MikeGPT CyberSecurity

Heroes, a movie review! Also, update your Apple devices!! Here's a curated look at the current cybersecurity landscape for December 13, 2025.

Critical Threats

Apple Issues Emergency Updates for WebKit Flaws Exploited in the Wild

The Hacker News · 5:32 AM ·CVE-2025-24201

▾

Apple has released urgent security updates for the entire Apple ecosystem (iOS, macOS, etc.) to address two WebKit vulnerabilities that are currently being exploited by attackers. These flaws allow malicious web content to execute code on the victim's device simply by visiting a compromised site.

Business Impact

If exploited, this vulnerability allows attackers to compromise executive mobile devices and workstations, leading to data theft, spyware installation, and unauthorized access to corporate resources. This poses a severe risk to intellectual property and executive privacy.

Recommended Action

Ask your IT/MDM team: "What is the compliance status of our Apple fleet regarding today's emergency security updates, and can we force a restart for non-compliant devices within 24 hours?"

CVE-2025-24201 SOX The Hacker News ↗
Share
LinkedIn X Text Email

CISA Adds Actively Exploited Sierra Wireless Router Flaw to KEV

The Hacker News · 12:33 PM ·CVE-2018-4063

▾

CISA has confirmed active exploitation of a critical vulnerability in Sierra Wireless AirLink ALEOS routers, adding it to the Known Exploited Vulnerabilities (KEV) catalog. This flaw allows remote attackers to execute arbitrary code on the device, potentially granting full control over network edge devices.

Business Impact

Compromise of these routers can allow attackers to intercept sensitive data, disrupt critical communications, or use the devices as a beachhead to launch further attacks into the internal network. For critical infrastructure, this represents a direct risk to operational continuity and safety.

Recommended Action

Ask your Network Engineering team: "Do we have any Sierra Wireless AirLink routers in our fleet, and have we verified they are running the latest firmware patched against CVE-2018-4063?"

CVE-2018-4063 SOX The Hacker News ↗

Share

LinkedIn X Text Email

🎥 blackhat: 5/5

Chris Hemsworth shatters the glass ceiling and shows that handsome men with rugged jawlines and who wear the bejeezus out of a linen shirt can be technically capable.

High Severity

Notepad++ Fixes Updater Vulnerability Allowing Traffic Hijacking

Security Affairs · 10:16 PM

▾

The popular text editor Notepad++ has patched a vulnerability in its updater mechanism that allowed attackers to hijack the update process due to weak file authentication. This could enable a supply chain-style attack where users believe they are updating the software but are instead downloading malware.

Business Impact

Compromised developer tools are a primary vector for supply chain attacks; if exploited, attackers could gain persistent access to developer workstations, potentially leading to code theft or the injection of malicious code into your own products.

Recommended Action

Ask your Endpoint Security team: "Can we verify that all instances of Notepad++ in our environment are updated to the latest version, or block the application's update URL at the gateway until patched?"

SOX Security Affairs ↗
Share
LinkedIn X Text Email

Microsoft Expands Bug Bounty to Cover Third-Party Code Risks

Security Boulevard · 7:20 PM

▾

Acknowledging the growing supply chain threat, Microsoft is expanding its bug bounty program to reward researchers for finding vulnerabilities in third-party code (commercial and open source) that impacts Microsoft users. This strategic shift highlights the critical nature of third-party dependencies in modern cloud and AI environments.

Business Impact

This move signals an increased scrutiny on the software supply chain; organizations should expect more vulnerabilities to be disclosed in common dependencies, requiring faster patch management cycles to avoid regulatory penalties and breaches.

Recommended Action

Ask your AppSec team: "Do we have an automated inventory of third-party components (SBOM) for our critical applications to quickly react when new supply chain vulnerabilities are disclosed?"

SOX Security Boulevard ↗

Share

LinkedIn X Text Email

NCSC Warns Prompt Injection Requires Impact Reduction, Not Just Prevention

Security Boulevard · 6:36 PM

▾

The NCSC has issued guidance stating that prompt injection in LLMs cannot be fully mitigated like traditional SQL injection. Organizations are urged to shift focus from pure prevention to architectural defense-in-depth and impact reduction.

SOX Security Boulevard ↗

Share

LinkedIn X Text Email

OWASP and CISA Highlight Top Agentic AI and Software Flaws

Tenable · 2:00 PM

▾

Tenable reports on new OWASP rankings for Agentic AI application risks and CISA's list of most dangerous software flaws for 2025. This underscores the emerging attack surface created by autonomous AI agents in enterprise environments.

SOX Tenable ↗

Share

LinkedIn X Text Email

DOJ Sues Fulton County Over 2020 Voter Data Records

CyberScoop · 8:37 PM

▾

The DOJ is suing Fulton County, Georgia, for refusing to hand over voter records as part of a nationwide data collection project. This highlights the ongoing legal and compliance complexities surrounding election data governance.

SOX CyberScoop ↗

Share

LinkedIn X Text Email

Medium Severity

NCSC Warns Prompt Injection Requires Impact Reduction, Not Just Prevention

Security Boulevard · 6:36 PM

▾

The NCSC has issued guidance stating that prompt injection in LLMs cannot be fully mitigated like traditional SQL injection. Organizations are urged to shift focus from pure prevention to architectural defense-in-depth and impact reduction.

