June 7, 2025 - Red Dot Security

Header image for the Red Dot Weekly Cyber Security News https://reddotsecurity.news

Hello all,

With the Patch Tuesday onslaught coming next week, I was happy to see that this was another somewhat quiet week as far as vulnerabilities and zero-day reveals are concerned. Last month I was quite wrong in my prediction of fewer vulnerabilities coming out, so this month, I’ll just wait and see, with no assumptions or expectations. Despite fewer new vulnerabilities and defects being unveiled this week, threat actors still had plenty of old ones that are out there unpatched that are being exploited. Yes, we defenders have an unending task. But, if we don’t do it, who will?

As usual, the RedDotSecurity.news website contains this commentary and a plethora of links to other items that are not in this video and that are worth skimming to see if they interest you or pertain to your particular environment or of those you support. There is a lot more than just what was said here.

Headline NEWS:

Cisco is warning of a critical authentication bypass defects in their Identity Services Engine (ISE). This is used in Cloud environments such as AWS, Azure, and Oracle. There is some mitigation guidance, which is rather harsh since it performs a factory reset. A wiser route might be to apply the available patches – quickly.
CISA noticed that ConnectWise ScreenConnect released patches for a defect in April and has updated their KEV (Known Exploited Vulnerabilities) catalog to include this patch. Any ConnectWise hosted ScreenConnect instances were patched by them when they first found the issue. If you self-host ScreenConnect and haven’t patched, do so quickly, and follow the vendor’s guidance on how to check for exploitation.
Google Chrome was found to have yet another defect in their V8 JavaScript engine, which required an emergency patch. This zero-day was already under active exploitation, so make sure you check your Chromium based browsers for updates, and check Node.js since it also uses the V8 JavaScript engine. Additionally, there were two other flaws in Chrome that were patched with this latest update. If you aren’t restarting your Chrome browser at least once a week, which initiates an update cycle, you should consider adding that as a regular part of your weekly maintenance. These defect updates seem to be arriving weekly now.
Hewlett Packard Enterprise (HPE) has released updates to address eight vulnerabilities in their StoreOnce disk-based backup and deduplication solution. The defects are rated critical, with upgrading to version 4.3.11 or higher being the fix. Prioritize this update, if threat actors get into your backup infrastructure, it is game over as they can corrupt, or even delete your backups, leaving you no recourse other than to pay a ransom that may or may not provide a reliable ransomware decryptor to get your data back.

In Ransomware, Malware, and Vulnerabilities News:

Feds Take Down Virus Scanner Used by Hackers to Refine Their Malware. If you’re an enterprising threat actor and you want to ensure that your latest version of evil software will get past the defenses of your victims, you test it against the defenses. But that takes a lot of time, unless you submit to VirusTotal. However, you then have a new problem as you’ve just given defenders a copy of your evil payload. No, instead you’d subscribe to a service that tested against different anti-malware vendors and then gave you the results so you could tweak until nothing amiss was seen. The US Justice Department, along with Dutch and Finnish authorities have taken down just such a service, and they’ve seized a trove of information about the subscribers. Score a nice win for the good guys!

In Other News Events of Note and Interest:

Kali GPT- AI Assistant That Transforms Penetration Testing on Kali Linux. This feels like an amazing transformative moment, but it is also fraught with danger. Kali Linux has long been the staple of penetration testers and hackers alike, providing over 600 pre-installed tools that can be used by defenders and threat actors. One limiting factor has been the complexity of use since most of the tools involve command-line controls. All that has changed with Kali-GPT. Now you can ask the AI and it will assist you in getting the results you need. And herein lies the problem. This is hosted by OpenAI. And they were just ordered by the US District Court of New York to “preserve and segregate all output log data that would otherwise be deleted on a going forward basis until further order of the Court (in essence, the output log data that OpenAI has been destroying), whether such data might be deleted at a user’s request or because of “numerous privacy laws and regulations” that might require OpenAI to do so.” Yep, anything you tell OpenAI is to be logged, whether you want that to happen or not. With the amount of potentially damaging information that a legitimate penetration tester might input into Kali-GPT, this could be disastrous if a threat actor were to obtain it. If you’re considering using this new tool, be very mindful of what information you share.
AI in general. There are a lot of articles linked this week about AI, the impact of AI, how to deploy it safely, the timelines to milestones, and a very lengthy PDF presentation about AI from the legendary Bond report and more. Lots of good stuff here.

Musings:

Lately it feels as though doing much of anything on the internet is like driving down a highway in a Mad Maxx post-apocalyptic world. You need to be armored, drive fast, don’t pick up strangers, occasionally fight off raiders that want to disable you and steal your stuff, or that want to do you physical harm. And once you reach your destination, you have to hope that it hasn’t been taken over by marauders intent on malfeasance. To gain entry you often must prove your intent with several forms of interrogation, are you human, do you have multifactor, accept our cookies, pay for access, and more. Do I really want to get to that site that badly? Maybe I’ll just go to my bookshelf and pick up a nice physical hardbound book to read instead.

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Like this: