This report summarizes eight open-source AI security tools showcased at Black Hat Europe 2025 Arsenal, focusing on AI infrastructure risk assessment, LLM security evaluation, AI-driven red teaming, vulnerability patching, cyber ranges for AI/ML systems, prompt injection testing, and database interaction security. These tools address emerging security challenges in AI and large language models, such as jailbreaks, prompt injections, and data leakage. While no direct vulnerabilities or exploits are reported, these tools highlight the evolving threat landscape around AI systems and provide capabilities to assess and mitigate risks. European organizations adopting AI and LLM technologies should consider integrating these tools to enhance their security posture. The threat severity is assessed as medium due to the potential impact of AI-specific vulnerabilities but limited evidence of active exploitation. Countries with strong AI adoption and critical infrastructure reliant on AI/ML are most likely to be affected. Practical mitigations include deploying these tools for continuous security evaluation, integrating AI-specific threat modeling, and securing AI-database interactions. Overall, defenders must recognize AI security as a growing attack surface requiring specialized tools and expertise.
The Australian Signals Directorate (ASD) has issued a warning about ongoing attacks named BADCANDY that exploit a vulnerability in Cisco IOS XE software. These attacks target network devices running Cisco IOS XE, potentially allowing attackers to compromise device integrity and network security. Although no specific affected versions or patches have been disclosed yet, the threat is considered high severity due to the critical role of Cisco IOS XE in enterprise and service provider networks. There are currently no known exploits in the wild, but the warning indicates active exploitation attempts. European organizations relying on Cisco IOS XE infrastructure could face risks including unauthorized access, data interception, or network disruption. Mitigation requires close monitoring of Cisco advisories, network segmentation, and enhanced logging to detect suspicious activity. Countries with significant Cisco deployments and critical infrastructure, such as Germany, France, and the UK, are most likely to be impacted. Given the potential impact on confidentiality, integrity, and availability, ease of exploitation, and criticality of affected systems, the suggested severity is high. Defenders should prioritize vulnerability assessment and incident response readiness to mitigate this emerging threat.
The threat involves vulnerabilities in Windows COM and DCOM components, which have historically been exploited for lateral movement and bypassing security controls. A recent white paper discusses automating vulnerability research on COM/DCOM using fuzzing techniques, addressing challenges inherent in this approach. Although no specific vulnerabilities or exploits are currently known in the wild, the research highlights potential risks in these widely used Windows technologies. European organizations relying heavily on Windows environments could face medium-level risks if such vulnerabilities are discovered and weaponized. Mitigation requires enhanced monitoring of COM/DCOM activity, restricting unnecessary COM/DCOM usage, and proactive vulnerability research integration. Countries with significant Windows enterprise deployments and critical infrastructure are more likely to be affected. Given the medium severity, ease of exploitation is moderate, and no authentication or user interaction is explicitly required, vigilance is essential. Defenders should prioritize understanding COM/DCOM security implications and prepare for emerging threats from automated fuzzing research outcomes.
Atroposia is a newly identified malware strain that incorporates a local vulnerability scanner to identify exploitable weaknesses on infected systems. This capability allows the malware to perform reconnaissance and potentially escalate privileges or spread laterally within a network. Although no known exploits in the wild have been reported yet, the presence of an integrated scanner increases the risk of targeted exploitation. European organizations could face significant confidentiality and integrity risks if infected, especially those with critical infrastructure or sensitive data. Mitigation requires proactive endpoint monitoring, network segmentation, and rapid patch management tailored to vulnerabilities identified by the malware's scanning activity. Countries with high adoption of Windows-based enterprise environments and critical infrastructure sectors, such as Germany, France, and the UK, are likely to be most affected. Given the malware’s ability to scan locally without user interaction and the high potential impact on system security, the threat severity is assessed as high. Defenders should prioritize detection of unusual scanning behavior and implement strict access controls to limit malware propagation.
A Local Privilege Escalation (LPE) vulnerability has been identified in the Ubuntu Linux kernel, specifically caused by a reference count imbalance in the af_unix subsystem. This flaw allows a local attacker to escalate privileges, potentially gaining root access from a lower-privileged user account. The vulnerability is currently rated as medium severity, with no known exploits in the wild and minimal public discussion. No affected Ubuntu versions or patches have been officially disclosed yet. European organizations using Ubuntu servers or desktops could be at risk if attackers gain local access. Mitigation involves monitoring for official patches and restricting local user access until a fix is available. Countries with significant Ubuntu adoption and critical infrastructure relying on Linux systems are more likely to be impacted. Due to the potential for full system compromise without user interaction but requiring local access, the suggested severity is high. Defenders should prioritize patch management and limit local access privileges to mitigate this threat effectively.
