A (0:00)

Some of you may have missed Wednesday's edition. We had a situation at our hosting partner which prevented our RSS feed from reaching Google speakers. If this happens again, please remember you can simply ask for CyberSecurity today using YouTube Music on your Google speakers. I hope you won't need it, but if it happens again, give that a try. Cybersecurity Today would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them at meter.com CST Spiderman phishing kit hits European banks and crypto users GOG's zero day lets attackers hijack self hosted Git servers, Windows PowerShell zero day patched in December updates and Google patches, Gemini's zero click flaw that exposed workspace data and Google patches a Gemini zero click flaw that exposed workspace data. This is Cybersecurity Today. I'm your host Jim Love. A new phishing kit called Spiderman is going after customers of European banks and cryptocurrency services using pixel perfect copies of real sites. Researchers at Verona say the platform lets criminals spin up phishing pages that are almost indistinguishable from the real thing and then harvest login credentials, two factor authentication codes and credit card data. Spider man currently targets financial institutions in five countries, including big names like Deutsche Bank, ING, O2, Caxa Bank, Volks bank and Commerzbank. It can also build fake portals for fintech and crypto services including Klarna, PayPal and wallets like Ledger, Metamask and Exodus. According to Varonis, because Spiderman is modular, new banks, portals and authentication methods can be added easily. One of the criminal groups using it on signal already has about 750 members. From a central dashboard, operators can watch victim sessions in real time, grab credentials, export everything with one click intercept Phototan and one time passcodes and capture full credit card details. The basic defense hasn't changed. These kits still need you to click on a link, so the safest move is to check the domain carefully before you enter any credentials and be suspicious of any browser in the browser windows and treat any unexpected 2fa or prompt as a warning that someone may be trying to take over your account. The best defense might be paying attention to that nagging feeling that this might not be the right thing to click on. In other words, the best defense might be Spidey Sense. A zero day in Gogs, a popular self hosted git service is being actively exploited and there's still no official patch. Wiz Threat Research says The flaw, tracked as CVE2025 8110, is a symlink bypass of an earlier remote code execution bug, CVE202455947 and it lets authenticated users overwrite files outside the repository to achieve remote code execution. Gogs is written in Go, it's designed to be lightweight and easy to deploy, and it's used as an on prem or cloud alternative to GitLab or GitHub Enterprise. That convenience comes with a downside. Wiz found about 1400 GoG servers exposed to the Internet, many with open registration enabled by default, and says more than 700 of them show clear signs of compromise. In their words, during our analysis of the exploitation attempts, we identified that the threat actor was leveraging a previously unknown flaw to compromise instances. We responsively disclosed this vulnerability to the maintainers. They are currently working on a fix, but active exploitation continues in the wild. The new bug works because, as Wiz put it, unfortunately, an earlier fix implemented for the previous CVE didn't account for symbolic links. The actual attack chain is simple. An attacker with the ability to create a repository commits a symbolic link that points to a sensitive file outside the repo. Then they can use the Put Contents API to write through that symlink and overwrite the target file. And by overwriting git config and specifically the SSH command, they can get the system to execute arbitrary commands and take over the server until there is a patch. The minimum steps are to disable open registration if you don't need it, pull gogs behind a VPN or IP allow list at the minimum, and look for suspicious repos with random eight character names created in a tight time window. And if your instance is Internet facing and running version 0.13.3 or earlier, you should assume you are at risk and get more detailed guidance from research blogs like the one from Wiz or the CVE Advisory. Microsoft has fixed a newly disclosed zero day vulnerability in Windows PowerShell that could allow attackers to execute malicious code if they can persuade someone to run a crafted command or script. The flaw is tracked as CVE202554.100 and carries a CVSS score of 7.8. It's important. According to Cybersecurity News, the bug comes down to improper neutralization of special elements in PowerShell, essentially a command injection weakness. The attack requires local access and user interaction, so this is not a wormable network exploit by itself. But if an attacker can convince a user to run a script or can already execute commands on a machine. They can use this flaw to run arbitrary code in a more controlled or stealthy way. And let's face it, getting people to run a script is not impossible. Microsoft has shipped the fix as part of the December 2025 Patch Tuesday rollup, which includes more than 50 vulnerabilities across Windows, including 3.0days on supported systems. Installing updates like KB 5071546, KB 5071544, KB 5072033, and KB 5074204 closes the hole, and on some builds, PowerShell now shows a warning when scripts use Invoke Dash WebRequest, adding a safer parsing mode from newer PowerShell versions. Please note that a reboot is required before the fix is fully in place. It's easy to overlook a PowerShell bug compared to a browser or a VPN flaw, but PowerShell is deeply embedded in automation and admin workflows, so if you rely on scripts for deployment, management or incident response, this is one of those updates you really do need to schedule, test and roll out as quickly as you reasonably can. Google has patched a zero day vulnerability in Gemini Enterprise that turned hidden instructions inside ordinary workspace content into a data exfiltration channel. The flaw, named Gemini Jack by researchers at Noma Labs, allowed attackers to plant prompt injection payloads in places like shared Google Docs, calendar invites or emails and have Gemini execute them without any clicks or obvious warning to the user. Dark Reading reports that Noma described Gemini Jack as an architectural weakness in the way enterprise AI systems interpret information. Because Gemini Enterprise has access to Gmail, Calendar Docs and other workspace data, once it pulled a poisoned document into context, it could run the attacker's hidden instructions, search across corporate content for terms like budget or acquisition, and then send the results out via an external image URL controlled by the attacker. And all of that would happen through what looked like normal assisted behavior. Noma worked with Google to validate the findings. Google then changed how Gemini Enterprise and Vertex AI search interact with retrieval and indexing, and rolled out a fix globally. The company says it's addressed the specific flaw and has not seen evidence of widespread exploitation. But Noma and other commentators are clear that this is a sign of things to come, not a one off Any agentic AI that reads across email, documents and calendars, no matter who supplies it, can turn shared content into an instruction channel if it's not carefully constrained. Google has published a long term security blueprint for agentic browsing and AI assistance, but delivering that will take time and architectural work across Chrome, Workspace and their AI stack. In the meantime, administrators need to educate users about how AI tools process embedded content, make risk based decisions about enabling anti features, and review Google Security guidance for Workspace and Gemini Enterprise. And speaking personally, this is the point where I'd be looking at sandboxing, creating safe, limited environments where people can experiment with these tools and get some training while we all get a better handle on how autonomous AI is going to behave under real world circumstances. And that's our show. We'd like to thank Meter for their support in bringing you this podcast. Meter delivers full stack networking infrastructure, wired, wireless and cellular to leading enterprises. Working with their partners, Meter designs, deploys and manages everything required to get performant, reliable and secure connectivity in a space. They design the hardware, the firmware, build the software, manage deployments and run support. It's a single integrated solution that scales from branch offices to warehouses and large campuses to data centers. Book a demo@meter.com CST that's M E T E R.com CST and we've got a great weekend show for you. Hope to catch you there by but if not, David Shipley will be back in the News Chair on Monday. I'm your host Jim Love. Thanks for listening.