin-of-scattered-lapsus-hunters/

#U.S.CentersforDiseaseControlandPrevention #ScatteredLAPSUS$Hunters #cybero5tdev@proton.me #Ne'er-Do-WellNews #SchneiderElectric #Cyb3rDrag0nzTeam #SaifAl-DinKhader #ALittleSunshine #ScatteredSpider #OrangeRomania #BreachForums #ShinyHunters #Breadcrumbs #CrowdStrike #Disney/Hulu #SentinelOne #ShinySp1d3r #Ransomware #Flashpoint #Hikki-Chan #Telefonica #o5tdev

Beware, Insider incidents usually don't start with elite hacking skills; they begin with trust that no one really monitors. The CrowdStrike firing of a suspicious insider who allegedly shared internal screenshots with a hacking collective is a reminder that your people and your vendors are part of the same attack surface. In this case, the hackers pointed to a breach of Gainsight, a customer management platform, as a stepping stone into CrowdStrike, even while the company insists its own systems were not compromised. This is an old and familiar pattern: data leaves your boundary and often comes back wearing a different mask.

Most security programs still fixate on malware, not on who is quietly taking photos of dashboards and how vendor access is governed. Insider risk, third-party access, and routine screen-grabbing often sit in the gray space between security, HR, and legal, which means gaps in monitoring and accountability. Real resilience shows up when you design for messy human behavior: least privilege by default, strong identity and access management, and alerting on unusual activity from both people and machines. Teach employees how these social engineering campaigns actually work and build processes that assume someone, somewhere, will eventually be tempted to test the guardrails.

TL;DR
🧠 Insider risk is usually a process failure, not a villain origin story
⚡ Data stolen from vendors can be recycled against the vendors' customers
🎓 Monitor screenshots and access patterns, not only malicious code
🔍 Treat employees, vendors, and SaaS apps as one shared attack surface

https://techcrunch.com/2025/11/21/crowdstrike-fires-suspicious-insider-who-passed-information-to-hackers/

#CrowdStrike #CyberSecurity #InsiderThreat #SupplyChainRisk #security #privacy #cloud #infosec

"For an industry that promises near-perfect uptime, the last few months have raised an uncomfortable question: how resilient is the cloud, really?"

https://cybernews.com/cloud/cloudflare-outage-destroys-cloud-resilience-myth

#cloudflare #cloud #aws #crowdstrike #centralization

The fork of the CrowdStrike scanner introduced me to a really good idea, I should support the same exit code design so that our tools can work in tandem.

Maybe we detect different things or maybe one vs the other works in your environment.

So I made an issue to track this support:

https://github.com/datapartyjs/walk-without-rhythm/issues/18

#CrowdStrike #Sha1HuludScanner #WalkWithoutRhythm #cybersecurity #npm #nodejs

Looks like that CrowdStrike employee really took "sharing is caring" to a whole new level! #CrowdStrike #Cybersecurity

Cybersecurity firm CrowdStrike...