To deal with the evolving threat landscape, new Windows features, and community feedback, Microsoft is planning to revise the Windows Server baseline more frequently in the future. Windows Server security baselines are a collection of Microsoft-recommended configuration settings that help administrators establish secure and consistent Windows Server environments.

This is the first security baseline update for Windows Server 2025 since January, a summary of the changes is presented in this table:

Of these changes, the removal of WDigest Authentication and the addition of Include command line in process creation events are significant.

Microsoft said it removed WDigest Authentication from the security baseline because it is no longer necessary for Windows Server 2025. The policy was originally enforced so that WDigest couldn’t store plaintext passwords in memory, which was a significant theft risk. Since the 24H2 update in Windows Server 2022, the policy has been deprecated, so there’s no need to enforce this setting.

The update also adds Include command line in process creation events to improve the visibility of how processes are executed across the system. By capturing the command-line arguments, it makes it easier to detect and investigate malicious activity that may otherwise seem legitimate.

If you want to learn more about the other changes in a bit more depth, refer to Microsoft’s announcement of this security baseline update.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

Ubuntu users could see up to a 20 percent boost in graphics performance on Intel-based systems under a change that will turn off security mitigations for blunting a class of attacks known as Spectre.

Spectre, you may recall, came to public notice in 2018. Spectre attacks are based on the observation that performance enhancements built into modern CPUs open a side channel that can leak secrets a CPU is processing. The performance enhancement, known as speculative execution, predicts future instructions a CPU might receive and then performs the corresponding tasks before they are even called. If the instructions never come, the CPU discards the work it performed. When the prediction is correct, the CPU has already completed the task.

By using code that forces a CPU to execute carefully selected instructions, Spectre attacks can extract confidential data that the CPU would have accessed had it carried out the ghost instructions. Over the past seven years, researchers have uncovered multiple attack variants based on the architectural flaws, which are unfixable. CPU manufacturers have responded by creating patches in both micro code and binary code that restrict speculative execution operations in certain scenarios. These restrictions, of course, usually degrade CPU performance.

When the investment costs more than the return

Over time, those mitigations have degraded graphics processing performance by as much as 20 percent, a member of the Ubuntu development team recently reported. Additionally, the team member said, Ubuntu will integrate many of the same mitigations directly into its Kernel, specifically in the Questing Quokka release scheduled for October. In consultation with their counterparts at Intel, Ubuntu security engineers have decided to disable the mitigations in the device driver for the Intel Graphics Compute Runtime.

“After discussion between Intel and Canonical’s security teams, we are in agreement that Spectre no longer needs to be mitigated for the GPU at the Compute Runtime level,” Ubuntu developer Shane McKee wrote. He continued:

At this point, Spectre has been mitigated in the kernel, and a clear warning from the Compute Runtime build serves as a notification for those running modified kernels without those patches. For these reasons, we feel that Spectre mitigations in Compute Runtime no longer offer enough security impact to justify the current performance tradeoff.

McKee went on to say that as a result, “Users can expect up to 20% performance improvement.”

The developer acknowledged that the change could open security holes or introduce bugs but said that both Ubuntu and Intel have confidence that disabled versions will be safe.

Most of the researchers Ars consulted agreed. They reasoned that the mitigations built into the kernel are likely to protect against most if not all Spectre attack scenarios. They also noted that there are no known reports of Spectre attacks ever being actively used in the wild.

“Nobody bothers attacking these vulns because it takes a lot of engineering time to implement attacks against them to any useful level of rigor, and getting any interesting data back outside very targeted scenarios is very unlikely (plus it's noisy due to the number of iterations you need to do on these types of side-channels),” independent researcher Graham Sutherland wrote on Mastodon. “The economics just don't stack up for attackers, especially when there are so many lower-effort higher-reward attack approaches they can throw at stuff.”

“From the user perspective it’s risk/reward too,” a researcher going by the handle demize added. “Probably don’t disable side-channel mitigations on multitenant servers. ...” But for typical users, “you have a much higher threat from downloading malware that does literally anything else.”

Ultimately, cryptography engineer Sophie Schmieg said, the benefit of the mitigations isn't worth the performance costs to GPU performance, where predicting instruction branches is more critical than for CPU performance.

“The system can effectively parallelize a lot more actions without requiring expensive synchronization points between the cores,” Schmieg said. “If anything, something massively parallel like a GPU wants to do branch prediction even more liberally than a CPU.”

One thing Ubuntu users should know is that the change will only provide performance boosts when GPUs are handling workloads running the OpenCL framework or the OneAPI Level Zero interface. That likely means that people using games and similar apps will see no benefit.

Ubuntu users who run a custom Linux kernel without Spectre GPU mitigations should keep the compute runtime level mitigations on, a spokesman for Ubuntu developer Canonical said. These users can build a Compute Runtime themselves with the NEO_DISABLE_MITIGATIONS=false flag added.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

The flaw tracked as CVE-2025-6218 and assigned a CVSS score of 7.8 (high severity), was discovered by security researcher whs3-detonator who reported it through Zero Day Initiative on June 5, 2025.

It affects only the Windows version of WinRAR, from version 7.11 and older, and a fix was released in WinRAR version 7.12 beta 1, which was made available yesterday.

"When extracting a file, previous versions of WinRAR, Windows versions of RAR, UnRAR, portable UnRAR source code and UnRAR.dll can be tricked into using a path, defined in a specially crafted archive, instead of user specified path," read the changelog notes.

A malicious archive could contain files with crafted relative paths tricking WinRAR into "silently" extracting those to sensitive locations like system directories and auto-run or startup folders.

If the archive's contents are malicious, these files could launch automatically and trigger dangerous code execution the next time the user logs into Windows.

Although the programs will run with user-level access rather than administrative or SYSTEM rights, they can still steal sensitive data like browser cookies and saved passwords, install persistence mechanisms, or provide remote access for further lateral movement.

The risk of CVE-2025-6218 is contained by the fact that user interaction is required for its exploitation, like opening a malicious archive or visiting a specially crafted page.

However, it is very common for users to utilize old versions of WinRar, and as there are so many ways to distribute malicious archives, the risk remains very high.

