Brief #117: Cisco CVSS 10.0 RCE Flaw, ChatGPT Prompt Hijacking, Security Budgets Drop

Happy Sunday!

Security budgets hitting a five-year low while threats keep escalating feels like trying to fill a bucket with a bigger hole in the bottom each year.

In this week's brief:

• Cisco patches a maximum severity vulnerability that lets attackers execute remote code on firewall management systems
• New "Man-in-the-Prompt" attacks turn your favorite AI tools into potential data theft machines
• Python skills now showing up in half of all cybersecurity job postings - time to dust off those coding tutorials

A quick note before we dive in.

Industry News

Cisco Warns of Critical CVSS 10.0 FMC RADIUS Flaw Allowing Remote Code Execution

• Cisco has patched a critical vulnerability (CVE-2025-20265) with maximum CVSS score of 10.0 in Secure Firewall Management Center (FMC) Software, affecting the RADIUS authentication subsystem.

• The flaw allows unauthenticated, remote attackers to inject arbitrary shell commands during authentication that execute with high privileges when the system is configured for RADIUS authentication.

• Cisco also released patches for multiple high-severity bugs affecting various Firewall products, including denial-of-service vulnerabilities in Adaptive Security Appliance and Secure Firewall Threat Defense Software.

Top GenAI Tools Vulnerable to "Man-in-the-Prompt" Attack

• LayerX researchers discovered a new exploit allowing browser extensions to access and manipulate LLM prompts without special permissions, affecting major platforms like ChatGPT (5B monthly visits) and Google Gemini (400M monthly visits).

• The vulnerability enables attackers to turn LLMs into "hacking copilots" that can extract sensitive data, with malicious extensions able to inject hidden instructions, exfiltrate information, and delete evidence of the attack.

• Internal corporate LLMs are especially vulnerable as they contain proprietary datasets and often lack hardening against adversarial input, creating significant risks for intellectual property theft and regulatory compliance violations.

Crypto24 Ransomware Targets Large Organizations With Custom EDR Evasion Tool

• The ransomware group is targeting high-value victims in finance, manufacturing, entertainment, and tech sectors across the US, Europe, and Asia, using a custom variant of RealBlindingEDR to disable security solutions from 12 major vendors.

• After initial access, attackers escalate privileges by activating default admin accounts, create persistence through malicious Windows services (WinMainSvc keylogger and MSRuntime ransomware loader), and deploy custom tools to systematically evade detection.

• Crypto24 uses a custom exfiltration tool that leverages the WinINET API to send stolen data to Google Drive before encrypting files and deleting volume shadow copies to prevent recovery.