CyberWire Daily: GoAnywhere Bug, Redis Vulnerability, and Shadow AI

Critical Vulnerabilities and Exploitation

• 🚨 A critical vulnerability in Fortra's GoAnywhere managed file transfer software is being exploited in ransomware attacks, with Microsoft linking it to threat group Storm 1175.
• 🔑 The flaw allows attackers to bypass license verification and achieve remote code execution, posing a significant risk to internet-facing instances.
• ⚠️ A critical vulnerability in Redis could allow remote code execution due to a use-after-free bug in its Lua scripting feature, affecting over 330,000 exposed instances.

Threat Intelligence and Data Breaches

• 🇨🇳 Researchers assess that BIETA is likely a public front for China's Ministry of State Security, aiding intelligence and counterintelligence missions.
• ⚖️ Ohio-based IMED Vision Care will pay $5 million to settle a class-action lawsuit over a 2020 phishing-related data breach.
• 💥 The Trinity of Chaos ransomware collective has launched a leak site, allegedly tied to previous breaches and claiming to hold over 1.5 billion records.
• 🔗 LinkedIn is suing ProAPIs for allegedly creating over 1 million fake accounts to scrape user data and sell access.

AI in the Workplace and Security Challenges

• 💡 Shadow AI is emerging as a significant trend, with employees increasingly using AI chatbots and agents for work tasks, often outside of traditional IT controls.
• 🔒 Traditional security controls like CASB and DLP are not adequately equipped to monitor prompt-level data and context-specific AI usage.
• 🚫 Blocking AI tools is deemed unsustainable, as employees find workarounds, leading to frustration and security teams becoming the "department of no."
• 🤝 The winning approach involves visibility and understanding employee use cases to implement appropriate controls, rather than outright blocking.
• 🤖 Organizations are urged to move beyond blocking and become enablers of AI adoption with appropriate guardrails, fostering a more collaborative security posture.

AI's Impact on Work and Research

• 🏆 The 2025 Nobel Prize in Physics was awarded for pioneering research into quantum mechanical tunneling, fundamental to quantum computing and modern electronics.
• 🇦🇺 An Australian government contract with Deloitte is being partially refunded due to an AI-authored report containing fabricated citations and judgments.
• 🌐 The future of work is expected to involve increased use of third-party AI agents and applications, primarily accessed through browsers, with employees dictating adoption through their choices.