👁️ InfoSec.Watch — Issue # 106

This week the spotlight is on a critical Oracle E‑Business Suite zero-day being actively exploited by Cl0p, underscoring the rising risk of supply‑chain–adjacent enterprise software. Also in focus: VMware zero-day patching, Unity engine’s LFI, and surging scans on Palo Alto portals. The stakes: high exposure in business‑critical systems.

Oracle published an emergency alert for CVE‑2025‑61882, a remote code execution flaw in E‑Business Suite that requires no authentication — and there is evidence it’s already being exploited in Cl0p data theft campaigns. The Hacker News
💡 Key Takeaway: Prioritize patching all exposed Oracle EBS instances immediately. Use IOCs from Oracle’s advisory and Tenable’s FAQ to hunt for signs of compromise.

Broadcom released fixes for CVE‑2025‑41244 in VMware Tools / Aria Operations, a privilege escalation bug exploited by UNC5174. TechRadar
💡 Key Takeaway: Update all VMware Tools / Aria components promptly, especially in VMs exposed to untrusted users, and validate no unauthorized root escalation has occurred.

Unity disclosed a serious Local File Inclusion (LFI) vulnerability dating back to version 2017.1. A patched version and runtime patcher are available for affected platforms (Android, macOS, Windows) — though some Linux / anti-cheat builds may remain vulnerable. PC Gamer
💡 Key Takeaway: Audit Unity‑based applications (especially cross‑platform) and recompile / republish with the patch. For non‑recompilable builds, apply vendor patchers where supported.

A newly disclosed local code execution vulnerability in QNAP’s NetBak Replicator utility allows a local attacker to execute unauthorized code. Cyber Security News
💡 Key Takeaway: For QNAP deployments, restrict access to NetBak Replicator functionality, isolate affected appliances, and patch as soon as vendor updates arrive.

Prompt injection attacks in production LLM systems (zero-click) are here
The EchoLeak study (CVE‑2025‑32711) revealed a zero-click prompt injection exploit in Microsoft 365 Copilot that chain‑exfiltrated data without any user interaction. arXiv
💡 Key Takeaway: LLM systems, even in trusted environments, must be treated as attack surfaces — enforce prompt isolation, content sanitization, and provenance validation aggressively.

Expiration of the Cybersecurity Information Sharing Act (CISA)
As of October 1, 2025, the CISA (information sharing incentive law) has lapsed amid the U.S. government shutdown. Industry observers warn this may reduce cross-sector intelligence sharing by up to 80%. World Economic Forum
💡 Key Takeaway: Organizations should bolster internal threat intelligence channels and reconsider direct vendor / partner sharing agreements now that federal protections are unclear.

Tenable’s CVE‑2025‑61882 FAQ & detection guidance
Tenable published a detailed FAQ and detection approach for the Oracle EBS zero‑day, including mappings of affected versions, recommended controls, and plugin availability. Tenable💡 Key Takeaway: Use Tenable’s guidance to configure IDS/IPS rules, detection scanning, and verification steps specifically for CVE‑2025‑61882.

Deploy dynamic-layered isolation + active hunt for enterprise app exploitation

This week highlights a shifting battleground: not just infrastructure, but the business logic layer itself (Oracle EBS), and the emerging attack surface in AI systems. Defenders must pivot from reactive patching to proactive isolation, detection, and anticipation — because adversaries are reaching deeper than ever.

AI keeps coming up at work, but you still don't get it?

That's exactly why 1M+ professionals working at Google, Meta, and OpenAI read Superhuman AI daily.

Here's what you get:

Join 1M+ pros