mercedes-benz

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

React conquered XSS? Think again. That's the reality facing JavaScript developers in 2025, where attackers have quietly evolved their injection techniques to exploit everything from prototype pollution to AI-generated code, bypassing the very frameworks designed to keep applications secure. Full 47-page guide with framework-specific defenses (PDF, free). JavaScript conquered the web, but with that victory came new battlefields. While developers embraced React, Vue, and Angular, attackers evolved their tactics, exploiting AI prompt injection, supply chain compromises, and prototype pollution in ways traditional security measures can’t catch. A Wake-up Call: The Polyfill.io Attack In June 2024, a single JavaScript injection attack compromised over 100,000 websites in the biggest JavaScript injection attack of the year. The Polyfill.io supply chain attack, where a Chinese company acquired a trusted JavaScript library and weaponized it to inject malicious code, affected major platforms including Hulu, Mercedes-Benz, and WarnerBros. This wasn't an isolated incident targeting vulnerable forms or outdated systems. This was a sophisticated injection that turned websites' own security tools against them, proving that traditional JavaScript defenses have become dangerously obsolete. The Threat Landscape Has Changed Gone are the days when a simple innerHTML sanitization could keep your app secure. Today's attackers are leveraging: Supply chain compromises targeting your favorite npm packages Prototype pollution attacks that can hijack your entire object model AI-driven prompt injections that trick LLMs into generating malicious code DOM-based XSS in single-page applications that bypass server-side protections The numbers tell the story: 22,254 CVEs were reported by mid-2024, a 30% jump from 2023 and 56% increase from 2022. With 98% of websites using JavaScript client-side and 67.9% of developers relying on it as their primary language, the attack surface has never been larger. What Makes This Different Most security guides still focus on decade-old attack patterns. This comprehensive analysis breaks down modern threats with a defense-in-depth approach that prioritizes protections by impact: For real-world code samples and a prioritized roadmap, see the full guide The Framework Reality Check Even modern frameworks aren't bulletproof: This React code looks safe but isn't – // 🚨 Vulnerable: unsanitized input Better approach with proper sanitization - // ✅ Secure: React component with DOMPurify Why it matters: dangerouslySetInnerHTML bypasses React's built-in XSS protection by directly injecting HTML into the DOM. When user content contains malicious scripts, they execute immediately in the victim's browser, potentially: Stealing authentication cookies and session tokens Performing actions on behalf of the user Redirecting to malicious sites Keylogging sensitive information DOMPurify sanitizes HTML by parsing the content and removing any potentially malicious elements while preserving safe formatting tags like , , , etc. The Banking Sector Under Siege The financial industry has become prime target for sophisticated JavaScript injection attacks. In March 2023, IBM uncovered a malware campaign that targeted over 40 banks across the Americas, Europe, and Japan, compromising more than 50,000 individual user sessions. The attack leveraged advanced JavaScript web injections that detect specific page structures used by banking platforms, then dynamically inject malicious scripts to steal user credentials and one-time password tokens. What made this campaign particularly dangerous was its adaptive behavior, the malware constantly communicated with command-and-control servers, adjusting its tactics in real-time based on page states and security detection attempts. Using sophisticated obfuscation techniques, the malware could patch functions to remove traces of its presence and avoid execution when security products were detected, proving that traditional JavaScript defenses are no match for modern, dynamically evolving threats. The Store Raw, Encode on Output Principle One of the guide's most practical insights reinforces a fundamental security best practice: always store raw data and encode based on output context. This approach: Store raw, unencoded data in your database Apply context-specific encoding at render time based on where data appears Use different encoding methods for each output context (HTML entities for HTML content, JavaScript escaping for JS contexts, URL encoding for URLs, CSS escaping for stylesheets) This context-aware encoding approach prevents double-encoding issues, maintains data integrity, and ensures proper protection regardless of how the data is eventually displayed, something any TypeScript developer building robust domain models will appreciate. The key insight is that the same user input might need HTML encoding when displayed in a div, JavaScript escaping when used in a script tag, and URL encoding when used in a link parameter. WebAssembly Security Considerations While WebAssembly offers performance benefits and sandboxing, it's important to understand its security implications. The guide examines how Wasm introduces specific considerations that developers should be aware of: Source code vulnerabilities carry over: Memory-unsafe languages like C/C++ compiled to Wasm retain their original vulnerability patterns (buffer overflows, use-after-free, etc.) Reduced transparency: The binary format makes security auditing more challenging compared to readable JavaScript source Novel attack surfaces: Side-channel attacks through timing analysis and potential VM escape vectors, though these remain largely theoretical WebAssembly's sandboxed execution model does provide strong isolation, but like any technology, it requires thoughtful implementation and shouldn't be viewed as an automatic security upgrade from JavaScript. Emerging AI Threats As LLMs become integrated into web applications, a new attack vector has emerged: prompt injection attacks. Malicious users craft prompts that trick AI models into generating JavaScript code that executes on the client side, a completely new category of injection vulnerability. You can learn more about it in the full guide. The Bottom Line Modern JavaScript security isn't about implementing a checklist, it's about understanding how attackers think and building layered defenses that adapt to evolving threats. Whether you're building with React, Angular, or Vue, the fundamental principle remains: never trust client-side code, always validate server-side, and encode based on context. The complete guide provides implementation examples for all major frameworks, practical code samples, and a prioritized approach that helps teams tackle the most critical vulnerabilities first.

