Grok flaw leaks confidential business data

Hi there, this is your daily ☕️ Cyberpresso.

Grok flaw leaks confidential business data LINK

• Security researchers at Claroc found that apps built with Grok's Build mode sit open to anyone online, leaking private business data, staff details, plain-text passwords, and patient records without any hacking needed.
• Of the live apps checked on November 8, 2026, nearly 95% opened with no sign-in; about one in ten held sensitive data, including a hospital roster of 3,500 staff and a contractor's timesheet full of plain-text passwords.
• No CVE was assigned and the flaw stems from paid apps defaulting to public access; Grok's parent SpaceXSI took down its own 24 exposed apps but not others, and unpublishing a grok.​me app removes it within seconds.

Microsoft patches exploited Outlook zero-day LINK

• Microsoft has fixed an Outlook zero-day, CVE-2026-124194, that hackers are already exploiting to steal Windows login data when someone opens a booby-trapped message file, with the patch released yesterday.
• Microsoft marks the flaw "Exploitation Detected," meaning real attacks are confirmed; opening the file makes Outlook connect to an attacker's server without its usual external-content warning, leaking the user's NTLMv2 hash and letting them impersonate that person.
• Affected software includes Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024; admins should install the Office updates and, as extra protection, block outbound SMB traffic on port 445 to the internet.

CISA flags two exploited Cisco flaws LINK

• U.S. cybersecurity agency CISA says attackers are now exploiting two Cisco-related flaws in the wild, even though Cisco had already shipped patches for both earlier this year.
• The main bug, CVE-2026-20320, lets an unauthenticated remote attacker read sensitive configuration data from Cisco BroadWorks through its XML parser; Cisco fixed it in August 2026, with no named threat actor identified.
• CISA added both flaws to its Known Exploited Vulnerabilities list yesterday and ordered federal civilian agencies to apply the fixes by November 24, 2026, to protect their networks.

AI agents can be backdoored by tweaking 10 neurons LINK

• Microsoft researchers showed that editing fewer than 10 rarely used neurons in an AI model can plant a hidden backdoor without retraining it, making the model run an attacker's command whenever a chosen trigger word appears.
• The method, called Lazarus, needs about one neuron per command token and worked in up to 99% of triggered sessions across three open-weight models, including Nemotron-Terminal-8B with seven edited neurons, while edited models still passed normal math and coding tests.
• Microsoft says no threat actors have used the technique yet and published defenses, including comparing each model file against its original weights before use; a trained detector flagged 91% of edited checkpoints but wrongly flagged about 10% of clean ones.

Xen Orchestra flaw gives admin access LINK

• French software maker Vates VMS says attackers are actively exploiting a critical authentication bypass in Xen Orchestra, tracked as VSA-2026-062 and still lacking a CVE number, letting intruders gain admin access on affected systems.
• The flaw tricks REST cookie parsing with a crafted token, returning the first stored login token and authenticating as its owner, which can lead to code execution on managed pools and a full XCP-ng node takeover as root.
• Vates VMS has fixed it in the latest Xen Orchestra releases; those who can't patch should keep instances off the internet, block the attacker's IP and TOR domain, and reject empty tokens through a firewall.

Strategies & Tactics

> ScriptBlock Smuggling: Attackers can split PowerShell's displayed script from its executed code to slip past Microsoft's malware scanner, but enabling PowerShell logging still exposes the hidden commands.

> PHP2Shell: Walks through exploiting a PHP use-after-free bug, where freeing memory while a stale pointer lingers lets attackers hijack a worker process to run commands.

> Your training data is boring: Anomaly detection with LLMs: Use anomaly detection to surface unusual files and two opposing LLM prompts to label them, giving security classifiers the rare training examples they usually miss.

> How to Evaluate AI Agent Cybersecurity Capabilities: Grade AI security agents on whether they can pull off real attacks in isolated tests graded by code, not by other AI judges.

> Detecting & Responding to AI-aided or Agentic Attacks: Hunt for AI-driven intrusions by watching how fast attackers adapt their tools to new information, since quick, complex changes exceed human speed.

> Contagious Interview - One Interview Away From Infection: North Korean hackers build fake recruiting companies with verified LinkedIn profiles and realistic coding tests that trick developers into running malware during job interviews.

Other news you might like

• Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem LINK

• Git security vulnerabilities announced LINK

• New GhostFrame Malware Lets Hackers Hijack VMware ESXi VMs and Steal Windows Credentials LINK

• Near AI Breach Exposes User Details and Data From 18 AI Agents LINK

• Google DeepMind analysis proves Signal and WhatsApp encryption is secure LINK

• Railway breach leads to $740,000 in fraudulent AI charges LINK

• Japanese furniture giant Nitori says hackers stole 37.6M customer records LINK

Trending tools

Servor: browser-based console for managing 2 to 50 servers with a terminal, file editor, cron, and monitoring, using signed commands without exposing inbound SSH ports. LINK

face2social: reverse image search that matches a photo across Instagram, Facebook, LinkedIn, TikTok, and X, helping you verify identities and spot scammers. LINK

Upsolve Row-Level Security: enforces data access permissions server-side, letting AI agents safely serve multiple tenants without bypassing or exposing row-level rules. LINK

Koreshield: screens customer messages, retrieved documents, and tool calls before your AI agent acts, catching data leaks, hidden instructions, and unsafe actions while logging decisions. LINK

ReallyFree: labels search results by their real cost, flagging watermarks, paid plans, and hidden fees so you know before clicking. LINK

PortAura: monitors which processes listen on which ports, flags exposure and baseline changes, giving you local service visibility without Terminal commands. LINK

Trending papers & reports

Antivirus-evasion testing gives security teams the first standardized way to measure whether AI agents can build programs that slip past endpoint defenses, with one lightweight model succeeding in 17 of 18 tries. LINK

Geometric access control keeps restricted documents in AI retrieval systems isolated but fails to hide their contents, as a curious user can reconstruct original data from just a few hundred paired examples. LINK

Keystroke eavesdropping can now reverse-engineer what you type from the sound of your keys using just a cheap microphone, even on unfamiliar keyboards in noisy rooms, breaking out of lab conditions into real-world attacks. LINK

Hidden backdoor removal cleans tampered image-and-text AI systems after the fact, cutting attack success below 1% across all twelve tested cases without slowing the model or needing to know what the attacker planted. LINK

Face-cloning defenses can shield your photos by subtly altering just 5% of an image, keeping it looking clean while blocking AI tools from learning and reproducing your identity from a few shots. LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!