Lightnews — Scholar-powered news

ZeroDay Cloud: Cloud Security Hacking Competition

Reposted by Trend Zero Day Initiative

The Dustin Childs @dustinchilds.bsky.social · 9d

Hey #Wiz - congrats on starting your own contest (zeroday.cloud) but uh... did you have to cut/paste sections of the rules from @thezdi.bsky.social? Seems like you should at least run that through ChatGPT to reword it. I guess imitation is the sincerest form of plagiarism.

Join the world's top researchers in a competition to find zero-day vulnerabilities in core open-source software powering the cloud. Put your skills to the test, win huge prizes from our $4.5M prize po...

zeroday.cloud

Coming Soon...Pwn2Own Ireland 2025!

Trend Zero Day Initiative @thezdi.bsky.social · 10d

Soon.... #Pwn2Own #P2OIreland youtu.be/xVSWGtrN8s4

Zero Day Initiative — CVE-2025-23298: Getting Remote Code Execution in NVIDIA Merlin

Trend Zero Day Initiative @thezdi.bsky.social · 16d

CVE-2025-23298: Trend ZDI's @gothburz.bsky.social covers an RCE in the #NVIDIA Merlin Transformers4Rec library. He details the root cause and the patch to fix it. Finally, he highlights highlights several important lessons for the AI/ML security community. www.zerodayinitiative.com/blog/2025/9/...

While investigating the security posture of various machine learning (ML) and artificial intelligence (AI) frameworks, the Trend Micro Zero Day Initiative (ZDI) Threat Hunting Team discovered a critic...

The Patch Report for September 2025

Trend Zero Day Initiative @thezdi.bsky.social · Sep 9

No time to read the blog? Just like living walls and shrubbery? Check out the Patch Report for September 2025. @dustinchilds.bsky.social summarizes the Patch Tuesday release from the @TrendMicro Dallas office and points out the patches with extra flair. youtu.be/TIkwpdP2YAU

Zero Day Initiative — The September 2025 Security Update Review

2 2

Trend Zero Day Initiative @thezdi.bsky.social · Sep 9

It's a moderate release from both #Adobe and #Microsoft, but there's still lots to cover. Join @dustinchilds.bsky.social as he breaks down the September Patch Tuesday and highlights some fixes that require some extra attention. www.zerodayinitiative.com/blog/2025/9/...

There’s a crispness in the air – at least here in North America – and with it comes the latest security patches from Adobe and Microsoft. Take a break from your scheduled activities and join us as we ...

2 2

Trend Zero Day Initiative @thezdi.bsky.social · Sep 3

We're prepping for #Pwn2Own Ireland. We have a surge protector filled with #Amazon smart plugs, with #Philips Hue Bridge devices, which are controlling the lights. And ignore the surge protector going into a surge protector plugged into a extension cord. Don't try this at home, we're professionals.

2 4

Trend Zero Day Initiative @thezdi.bsky.social · Aug 22

We have updated the #Pwn2Own Ireland rules to clarify scoping for WhatsApp for Windows. For WhatsApp for Windows, both “WhatsApp” and the “WhatsApp Beta” applications are in scope for the competition. #P2OIreland www.zerodayinitiative.com/blog/2025/7/...

Pwn2Own Ireland 2025 Rules

1 1

Trend Zero Day Initiative @thezdi.bsky.social · Aug 15

We have updated the rules for #Pwn2Own Ireland to clarify which printer models are in scope. The HP DeskJet 2855e is the new target, which is more widely available. The rules are at www.zerodayinitiative.com/Pwn2OwnIrela...

Microsoft fixes "BadSuccessor" Kerberos vulnerability (CVE-2025-53779) - Help Net Security

Reposted by Trend Zero Day Initiative

Help Net Security @helpnetsecurity.com · Aug 13

Microsoft fixes “BadSuccessor” Kerberos vulnerability (CVE-2025-53779)

📖 Read more: www.helpnetsecurity.com/2025/08/13/m...

#cybersecuritynews #patchtuesday @microsoft.com @tenablesecurity.bsky.social @satn.am @qualysofficial.bsky.social @dustinchilds.bsky.social @thezdi.bsky.social

For August 2025 Patch Tuesday, Microsoft has fixed an EoP flaw (CVE-2025-53779) that could be used in BadSuccessor attacks.

www.helpnetsecurity.com

1 1

Trend Zero Day Initiative @thezdi.bsky.social · Aug 12

No time to read the patch blog? Just want to put it on double speed and hear @dustinchilds.bsky.social talk silly? The Patch Report for August 2025 is now available. youtu.be/agMv21gLZI8

The Patch Report for August 2025

Zero Day Initiative — The August 2025 Security Update Review

Trend Zero Day Initiative @thezdi.bsky.social · Aug 12

We've managed to make it through hacker summer camp, and #Microsoft and #Adobe survived enough to deliver their latest security patches. Join @dustinchilds.bsky.social as he breaks down another large Patch Tuesday release. www.zerodayinitiative.com/blog/2025/8/...

We’ve made it through hacker summer camp and made our way to the second Tuesday of the month. Adobe and Microsoft seemed to have survived as well, as they released their latest security patches. Take ...

Microsoft Probing If Chinese Hackers Learned of Flaws Via Alert

Trend Zero Day Initiative @thezdi.bsky.social · Aug 9

Congrats to Ken Gannon of NCC Group for winning the Pwnie for Best Mobile Bug for his #Samsung exploit he used at #Pwn2Own Ireland! We hope he returns in a few weeks with something even better.