Besides CVE-2025-6218, WinRAR 7.12 beta 1 also addresses an HTML injection in report generation problem reported by Marcin Bobryk, where archived file names containing < or > could be injected into the HTML report as raw HTML tags. This could enable HTML/JS injection if reports are opened in a web browser.

Two more minor issues fixed in the latest WinRAR release include incomplete testing of recovery volumes and timestamp precision loss for Unix records.

Although CVE-2025-6218 does not impact Unix versions, Android, and portable UnRAR source code, all users of WinRAR, regardless of the platform, are recommended to upgrade to the latest version immediately.

Currently, there are no reports about CVE-2025-6218, but given the widespread deployment of WinRAR globally and the history of hackers targeting the software, users should update to the latest version immediately.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

News of the arrests come from Le Parisien, which claims the law enforcement operation was carried out by the cybercrime unit (BL2C) of the Paris police department on Monday.

According to reporters, the police carried out simultaneous raids in the regions of Hauts-de-Seine (Paris), Seine-Maritime (Normandy), and Réunion (overseas).

During this action, they have arrested four hackers known online by the handles "ShinyHunters," "Hollow," "Noct," and "Depressed."

For months, rumors circulated that another well-known threat actor, "IntelBroker," had also been arrested. Le Parisien reports that IntelBroker was also arrested by French authorities in February 2025.

The BreachForums hacking forums have gone through numerous iterations over the years but acted as a community for cybercriminals to trade, sell, and leak stolen data, as well as sell access to corporate networks and other illegal cybercrime services.

In 2023, the original BreachForums shut down after its operator, Conor Brian FitzPatrick (aka Pompompurin), was arrested.

Soon after, other threat actors in the community launched BreachForums v2, which was led by threat actors known as ShinyHunters, Baphomet, and, later, IntelBroker.

The five threat actors that were arrested were reportedly involved in the operation of this new launch of the site.

ShinyHunters and IntelBroker were admins/owners of the site, and archived posts show Hollow acting as a moderator.  It is unclear what involvement "depressed" and "noct" had in the operation of the site.

Those cybercriminals are accused of having direct involvement in data breaches against French entities like Boulanger, SFR, France Travail, and the French Football Federation.

The attack against France Travail (formerly Pôle Emploi) was particularly notable for compromising the sensitive details of an estimated 43 million individuals.

IntelBroker rose to notoriety for his involvement in highly publicized breaches at Europol,  General Electric, Weee!, AMD, HPE, Nokia, and Cisco. However, the threat actor entered the spotlight after breaching DC Health Link, the organization that administers the health care plans of U.S. House members, their staff, and their families.

ShinyHunters is the most notorious among those arrested, as the alias has been linked to multiple high-profile data breaches and attacks, including those against Salesforce and PowerSchool, and the SnowFlake attacks, which impacted Santander, Ticketmaster, AT&T, Advance Auto Parts, Neiman Marcus, and Cylance.

The ShinyHunters threat actors have also been involved in a large number breaches in 2025, with the group believed to consist of multiple threat actors operating under the same name.

BreachForums v2 went offline in April 2025 after the site was allegedly breached by a MyBB zero-day vulnerability. The forum never returned online.

BleepingComputer has contacted the Paris police and ANSSI to comment on the validity and accuracy of the reports, but we have not received a response yet.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

The UK’s competition regulator is proposing to loosen Google’s control of its search engine in the first application of Britain’s tough new digital market rules.

The Competition and Markets Authority said on Tuesday that Google could be required to implement new “fair ranking” measures in its search results and give publishers more control over how it uses their content, including in output generated by artificial intelligence.

The CMA said it was minded to hand Google “strategic market status”—a label introduced under new digital market laws this year—in light of its dominant position in search and search advertising, which would require the tech giant to abide by a number of such conduct rules. A final decision will be made by October following a public consultation.

The Big Tech giant became the first company to be targeted under strict new UK digital laws that require businesses with an outsized impact in certain digital markets to be granted the SMS label and subjected to specific rules.

The CMA’s investigation, which was opened in January, examined whether Google’s position in search and advertising was “delivering good outcomes” for consumers and businesses in the UK.

“Google is the world’s leading search tool and plays an important role in all our lives, with the average person in the UK making five to 10 searches a day,” said Sarah Cardell, the CMA’s chief executive. “Our investigation so far suggests there are ways to make these markets more open, competitive and innovative.”

Other conduct rules that the CMA is considering include requirements in how it ranks its search results and for Google’s distribution partners such as Apple to offer “choice screens” to help consumers switch more easily between search providers.

The CMA said Alphabet-owned Google’s dominance made the cost of search advertising “higher than would be expected” in a more competitive market.

Google on Tuesday slammed the proposals as “broad and unfocused” and said they could threaten the UK’s access to its latest products and services.

Oliver Bethell, Google’s senior director for competition, warned that “punitive regulations” could change how quickly Google launches new products in the UK.

“Proportionate, evidence-based regulation will be essential to preventing the CMA’s road map from becoming a roadblock to growth in the UK,” he added.

Bethell’s warning of the potential impact of any regulations on the wider UK economy comes after the government explicitly mandated the CMA to focus on supporting growth and investment while minimizing uncertainty for businesses.

Google said last year that it planned to invest $1 billion in a huge new data center just outside London.

The CMA’s probe comes after Google lost a pair of historic US antitrust cases over its dominance of search and its lucrative advertising business.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

Over the past few weeks, Google has doubled down on throttling and preventing playback on YouTube videos for users with ad blockers installed on their devices. At this point, it feels like a cat-and-mouse chase, leaving Google stuck in a "hamster wheel" of chasing down the loopholes users are leveraging to bypass YouTube's ads.

Recently, Belgian software engineer Stijn Spanhove developed an ingenious augmented reality (AR) app designed to identify and block ads in real life, including billboards and product branding (via Tom's Hardware).

The Google Threat Intelligence Group (GTIG) has explained what happened on Google's blog. It worked with Citizen Lab, which is known for its investigative reports, to probe the incident.

GITG had observed that hackers had crafted a sophisticated, personal, social engineering attack to target Keir Giles, a prominent British researcher on Russia. Google's team has labeled the threat actor as UNC6293, a likely Russia state-sponsored cyber actor, and links them with low confidence to APT29 / ICECAP (also called Cozy Bear), which has ties to Russia's Foreign Intelligence Service (SVR).

