> InfoSec News Nuggets 10/22/2025

Hackers exploit 34 zero-days on first day of Pwn2Own Ireland On the first day of Pwn2Own Ireland 2025, security researchers exploited 34 unique zero-days and collected $522,500 in cash awards. The highlight of the day was Bongeun Koo and Evangelos Daravigkas of Team DDOS chaining eight zero-day flaws to hack the QNAP Qhora-322 Ethernet wireless router via the WAN interface and gain access to a QNAP TS-453E NAS device. For this successful attempt, they won $100,000 and are now in second place on the Master of Pwn leaderboard with 8 points. Synacktiv Team, Sina Kheirkhah of the Summoning Team, the DEVCORE Team, and Stephen Fewer of Rapid7 have also earned $40,000 each after gaining root on the Synology BeeStation Plus, the Synology DiskStation DS925+, the QNAP TS-453E, and the Home Assistant Green, respectively.   China-Linked Salt Typhoon breaches European Telecom via Citrix exploit A European telecom firm was targeted in July 2025 by China-linked APT group Salt Typhoon (also known as Earth Estries, FamousSparrow, GhostEmperor, UNC5807, RedMike)), which exploited a Citrix NetScaler Gateway to gain initial access. In late 2024, a large-scale Chinese cyberespionage campaign targeted global telecoms was exposed and attributed by the US to state-backed group Salt Typhoon. In December 2024, President Biden’s deputy national security adviser Anne Neuberger said that China-linked APT group Salt Typhoon breached telecommunications companies in dozens of countries. The Wall Street Journal reported that the senior White House official revealed that at least eight U.S. telecommunications firms were compromised in the attack.   AI-generated code is now the cause of one-in-five breaches – but developers and security leaders alike are convinced the technology will come good eventually AI coding tools are creating serious security risks in production, with one-in-five CISOs saying they’ve suffered major incidents because of AI-generated code. AI coding tools now write 24% of production code – 21% in Europe and 29% in the US – according to a new report from Aikido. But it’s risky, with 69% of security leaders, security engineers, and developers across Europe and the US revealing they’d found serious vulnerabilities in AI-written code.   Bombarding Cars With Lasers: Novel Auto Cyberattacks Emerge Researchers are proposing that microchip manufacturers adopt a new multi-layered, insulating design to protect them against cyber-physical attacks, primarily from lasers. On Monday, members of the French Alternative Energies and Atomic Energy Commission (CEA) and Soitec, a semiconductor manufacturing company, released a report advocating for a new kind of microchip technology designed to strengthen automotive cybersecurity. It’s called “Fully Depleted Silicon-on-Insulator” (FD-SOI), and it obstructs cyber-physical attacks against chips, making already elaborate and costly attack scenarios even more unrealistic than they might already seem.   PhantomCaptcha ClickFix attack targets Ukraine war relief orgs A spearphishing attack that lasted a single day targeted members of the Ukrainian regional government administration and organizations critical for the war relief effort in Ukraine, including the International Committee of the Red Cross, UNICEF, and various NGOs. Dubbed PhantomCaptcha, the one-day campaign attempted to trick victims into running commands used in ClickFix attacks, disguised as Cloudflare CAPTCHA verification prompts, to install a WebSocket Remote Access Trojan (RAT). SentinelLABS, the threat research division at SentinelOne, says that the campaign started and ended on October 8, and that the attacker spent significant time and effort to set up the necessary infrastructure, as some domains used in the operation were registered at the end of March.   The post InfoSec News Nuggets 10/22/2025 appeared first on AboutDFIR - The Definitive Compendium Project.