1 3

Trend Zero Day Initiative @thezdi.bsky.social · Aug 7

Great to see Trend ZDI researchers Jonathan Andersson and Thanos Kaliyanakis present their findings on EV Charger security. We heard things got a bit flammable. #Blackhat

2

Trend Zero Day Initiative @thezdi.bsky.social · Jul 31

Announcing #Pwn2Own Ireland for 2025! We return to the Emerald Isle with our new partner #Meta & a $1,000,000 WhatsApp bounty. Plus new USB vectors on phones & more. Read the details https://www.zerodayinitiative.com/blog/2025/7/30/pwn2own-returns-to-ireland-with-a-one-million-dollar-whatsapp-target

1 4 5

Reposted by Trend Zero Day Initiative

Bloomberg News @bloomberg.com · Jul 25

Microsoft is investigating whether a leak from its early alert system for cybersecurity companies allowed Chinese hackers to exploit flaws in its SharePoint service before they were patched

Microsoft Corp. is investigating whether a leak from its early alert system for cybersecurity companies allowed Chinese hackers to exploit flaws in its SharePoint service before they were patched, according to people familiar with the matter.

bloom.bg

2 10 25

Trend Zero Day Initiative @thezdi.bsky.social · Jul 25

CVE-2025-20281: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability: ZDI analyst Bobby Gould details this bug and another that may be a dupe. He also shows how it can be exploited. www.zerodayinitiative.com/blog/2025/7/...

Zero Day Initiative — CVE-2025-20281: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

On January 25th, 2025, the Trend Zero Day Initiative (ZDI) received a report from Kentaro Kawane of GMO Cybersecurity by Ierae regarding a deserialization of untrusted data vulnerability in Cisco Iden...

Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks

2

Trend Zero Day Initiative @thezdi.bsky.social · Jul 21

The critical RCE Vulnerability in Microsoft #SharePoint was disclosed at #Pwn2Own in May. Because of Trend @thezdi.bsky.social, our customers have been protected since May.

Stay up to date on the latest with this vulnerability here: https//www.trendmi...

CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through adva...

www.trendmicro.com

1 3 4

Trend Zero Day Initiative @thezdi.bsky.social · Jul 15

CVE-2025-4941 - Trend ZDI analyst Hossein Lotfi details the Firefox bug used at #Pwn2Own Berlin by Manfred Paul. Includes root cause analysis and video demo. www.zerodayinitiative.com/blog/2025/7/...

Zero Day Initiative — CVE-2025-4919: Corruption via Math Space in Mozilla Firefox

In recent years, there has been an increase in interest in JavaScript engine vulnerabilities in order to compromise web browsers. Notably, vulnerabilities in JIT engines are among the most favorite on...

Zero Day Initiative — The July 2025 Security Update Review

Trend Zero Day Initiative @thezdi.bsky.social · Jul 9

#Adobe has (finally!) released their updates for July. 13 bulletins addressing 60 CVEs in various products. Nothing is listed as under active attack. The patch blog has bee updated with all the details. www.zerodayinitiative.com/blog/2025/7/...

It’s the second Tuesday of the month, and as expected, Adobe and Microsoft have released their latest security patches. Take a break from your scheduled activities and join us as we review the details...

The Patch Report for July 2025

Trend Zero Day Initiative @thezdi.bsky.social · Jul 8

It may be a little late (looking at you @adobe.com) but the Patch Report for July is now available. Join @dustinchilds.bsky.social as he breaks down the Microsoft release and contemplates where Adobe patches may have gone. youtu.be/BhkZ9llB5d0

Zero Day Initiative — The July 2025 Security Update Review

Trend Zero Day Initiative @thezdi.bsky.social · Jul 8

The #Adobe patches may be late, but 130 new CVEs from #Microsoft, there's still plenty to talk about. Join @dustinchilds.bsky.social as he covers the release and point out why it's a bad month to be a SQL Server admin. www.zerodayinitiative.com/blog/2025/7/...

It’s the second Tuesday of the month, and as expected, Adobe and Microsoft have released their latest security patches. Take a break from your scheduled activities and join us as we review the details...

Zero Day Initiative — Extracting Embedded MultiMediaCard (eMMC) contents in-system

Trend Zero Day Initiative @thezdi.bsky.social · Jun 20

Extracting Embedded MultiMediaCard (eMMC) contents in-system. ZDI researcher Dmitry Janushkevich details how to interact with an eMMC chip and notes some pitfalls you may encounter on the way. www.zerodayinitiative.com/blog/2025/6/...

Every complex modern device needs non-volatile storage to keep program and configuration data while unpowered. There are several competing options on the market available to today’s systems designers:...

The Patch Report for June 2025

Reposted by Trend Zero Day Initiative

Hexacon @hexacon.bsky.social · Jun 11

🚨 Long-time sponsor announcement 🚨

"Trend ZDI (@thezdi.bsky.social) is honored to be a continuing sponsor of Hexacon. Join us there to see some of the latest in offensive research and reverse engineering. We hope to rendez-vous with you in Paris."

www.zerodayinitiative.com

1 4

Trend Zero Day Initiative @thezdi.bsky.social · Jun 10

No time to read the blog? Just want the highlights of what to prioritize (and what to look out for)? Check out the Patch Report for the June Patch Tuesday release. @dustinchilds.bsky.social provides all the details, including a silent patch from last month. youtu.be/5RJqjm6VpQg