We have seen phishing attacks that involved messaging apps, and mercenary spyware such as Pegasus, but these hackers used a new technique. They had taken precautions to prevent Mr. Giles from getting suspicious. On May 22, 2025, the attackers impersonated a U.S. State Department official, "Claudie S. Weber", in an email that invited Mr. Giles for a private online consultation to discuss something in his field of expertise. The hacker simply used a Gmail address, but had CC-ed 4 @state.gov email addresses, likely to pose as a legitimate sender, and they had sent the email during Washington D.C. working hours too. In reality, the .gov addresses likely do not exist. Citizen Lab says that the language and grammar seems to suggest that the hackers had used a large language model or some similar AI tools to craft the emails.

Mr. Giles replied that the date may not work for him, to which the attacker replied inviting him to register for an account the State Department’s “MS DoS Guest Tenant” platform, where he would be able to attend future meetings with ease, wherever they take place. About 10 email exchanges later, the hacker sent the victim a PDF file with details on how to register for the said account. The PDF in question was carefully crafted to look like an official document and contained markings, revision history.

This is where the mystery unfolded, as the PDF contained instructions to create an app-specific password for his Gmail account. Google says that this threat actor had targeted prominent academics and critics of Russia from early April to June 2025, building rapport, luring them to set up app specific passwords (ASPs), which they then exploit to gain persistent access to the victim's mailbox. Unfortunately, Mr. Giles was tricked by the patient, clever hackers, into creating ASPs for his accounts.

Google says it identified the attack and managed to lock down the impacted accounts, while blocking the attacker's emails. This is when Mr. Giles had discovered that a suspicious login attempt had been made in early June. An extensive report of the incident has been published by the security researches at Citizen Lab.

GITG says there was a similar-crafted attack that involved a campaign with a Ukrainian theme and a Microsoft ASP, where the attackers directed the target to share the app specific password with them, to set up a mail client and spy on their email correspondence.

This is a rare case scenario in which attackers targeted a person of interest. I'm not saying this won't happen to us commoners, but the fact that app specific passwords were used to hack the account is concerning. Just be careful which app you're signing in to using ASPs, or avoid them altogether and use OAuth to sign in to apps with your Google account, or Apple's, etc. In case you fear being state sponsored attacks, you can enable Lockdown Mode on your iPhone, or Advanced Protection Mode on Android.

While we are on the topic of security, there are reports circling around which state that 16 Billion passwords were exposed in a data breach, and that this data includes user credentials for Google, Facebook, Apple, etc. Bleeping Computer says this wasn't a breach at all, rather this is just a dataset, i.e. a collection of previous data breaches.

Google recently advised users to stop using passwords in favor of passkeys, and social sign-ins. I think this story provides some better context to its recommendation.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

During the February 2025 incident, Salt Typhoon exploited the CVE-2023-20198 flaw, a critical Cisco IOS XE vulnerability allowing remote, unauthenticated attackers to create arbitrary accounts and gain admin-level privileges.

The flaw was first disclosed in October 2023, when it was reported that threat actors had exploited it as a zero-day to hack over 10,000 devices.

Despite a significant period having passed, at least one major telecommunications provider in Canada still hadn't patched, giving Salt Typhoon an easy way to compromise devices.

"Three network devices registered to a Canadian telecommunications company were compromised by likely Salt Typhoon actors in mid-February 2025," reads the bulletin.

"The actors exploited CVE-2023-20198 to retrieve the running configuration files from all three devices and modified at least one of the files to configure a GRE tunnel, enabling traffic collection from the network."

In October 2024, following Salt Typhoon breaches on multiple American broadband providers, the Canadian authorities flagged reconnaissance activity that targeted dozens of key organizations in the country.

No actual breaches were confirmed at the time, and despite the calls to elevate security, some critical service providers didn't take the required action.

The Cyber Centre notes that, based on separate investigations and crowd-sourced intelligence, activity likely tied to Salt Typhoon extends beyond the telecommunications sector, targeting multiple other industries.

In many cases, the activity is limited to reconnaissance, though the data stolen from internal networks can be used for lateral movement or supply chain attacks.

The Cyber Centre warned that the attacks against Canadian organizations "will almost certainly continue" over the next two years, urging critical organizations to protect their networks.

Telecommunication service providers who handle valuable data, such as call metadata, subscriber location data, SMS contents, and government/political communications, are prime targets for state-sponsored espionage groups.

Their attacks typically target edge devices at the network perimeter, routers, firewalls, and VPN appliances, while MSPs and cloud vendors are also targeted for indirect attacks on their customers.

The Cyber Centre's bulletin lists resources providing edge device hardening instructions for critical infrastructure operators.

Salt Typhoon attacks have impacted multiple telecom companies in dozens of countries, including AT&T, Verizon, Lumen, Charter Communications, Consolidated Communications, and Windstream.

Last week, Viasat also confirmed that Salt Typhoon had breached them, but customer data was not impacted.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

DDoS attacks flood targets with massive amounts of traffic with the sole aim to overwhelm servers and create service slowdowns, disruptions, or outages.

This new attack, which is 12% larger than the previous record, delivered a massive data volume of 37.4 TB in just 45 seconds. This is the equivalent of about 7,500 hours of HD streaming or 12,500,000 jpeg photos.

Cloudflare, a web infrastructure and cybersecurity giant specializing in DDoS mitigation, offers a network-layer protection service called 'Magic Transit,' which was used by the targeted customer.

The attack came from 122,145 source IP addresses spread across 161 countries, with the majority based in Brazil, Vietnam, Taiwan, China, Indonesia, and Ukraine.

The "garbage" data packages were delivered across multiple destination ports on the victim's system, averaging 21,925 ports per second and peaking at 34,517 ports/second.

This tactic of scattering traffic helps overwhelm firewall or intrusion detection systems, but Cloudflare claims to have ultimately been able to mitigate the attack without human intervention.

Cloudflare's anycast network dispersed attack traffic to 477 data centers in 293 locations, leveraging key technologies such as real-time fingerprinting and intra-data center gossiping for real-time intelligence sharing and automated rule compilation.

