Checkmarx Zero

Looking for #LastWeekInAppSec for 5. Aug? We're taking a bye week on it to hang out at #BHUSA and #DEFCON -- look for us to get back on it next week! Meanwhile, keep an eye out for your friendly researchers (and Darren) around Las Vegas.

Removing leaks from git history is complicated, and may be impossible if you use a hosted git service.

🙅‍♀️ Prevent leaks by running secrets scanners as pre-commit hooks
🔎 Regularly examine your repositories for leaked secrets
👨‍🔧 leaked creds MUST be rotated so the leaked secret is no longer valid

Why GitHub Commits Aren’t as Private as You Think | HackerNoon GitHub's repo network can expose deleted or private commits. Learn how forks, SHAs, and metadata can leak your secrets even after cleanup.

This article by Shelkovnikov is a great summary of git commit privacy, and why it's so important to prevent sensitive data from leaking to git. Rewriting git history after you leak a credential doesn't always remove it; you should treat it as essentially impossible "unleak" data
buff.ly/sv8gmwb

Marx Bros Groucho and Chico ham it up in the "Password Scene” from the 1932 comedy classic "Horse Feathers." Groucho “outsmarts” his genial goof brother into spilling the speakeasy password in an… Marx Brothers - Password Scene - Horse Feathers - Chico Groucho (1932 #grouchomarx #comedymovies)

buff.ly/0O9oeSP

We're very excited to be at #DEFCON again this year, with an event and a talk in the #AppSecVillage and shenanigans throughout the weekend. If you see one of us, come say "swordfish"

Vulnerability Hunt - The Snippets Edition | AppSecVillage Raphael Silva

Come play with us at #DEFCON! A couple of our Checkmarx Zero members will be hosting an interactive Vulnerability Hunt challenge pod at #AppSecVillage:

🗓️ Friday 08. Aug 13:00–15:00 : buff.ly/2IL2if8
🗓️ Saturday 09. Aug 13:00–15:00 : buff.ly/cQjPSNG
🗓️ Sunday 10. Aug 11:00–13:00 : buff.ly/4UHc3oM

Want to see a free, #OpenSource, developer-friendly tool for preventing secrets leaks? Checkmarx Zero's Tal Folkman will be on-site BlackHat #Arsenal (#BHUSA) to demo Too Many Secrets (2MS), available from buff.ly/Yng76l5

Mark your calendar! 2pm (local time) on 6th August, at Arsenal Station 5

🔒 Patch: Upgrade to BentoML version 1.4.19
🛡️ Implement strict validation for all user-provided URLs, especially in file upload functionalities.
📛 Internal exposure is dangerous; attackers can compromise all hosted code and or services! (🧵 3/3)

This allows attackers to force the server to make arbitrary HTTP requests to internal networks, cloud metadata endpoints, and other restricted resources. This feature is explicitly promoted in the documentation, making it a default exposure for deployed services. (🧵 2/3)

Image summarizing the contents of this thread

#CVE-2025-54381 → #BentoML versions 1.4.0 to 1.4.18 are vulnerable to an unauthenticated Server-Side Request Forgery (#SSRF) due to improper validation of user-provided URLs in file upload handlers. CVSSv3 base 9.9, EPSS prediction 6.02% buff.ly/0zoOTvB (🧵 1/3)

Use with caution, be aware it can make things up or "lie", and always put a skeptical and competent human between it and anything important.

Replit AI's whole recent incident with going rogue and causing problems with deleting databases, making up users, and other frustrating and potentially harmful activities is a good reminder that AI is very far from ready to make decisions on its own.

Code Execution Through Deception: Gemini AI CLI Hijack | Tracebit Tracebit discovered a silent attack on Gemini CLI where, through a toxic combination of prompt injection, misleading UX and missing validation, inspecting untrusted code consistently leads to…

This is a pretty cool find by Tracebit – abusing the developer trust, then using prompt injection to get Gemini to silently run malicious commands. Weaponization of this attack would be hard, but we'll see them get more capable and easier to execute. buff.ly/Eh7qF8T #AI #LLM #CyberSecurity

On July 23, 2025, the popular #NPM package #stylus was mistakenly flagged as malicious. For about 12 hours, builds broke, developers scrambled, and the ripple effects were felt across the JavaScript ecosystem.

