The incident occurred on June 12, 2025, due to a policy change that contained blank fields, causing 503 errors in Google Cloud and Google Workspace APIs. The root cause was:

1. A new feature added to Service Control on May 29, 2025, without adequate error handling.
2. The policy change with blank fields was globally replicated and caused Service Control binaries to crash.

The first vulnerability, CVE-2025-5054, affects Ubuntu’s Apport crash reporting system, while the second, CVE-2025-4598, impacts systemd-coredump, the default core dump handler used across Red Hat Enterprise Linux 9 and 10, as well as Fedora distributions.

Post from Coinbase: https://www.coinbase.com/en-gb/blog/protecting-our-customers-standing-up-to-extortionists

Direct link.

!selfhosted@lemmy.world to the win!

I didn’t know about that tool. Apparently, it is a CDR, which I like very much. I’m not aware of any good open-source implementations.

Very nice approach!

Some points about the article:

Nature of the Vulnerability: The vulnerability is a security flaw that allows leaking the email associated with a YouTube channel by exploiting endpoints from both YouTube and Google Pixel Recorder.

Impact: It allows an attacker to obtain the email associated with any YouTube channel, which can lead to phishing attacks, privacy invasion, and other malicious activities. This potentially affects all YouTube users who own a channel.

Fix Status: The vulnerability has been fixed by Google. Both parts of the exploit were resolved by 02/09/2025, and the report was disclosed on 02/12/2025.

Apparently was not related to a cyber attack, as stated in status page (https://status.proton.me/)

We have resolved all service outages, and the situation has been stable for some time. We have identified the root cause of the problem, implemented a fix, and are now monitoring the results. Jan 09, 2025 - 19:27 CET

Original research: https://www.jamf.com/blog/tcc-bypass-steals-data-from-icloud/

Welcome! I dont know you background, but I would suggest get into selfhosting. There are several projects related to cybersecurity, fun and useful. Ex: MISP, Pihole, The Hive.

Nevertheless: https://www.crowdstrike.com/en-us/blog/crowdstrike-fortinet-partnership-unifies-endpoint-firewall-protection/

Update: Israel Planted Explosives in Pagers Sold to Hezbollah, Officials Say (https://www.nytimes.com/2024/09/17/world/middleeast/israel-hezbollah-pagers-explosives.html)

You can use https://tails.net/ booting from another flash drive in memory only.

Agreed

I like to use the 2013 Target breach case. They lost $1 billion due to the attack, their stocks dropped significantly after the attack, had several lawsuits, they closed a few stores, and changed the CEO and CIO. But a few months later, all was forgiven, their stocks recovered, and life went on.

Don’t get me wrong, the risks of a cyber attack have to be taken seriously. But I feel that I have overestimated the impacts of reputational damage my whole life, as an infosec professional. My thinking was always like this: if you get reputational damage, you are done, no chance to recover, it is the end of it.

I’m following the Crowdstrike case, but I would bet that they will lose some market share (mostly prospects), perhaps some layoffs, but stocks will come up eventually.

Not as much as if it contained passwords, for sure. Bu it gives a nice mailing list for phishing and so on.

Depends of the country. Disrupt with Internet/communications may be a crime in some countries.

Kudos to SOC team.

CrowdStrike report of the incident: https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/

Well, depends. If the user go to a captive portal to “authenticate” before the VPN could closes, than no. But, if the VPN can “pierce” through it (without any intervention from the AP), than yes. Anyways, If the user is willing to provide authentication data (like social media accounts, etc), nothing matters.