Though nearly the entire attack volume came from UDP floods, accounting for 99.996% of the total traffic, there were multiple other vectors involved, including:

• QOTD reflection
• Echo reflection
• NTP amplification
• Mirai botnet UDP flood
• Portmap flood
• RIPv1 amplification

Each vector exploited legacy or poorly configured services. While this was only a tiny percentage of the attack, it served as part of the attackers' evasion and effectiveness strategy and could also help probe for weaknesses and misconfigurations.

Cloudflare says valuable IoCs from this attack were timely included in its DDoS Botnet Threat Feed, a free service that helps organizations block malicious IP addresses preemptively.

Over 600 organizations have subscribed to this feed, and the internet giant calls any others at risk of massive DDoS attacks to do the same and block the attacks before they reach their infrastructure.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

Major platforms were recently hit by what cybersecurity experts are calling "the largest data breach." The Cybernews research team uncovered a whopping 16 billion leaked login credentials, including passwords to Facebook, Google, and Apple accounts buried under massive datasets (via Forbes).

The number of cybersecurity threats threatening the safety and privacy of your confidential data is on the rise, with bad actors leveraging sophisticated tools like generative AI to deploy their deceptive ploys.

Now, Cybernews has been looking into this issue since the beginning of the year, discovering "30 exposed datasets containing from tens of millions to over 3.5 billion records each."

Perhaps more concerning, none of the exposed datasets had been previously reported, further elaborating the magnitude of the data breach. However, there might be an exception for the 184 million record “mysterious database” uncovered by security researchers, as reported by WIRED.

According to the research team:

"This is not just a leak – it’s a blueprint for mass exploitation. With over 16 billion login records exposed, cybercriminals now have unprecedented access to personal credentials that can be used for account takeover, identity theft, and highly targeted phishing."

"What’s especially concerning is the structure and recency of these datasets – these aren’t just old breaches being recycled. This is fresh, weaponizable intelligence at scale."

A new report from POLITICO confirms that Meta, which owns the messaging service, has informed Ireland's privacy regulator that the new advertising model will not roll out in the European Union for quite some time, even as it appears elsewhere in the coming months. This is not some charitable act, of course. The delay gives European regulators time to scrutinize the plan, which involves using ad preferences from linked Facebook and Instagram accounts to target users.

This situation follows a pattern of other "wins" for EU users, like the changes in iOS 17.4 that finally enabled sideloading. This opened the door for alternative app stores and the (temporary) return of games like Fortnite to iPhones in the region. Similarly, we are seeing Microsoft finally back off from shoving Edge down the throats of EU users, all thanks to the Digital Markets Act. This legislation has put pressure on big tech companies to operate more "fairly" within the bloc, leading to changes that users everywhere else can only dream of for now.

These regulations are precisely what companies like Apple hate. Remember, Apple has issued a warning to Australia, telling the country not to follow Europe's lead on these matters because it would create massive security and privacy risks. Apple argues that its control over the ecosystem keeps users safe, so any attempt to break that open is dangerous.

The Irish Data Protection Commission will be meeting with WhatsApp to discuss the matter further. According to Commissioner Des Hogan, they plan to discuss the ad model with other European data protection authorities to gather any collective concerns.

Commissioner Dale Sunderland noted that discussions with the company are "still early days", and it is too soon to identify what, if any, specific "red line issues" might exist with Meta's advertising plans. For now, Europeans can continue using their ad-free messenger, while the rest of the world prepares for the inevitable.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

DuckDuckGo is a privacy-focused web browser and search engine that doesn't track users' searchers or browsing history.

The browser, which became available as a public beta for macOS and Windows in October 2022 and June 2023, respectively, blocks all trackers by default, does not engage in personalized search profiling, and offers powerful anonymity tools.

Scam Blocker has been a component of the browser's privacy toolkit since its launch in 2018, protecting users attempting to visit known malware distribution and phishing URLs.

As part of the latest update, in addition to blocking phishing sites and malware, Scam Blocker now also detect and block the following:

• Fake e-commerce stores
• Scam investment and crypto trading sites
• Survey scams with false cash rewards
• Scareware (fake virus alerts prompting bogus tech support)
• Malvertising (malicious tracker-powered ads)

When the user attempts to load a webpage, the tool scans the URLs locally against a continually updated (every 20 minutes) threat list supplied by cybersecurity firm Netcraft.

Rare or unknown threats are checked against DuckDuckGo servers using an anonymous cryptographic process, ensuring that this process doesn't compromise user privacy.

When a scam site is detected, users are served a prominent warning message giving them the option to leave or ignore it and proceed to the risky site.

DuckDuckGo notes that, unlike Chrome, Safari, or Firefox, which rely on Google Safe Browsing and hence share data with Google, Scam Blocker offers privacy-first protection with no external data sharing.

Scam Blocker is activated in the browser by default and requires no account to work effectively.

Privacy Pro subscribers get a significant perk, as Scam Blocker will work across any internet apps on their devices when the DuckDuckGo VPN is active, covering other browsers as well.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

DENVER—Most smart TV operating system (OS) owners are in the ad sales business now. Software providers for budget and premium TVs are honing their ad skills, which requires advancing their ability to collect user data. This is creating an “inherent conflict” within the industry, Takashi Nakano, VP of content and programming at Samsung TV Plus, said at the StreamTV Show in Denver last week.

During a panel at StreamTV Insider’s conference entitled “CTV OS Leader Roundtable: From Drivers to Engagement and Content Strategy,” Nakano acknowledged the opposing needs of advertisers and smart TV users, who are calling for a reasonable amount of data privacy.

“Do you want your data sold out there and everyone to know exactly what you’ve been watching … the answer is generally no,” the Samsung executive said. “Yet, advertisers want all of this data. They wanna know exactly what you ate for breakfast."

Nakano also suggested that the owners of OSes targeting smart TVs and other streaming hardware, like streaming sticks, are inundated with user data that may not actually be that useful or imperative to collect:

I think that there's inherent conflict in the ad ecosystem supplying so much data. … We're fortunate to have all that data, but we're also like, ‘Do we really want to give it all, and hand it all out?’ There's a constant conflict around that, right? So how do we create an ecosystem where we can serve ads that are pretty good? Maybe it's not perfect ...