SOX Security Boulevard ↗

Share

LinkedIn X Text Email

OWASP and CISA Highlight Top Agentic AI and Software Flaws

Tenable · 2:00 PM

▾

Tenable reports on new OWASP rankings for Agentic AI application risks and CISA's list of most dangerous software flaws for 2025. This underscores the emerging attack surface created by autonomous AI agents in enterprise environments.

SOX Tenable ↗

Share

LinkedIn X Text Email

Low Severity

DOJ Sues Fulton County Over 2020 Voter Data Records

CyberScoop · 8:37 PM

▾

The DOJ is suing Fulton County, Georgia, for refusing to hand over voter records as part of a nationwide data collection project. This highlights the ongoing legal and compliance complexities surrounding election data governance.

SOX CyberScoop ↗

Share

LinkedIn X Text Email

Executive Briefing

MIT Launches Program to Train Military Leaders for the AI Age

MIT has launched a joint program to train military leaders in applied artificial intelligence, emphasizing AI's critical role in national security decision-making. This reflects a broader trend of upskilling leadership to manage AI-driven operational risks.

MIT News · 6:10 PM · Share

LinkedIn X Text Email

Vendor Spotlight

Entro Security (NHI & Secrets Management)

Spotlight Rationale: With Tenable and OWASP highlighting Agentic AI risks and the explosion of machine identities, securing Non-Human Identities (NHIs) is now a critical priority.

Threat Context: OWASP Ranks Top Agentic AI App Risks

Platform Focus: Entro Security (NHI & Secrets Management)

As organizations deploy Agentic AI (as noted in today's Tenable report), the number of Non-Human Identities (NHIs)—API keys, tokens, and service accounts—explodes. Entro Security provides a specialized platform to discover, classify, and secure these identities, directly addressing the "Agentic AI security" gap by ensuring the secrets these agents use are not exposed or over-privileged.

Actionable Platform Guidance: Implement Entro's discovery engine to map all NHIs associated with AI agents. Specifically, audit permissions for any NHI used by an autonomous agent to ensure least-privilege access, mitigating the impact of the "Prompt Injection" risks warned about by the NCSC today.

Source: Entro Security ↗, Entro Security ↗

Detection & Response

Detection & Response Kit (4 items) ▾

⚠️ Disclaimer: Test all detection logic in non-production environments before deployment.

1. Vendor Platform Configuration - Entro Security

Copy

# Entro Security CLI - NHI Discovery for AI Agents # Prerequisite: Entro CLI installed and authenticated # 1. List all discovered Non-Human Identities (NHIs) tagged with 'AI' or 'Agent' entro-cli secrets list --tags "AI,Agent,LLM" --format json > ai_secrets_audit.json # 2. Analyze permissions for high-risk secrets # Look for secrets with 'admin' or 'write' privileges cat ai_secrets_audit.json | jq '.[] | select(.permissions | contains("admin") or contains("write"))' # 3. Rotate compromised or over-privileged secrets immediately # entro-cli secrets rotate --id [SECRET_ID]

2. YARA Rule for Sierra Wireless Malware Indicators

Copy

rule SierraWireless_Malware_Indicators { meta: description = "Detects malware artifacts associated with Sierra Wireless router exploitation (Chaya, RondoDox, Redtail)" author = "Threat Rundown" date = "2025-12-13" reference = "https://thehackernews.com/2025/12/cisa-adds-actively-exploited-sierra.html" severity = "critical" tlp = "white" strings: $s1 = "Chaya" ascii wide $s2 = "RondoDox" ascii wide $s3 = "Redtail" ascii wide $s4 = "ShadowV2" ascii wide $h1 = { 45 4c 46 01 01 01 00 } // ELF Header common in IoT malware condition: uint32(0) == 0x464c457f and (any of ($s*) or ($h1 and 2 of ($s*))) }

3. SIEM Query — Sierra Wireless Exploitation Attempts

Copy

index=security sourcetype="firewall" OR sourcetype="web_proxy" (dest_port=80 OR dest_port=443 OR dest_port=8080) (url="*/api/*" OR url="*/admin/*") | eval risk_score=case( match(user_agent, "(?i)(Chaya|RondoDox|Redtail)"), 100, match(dest_ip, "[Known_Compromised_IP_List]"), 90, 1==1, 0) | where risk_score >= 90 | table _time, src_ip, dest_ip, url, user_agent, risk_score | sort -_time

4. PowerShell Script — Notepad++ Version Audit

Copy

$computers = "localhost", "WKSTN01", "WKSTN02" foreach ($computer in $computers) { if (Test-Connection -ComputerName $computer -Count 1 -Quiet) { Invoke-Command -ComputerName $computer -ScriptBlock { $npp = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | Where-Object { $_.DisplayName -like "*Notepad++*" } if ($npp) { Write-Host "Found Notepad++ Version: $($npp.DisplayVersion) on $env:COMPUTERNAME" # Alert if version is vulnerable (Example logic) } } } }

This rundown should provide a solid overview of the current threat landscape. Thank you to all our cyberheroes for your diligence and hard work. Stay vigilant!