> InfoSec News Nuggets 10/10/2025

The Y2K38 Bug Is a Vulnerability, Not Just a Date Problem, Researchers Warn  Widely known time-related software bugs that could cause significant disruptions when triggered in more than a decade are actually exploitable by hackers today, researchers warn. One of the bugs, known as ‘The Year 2038 problem’ and Y2K38, could cause computers to malfunction on January 19, 2038. The issue affects systems that use a 32-bit integer to store time as the number of seconds that have passed since the Unix epoch (January 1, 1970). A 32-bit signed integer variable has a maximum value of 2,147,483,647, which will be reached on January 19, 2038. When the number exceeds its limit and overflows, systems will interpret the date as a negative number, resetting it to December 13, 1901.    Hackers claim Discord breach exposed data of 5.5 million users  Discord says they will not be paying threat actors who claim to have stolen the data of 5.5 million unique users from the company’s Zendesk support system instance, including government IDs and partial payment information for some people. The company is also pushing back on claims that 2.1 million photos of government IDs were disclosed in the breach, stating that approximately 70,000 users had their government ID photos exposed. While the attackers claim the breach occurred through Discord’s Zendesk support instance, the company has not confirmed this and only described it as involving a third-party service used for customer support.    SaaS Breaches Start with Tokens – What Security Teams Must Watch  Token theft is a leading cause of SaaS breaches. Discover why OAuth and API tokens are often overlooked and how security teams can strengthen token hygiene to prevent attacks. Most companies in 2025 rely on a whole range of software-as-a-service (SaaS) applications to run their operations. However, the security of these applications depends on small pieces of data called tokens. Tokens, like OAuth access tokens, API keys, and session tokens, work like keys to these applications. If a cybercriminal gets hold of one, they can access relevant systems without much trouble.    GitHub Copilot Chat Flaw Leaked Data From Private Repositories  Legit Security has detailed a vulnerability in the GitHub Copilot Chat AI assistant that led to sensitive data leakage and full control over Copilot’s responses. Combining a Content Security Policy (CSP) bypass with remote prompt injection, Legit Security’s Omer Mayraz was able to leak AWS keys and zero-day bugs from private repositories, and influence the responses Copilot provided to other users. Copilot Chat is designed to provide code explanations and suggestions, and allows users to hide content from the rendered Markdown, using HTML comments.    Microsoft Defender mistakenly flags SQL Server as end-of-life  Microsoft is working to resolve a known issue that causes its Defender for Endpoint enterprise endpoint security platform to incorrectly tag SQL Server software as end-of-life. According to a service alert seen by BleepingComputer, this bug has been impacting Microsoft Defender XDR customers with SQL Server 2017 and 2019 since at least Wednesday morning. While Defender flagged the software as no longer supported, SQL Server 2019 is supported until January 2030, while SQL Server 2017 reaches the end of extended support in October 2027, two years from now.  The post InfoSec News Nuggets 10/10/2025 appeared first on AboutDFIR - The Definitive Compendium Project.