Today, connected TV (CTV) OSes are largely built around not just gathering user data, but also creating ways to collect new types of information about viewers in order to deliver more relevant, impactful ads. LG, for example, recently announced that its smart TV OS, webOS, will use a new AI model that informs ad placement based on viewers’ emotions and personal beliefs.

However, at a certain point, OS operators may be gathering more data than is truly helpful, which crosses viewers’ boundaries. Nakano said:

I think we have to get comfortable between the advertiser, the operating system, and the systems in between to create more efficiencies. Because I do think it’s broken. I do think that there's so many different hops that these requests go through that aren't likely necessary and that they're a byproduct of inefficiencies that we try to patch.

The executive added that he thinks the industry needs to "look at our ad ecosystem holistically and say, 'Okay, how can we make this work?'" because knowing everything about a particular streaming user is "not realistic."

Spotlight on software

The ability for streaming OSes to generate revenue is increasingly important to TV and streaming hardware makers such as Samsung, Amazon, LG, Roku, Vizio, and Walmart, which struggle with low margins and growing unit sales and seek more reliable growth from software’s ability to advertise to and track users.

In a forecast shared this month, WPP Media (formerly GroupM) predicted that streaming TV will represent about 27 percent of TV advertising revenue in 2025 at $41.8 billion. The world’s biggest media investment firm expects streaming ad revenue to reach $71.9 billion by 2030. In January, research firm eMarketer predicted that CTV display ad spend would reach $33.35 billion this year and show double-digit annual growth rates to reach $46.89 billion in 2028. That gives OS operators a strong incentive to build software that can extract useful data from viewers and determine the types of ads that viewers will pay attention to.

However, viewers aren’t demonstrating as much focus on the software of their streaming hardware. TV brands that Ars has spoken with have frequently pointed to picture quality and price as the top considerations for users. During the StreamTV Show panel, Nakano pointed to brand and picture quality as the top factors for people. He noted, however, that those “who buy Samsung TVs generally use the operating system, and that's how they navigate through the UI.”

Katherine Pond, Vizio’s group VP of platform content and partnerships, noted during the panel that once someone buys a TV, OS operators are “not really in competition anymore.” However, OEMs still try to ensure that customers use their OSes, so that viewers are engaged for ads and potentially buy more devices from that brand.

“You have to create a fitting, and you create a fitting by getting people into content that they love as soon as they can, or helping with discovery [and] helping search,” Jennifer Vaux, VP of content acquisition and programming at Roku Media, said during the panel.

As TVs progress toward a battle of data, ads, and tracking over hardware sales and panel advancements, TV brands are largely invested in driving OSes that can serve advertisers’ needs. But there’s also a demand for navigable OSes that help users maximize their TV’s usage and find content they’ll enjoy. Here, we see another conflict facing TV OS owners. However, without ensuring that TV OSes serve users as well as they serve corporations, viewers are likely to replace their hardware’s software with slicker alternatives, like an Apple TV box.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

The first flaw (tracked as CVE-2025-6018) was found in the configuration of the Pluggable Authentication Modules (PAM) framework on openSUSE Leap 15 and SUSE Linux Enterprise 15, allowing local attackers to gain the privileges of the "allow_active" user.

The other security bug (CVE-2025-6019) was discovered in libblockdev, and it enables an "allow_active" user to gain root permissions via the udisks daemon (a storage management service that runs by default on most Linux distributions).

While successfully abusing the two flaws as part of a "local-to-root" chain exploit can let attackers quickly gain root and completely take over a SUSE system, the libblockdev/udisks flaw is also extremely dangerous on its own.

"Although it nominally requires 'allow_active' privileges, udisks ships by default on almost all Linux distributions, so nearly any system is vulnerable," said Qualys TRU senior manager Saeed Abbasi.

"Techniques to gain 'allow_active,' including the PAM issue disclosed here, further negate that barrier. An attacker can chain these vulnerabilities for immediate root compromise with minimal effort."

The Qualys Threat Research Unit (TRU), which discovered and reported both flaws, has also developed proof-of-concept exploits and successfully targeted CVE-2025-6019 to get root privileges on Ubuntu, Debian, Fedora, and openSUSE Leap 15 systems.

Admins urged to patch immediately

The Qualys Security Advisory team has shared more technical details regarding these two vulnerabilities here and linked to security patches in this Openwall post.

"Root access enables agent tampering, persistence, and lateral movement, so one unpatched server endangers the whole fleet. Patch both PAM and libblockdev/udisks everywhere to eliminate this path," Abbasi added.

"Given the ubiquity of udisks and the simplicity of the exploit, organizations must treat this as a critical, universal risk and deploy patches without delay."

In recent years, Qualys researchers have discovered several other Linux security vulnerabilities that let attackers hijack unpatched Linux systems, even in default configurations.

Security flaws they discovered include a flaw in Polkit's pkexec component (dubbed PwnKit), one in glibc's ld.so dynamic loader (Looney Tunables), another in the Kernel's filesystem layer (dubbed Sequoia), and one in the Sudo Unix program (aka Baron Samedit).

Shortly after the Looney Tunables flaw was disclosed, proof-of-concept (PoC) exploits were released online. One month later, attackers began exploiting it to steal cloud service provider (CSP) credentials using Kinsing malware.

Qualys also recently found five LPE vulnerabilities introduced over 10 years ago in the needrestart utility used by default in Ubuntu Linux 21.04 and later.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

Google is on a bit of a crusade against ad blockers. Last week, the tech giant started showing warning messages stating, “Ad blockers are not allowed on YouTube.”

Another prompt stating "Ad blockers violate YouTube’s terms of service" will also appear in some cases if you try to block ads while watching YouTube videos.

Now, it appears that YouTube is throttling videos and slowing down the user experience if an ad blocker is enabled.

A user on the Brave browser forum shared the following:

"Hi, been using brave to block YouTube ads and it’s technically working but most videos will be black screen for the length of an ad or two with YouTube saying “experiencing interruptions” on the bottom left corner, and one of the possible reasons being ad blockers from what it is saying, is there anything I can do."

Some users have been prevented from viewing videos altogether unless ad blockers are disabled.

The push appears to be part of an effort to convince users to subscribe to YouTube Premium, which removes ads but costs $14 per month.

