In today’s cybersecurity news…
Cisco issues 10.0 Secure Workload admin flaw warning
Cisco has announced the existence of a vulnerability with a CVSS score of 10.0, which can enable unauthenticated attackers to gain site admin privileges in its Cisco Secure Workload Cluster Software in both SaaS and on-prem environments, by sending crafted API requests to vulnerable systems. The CVE numbered vulnerability (CVE-2026-20223) comes down to “weak validation and authentication checks in internal REST API endpoints.” This means attackers don’t require credentials, user interaction, or any significant effort to exploit the bug. Cisco released patches for a critical vulnerability yesterday.
Spammers abuse internal Microsoftonline account
A loophole in an internal Microsoft system has been allowing the distribution of spam emails from an email address typically used for sending legitimate account alerts. Scammers “have been able to set up new Microsoft accounts as if they are new customers, and use that access to send out emails purportedly from the tech giant itself.” The emails are sent from msonlineservicesteam@microsoftonline.com, which is “an email account that Microsoft uses to send important notifications to users, such as two-factor authentication codes and other critical alerts about their online account.” When contacted by TechCrunch earlier this week, “a Microsoft spokesperson acknowledged the inquiry, but has not yet commented or said if the company has stopped the abuse of its account notification email.”
Google’s surge in Chrome vulnerability announcements
A comparison of Chrome security advisories published by Google shows quite an increase – from 16 for the Chrome update released on April 15, to 21 for the update issued on April 28, and then 100 in the advisory published on May 5. More than 70 of these vulnerabilities patched were found internally by the tech giant. Google has not clarified if the surge correlates to any use of AI, but they would be joining many other organizations such as Mozilla that have also reported surges in vulnerability discovery thanks to the use of internal or third-party or AI tools, including Claude Mythos.
Police seize First VPN service used in cyberattacks
The takedown was the result of a joint international law enforcement operation led by French and Dutch authorities, and which was the result of an investigation that started in 2021. They seized dozens of First VPN servers located in 27 countries, “arrested the administrator, and conducted a house search in Ukraine.” The VPN service had been “advertised on various cybercrime forums as a privacy-focused VPN that does not log user data and ignores law enforcement requests for user information.”
Huge thanks to our sponsor, ThreatLocker
Chinese hackers target telcos with new Linux, Windows malware
Two newly discovered applications, a Linux malware called Showboat and a Windows malware called JFMBackdoor have been active since at least mid-2022 and are targeting organizations across the Asia Pacific and parts of the Middle East. It has been attributed to the Calypso threat group, also tracked as Red Lamassu. The malware can upload or download files, hide its own process, and establish persistence via a new service. Researchers at Lumen’s Black Lotus Labs conclude that “the tooling is likely shared across multiple China-aligned threat groups, each targeting different regions and using the same malware ecosystem.”
Discord adds end-to-end encryption to voice and video calls by default
Without any major announcement, Discord started using its DAVE encryption protocol, designed to support voice and video calls on PCs, phones, consoles, and browsers, with minimal latency. This goes in stark contrast to Meta, which removed its end-to-end encryption from Instagram’s direct messaging feature, as well as TikTok that confirmed “it would not be adding end-to-end encryption to direct messages.” Monday’s change simply makes encryption the default for everyone, with exception of its Stage channels which are designed for broadcast-style communication.
UK cybercrime law reform would protect almost no one, say experts
According to Recorded Future News, “the British government’s plans to overhaul the country’s main cybercrime law would offer such narrow legal protections that most security researchers would be left in the same position as today.” As we reported last week, plans to amend the Computer Misuse Act of 1990 were announced in the King’s Speech with the goal of modernizing cybersecurity law. The updated law was intended to “protect researchers from conviction in court, as long as they meet certain safeguards,” but sources say those safeguards are extremely limited, to cases where researchers are “being prosecuted for scanning internet-facing systems.” A link to the full breakdown of the proposed law is available in the show notes to this episode.
Move over, Flipper Zero, Flipper One is in town
The Flipper One is an open Linux pocket computer from Flipper Devices, the makers of the infamous Flipper Zero multi-tool device. It is essentially a tiny Linux computer designed for cybersecurity research, electronics experimentation, networking, and hardware tinkering. Whereas the Flipper Zero was built around a microcontroller, the Flipper One reportedly uses a much stronger Rockchip processor plus a secondary Raspberry-Pi-style RP2040 chip for lower-level hardware handling and will likely be of greatest interest to cybersecurity professionals who want a portable toolkit, electronics hobbyists and Linux enthusiasts.
(ZDNet)