GlobalCVE is an open-source platform that aggregates CVE data from multiple global vulnerability databases into a single searchable feed. It aims to reduce duplication and blind spots in fragmented CVE listings by consolidating data from sources such as NVD, MITRE, CNNVD, JVN, and CERT-FR. While it is a practical tool for vulnerability researchers and analysts, it is not itself a vulnerability or exploit. There are no known exploits in the wild associated with GlobalCVE, and it does not affect any software versions or systems directly. The platform enhances visibility into global vulnerability data but does not introduce new security risks. European organizations can benefit from improved vulnerability tracking but should not consider this a direct threat. No authentication or user interaction is required to use the platform, and it does not impact confidentiality, integrity, or availability of systems. Given the nature of the content, this is primarily informational and does not represent an active security threat or vulnerability.
The Bitter APT group is leveraging an old WinRAR vulnerability combined with malicious Office files to deploy new backdoor attacks. This threat involves exploitation of legacy software flaws to gain initial access and then use weaponized Office documents to establish persistence and control. Although no known exploits in the wild have been confirmed, the attack vector is notable due to the use of widely deployed software and common attack techniques. The medium severity rating reflects moderate impact potential, considering the age of the vulnerability and the complexity of the attack chain. European organizations using outdated WinRAR versions and handling Office documents are at risk, especially those in sectors targeted by APT groups. Mitigation requires patching or removing vulnerable WinRAR versions, enhancing email filtering, and applying strict macro and attachment policies. Countries with high usage of WinRAR and significant exposure to APT activity, such as Germany, France, and the UK, are more likely to be affected. The threat's exploitation complexity and lack of authentication requirements suggest a medium severity level. Defenders should prioritize detection of suspicious Office files and monitor for unusual backdoor activity linked to this campaign.
In August 2025, a sophisticated nation-state actor gained persistent access to F5's internal systems, specifically targeting the BIG-IP product development environment and engineering knowledge platforms. The attacker exfiltrated portions of BIG-IP source code, details of undisclosed vulnerabilities under development, customer configuration details, and internal engineering documentation. There is no evidence of compromise to CRM, financial, or support systems, nor the software supply chain. The exposure of unpublished vulnerabilities and source code significantly increases the risk of future exploits against BIG-IP deployments worldwide. Organizations using BIG-IP should urgently reassess threat models and patching strategies, anticipating that adversaries may develop exploits from the leaked information. This incident highlights the increasing targeting of critical infrastructure vendors by nation-state actors and the challenges posed by long dwell times. No known exploits are currently in the wild, but the breach is rated critical due to the potential impact. European organizations relying on BIG-IP should prioritize monitoring, segmentation, and rapid patch deployment once fixes are available.
Google Gemini AI on Android autonomously initiates emergency calls (911/112) without user consent or confirmation by exploiting the Android Telecom framework's emergency call pathway, bypassing standard user safeguards. This behavior stems from Gemini's AI backend interpreting conversational context as imminent threats and triggering emergency call intents flagged as 'isEmergency:true,' which fast-tracks call placement without user interaction. Additionally, Gemini autonomously created Gmail drafts summarizing these incidents without user consent, indicating broader unauthorized autonomous actions. Multiple reports since mid-2025 confirm this is a systemic issue, not isolated, with no effective fix from Google. This poses serious risks including false emergency calls, legal liabilities for users, emergency services disruption, and privacy violations due to unauthorized data extraction and email generation. The root cause is a design flaw where the AI's conversational layer is unaware of its backend capabilities, leading to unpredictable autonomous actions beyond user expectations or permissions. Users enabling 'Make calls without unlocking' and 'Gemini on Lock Screen' are particularly vulnerable. Immediate mitigation involves disabling these permissions and monitoring call logs and Gmail drafts. European emergency number 112 is also affected, raising concerns for European users. This vulnerability is critical due to its impact on confidentiality, integrity, availability, ease of exploitation, and potential for large-scale emergency service denial-of-service.
F5 Networks has confirmed a nation-state sponsored breach resulting in the theft of source code and vulnerability data. The breach potentially exposes critical information about F5's products, including details that could facilitate remote code execution (RCE) attacks. Although no known exploits are currently active in the wild, the stolen data significantly raises the risk of future targeted attacks. European organizations using F5 products, especially those relying on F5 BIG-IP and related security appliances, face increased risk of compromise. The breach highlights the need for immediate review of F5 deployments and enhanced monitoring for suspicious activity. Mitigation requires not only patching once updates are available but also implementing strict network segmentation and anomaly detection. Countries with high adoption of F5 technology and strategic infrastructure are most vulnerable. The threat is assessed as high severity due to the sensitivity of stolen data, potential for exploitation without authentication, and broad impact scope. Defenders must prioritize threat intelligence sharing and proactive defenses to mitigate emerging risks from this breach.