Apart from ads in Statuses, Meta is also letting people pay to promote their Channels. This means businesses and creators can pay to get their broadcast channels discovered by more users. A few will even be able to charge for subscriptions to their channels for exclusive content. The company says it will not take a fee from these subscriptions at first, but that is probably not going to last forever. Meta is a business, after all, not a charity.

Meta has tried to calm everyone down by saying your personal chats and calls will remain encrypted and untouched. The company claims it only uses general information like your country and language, plus the channels you follow, to figure out which ads to show you. However, if you have linked your WhatsApp to Meta's Account Center, then your ad preferences from Facebook and Instagram will follow you.

This entire plan certainly excited Wall Street. After the news broke, Meta's stock climbed 2.8% in pre-market trading, as investors salivated over the prospect of finally monetizing WhatsApp's 2 billion+ users.

Ads in messaging apps are not new at all. Take Telegram, for example. The app shows sponsored messages in large public channels, but it also gives users a way out. For a monthly fee, you can get Telegram Premium, and all those ads disappear (plus a bunch of advanced paid features). Maybe, in the future, WhatsApp will offer a similar premium service for people willing to pay to escape the ads.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

Google is seemingly ramping up its campaign against ad blockers on YouTube. Over the past few years, it's become increasingly annoying to watch content on the social video sharing platform, as many videos are rife with multiple unskippable ads.

Last week, reports emerged about Google preventing playback on YouTube videos for users with ad-blockers installed on their devices. “Ad blockers violate YouTube’s terms of service,” added Google.

Google's aggressive campaign against ad-blockers in YouTube has now taken a turn for the worse, after reigning down on the remaining few loopholes in browsers and third-party extensions that allowed users to enjoy ad-free videos without necessarily getting the $14/month YouTube Premium subscription.

Users have flagged a new issue, indicating that Google is intentionally slowing down YouTube videos for users with ad-blockers installed on their devices (via PCWorld). According to a user on the Brave browser forum:

"Hi, been using brave to block YouTube ads and it’s technically working but most videos will be black screen for the length of an ad or two with YouTube saying “experiencing interruptions” on the bottom left corner, and one of the possible reasons being ad blockers from what it is saying, is there anything I can do."

Some users have even indicated that they received a three-video countdown asking them to disable their ad-blockers or get blocked from watching YouTube videos. Failure to disable the third-party software resulted in users being barred from watching videos until they updated and restarted their browsers. Users have shared accounts of experiencing a 5 to 10 second pause on every video with an "Experiencing interruptions? Find out why" popup.

YouTube users with ad-blockers installed on their devices are redirected to a technical support page by Google that directs them on how to troubleshoot YouTube video errors:

Reddit is launching a new feature for advertisers that slots positive posts from Reddit users right under their ads.

The new alpha feature, called Conversation Summary Add-ons, “dynamically integrates positive content from Reddit users directly below an advertiser’s creative, putting community conversations front-and-center in the user experience and blending AI-driven efficiency with real human perspectives,” according to a post from Reddit.

As shown by Reddit, you’ll be able to scroll through the posts that appear under an ad. You’ll also see a short summary of what Reddit users are saying about the advertiser. Jackbox Games and Lucid are alpha testers of the feature.

GIF: Reddit

Powering this new feature is an “engine” Reddit calls Reddit Community Intelligence. According to the company, Reddit Community Intelligence can turn the platform’s more than 22 billion posts and comments “into structured intelligence for smarter marketing decisions.”

As part of today’s announcements, which Reddit is making alongside the Cannes Lions festival, the company is also introducing a “scalable, AI-powered social listening tool” called Reddit Insights. “Informed by proprietary metadata, it provides precise, real-time insights that help marketers confidently plan campaigns, validate creative ideas, and make smarter business decisions,” Reddit says.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

The security issue is tracked as CVE-2025-3464 and received a severity score of 8.8 out of 10.

It could be exploited to bypass authorization and affects the AsIO3.sys of the Armoury Crate system management software.

Armoury Crate is the official system control software for Windows from ASUS, providing a centralized interface to control RGB lighting (Aura Sync), adjust fan curves, manage performance profiles and ASUS peripherals, as well as download drivers and firmware updates.

To perform all these functions and provide low-level system monitoring, the software suite uses the kernel driver to access and control hardware features.

Cisco Talos' researcher Marcin "Icewall" Noga reported CVE-2025-3464 to the tech company.

According to a Talos advisory, the issue lies in the driver verifying callers based on a hardcoded SHA-256 hash of AsusCertService.exe and a PID allowlist, instead of using proper OS-level access controls.

Exploiting the flaw involves creating a hard link from a benign test app to a fake executable. The attacker launches the app, pauses it, and then swaps the hard link to point to AsusCertService.exe. 

When the driver checks the file's SHA-256 hash, it reads the now-linked trusted binary, allowing the test app to bypass authorization and gain access to the driver.

This grants the attacker low-level system privileges, giving them direct access to physical memory, I/O ports, and model-specific registers (MSRs), opening the path to full OS compromise.

It is important to note that the attacker must already be on the system (malware infection, phishing, compromised unprivileged account) to exploit CVE-2025-3464.

However, the extensive deployment of the software on computers worldwide may represent an attack surface large enough for exploitation to become attractive.

Cisco Talos validated that CVE-2025-3464 impacts Armoury Crate version 5.9.13.0, but ASUS' bulletin notes that the flaw impacts all versions between 5.9.9.0 and 6.1.18.0.

To mitigate the security problem, it is recommended to apply the latest update by opening the Armoury Crate app and going to "Settings"> "Update Center"> "Check for Updates"> "Update."

Cisco reported the flaw to ASUS in February but no exploitation in the wild has been observed so far. However, "ASUS strongly recommends that users update their Armoury Crate installation to the latest version."

Windows kernel driver bugs that lead to local privilege escalation are popular among hackers, including ransomware actors, malware operations, and threats to government agencies.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

The fact that a Microsoft work email account was potentially hacked strongly suggests The Washington Post utilizes Microsoft 365, which makes us question the security of Microsoft’s widely used enterprise services. Given that Microsoft 365 is very popular, it is a hot target for attackers.

