Security researchers demonstrated that a $30 children's GPS watch can be remotely tracked, photographed, and listened to without the wearer’s knowledge. The flaw stems from a missing authentication check in the SETracker backend that powers dozens of brands, meaning millions of kids could be spied on. Fixes are required across the whole supply chain.
Tenet Security showed that a blocked request logged verbatim can carry malicious instructions that AI agents blindly execute. The proof‑of‑concept hijacked Cloudflare DNS, stole Datadog secrets and co‑opted Sentry’s AI, proving that trusted logging pipelines are a new attack surface for enterprises.
CERT.PL disclosed that Sandworm-linked actors leveraged a private APN to tunnel into a Polish combined heat and power plant’s OT network, shutting down a steam turbine and water treatment system. This is the first known use of a private APN as an attack vector, highlighting a new supply‑chain risk for critical infrastructure worldwide.
South Korean firm Genians uncovered Kimsuky running local large‑language models (Ollama, GPT‑4All, Msty) on its own servers. The AI stack powers automated document‑search, AI‑generated phishing lures and integrates into its .NET malware, widening attacks on diplomats, military and virtual‑asset targets.
A new analysis shows LockBit 5.0’s Linux variant generates ChaCha20 keys locally, wraps them with a hard‑coded Curve25519 public key, and encrypts files entirely offline. It also bypasses traditional strace monitoring using eBPF tracing and wipes free space aggressively, raising the bar for ransomware evasion on Linux servers.
Wordfence uncovered a supply‑chain attack on BdThemes where threat actors poisoned a static JSON feed used by the plugins’ admin banner component. The malicious payload creates hidden administrator accounts and can drop web‑shells, giving attackers full control of affected sites. All affected plugins were temporarily removed from the WordPress repo pending fixes.
Jonathan Brossard has acquired securityfocus.com and revived Bugtraq, restoring its original researcher‑first, full‑disclosure ethos. The mailing list is live again at bugtraq@securityfocus.com, with legacy archives to be preserved separately, and the community is invited to post new findings.
EvilFontTool is a Python CLI that creates “evil fonts” by remapping glyphs so a document shows benign text to a human reader while copy‑pasting or feeding the same file to AI models or terminals reveals a hidden payload. Red‑teamers can use it to test font‑based deception in Word, PDF, and web content.
Trail of Bits released a pip‑installable library that plugs NIST‑standard ML‑KEM and ML‑DSA into pyca/cryptography, funded by the Sovereign Tech Agency. Python developers can now deploy quantum‑resistant key exchange and signatures instantly, future‑proofing applications before quantum computers arrive.
Luke Marshall used TruffleHog via AWS Lambda to scan all 5.6M public GitLab Cloud repos, finding 17,430 verified live secrets, a 2.8× higher count than Bitbucket and about 35% higher secret density per repo. Google Cloud Platform credentials were the most common leak, appearing in roughly one in 1,060 repositories.
You’re caught up.
That was all 10 stories in the 10 August issue.