In today’s cybersecurity news…
MITRE gets last-minute bailout from CISA
Yesterday, the day that MITREs contract was set to expire, MITRE Vice President Yosry Barsoum confirmed that CISA has provided funding to avoid a break in service for both the Common Vulnerabilities and Exposures (CVE®) and the Common Weakness Enumeration (CWE™) programs. CISA issued a statement saying, “The CVE Program is invaluable to the cyber community and a priority of CISA.” The extension of MITRE’s contract is set for 11 months.
(Bleeping Computer and The Verge)
Krebs exits SentinelOne after security clearance pulled
Following up on a story we brought to you Friday on Cyber Security Headlines, Chris Krebs has resigned as SentineOne’s Chief Intelligence and Public Policy Officer, effective immediately. This follows a presidential order that revoked Krebs’ security clearance and ordered a review of CISA’s conduct under his leadership. In a farewell note to SentialOne staff, Krebs said, “I want to be clear: this is my decision, and mine alone. This is my fight, not the company’s. This will require my complete focus and energy. It’s a fight for democracy, for freedom of speech, and for the rule of law. I’m prepared to give it everything I’ve got.”
Apple fixes two zero-days exploited in targeted iPhone attacks
On Wednesday, Apple released emergency fixes for two zero-day vulnerabilities that were used in an “extremely sophisticated attack” on the iPhones of specific targets. The two vulnerabilities are in CoreAudio (CVE-2025-31200) and RPAC (CVE-2025-31201), with both bugs impacting iOS, macOS, tvOS, iPadOS, and visionOS. The CoreAudio flaw can be exploited with a maliciously crafted media file to execute remote code on the device. The RPAC bug allows attackers with read or write access to bypass Pointer Authentication (PAC), an iOS security feature that helps protect against memory vulnerabilities. Apple has not shared further details related to how the flaws were exploited.
CISA warns of potential data breaches caused by legacy Oracle Cloud leak
In another follow-up to a story we covered last week, Federal officials at CISA on Wednesday warned of the potential fallout of a data breach impacting Oracle. The incident surfaced when the alleged hacker boasted on social media that they were selling Oracle’s stolen data on cybercriminal forums. The claims were substantiated by CloudSEK, CybelAngel and several other cybersecurity firms. Last week, Oracle admitted that credential data was stolen ”from two obsolete servers” but not from its Oracle Cloud Infrastructure (OCI). CISA said ”The compromise of credential material, including usernames, emails, passwords, authentication tokens, and encryption keys, can pose significant risk to enterprise environments.” The agency urged organizations to reset passwords for affected services, review source code for potential issues, monitor authentication logs, and report any incidents to authorities.
Huge thanks to our sponsor, Vanta
We know that real-time visibility is critical for security, but when it comes to our GRC programs…we rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta.
Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done 5 times faster with AI.
Now that’s…a new way to GRC. Get started at Vanta.com/headlines.
NVIDIA flaw gets a second patch amidst reporting confusion
Back in September, NVIDIA released a patch for a high severity time-of-check time-of-use (TOCTOU) vulnerability (CVE-2024-0132). However, after closer inspection, researchers from Trend Micro and Wiz separately discovered a secondary flaw that the patch did not mitigate. In a blog post last week, Trend Micro said the “incomplete” fix leaves systems exposed to a secondary denial-of-service (DoS) bug affecting NVIDIA Container Toolkit or Docker in AI, cloud, or containerized environments (tracked as ZDI-25-087 and/or CVE-2025-23359). Interestingly, Wiz released its own report on the secondary bug back on February 11. About a week later, NVIDIA released an advisory and issued a patch leaving overtaxed defenders and other industry experts to wonder why it took Trend Micro until last week to issue its report.
Microsoft to strengthen email sender requirements
Microsoft recently announced that, effective May 5, 2025, it will enforce new security requirements for domains sending over 5,000 daily emails to outlook.com, hotmail.com, and live.com. These requirements include SPF (Sender Policy Framework) checks to ensure sending domain DNS records accurately list authorized IP addresses, DKIM (DomainKeys Identified Mail) validation to confirm message integrity and authenticity, and DMARC (Domain-based Message Authentication, Reporting, and Conformance) policies which action messages that fail authentication. Microsoft’s initiative aligns with similar measures introduced by Google and Yahoo in 2024.
Google blocked over 5 billion harmful ads in 2024
On Wednesday, Google reported that it suspended over 39.2 million advertiser accounts last year. Google leveraged AI-powered tools to identify and block the majority of the accounts before they could serve harmful ads to users. In all, the tech giant blocked 5.1 billion malicious ads and restricted 9.1 billion ads across 1.3 billion pages last year. The top six ad policy violations included ad network abuse (793.1 million), trademark misuse (503.1 million), personalized ads (491.3 million), legal requirements (280.3 million), financial services (193.7 million), and misrepresentation (146.9 million).
92% of mobile apps found using poor encryption practices
New research from Zimperium’s zLabs examined 17,333 Android and iOS mobile apps from the official app stores and being used by the firm’s own customers’ employees. Of these, 83 Android apps (4 from within Google Play Store’s top 100 popularity list) were found to use unprotected or misconfigured cloud storage. In some cases, the file indexes are world viewable, and in others the content can be accessed without credentials. The researchers also found that 92% of the apps it tested use weak or flawed cryptographic methods. The researchers concluded that organizations should take measures to identify and resolve misconfigured cloud storage settings, detect and rotate exposed credentials and API keys, avoid use of outdated or insecure algorithms and monitor third-party SDKs for known vulnerabilities.