Bare Metal Cyber

This is the Friday Rollup for October twentieth through October twenty-fourth, twenty twenty-five, powered by DailyCyber.news. You can also listen on the go at daily cyber dot news.

A Windows change tripped up organizations that still clone machines without fixing their identity. Systems sharing a duplicate Security Identifier started failing in odd ways: domain logins broke, Group Policy missed, and access denials looked like gremlins until someone checked the imaging history. The pain clustered in virtual desktop pools and lab builds spun from a gold image that never regenerated S I D values. Microsoft’s guidance exists, but the real work is finding the offenders quickly across fleets that mix laptops, desktops, and virtual sessions. The lesson is simple: authentication brittleness can stall operations just as effectively as a cyberattack. If you run older imaging or on-prem V D I, add S I D uniqueness checks to the build pipeline and compliance scans. Then quarantine and reimage or reset the outliers so this doesn’t consume your service desk for another week.

There’s also a serious edge-device issue that deserves immediate attention. A critical flaw in T P-Link Omada gateways lets attackers run commands without logging in, and these boxes are common in small and midsize businesses, branches, and guest networks. Successful exploitation can change configurations, plant malware, or open a path deeper into your environment. The exposure spikes when management interfaces sit on the open internet or ship with defaults that never got tightened. Edge gear is a high-leverage foothold because it sits between users and everything they need, and many teams don’t monitor it closely. Inventory your Omada models now, confirm patch or mitigation status by serial number, and lock management behind a V P N. If you can’t patch today, rotate credentials, check for unauthorized admin accounts, and diff configurations for surprises.

Finally, a reminder that developer tools are part of your attack surface, not a safe zone. Two popular A I-assisted code editors package embedded Chromium components that lag upstream security fixes, leaving dozens of known browser and JavaScript engine vulnerabilities inside the editor. Developers often browse docs, sign into services, or preview apps from within that interface, which puts session tokens and credentials at risk. Attackers can chain a web-exposed flaw with local file access for a bigger win, and teams tend to delay editor upgrades because they fear breaking extensions. Treat dev workstations like the keys to the kingdom: set a policy that editor runtimes auto-update within a defined window, monitor for outdated versions, and move sensitive browsing to a fully patched browser until fixes land. If you’ve used these editors recently, rotate high-value tokens and audit plugins for anything that shouldn’t be there.

Attackers are also leaning on Microsoft’s own cloud to sell the illusion of safety. They’re hosting Office 365-lookalike pages on Azure Blob Storage, which means the pages carry legitimate Microsoft certificates and familiar subdomains. That trusted wrapper helps them slip past both human skepticism and some filters, and adversary-in-the-middle kits collect credentials and multi-factor prompts. The current waves target finance staff and administrators, where one mailbox takeover can flip invoices or reset access downstream. If you haven’t moved high-risk roles to phishing-resistant authentication yet, this is your nudge. Lock down conditional access, scrutinize OAuth grants, and hunt for new forwarding rules or strange sign-ins flagged as impossible travel. When in doubt, reset sessions and turn up auditing so you can see what the attacker tried to do.

Edge VPN appliances continue to be high-value targets, and a critical issue in WatchGuard Fireware’s I K E v2 service shows why. The flaw allows remote, unauthenticated code execution on Firebox devices, which plenty of small and midsize businesses use for site-to-site and remote access. If an appliance on the internet goes down to a memory bug or out-of-bounds write, the attacker can change policy, add accounts, and quietly pivot into internal networks. Managed service providers, retail branches, and clinics that patch slowly or run change windows on paper are especially vulnerable. Treat these boxes like tier-zero assets: inventory them, patch them, and confirm they only accept peers you trust. Then watch for unexpected tunnel establishments, process crashes, and config diffs outside change windows, because those are the breadcrumbs you’ll get when someone is already inside.

Vidar, the information-stealing malware, just got a speed upgrade. The operators re-engineered it to run multithreaded tasks, which makes credential, cookie, and wallet theft faster and more reliable. Initial access still leans on malvertising and cracked-software lures, and command-and-control servers rotate through legitimate hosting to dodge simple blocks. Faster data theft shortens the window for users or tools to interrupt the compromise, and session cookies make passwords optional for the attacker. If your crown jewels sit behind a browser session—admin consoles, finance platforms, developer portals—assume those tokens are what adversaries want. Push hardware-backed multi-factor authentication for high-risk roles, block high-risk download sites, and monitor for strange file access patterns from browser processes. When you find Vidar, quarantine quickly, rotate tokens, and invalidate active sessions before you focus on cleanup.

Meanwhile, multiple teams showed how common A I agents can be pushed into running system commands through argument injection and prompt tricks. Even so-called human-in-the-loop approvals can be gamed when the interface nudges people to click accept without context. That turns a chat-looking interaction into data exfiltration, shell execution, or package installs on developer machines and internal tools. If you’re piloting agents, treat them like privileged applications, not toys on a laptop. Lock down tool permissions to a default-deny list, pin network egress, and filter command-line arguments so an agent can’t slip dangerous flags past you. Then watch for any agent host invoking shells, calling package managers, or making new outbound requests right after a prompt interaction.

That’s the Friday Rollup for October twentieth through October twenty-fourth, twenty twenty-five. For more, visit BareMetalCyber dot com, and listen daily at daily cyber dot news. Thanks for listening. We’re back Monday.