Welcome to today's edition of Secret CISO, where the digital landscape's vulnerabilities are laid bare. In a world where data breaches are becoming alarmingly routine, we explore a series of incidents that underscore the fragility of our digital defenses.

Qantas and CMS have both fallen victim to significant data breaches, exposing millions of personal records and raising questions about the security of sensitive information. Meanwhile, Columbia University and Radiology Associates of Richmond face their own cybersecurity challenges, highlighting the diverse threats targeting educational and healthcare institutions.

On the tech frontier, a young prodigy has forced Microsoft to rethink its bug bounty program, while a savvy hacker has uncovered hidden data on GitHub, earning a substantial reward. These stories remind us of the power of innovation and vigilance in the cybersecurity realm.

In the realm of software vulnerabilities, critical flaws in popular platforms like WordPress and DjVuLibre emphasize the ongoing need for rigorous security practices. Meanwhile, the discovery of backdoors and improper authentication in various systems serves as a stark reminder of the ever-present threat of exploitation.

Finally, as we delve into the world of open-source vulnerabilities and unauthorized access, we see how even the most trusted tools can become gateways for malicious actors. From remote code execution in macOS utilities to improper authorization in workflow automation, today's newsletter is a call to action for enhanced security measures and proactive defense strategies.

Stay informed, stay secure, and join us as we navigate the complex and ever-evolving landscape of cybersecurity.

Data Breaches

1. Qantas Data Breach: Qantas has confirmed a data breach affecting up to 6 million customers, exposing their personal details. The airline is working to notify affected individuals and enhance its security measures to prevent future incidents. Source: teiss
2. CMS Data Breach: The U.S. Centers for Medicare and Medicaid Services (CMS) experienced a data breach impacting over 100,000 Americans. The breach led to the creation of fraudulent accounts, raising concerns about the security of sensitive health information. Source: AInvest
3. Columbia University Data Breach: Columbia University suffered a data breach where a politically motivated hacker accessed student data and disrupted university systems. This incident highlights the growing threat of ideology-driven cyberattacks on educational institutions. Source: LinkedIn
4. Radiology Associates of Richmond Data Breach: A data breach at Radiology Associates of Richmond has prompted potential class action lawsuits. The breach compromised sensitive patient information, raising alarms about the security of healthcare data. Source: Class Action
5. Catwatchful Stalkerware Data Breach: A security flaw in the Catwatchful Android spyware operation has exposed thousands of users' data. This breach reveals the risks associated with surveillance software and the potential for misuse of personal information. Source: DataBreaches.net

Security Research

1. Cooperation Helps Environment, Security: This research highlights the intersection of environmental and security concerns, emphasizing the importance of collaborative efforts to address these dual challenges. The study underscores how strategic partnerships can enhance both environmental sustainability and security resilience. Source: DVIDS.
2. Hacker Analyzes “Deleted” Data on GitHub, Scores $25K in Bug Bounties: A security researcher discovered that GitHub's handling of dangling commits could expose sensitive data. By identifying these vulnerabilities, the researcher earned significant bug bounties, showcasing the importance of thorough data management practices. Source: Cybernews.
3. 13-Year-Old Hacks Teams, Forces Microsoft to Change Bug Bounty: A young security enthusiast identified a critical vulnerability in Microsoft Teams, prompting the company to revise its bug bounty program. This incident highlights the potential of youthful ingenuity in cybersecurity. Source: Interesting Engineering.
4. CVE-2025-53367: An Exploitable Out-of-Bounds Write in DjVuLibre: This vulnerability in DjVuLibre allows for potential exploitation through out-of-bounds write operations. The discovery by GitHub's Security Lab emphasizes the need for continuous vigilance in open-source software security. Source: The GitHub Blog.
5. WordPress Plugin Flaw Exposes 600,000 Sites to File Deletion: A flaw in a popular WordPress plugin, tracked as CVE-2025-6463, was discovered, potentially allowing unauthorized file deletion. This finding underscores the critical need for regular updates and security checks in widely-used web applications. Source: Infosecurity Magazine.

