Transcript
A (0:00)
From the CISO series, it's Cybersecurity Headlines.
B (0:07)
These are the cybersecurity headlines for Monday, July 14, 2025. I'm Steve Prentiss. CISA gives one day for Citrix Bleed 2 Fix following up on a story we have been covering for a couple of weeks now regarding Citrix Bleed 2, CISA has now ordered all federal civilian agen agencies to, quote, immediately patch a vulnerability impacting several NetScaler products used by organizations to manage network traffic. This Citrix vulnerability, known colloquially as Citrix Bleed 2, has been described by CISA Acting Executive Assistant Director for Cybersecurity Chris Butera as posing a significant unacceptable risk to the security of the federal civilian enterprise. End quote. This has led CISA to take the unusual step of giving federal civilian agencies just one day to patch it. The bug affects Citrix customers who manage their own netscaler ADC and netscaler gateway appliances, but not those with Citrix managed cloud services. Google Gemini flaw hijacks email summaries for phishing as posted in Bleeping Computer Google Gemini for Workspace can be exploited to generate email summaries that appear legitimate but include malicious instructions or warnings that direct users to phishing sites without using attachments or direct links. This is a reinvention of the white font zero point size technique, and as such this attack leverages indirect prompt injections that are invisible to humans but obeyed by Gemini when generating the message summary. The model, disclosed by a researcher at Mozilla as part of that company's bug Bounty program for generative AI tools, shows how an attacker can hide malicious instructions in the body text at the end of the message using HTML and CSS that literally sets the font size to 0 and color to white, lacking any links or attachments, allows the email to slip through, at which point, if the recipient opens the email and asks Gemini to generate a summary of the email, Google's AI tool will parse the invisible directive and obey it. Louis Vuitton says UK customer data stolen in Cyberattack, the leading brand of the French luxury group lvmh, has announced that an unauthorized third party accessed UK operations systems, obtaining information such as customer names, contact details and purchase history. This follows a similar attack on its Korean operation announced last week. The company says no financial data was compromised, but warns that phishing and fraud attempts may occur huge thanks to our sponsor, ThreatLocker. ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and to start your free trial, visit threatlocker.com CISO that is T H R E A T L O C k-e r.com CISO hackers exploit RCE flaw in wing FTP server just one day after technical details on this flaw became public, exploitation by hackers has been reported. The vulnerability has a CVE number and also has a maximum severity rating of 10. It allows a remote unauthenticated attacker to execute code with the highest privileges on the system, that is Root system Wing FTP server manages secure file transfers that uses scripts written in Lua Lua, which is widely used in enterprise and SMB environments. According to researchers at Huntress, one Wing FTP instance was targeted by five distinct IP addresses within a short time frame, potentially indicating mass scanning and exploitation attempts by several threat actors. This attack, however, failed due to the hackers inexperience, perhaps, or thanks to Microsoft Defender. Regardless, Huntress states that hackers are likely to scan for other Wing FTP instances and and try again GPU Hammer degrades AI models on Nvidia GPUs a warning from Nvidia to enable your system level error correction codes. This is to defend against a variant of the Rowhammer attack named GPU Hammer. This is the first ever Rowhammer exploit demonstrated against Nvidia's GPUs, one that allows malicious GPU users to tamper with other users data by triggering bit flips in GPU memory. According to researchers at the University of Toronto, this can result in the degradation of an AI model's accuracy from 80% to less than 1%. Rowhammer is to modern drams as Spectre and Meltdown are to contemporary CPUs, except that unlike CPUs which have benefited from years of side channel defense research, GPUs often lack parity checks and instruction level access controls, leaving their memory integrity more exposed to low level fault injection attacks Albemarle County, Virginia suffered ransomware attack in June. This attack, which happened June 11th and which has not yet been claimed by any cybercrime group, caused the usual type of damage that we have seen frequently when hitting towns, municipalities and counties across the US and elsewhere. Some phone systems were disabled and the data of local government and public school employees, including driver's license numbers, Social Security numbers, passport numbers, military IDs and more, was likely accessed. As officials have stated, residents too may have had their names, addresses and Social Security numbers exposed. The county believes the hackers failed to gain access to cloud based systems and were only able to breach data held on local servers, end quote Former Mexican President investigated over alleged spyware bribes Former Mexican President Enrique Pena Nieto is being investigated by Mexico's Attorney General following allegations that he took bribes from Israeli businessmen, end quote, to secure government contracts for spyware and other technology. The contracts appeared to include a deal to buy Pegasus and the total amount of the bribes is set to equal $25 million. The investigation comes in response to an account in the Israeli business publication the Marker, which is based on documentation filed as part of a legal dispute between the two Israeli businessmen who had entered into arbitration in Israeli courts to determine their individual proceeds from a joint $25 million investment in Mr. Pena Nieto. Have you ever seen a cybersecurity vendor cross the line in the name of competition? We all know it is a crowded vendor landscape, so it's not surprising to see some of them occasionally behaving badly. We are digging into the best and worst vendor habits on this week's Super Cyber Friday discussion. Join us this Friday at 1pm Eastern for hacking Vendor Competition. Head on over to our events page@cisoseries.com to register. And if you have some thoughts on the news from today or about this show in general, please be sure to reach out to us feedbackisoseries.com we would love to hear from you. I'm Steve Prentice reporting for the CISO series.