Microsoft's enterprise security offerings and challenges

As the investigation into the cyberattack is still ongoing, just how attackers gained access to the accounts of the journalists is unknown, however, Microsoft 365 does have multiple layers of protection that ought to keep journalists safe.

One of the security tools is Microsoft Defender for Office 365. If the hackers tried to gain access with malicious links, Defender provides protection against any malicious attachments, links, or email-based phishing attempts with the Advanced Threat Protection feature. Defender also helps to protect against malware that could be used to target journalists at The Washington Post.

Another security measure in place is Entra ID which helps enterprises defend against identity-based attacks. Some key features of Entra ID include multi-factor authentication which protects accounts even if a password is compromised, and there are granular access policies that help to limit logins from outside certain locations, unknown devices, or limit which apps can be used.

While Microsoft does offer plenty of security technologies with M365, hacks can still take place due to misconfiguration, user-error, or through the exploitation of zero-day vulnerabilities. Essentially, it requires efforts from both Microsoft and the customer to maintain security.

Lessons for organizations using Microsoft 365

The incident over at The Washington Post serves as a stark reminder that all organizations, not just news organizations, should audit and strengthen their security setups. Some of the most important security measures you can put in place include mandatory multi-factor authentication (MFA) for all users, especially for privileged accounts; strong password rules such as using letters, numbers, and symbols; regular security awareness training; and installing any security updates in a timely manner.

Many of the cyberattacks that we learn about from companies like Microsoft involve hackers taking advantage of the human in the equation, such as being tricked into sharing passwords or sharing sensitive information due to trickery on behalf of the hackers. This highlights that employee training is crucial in protecting systems and that Microsoft’s technologies, as advanced as they are, can’t mitigate all attacks 100 percent of the time.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

The incident was discovered on Thursday evening and the publication started an investigation. On Sunday, June 15, an internal memo was sent to employees, informing them of a “possible targeted unauthorized intrusion into their email system.”

According to The Wall Street Journal, the memo was signed by Executive Editor Matt Murray and informed that Microsoft accounts of a limited number of journalists were affected.

Owned by Amazon founder Jeff Bezos, The Washington Post is one of the most influential newspaper publications in the United States.

Internal sources told The Wall Street Journal that the attack targeted journalists writing on national security and economic policy topics, as well as some who write about China.

Advanced persistent threats (APTs), or state-sponsored actors, often target email systems like Microsoft Exchange. Two years ago, Chinese hackers leveraged insecure Exchange endpoints to breach email accounts of two dozen government agencies globally, accessing extremely sensitive and confidential data.

But Chinese threat groups have a long history of exploiting Exchange vulnerabilities in highly organized campaigns. They targeted U.S. government agencies in 2020, and multiple NATO members in 2021.

Last year, Microsoft warned that hackers were exploiting a critical privilege elevation bug in Exchange as a zero-day to perform NTLM relay attacks.

ESET cybersecurity company also discovered in 2021 multiple Chinese threat groups, including APT27, Bronze Butler, and Calypso, exploiting zero-day vulnerabilities in Microsoft Exchange.

Washington Post has not shared publicly any details about the attack.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

Tracked under ID "CVE-2025-2884" (AMD is tracking it as "AMD-SB-4011"), the vulnerability allows an attacker to exploit the vulnerability by sending malicious commands to read data stored in the TPM via an information disclosure flaw or potentially impact TPM availability on systems through a denial of service attack. This is a type of out-of-bound read security flaw.

The TCG notes that the flaw occurs in the CryptHmacSign function due to improper validation of a message digest or hash via the hash-based message authentication code (HMAC) signature scheme, leading to an out-of-bounds situation. TCG explains in its VRT0009 advisory:

The reference code did not implement appropriate consistency check in CryptHmacSign() resulting in potential out-of-bound read. The out-of-bound read occurs on the buffer passed to the ExecuteCommand() entry point. CVE-2025-2884 may allow an attacker to read up to 65535 bytes past the end of that buffer.

The Common Vulnerability Scoring System (CVSS) score of the flaw is 6.6 indicating a medium level of severity. This is typically the case for most local-level attacks as in order to exploit such a flaw, the threat actor must have physical access to a device. Regardless, AMD has issued firmware to patch the vulnerability on Ryzen 7000, 8000 (Zen 4) and Ryzen 9000 (Zen 5) parts.

AMD has confirmed that AGESA (AMD Generic Encapsulated Software Architecture) firmware Combo PI (Platform Initialization) 1.2.0.3e mitigates the flaw. The company notes that the said firmware fixes "ASP fTPM + Pluton TPM" issue. If you are wondering, ASP refers to AMD Secure Processor which is "a dedicated hardware component embedded in every system-on-a-chip."

AMD's motherboard vendor partners like Asus and MSI have already begun rolling out the firmware update. MSI has a blog post about the 1.2.0.3e Combo PI as it mentions several new upcoming features including support for new CPUs, better memory compatibility, and more. MSI writes:

This update not only adds support for upcoming new CPU, but also enables all AM5 motherboards to support large-capacity 64GBx4 DRAM chips. .... Even with four 64GB DRAM fully installed, the system can still achieve a stable overclocking speed of 6000MT/s, and even up to 6400MT/s.

 

In addition, this update optimizes 2DPC 1R capability and includes overclocking enhancements specifically for Samsung's 4Gx8 chips.

Interestingly, Asus notes that this firmware update is irreversible as it is a major release. Thus one would hope that it is a very stable release and given that this is the "e" stepping of the firmware, there are pretty good chances of that.

Other vendors like Gigabyte and ASRock are yet to release their updates.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

The company operates around 1,380 retail stores in nearly 70 countries and has reported net sales of $1.353 billion for the first quarter of 2025, with a forecasted net sales range of up to $6.3 billion for the year.

In a Thursday filing with the U.S. Securities and Exchange Commission, the company disclosed that all restored critical systems are now fully operational and that it's working with external experts to assess the cyberattack's impact.

It also believes the incident will likely have no material impact on its yearly fiscal results, even though it may continue to incur expenses related to the attack.

"We immediately enacted our response protocols to contain and eradicate unauthorized network access, and third-party experts were engaged. All critical systems are restored and fully operational," Victoria's Secret said.