Top CVEs

1. CVE-2025-34089: An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio. When authentication is disabled, the /api/executeScript endpoint is exposed, allowing attackers to inject arbitrary AppleScript payloads. This results in code execution with the privileges of the Remote for Mac background process. Source: Vulners.
2. CVE-2025-34082: A command injection vulnerability in IGEL OS versions prior to 11.04.270 affects the Secure Terminal and Secure Shadow services. The flaw allows unauthenticated attackers to inject commands via specially crafted PROXYCMD commands, leading to remote code execution with elevated privileges. Source: Vulners.
3. CVE-2025-34061: A backdoor in PHPStudy versions 2016 through 2018 allows remote attackers to execute arbitrary PHP code. The backdoor processes base64-encoded PHP payloads in the Accept-Charset HTTP header, leading to remote code execution as the web server user. Source: Vulners.
4. CVE-2025-6926: An improper authentication vulnerability in Wikimedia Foundation Mediawiki's CentralAuth Extension allows authentication bypass. This affects versions from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, and from 1.43.X before the latest updates. Source: Vulners.

API Security

1. AI Engine Plugin for WordPress: The AI Engine plugin for WordPress is vulnerable to an open redirect in version 2.8.4 due to an insecure OAuth implementation. This flaw allows unauthenticated attackers to intercept authorization codes and obtain access tokens by redirecting users to attacker-controlled URIs. The issue is resolved in the patched version where OAuth is disabled. Source: CVE-2025-6238.
2. StarCitizenTools Citizen Skin XSS Vulnerability: The Citizen skin for StarCitizenTools is vulnerable to a stored XSS attack through unsanitized page descriptions in the legacy search bar. This vulnerability allows attackers to execute arbitrary scripts by inserting malicious HTML into page descriptions. Source: GHSA-RQ6G-6G94-JFR4.
3. n8n Improper Authorization: An authorization vulnerability in the /rest/executions/:id/stop endpoint of n8n allows authenticated users to stop workflow executions they do not own, potentially disrupting business operations. The issue is patched in version 1.99.1, and users are advised to upgrade or restrict access to the endpoint. Source: GHSA-GQ57-V332-7666.
4. Remote for Mac RCE Vulnerability: A remote code execution vulnerability in Remote for Mac allows unauthenticated attackers to execute arbitrary AppleScript payloads via the /api/executeScript endpoint when authentication is disabled. This grants attackers the ability to run commands on the macOS host. Source: CVE-2025-34089.
5. eKuiper Arbitrary File Writing: The eKuiper /config/uploads API allows arbitrary file writing due to insufficient security restrictions, potentially leading to remote code execution if run with root privileges. This vulnerability can be exploited by writing crontab files or SSH keys. Source: GHSA-GJ54-GWJ9-X2C6.

Sponsored by Wallarm API Security Solution

Final Words

As we wrap up today's edition of Secret CISO, it's clear that the digital landscape is as dynamic as ever, with new challenges and opportunities emerging daily. From the massive data breaches at Qantas and CMS to the vulnerabilities in popular platforms like WordPress and GitHub, the need for robust cybersecurity measures has never been more pressing.

These stories remind us of the importance of staying informed and vigilant. Whether it's a young hacker reshaping Microsoft's bug bounty program or researchers uncovering critical vulnerabilities, every piece of information contributes to a safer digital world.

We hope you found today's insights valuable and that they inspire you to take proactive steps in your own cybersecurity journey. Remember, knowledge is power, and sharing it can make a difference. If you enjoyed this newsletter, please consider sharing it with your friends and colleagues. Together, we can build a more secure and resilient digital future.

Thank you for being a part of our community. Stay safe, stay informed, and we'll see you in the next edition of Secret CISO!