Maor Goldberg

🔓 We built local backdoors for Signal, 1Password, and Slack using a “data” file their integrity checks ignored. CVE-2025-55305: override common JavaScript builtins in v8_context_snapshot.bin. When apps use these builtins during normal operation, malicious code executes. The vulnerability affects nearly every Chromium-based application because code integrity checks don't consider these snapshot files "executable"—but they contain JavaScript that runs with the privileges of their V8 isolate. Even apps with Electron's integrity protection fuses on were vulnerable to this framework-level bypass. https://lnkd.in/g4QHijVs

329

9 Comments

Frequent outages? Inconsistent security? Consider them overruled 🧑‍⚖️ To build a more resilient, high-performance network, the Vermont Judiciary overhauled its IT infrastructure and standardized with a unified platform approach: 🧱 Next-Generation Firewalls to secure data centers and Azure
 ✅ Prisma SASE for a high-performance, always-on network
 🔍 Cortex XDR for AI-powered threat detection
 ✍️ Unit 42 Proactive Services for security planning The results? 50X more bandwidth. 100% uptime. 99% faster threat response. That’s how you future-proof justice. See the transformation. https://bit.ly/4bJInOs

120

8 Comments

Emerging Threat: CVE-2025-55190 🚨 When “read-only” isn’t really read-only. Here’s the 411 from our Threat Research Team 👇 A critical vulnerability was just disclosed in Argo CD, the popular GitOps tool used to automate cloud-native deployments. It’s one of those bugs that quietly breaks the trust model behind your automation workflows. 𝗪𝗵𝗮𝘁 𝗵𝗮𝗽𝗽𝗲𝗻𝗲𝗱? Due to improper access control in Argo CD’s /𝗮𝗽𝗶/𝘃𝟭/𝗽𝗿𝗼𝗷𝗲𝗰𝘁𝘀/{𝗽𝗿𝗼𝗷𝗲𝗰𝘁}/𝗱𝗲𝘁𝗮𝗶𝗹𝗲𝗱 endpoint, any token with 𝗽𝗿𝗼𝗷𝗲𝗰𝘁𝘀,𝗴𝗲𝘁 permissions, even those scoped for limited use, can retrieve all repository credentials linked to the project. This turns a read-only permission into a critical exposure risk. 𝗪𝗵𝘆 𝗶𝘁 𝗺𝗮𝘁𝘁𝗲𝗿𝘀: Tokens assumed to be low-risk for automation can now expose critical secrets, putting your deployment pipeline and source code at risk. These tokens are often widespread and hard to rotate, making this a high-impact vulnerability. 𝗛𝗲𝗿𝗲’𝘀 𝘄𝗵𝗮𝘁 𝘁𝗲𝗮𝗺𝘀 𝘀𝗵𝗼𝘂𝗹𝗱 𝗱𝗼:    • Upgrade to Argo CD(V2: 2.13.9 / 2.14.16) or (V3: 3.0.14 / 3.1.2)  • Limit project-level tokens where possible and limit access to the vulnerable endpoint  • Enforce least privilege, monitor runtime token activity, and secure credentials with proper secrets management Upwind detects abnormal API access at runtime, flags workloads running vulnerable Argo CD versions, and highlights risky token exposure, so you can act before attackers do. When something like this happens, we don’t just point at the problem, we help teams see it, understand it, and take action. If you need help assessing exposure or want to see how runtime insight changes the game, we’re here. DM us. Cloud security happens at runtime. Make sure you can see it. More details from our team here: https://lnkd.in/enfJRE7W Up & Upwind! 🏄‍♂️

53

1 Comment

Vulnerabilities in container images and runtime environments expose organizations to significant risks, which makes proactive vulnerability scanning an essential practice. Trivy is an open-source vulnerability scanner designed for containers, file systems, and software dependencies. Our new blog post, Container Image Security with Wazuh and Trivy, demonstrates how to integrate Trivy with Wazuh to perform effective container image vulnerability scanning. Read more: https://ow.ly/J0SV50V8hKL #InformationSecurity #CyberSecurity #OpenSource

216

Let's talk #MCP - one last time. We're wrapping up our three-part blog series with this final installment, where we ask the big questions: 💬 Can MCP become the distributed control plane for AI agents? 💬 Can MCP be adopted as the go-to identity fabric that lets AI scale safely? Thanks to your help answering our recent survey, we were able to bring in many voices and share some powerful, real-world insights into the future of MCP adoption. The momentum is real, and so is the opportunity. Ready to dive in? Read Jonathan Sander's full blog post below 👇🏼

43

5 Comments

OPSWAT’s Unit 515 discovered a critical vulnerability (CVE-2025-24293) in Ruby on Rails Active Storage that could allow remote code execution in certain configurations.  The research exposed a bypass of a previously patched CVE and contributed directly to the Rails security team’s latest fix.  Get the full breakdown: https://hubs.la/Q03JhWQg0

39

How the NVD funding near-miss exposed the risk of single-source intelligence. The cybersecurity world received an abrupt wake up call to the issue of using single-source vulnerability intelligence last week. This new blog analyzes the cracks exposed and how to prepare for a future when single-source intelligence is now a realistic business risk to organizations. Check out the details: https://bit.ly/3EiG88J #CVE #NVD #vulnerabilityintelligence

35

1 Comment