Welcome to today's edition of Secret CISO, where we unravel the intricate web of cybersecurity breaches and innovations shaping our digital landscape. In a world where data is the new currency, the stakes have never been higher.

Columbia University finds itself in the crosshairs of a significant data breach, exposing sensitive banking and academic records. This incident echoes across borders as Canada's Privacy Commissioner delves into WestJet's cybersecurity lapse, questioning the robustness of their defenses.

Meanwhile, the Tea app faces legal heat after a breach leaks personal photos, sparking debates on digital responsibility. Cisco, too, grapples with a breach, as attackers siphon user data, highlighting vulnerabilities even in tech giants.

Amidst these breaches, a poignant plea emerges from Britain, urging the safe passage of Afghan families after a major data leak threatens their safety. This narrative of vulnerability extends to the digital realm, where Microsoft's Project Ire promises a new dawn in malware detection through AI, while the Akira ransomware group exploits SonicWall SSL VPNs, underscoring the relentless nature of cyber threats.

In a race against time, Nvidia patches critical Triton vulnerabilities, and Dell addresses a flaw that could have left millions exposed. Yet, the shadow of deception looms large as fake pharmacy websites exploit AI and crypto payments, duping thousands.

As we navigate these turbulent waters, the discovery of vulnerabilities in RISC Zero's zkVM and mcp-package-docs reminds us of the ever-present need for vigilance. WakaTime's OAuth flow vulnerability and the CVE-2025-8548 issue further emphasize the importance of proactive security measures.

Join us as we delve deeper into these stories, exploring the challenges and innovations that define our digital age. Stay informed, stay secure.

Data Breaches

1. Hacked Columbia University Data Includes Banking Numbers, GPAs: Columbia University recently suffered a data breach that exposed sensitive financial and academic information of students and alumni. The breach has raised concerns about the security measures in place to protect such critical data. Source: Bloomberg
2. Privacy Commissioner Investigating WestJet Cybersecurity Breach: Canada's Privacy Commissioner is investigating a cybersecurity breach at WestJet to assess the security safeguards that were in place at the time of the incident. The investigation aims to determine the adequacy of WestJet's measures to protect customer data. Source: CTV News
3. 10 Women Have Sued Tea App After Photos Hacked, Leaked Online: The Tea app faces multiple class action lawsuits after a data breach led to the leak of thousands of selfies and ID photos. The incident has sparked discussions on the app's responsibility in safeguarding user data. Source: NBC News
4. Cisco Hacked - Attackers Stole Profile Details of Users Registered on Cisco.com: Cisco experienced a data breach where attackers accessed user profile details, including account-related metadata. The breach was discovered by Cisco's security team, who are now working to mitigate the impact. Source: Cybersecurity News
5. Britain Urged to Let Hero Afghans Bring Their Families to UK After Major Data Leak: A significant data leak has put thousands of Afghans at risk, prompting calls for the UK to allow them to bring their families to safety. The leak has highlighted the potential dire consequences for those affected. Source: The Independent

Security Research

1. Project Ire: Microsoft's Autonomous Malware Detection AI Agent
2. Microsoft has unveiled Project Ire, an AI-driven agent designed to autonomously detect and neutralize malware threats. This innovative approach leverages machine learning to enhance cybersecurity defenses, potentially revolutionizing how threats are managed. The project demonstrates significant advancements in AI applications for security. Source:
3. Help Net Security
4. .
5. Akira Ransomware Group Targeting SonicWall SSL VPNs; Zero-Day Feared
6. The Akira ransomware group has been actively exploiting vulnerabilities in SonicWall SSL VPNs, raising concerns about potential zero-day exploits. This ongoing threat highlights the critical need for organizations to patch vulnerabilities promptly to prevent ransomware attacks. The situation underscores the persistent challenges in securing network infrastructure. Source:
7. SC Media
8. .
9. Nvidia Patches Trio of Triton Vulnerabilities
10. Nvidia has addressed three critical vulnerabilities in its Triton software, which could have been exploited by attackers to compromise systems. The swift response by Nvidia's security team emphasizes the importance of proactive vulnerability management in protecting against potential threats. This patching effort is crucial for maintaining the integrity of Nvidia's software ecosystem. Source:
11. GovInfoSecurity
12. .
13. Thousands Duped by Fake Pharmacy Websites Using AI Tricks, Crypto Payments
14. A global network of over 5,000 fake pharmacy websites has been uncovered, using AI and cryptocurrency payments to deceive users. This discovery highlights the evolving tactics of cybercriminals and the need for increased vigilance and advanced security measures to protect consumers from such sophisticated scams. Source:
15. TechRadar
16. .
17. Security Flaw Found, Fixed That Could Have Left Millions of Dell Laptops Vulnerable
18. Researchers have identified and fixed a critical security flaw in Dell laptops that could have exposed millions of devices to potential attacks. This vulnerability underscores the necessity for continuous security assessments and timely updates to safeguard hardware against emerging threats. The fix is a crucial step in protecting users' data and privacy. Source:
19. Reuters
20. .

API Security

1. RISC Zero Underconstrained Vulnerability: Division
2. Two issues were identified in RISC Zero's zkVM: an underconstrained output for signed integer division and a division by zero vulnerability. These issues were discovered using the Picus tool from Veridise, leading to the disabling of impacted on-chain verifiers. Users are advised to upgrade to version 2.2.0 or later to mitigate the risks.
3. Source:
4. Vulners
5. mcp-package-docs vulnerable to command injection in several tools
6. A command injection vulnerability in the mcp-package-docs MCP Server allows attackers to inject arbitrary system commands due to unsanitized input parameters. This can lead to remote code execution with server process privileges. The vulnerability is rooted in the server's execution of shell commands using unvalidated user input.
7. Source:
8. Vulners
9. WakaTime: Double Clickjacking Attack on WakaTime OAuth Authorization Flow
10. The WakaTime OAuth authorization flow was susceptible to a double-clickjacking attack, allowing attackers to trick users into clicking the "Connect my WakaTime account" button. This enabled attackers to register an OAuth application, capture the authorization code, and exchange it for an access token, gaining full access to user permissions.
11. Source:
12. Vulners
13. CVE-2025-8548
14. A vulnerability in atjiu pybbs up to version 6.0.0 affects the sendEmailCode function, leading to information exposure through error messages. The attack complexity is high, and exploitation is difficult. A patch has been released to address this issue, and it is recommended to apply it promptly.
15. Source:
16. Vulners

Sponsored by Wallarm API Security Solution

Final Words

As we wrap up today's edition of Secret CISO, it's clear that the cybersecurity landscape is as dynamic and challenging as ever. From the breach at Columbia University exposing sensitive student data to the innovative strides in AI-driven malware detection by Microsoft, each story underscores the importance of vigilance and innovation in our ongoing battle against cyber threats.

We've seen how vulnerabilities can affect major corporations like Cisco and Nvidia, and how personal data can be compromised through apps like Tea. These incidents remind us of the critical need for robust security measures and the constant evolution of strategies to protect both individual and organizational data.

As we continue to navigate these complex challenges, remember that staying informed is your first line of defense. If you found today's insights valuable, please share this newsletter with your friends and colleagues. Together, we can build a more secure digital world, one informed reader at a time.

Thank you for joining us today. Stay safe, stay secure, and we'll see you in the next edition of Secret CISO.