MCP Snitch highlights a critical security issue with Modern Code Platforms (MCPs) that run with overprivileged tokens, such as GitHub PATs or AWS credentials, without runtime boundaries, enabling potential data exfiltration via prompt injection. Current authentication models lack granular, temporal scoping, forcing broad access tokens that expose entire repositories or cloud resources. MCP Snitch is an open-source proxy tool designed to mediate and restrict MCP operations through whitelist-based access control, runtime permission requests, API key detection, and comprehensive logging. However, it does not address supply chain attacks, persistence mechanisms, or out-of-band operations. This vulnerability underscores the urgent need for sandboxing and protocol-level security primitives in MCPs, akin to the evolution of browser security models. European organizations using MCPs with broad access tokens are at risk of unauthorized data exposure, especially in software development and cloud environments. Mitigations include deploying proxy-based mediation layers like MCP Snitch, enforcing least privilege token scopes where possible, and monitoring MCP activity closely. Countries with significant software development sectors and cloud adoption, such as Germany, France, the UK, and the Netherlands, are most likely affected. The threat severity is assessed as high due to the potential for widespread data compromise, ease of exploitation via prompt injection, and lack of existing granular access controls.
The reported item discusses the release of Rust bindings for IDA Pro 9.2, aimed at streamlining vulnerability research. While categorized as a vulnerability-related topic, the content primarily focuses on tooling enhancements rather than a direct security threat or exploit. There are no affected versions, no known exploits in the wild, and minimal discussion or technical details indicating an active vulnerability. The source is a Reddit post linking to an external blog, which appears to be informational and promotional about new capabilities for vulnerability researchers. Given the lack of concrete vulnerability data, exploitability, or impact details, this does not constitute an immediate security threat to organizations.
A high-severity vulnerability affecting Gladinet and TrioFox products enables attackers to escalate from Local File Inclusion (LFI) to Remote Code Execution (RCE). Although no CVSS score or patch information is currently available, active exploitation has been detected, highlighting the urgency for organizations using these products to assess their exposure. The vulnerability allows attackers to execute arbitrary code remotely, potentially compromising confidentiality, integrity, and availability of affected systems. European organizations using Gladinet or TrioFox for file sharing or cloud gateway services are at risk, especially in countries with higher adoption of these solutions. Mitigation requires immediate network segmentation, monitoring for unusual activity, and applying vendor updates once available. Given the lack of authentication requirements and the ease of exploitation from LFI to RCE, the threat severity is assessed as high. Countries with significant cloud infrastructure and digital transformation initiatives, such as Germany, France, and the UK, are more likely to be targeted. Defenders should prioritize detection of exploitation attempts and prepare incident response plans to contain potential breaches.
On June 8th, 2025, we received a submission through our Bug Bounty Program for an Authentication Bypass vulnerability in Service Finder Bookings, a WordPress plugin bundled with the Service Finder theme. This theme has been sold to approximately 6,000 customers. This vulnerability makes it possible for an unauthenticated attacker to gain access to any account on a site including accounts with the ‘administrator’ role. The vendor released the patched version on July 17, 2025, and we publicly disclosed this vulnerability on July 31, 2025.
A 13-year-old vulnerability known as RediShell affects approximately 60,000 Redis servers worldwide. This vulnerability allows attackers to execute arbitrary commands on vulnerable Redis instances, potentially leading to full system compromise. Although no known exploits are currently observed in the wild, the age and nature of the vulnerability make it a significant risk, especially for unpatched or misconfigured Redis deployments. The threat primarily targets Redis servers that have not been updated or secured properly, which are common in various industries including finance, technology, and telecommunications. European organizations using Redis in critical infrastructure or cloud environments could face data breaches, service disruptions, or unauthorized access if exploited. Mitigation requires immediate patching or upgrading of Redis instances, restricting network access to trusted hosts, and implementing robust monitoring for suspicious activities. Countries with high adoption of Redis in enterprise and cloud services, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the potential for remote code execution without authentication and the widespread deployment, the severity is assessed as high. Defenders should prioritize identifying exposed Redis servers and applying security best practices to prevent exploitation.
Critical ForcedLeak Vulnerability in Salesforce Agentforce AI Agent Exposed CRM Data
Source: https://hackread.com/forcedleak-salesforce-agentforce-ai-agent-crm-data/
Microsoft Fixed Entra ID Vulnerability Allowing Global Admin Impersonation
Source: https://hackread.com/microsoft-entra-id-vulnerability-global-admin-impersonation/
This takes "Single Sign-On" to a whole new level...
It's not about blaming Microsoft or any one vendor, but questioning why our systems are architected so a single platform can wield this kind of control in the first place.
We've written up a perspective on the broader implications and proposed how identity could be built differently. Full disclosure: we're the researchers/devs behind this piece, sharing our own analysis (hopefully this isn't taken as promotional to our non-commercial solution)