What happened? Why did it happen? And what can we learn from it? buff.ly/4uVvajn

CVE-2025-54371 - GitHub Advisory Database Withdrawn Advisory: Axios has Transitive Critical Vulnerability via form-data

Popular JavaScript HTTP library #axios is impacted by a serious #vulnerability in a downstream library. The advisory has been withdrawn for Axios itself; bug is still present in the transitive dependency form-data. Fix either by updating axios 1.11.0, or override form-data to 4.0.4. buff.ly/BhK0lyV

Go package ekuiper, a moderately popular server and framework for IoT data analytics and stream processing, has a SQL Injection flaw (GHSA-526j-mv3p-f4vv and CVE-2025-54379), allowing attackers to perform damaging SQL operations; the example given drops the users table entirely. buff.ly/jOZPMBT

It's time for another #LastWeekInAppSec (29. July 2025) -- AppSec items of interest you might have missed in the last week. buff.ly/1b2laNf

Hey! Are you using #SQLite in your project? Time to update to version 3.50.2.
CVE-2025-6965 deals with a memory corruption issue that can lead to application crashes, data loss, or even #RCE via memory overflow.
More details in: devhub.checkmarx.com/cve-details/... #AppSec

Good news: the `stylus` package has been restored to NPM thanks to the efforts of the package maintainers and NPM reps working together

UPDATE: it appears one of the dev accounts associated with Stylus published a *different* malicious package; stylus does not appear to have been compromised. The stylus team is updating the community via their project GitHub page, and working with NPM to restore service for the package.

Dev alert: #stylus npm package flagged as malicious but maintainer disputes it. GitHub advisory vs. contested evidence = confusion. Don’t rush to “fixes” - attackers love chaos! Stick with your security team until there’s solid consensus. #npm #cybersecurity #dev

Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access Active SharePoint exploits since July 7 target governments and tech firms globally, risking key theft and persistent access.

🔥 SharePoint #RCE (#CVE-2025-53770) exploited since July 7. Attackers stealing crypto keys via web shells to forge ViewState tokens. 9K+ servers at risk. AppSec lessons: deserialization = danger, and adversaries find bypasses to incomplete patches.

Grafana security release: Medium and high severity fixes for CVE-2025-6197 and CVE-2025-6023 | Grafana Labs Today we are releasing security patches for Grafana 12.0.x, 11.6.x, 11.5.x, 11.4.x, and 11.3.x, which include fixes for CVE-2025-6023 and CVE-2025-6197. If you are affected, we recommend that you…

📉 GRAFANA #XSS: CVE-2025-6023 allows Cross-Site Scripting with just anonymous access - no editor permissions needed.

Found via bug bounty, now patched. Good reminder to review content-security-policy.

Details: buff.ly/TyqyIgE

Critical Vulnerabilities Blue SDK OpenSynergy | PCA Advisory PCA Cyber Security researchers identified and announced critical vulnerabilities in the Bluetooth stack of Blue SDK. PCA Researchers name the discovered vulnerability chain PerfektBlue. PerfektBlue -…

🚙 #BLUETOOTH STACK ATTACK: PCA Cyber Security found a devastating attack chain in OpenSynergy's #BlueSDK - memory corruption + logic bugs = device compromise for millions of devices. #PerfektBlue

Mobile phones, media devices, cars
#CVE: 2024-45431, 45432, 45433, 45434

Details: buff.ly/oxDZ07L

🚨 This week in #AppSec: Major Bluetooth stack vulnerabilities affecting millions of devices, NVIDIA container escape flaw, and Grafana XSS requiring only anonymous access. buff.ly/sxy6OAC

Three critical security stories you need to know about 👇

#CyberSecurity #InfoSec #VulnerabilityManagement

Definitely on our radar; we're identifying and reporting additional malware resulting from this campaign, like bsky.app/profile/chec...

The got-fetch issue is part of an ongoing and previously reported phishing campaign targeting NPM package maintainers.

Supply Chain Phishing Campaign Drops More Malware Into NPM: got-fetch 5.1  - Checkmarx Ariel Harush and Tal Folkman of Checkmarx Zero discover malware in NPM package ‘got-fetch’, resulting from a previously-uncovered phishing campaign targeting NPM developers

🔔 #Malware found in NPM got-fetch (5.1.11-5.1.12); migrate to native `fetch` or upgrade/downgrade to a safe version to avoid this information-stealer malware in this #SoftwareSupplyChain attack. More: buff.ly/H8VFlAc

#LastWeekInAppSec
⎈ The Kubernetes package manager Helm has a high-severity Code Injection vulnerability CVE-2025-53547.
🚂 The Conductor open-source microservices workflow orchestrator is vulnerable to a Remote Code Execution #RCE (CVE-2025-26074)
More details: buff.ly/BXWkoeF

Looking for #LastWeekInAppSec? Us too! We had some technical difficulties publishing to our site, which we're working to rectify. Watch this space!