DAILY BRIEFING
Exposed Rockwell PLCs, CryptoJS Wallet Drains, WebKit IP Leaks
5 stories2 min read
Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
Attackers exploited a SQL injection flaw in a public web application to compile the khunt post-exploitation toolkit directly inside an Oracle database engine. By executing Java source code via JDBC into database schema objects, attackers obtained Windows SYSTEM-level execution without dropping files to disk.
- What to do
- Fix SQL injection vulnerabilities in web applications, restrict database account privileges, and query Oracle logs for KHUNT schema objects.
Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities
Forescout identified 4,407 internet-exposed Rockwell PLCs globally, including 22 located in cities where US water utilities suffered recent cyberattacks. Attackers altered IP addresses and set passwords on exposed devices without needing exploit code, causing operators to lose equipment visibility and control.
CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps
year-old weak random number generator in CryptoJS (CryptoJS.lib.WordArray.random) was leveraged in the Ill Bloom wallet drains, resulting in at least $5.7 million stolen across five identified cryptocurrency wallet applications that used it for recovery phrase entropy.
- What to do
- Update affected wallet applications to patched releases and migrate funds to wallet seeds generated with secure entropy sources.
Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses
Researchers discovered that Apple's iCloud Private Relay can expose real IP addresses due to proxy bypasses in WebKit. Three WebKit features—DNS prefetching, WebAuthn Related Origin Requests, and WebTransport—send network traffic directly from the device rather than through configured privacy proxies.
- Why it matters
- Users relying on iCloud Private Relay for network anonymization can have their actual IP address exposed to external sites while browsing through any WebKit-based browser.
AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory
A new class of prompt injection is spreading across commercial websites.
- Why it matters
- Users clicking unverified AI links risk corrupting their LLM's long-term memory, silently biasing future AI outputs toward untrusted third-party vendors without safety warnings.
Key takeaways
- Forescout identified 4,407 exposed Rockwell PLCs online globally, including 22 located in cities where water utilities suffered cyberattacks.
- CryptoJS random number generator flaw led to $5.7 million in wallet drains across five affected crypto applications.
- Apple iCloud Private Relay can leak real IP addresses through WebKit proxy bypasses in DNS prefetching, WebAuthn, and WebTransport.
- Prompt injection attacks leverage pre-filled deep links in Ask AI buttons to poison LLM memory and manipulate future recommendations.
- Attackers compiled the khunt toolkit directly inside Oracle database schemas via SQL injection to elevate access to Windows SYSTEM privileges.