Daily digest

JSON RCE Bug Set to Rock the Java Ecosystem

Risky Business News reports that researchers are preparing to disclose a remote code execution vulnerability in a widely used Java JSON parsing library, expected to have broad impact across the Java ecosystem. The same bulletin also covers Google's introduction of a new APT naming taxonomy, expanding cyber-scam compounds in Myanmar, and a bug allowing attackers to swap the executable of legitimate signed macOS apps.

Why it matters: If any Java-based applications in your environment (Spring Boot services, internal tools) depend on the affected library, prioritize patching once the CVE details drop — RCE in a common JSON parser is a high-severity, wide-blast-radius issue.

Scans Ongoing for Exposed Spring Boot Heapdump Endpoints

SANS ISC observed continued internet scanning for the Spring Boot '/actuator/heapdump' endpoint, which by default returns a binary heap dump that can contain embedded secrets such as API keys and database passwords. The technique mirrors traditional core-dump analysis but targets Java application memory over HTTP.

Why it matters: Audit any self-hosted Spring Boot services for exposed actuator endpoints and disable or restrict '/actuator/heapdump' — this is a low-effort, high-value check for CMMC-relevant asset inventories.

Cruciferra Crypter Uses BYOVD and Process Ghosting to Evade Detection

Proofpoint identified a crypter-as-a-service called Cruciferra used by multiple unrelated cybercriminal groups, including a China-linked actor behind income-tax-themed phishing targeting Indian taxpayers and corporate finance teams. The service uses bring-your-own-vulnerable-driver (BYOVD) and process ghosting techniques to hide a range of remote access trojans from endpoint defenses.

TELESHIM Malware Abuses Telegram for C2 Against Middle East Governments

Zscaler ThreatLabz detected a campaign by an East Asia-linked threat actor deploying three previously unreported malware families — TELESHIM, MIXEDKEY, and BINDCLOAK — against government entities in the Middle East. TELESHIM uses the Telegram Bot API for command-and-control communications, and the activity was first detected earlier this month.

GitHub Adds 3-Day Dependabot Cooldown to Curb Poisoned Package Adoption

GitHub has added a cooldown mechanism to Dependabot that delays pull requests for new package releases by at least three days by default, configurable via dependabot.yml. The change aims to reduce the window during which malicious or compromised package versions get automatically pulled into projects.

Why it matters: If Ansible playbooks or automation pipelines pull dependencies via Dependabot-managed repos, review the cooldown settings — it's a free supply-chain risk reduction worth enabling org-wide.

Hackers Used Autonomous AI Agent to Spy on Thailand's Finance Ministry

Researchers discovered that a threat actor used an autonomous AI agent to conduct a cyber-espionage campaign against Thailand's Ministry of Finance. The Record reports this represents an escalation in AI-driven offensive tooling used in a real-world government-targeting intrusion.

Why it matters: As AI agents move from theoretical to operational offensive tooling, treat any self-hosted AI stack with the same scrutiny as internet-facing infrastructure — including logging, egress controls, and agent action auditing.

Federal Cloud Modernization Efforts Trade One Fragmentation Problem for Another

FedScoop reports that federal agencies' cloud modernization initiatives, intended to fix collaboration fragmentation, have in some cases introduced new technical fragmentation problems in their place, citing NASA as an example. The piece examines how consolidation efforts have not resolved underlying organizational silos.

Why it matters: Relevant context for any GCC High or AWS GovCloud migration planning — technical consolidation alone doesn't solve organizational data-silo problems that also complicate CUI boundary definition for CMMC scoping.

Foxconn Drops VMware, Adopts Hyperconverged Startup Arcrfra for AI Workloads

Foxconn has migrated off VMware and adopted hyperconverged infrastructure startup Arcrfra to run workloads including AI, according to The Register. The move is part of a broader wave of enterprises reevaluating virtualization platforms following Broadcom's VMware licensing changes.

Why it matters: Another large enterprise exiting VMware post-Broadcom acquisition reinforces the trend that made Nutanix AHV attractive — useful ammunition if you need to justify continued AHV investment or evaluate emerging HCI alternatives.

Digital Sovereignty Push Grows in Europe, Lags in the UK

The Register reports that unpredictability from the Trump administration is pushing European governments and businesses toward open-source alternatives to reduce dependence on US technology providers, while the UK remains largely tied to US tech stacks.

Google Introduces Its Own Cybercrime Group Naming Taxonomy

Google has published a new taxonomy for naming cybercrime groups, diverging from a previously discussed industry effort with Microsoft and CrowdStrike to standardize threat actor naming conventions across vendors. The move leaves threat intelligence consumers with yet another naming scheme to reconcile.

Weak Login Scanning Detected Against ESAFENET CDG Document Management System

SANS ISC reported ongoing scanning activity targeting ESAFENET's CDG (Content Data Guard) document management and data-leak prevention product, which has known SQL injection, XSS, and default password vulnerabilities. The product primarily targets the Chinese market and has been scanned previously following disclosure of an XSS flaw.