Cybersecurity briefing — August 10, 2025.

Cisco Talos disclosed five vulnerabilities in Broadcom/Dell ControlVault3 firmware and related Windows APIs, dubbed “ReVault.” Attackers could abuse them to bypass Windows authentication, extract cryptographic keys, and implant stealthy firmware malware that survives OS reinstalls. Organizations should prioritize vendor BIOS/firmware and driver updates and review controls around credential storage and hardware security modules on affected devices.

Source: Cisco Talos

Researchers at Eclypsium detailed vulnerabilities in select Lenovo webcams that allow remote attackers to reprogram them into BadUSB devices, enabling covert keystroke injection independent of the host OS. The attack expands webcam risk beyond video capture to full workstation compromise. Limit or block new USB HID devices via policy, deploy device control, and apply firmware updates when available.

Source: TheHackerNews

A path traversal vulnerability in WinRAR, fixed in version 7.13, was exploited as a zero‑day in phishing campaigns to install RomCom malware. Because archives are commonly trusted in workflows, this bug materially raises user risk until patched. Update WinRAR to v7.13 immediately and treat unsolicited archive files as untrusted content.

Source: Security Affairs

Wired reports the US court records system has been breached, with authorities investigating the scope and potential exposure of sensitive data. The incident underscores the systemic risks to critical public-sector platforms and the downstream potential for targeted phishing and identity abuse tied to case information.

Source: Wired

At DEF CON, researcher Micah Lee detailed how he compromised TeleMessage, a “secure” messaging app reportedly used by White House officials, leading to a large dump of communications. The episode highlights widespread OPSEC lapses and the danger of relying solely on vendor assurances without rigorous security architecture and monitoring.

Source: The Register

TRM Labs tracking shows Embargo ransomware has processed roughly $34.2 million in incoming crypto since emerging in April 2024. Researchers assess Embargo as a probable successor to ALPHV, signaling the rapid reconstitution of ransomware operations despite law enforcement pressure.

Source: Security Affairs

NeuralTrust researchers combined “Echo Chamber” and narrative steering to bypass GPT‑5 safety guardrails and generate illicit outputs, and showcased zero‑click AI‑agent attack paths that can reach cloud and IoT systems. The findings reinforce the need for strict permissioning of agent connectors, egress controls, and independent runtime monitoring for AI workflows.

Source: TheHackerNews