"We continue to assess the full scope and impact of the incident. This incident has not caused a material disruption to our operations to date and we do not believe it will have a material impact to our fiscal year 2025."

Quarterly earnings release delayed

As the company revealed after disclosing the incident last month, it was forced to take down corporate systems, some in-store services, and the e-commerce website as a precaution on May 26.

A Victoria's Secret spokesperson told BleepingComputer that the fashion retail giant was working to restore operations and had hired external experts to investigate the breach.

In a June 3 press release, Victoria's Secret added that it had to postpone releasing financial results for the first quarter because systems needed during this process were unreachable after the attack.

"The restoration process has prevented employees from accessing certain systems and information needed to support the Company's release of its financial results for the first quarter ended May 3, 2025," it stated. "As a result, the Company is postponing the date of its previously announced first quarter 2025 earnings release and earnings call webcast."

Victoria's Secret didn't reply to an email from BleepingComputer requesting more details on the nature of the incident, and no ransomware operations have claimed responsibility for the attack since then.

This security incident follows a series of attacks targeting other fashion companies in recent weeks, including French luxury fashion brands Cartier and Dior. German sportswear giant Adidas was also breached last month, with the threat actors stealing some of its customers' data after hacking into a customer service provider's systems.

Starting in April, a campaign linked to Scattered Spider threat actors and the DragonForce ransomware gang has also targeted multiple retailers across the United Kingdom, including Marks & Spencer, Co-op, and Harrods.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

The flaw affects nearly every system that trusts Microsoft's "UEFI CA 2011" certificate, which is pretty much all hardware that supports Secure Boot.

Binarly researcher Alex Matrosov discovered the CVE-2025-3052 flaw after finding a BIOS-flashing utility signed with Microsoft's UEFI signing certificate.

The utility was originally designed for rugged tablets but as it was signed with Microsoft's UEFI certificate, it can run on any Secure Boot-enabled system.

Further investigations discovered that the vulnerable module had been circulating in the wild since at least late 2022 and later uploaded to VirusTotal in 2024, where Binarly spotted it.

Binarly disclosed the flaw to CERT/CC on February 26, 2025, with CVE-2025-3052 being mitigated today as part of the Microsoft June 2025 Patch Tuesday.

However, during this process, Microsoft determined that the flaw impacted 13 other modules, which were added to the revocation database.

"During the triage process, Microsoft determined that the issue did not aect just a single module as initially believed, but actually 14 dierent modules," explains Binarly.

"For this reason, the updated dbx released during the Patch Tuesday on June 10, 2025 contains 14 new hashes."

The Secure Boot bypass

The flaw is caused by a legitimate BIOS update utility signed with Microsoft's UEFI CA 2011 certificate, which is trusted on most modern systems utilizing UEFI firmware.

This utility reads a user-writable NVRAM variable (IhisiParamBuffer) without validating it. If an attacker has admin rights to an operating system, they can modify this variable so arbitrary data is written to memory locations during the UEFI boot process. This is done before the operating system, or even the kernel, is loaded.

Using this vulnerability, Binarly created a proof-of-concept exploit to zero out the 'gSecurity2' global variable, which is used to enforce Secure Boot.

"For our proof of concept (PoC), we chose to overwrite the global variable gSecurity2," explains the Binarly report.

"This variable holds a pointer to the Security2 Architectural Protocol, which the LoadImage function uses to enforce Secure Boot. By setting it to zero, we eectively disable Secure Boot, allowing the execution of any unsigned UEFI modules."

Once disabled, attackers can install bootkit malware that can hide from the operating system and turn off further security features.

To fix CVE-2025-3052, Microsoft has added the affected module hashes to the Secure Boot dbx revocation list. Binarly and Microsoft urge users to install the updated dbx file immediately through today's security updates to protect their devices.

Also today, another Secure Boot bypass affecting UEFI-compatible firmware based on Insyde H2O was disclosed by Nikolaj Schlej. The flaw, dubbed Hydroph0bia and tracked as CVE-2025-4275, was reported to Insyde and patched 90 days after disclosure.

Binarly has shared a video demonstrating how their PoC can disable Secure Boot and cause a message to display before the operating system boots.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend  

The message reads "Ad blockers violate YouTube's Terms of Service", followed by three reasons why video playback may not be working and why ads are great. Also, why YouTube Premium is an option for users who want to go ad-free (not YouTube Premium Lite, which requires payment but still shows you ads, and soon even more ads).

The prompt, displayed on top of the video page itself, offers several options. The two core buttons -- allow YouTube ads and Try YouTube Premium -- are the solutions that Google suggests. The first has users disable their content blocker on YouTube. Means, ads will play, but so will the videos. The second is a monthly subscription option to get rid of advertisement on YouTube without using an ad blocker.

There is also an option to "report an issue", which may be useful if you get the message without using an ad blocker. Some users may also get an option to close the prompt using an x-button displayed in the top right corner. It is possible that this option is limited and going away after some time.

I received the prompt (in German) when I used Brave Browser to watch a video on YouTube. Notice the x-icon in the top right corner.

I did not get the warning prompt in Edge or Firefox with uBlock Origin installed. Google is likely showing the prompt to a low percentage of YouTube users who use ad blockers.

When I turned on a VPN and opened YouTube in Incognito Mode, I got the same prompt in English.

What you can do about it immediately

Here are a few suggestions that may help you deal with the issue without subscribing to YouTube Premium or turning off your ad blocker on YouTube.

• Try the browser's private browsing mode. Sometimes, this is enough to get the ball rolling again. Downside is that you are not signed in to your account in that mode by default.
• Try a different browser. I did not get the prompt in any of the other browsers that I tried.
• Update the content blocker or filter list of the content blocker.
• Some content blockers are better than others, try uBlock Origin.

Good content blockers may receive updates quickly that deal with the modified anti-ad-blocking prompt when you open YouTube. It is a cat and mouse game that seemingly never ends.

Now You: do you use YouTube? If so, have you encountered such a prompt before? Feel free to leave a comment down below.

Source

Hope you enjoyed this news post.

Thank you for appreciating my time and effort posting news every day for many years.

News posts... 2023: 5,800+ | 2024: 5,700+ | 2025 (till end of May): 2,377

RIP Matrix | Farewell my friend