For the latest discoveries in cyber research for the week of 14th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES McDonald’s has suffered a data breach that resulted in the exposure of chat transcripts, session tokens, and personal data from more than 64 million job applications submitted through its AI powered McHire chatbot platform. Data leaked included applicants’ names, email addresses, phone numbers, home addresses, availability, and personality test results, made accessible due to an insecure direct object reference (IDOR) vulnerability and admin accounts protected by weak default credentials. RocketGenius, the developer of WordPress plugin Gravity Forms, has experienced a cyber-attack that resulted in the compromise of plugin versions 2.9.11.1 and 2.9.12 available for manual download and composer install between July 10 and 11. The attack enabled remote code execution, extensive exfiltration of website metadata—including URLs, admin paths, installed themes, plugin and server versions—and the creation of a rogue admin account granting attackers complete control over affected websites, impacting potentially one million sites. Bitcoin Depot, a major Bitcoin ATM operator in the US, has suffered a data breach that resulted in the exposure of sensitive personal information belonging to nearly 27,000 customers, including full names, phone numbers, driver’s license numbers, addresses, dates of birth, and email addresses. Albemarle County in Virgina, United States, was hit by a ransomware attack that resulted in significant phone and technology outages, and the potential exposure of sensitive data belonging to local government and public-school employees, including driver’s license numbers, Social Security numbers, passport numbers, military IDs, and more. Some of the county’s 112,000 residents may have also had their names, addresses, and Social Security numbers compromised. GMX, a decentralized crypto exchange platform, has confirmed a cyber-attack that resulted in the theft of more than $40 million worth of cryptocurrency assets from its platform. The incident impacted user funds, with about $43 million in digital assets—including Ethereum, USDC, and DAI—being stolen and laundered by the hacker, affecting the platform’s more than 700,000 users. Nippon Steel Solutions, Japan’s largest steelmaker, has suffered a data breach after attackers exploited a zero-day vulnerability in its network equipment, resulting in unauthorized access to sensitive information. The breach has potentially exposed personal data of customers, partners, and employees. Ameos Group, a major Swiss hospital group, has experienced a cyber-attack that resulted in significant disruptions to its hospital operations across multiple locations. Critical IT systems were rendered inoperable, affecting both inpatient and outpatient care, as well as internal communication and documentation. VULNERABILITIES AND PATCHES Microsoft has published July’s Patch Tuesday, addressing 137 vulnerabilities across Microsoft products, including a publicly disclosed zero-day (CVE-2025-49719) in Microsoft SQL Server that allows remote, unauthenticated information disclosure due to improper input validation. Critical remote code execution vulnerabilities in Microsoft Office—triggered by malicious documents or preview pane viewing—and additional RCE flaws in Microsoft SharePoint (CVE-2025-49704) are also resolved. Details have been disclosed on a pre-authenticated SQL injection vulnerability (CVE-2025-25257, CVSS 9.8) in Fortinet FortiWeb, where exploitation can lead to remote code execution on unpatched systems. Attackers can inject arbitrary SQL via the Authorization header in HTTP requests, allowing unauthorized file creation and code execution through manipulated Python files. Exploits and technical details have been released publicly, greatly increasing the risk of compromise. Check Point IPS provides protection against this threat (Fortinet FortiWeb SQL Injection CVE-2025-25257) A technical analysis of the PerfektBlue vulnerability chain revealed four chained flaws (CVE-2024-45431 through CVE-2024-45434) in the Blue SDK Bluetooth stack used by OpenSynergy. The vulnerabilities enable remote code execution in over 350 million vehicles from Mercedes-Benz, Volkswagen, Skoda, and possibly Ford, and more than 1 billion embedded devices spanning automotive, industrial, consumer, mobile, and medical sectors. THREAT INTELLIGENCE REPORTS Check Point Research has released its June 2025 Malware Report highlighting AsyncRAT which was ranked number three among Top Malware. AsyncRAT was distributed via sophisticated multi-stage malware campaign exploiting expired Discord vanity invite links, leveraging trusted platforms such as GitHub, Bitbucket, and Discord for payload delivery and data exfiltration. The report also details additional malware families including FakeUpdates and Androxgh0st, affecting sectors such as education, healthcare, and government. Check Point Research has summarized key findings about the Scattered Spider threat group, which has recently targeted major airlines and diverse enterprises using sophisticated social engineering and phishing domain infrastructure. The group employs phishing sites that mimic corporate login portals (e.g., victimname-sso.com), MFA fatigue, vishing, SIM swapping, and uses both remote access tools and infostealers. Check Point has released findings revealing a 39% surge in weekly cyber-attacks targeting organizations in Latin America during the first half of 2025, averaging 2,716 weekly incidents compared to the global average of 1,955. Key threats include advanced malware such as RATs and botnets, while email was identified as the leading delivery vector.