The IT Nerd

Researchers have uncovered a new privacy risk with Shadow Escape that exploits the Model Context Protocol (MCP) businesses use to connect to LLMs. The attack enables hackers to steal volumes of data such as Social Security Numbers, medical records, and business information that use AI assistants without the user ever clicking a suspicious link or making a mistake. 

The details can be found here: https://www.operant.ai/art-kubed/shadow-escape

Roger Grimes, CISO Advisor at KnowBe4, provided the following comments:

“I’m familiar with at least one other similar attack involving another, more popular AI tool, that the research plans to publicly release soon after practicing responsible disclosure with the vendor. They seem to be coming out of the woodwork so to speak. This zero-click attack is just going to be one of thousands coming out over the next few years. These initial reports are just the beginning stages of what promises to be years and years of new types of exploits. That’s because AI and the way they interact with other AIs and humans are just starting to be discovered and explored. The sheer amount of ways that any AI can interact with something else makes it far harder, if not impossible, for the vendor or a cyber defender to test before the AI is released.

“We didn’t do a great job at testing non-AI, more deterministic software and systems, to make sure they didn’t have vulnerabilities. Heck, we had over 40K separate publicly announced vulnerabilities last year and we are on our way to having over 47K this year. Non-deterministic AIs with the ability to have thousands of different types of interactions is just going to make that number explode. We are just now opening pandora’s box, and we are definitely not going to like what we see. I thought stuff was complex in the past. We will think of the past decades of vulnerabilities as the “good times” before AI everywhere arrived. It’s getting ready to be very stormy.”

Organizations need to look at the use of AI by their employees. They need to ensure that they are using only company approved AI tools and making sure that anything that connects to an LLM is secure. Otherwise, they are wide open to this sort of attack.

Hackers are actively exploiting a critical vulnerability (CVE-2025-54236, CVSS 9.1) in Adobe Commerce and Magento Open Source, known as SessionReaper. The flaw, stemming from improper input validation, allows attackers to bypass security features and potentially take over customer accounts via the Commerce REST API. Although Adobe released a hotfix on September 9, exploitation began after the patch was leaked early, and only 38% of affected sites have applied the fix. Sansec has observed roughly 250 attacks already, with exploitation expected to escalate rapidly following the public release of technical details by Searchlight Cyber. Adobe has confirmed the vulnerability is now being exploited in the wild.

 Dale Hoak, CISO, RegScale had this to say:

     “The rapid exploitation of SessionReaper underscores how compliance and security controls must operate continuously, not periodically. Many organizations treat patch management and vulnerability response as checklist items, but real resilience comes from continuous monitoring of control drift and evidence of remediation. When technical writeups go public, automation and compliance-as-code can make the difference between being patched in hours versus weeks.”

We are now in an age of patch everything ASAP before the bad guys try to pwn you. This illustrates how bad things have become and why things need to change ASAP.

A researcher has uncovered an RCE vulnerability in open-source identity management system Apache Syncope through its Groovy scripting feature. On versions prior to 3.0.14 and 4.0.2, an administrator can upload Groovy code that executes with the privileges of the running Syncope Core process, enabling remote code execution (RCE).

You can find more details here:

 https://gist.github.com/N3mes1s/213e20931ea2d27af5c47e90dedbe05f

Henrique Teixeira, SVP of Strategy, Saviynt, commented:

“First, credit to the researcher and Apache for identifying and resolving this issue. CVEs like this matter. If exploited, attackers could execute code, exfiltrate secrets, or pivot across environments. But we also need to look at the threat model: exploitation requires administrative access to the tenant or domain. And if someone already has admin rights in an identity system, it’s effectively game over. That person can create or remove users, escalate privileges, and move laterally across systems.

This highlights why identity controls are so critical. Organizations should upgrade to the patched Syncope versions, avoid Groovy in favor of Java implementations, and enforce least privilege and strong authentication. Log everything, continuously audit admin activity, and prioritize identity hygiene by removing unused permissions and applying just-in-time privilege access. The bigger picture is that while patching vulnerabilities is essential, most breaches still start with exposed or misused identities. Securing them must remain the first line of defense.”

This was fixed pretty quickly. But next time, because there is always a next time, the world may not be so lucky. Thus having a layered defensive structure that includes the suggestions that Mr. Teixeira made above is the best advice that organizations could receive.