Remote Code Execution Vulnerabilities in AI/ML Libraries
Executive Summary
Unit 42 researchers identified remote code execution (RCE) vulnerabilities in open-source AI/ML Python libraries from Apple, Salesforce, and NVIDIA. Vulnerable versions allow RCE when a model file with malicious metadata is loaded; NVIDIA issued CVE-2025-23304 and Salesforce issued CVE-2026-22584, both rated as high severity and have released fixes.
Vulnerability Details
Affected Product: NVIDIA NeMo (versions prior to 2.3.2)
Identifier: CVE-2025-23304
CVSS Score: High
Affected Product: Salesforce Uni2TS
Identifier: CVE-2026-22584
CVSS Score: High
Risk & Impact
Triage: High urgency due to the potential for arbitrary code execution by exploiting model metadata.
Attack Vector: An attacker can embed arbitrary code in model metadata, which executes when vulnerable libraries load the modified models.
Ease of Exploit: Relatively easy, as vulnerable libraries automatically execute the provided data as code.
Action Plan
Immediate Action: Upgrade NVIDIA NeMo to version 2.3.2 or later. Apply the fix released by Salesforce.
Workaround: Ensure that AI/ML model files are loaded only from trusted sources and implement rigorous input validation.
Detection: Employ Prisma AIRS to identify models leveraging these vulnerabilities and extract their payloads.
Relevant professional terms
Remote Code Execution (RCE)
A type of vulnerability that allows an attacker to execute arbitrary code on a target system.
Deserialization
The process of converting serialized data back into an object. Insecure deserialization can lead to RCE if the data is not validated.
iPhone Users Urged to Update to iOS 26 to Patch Actively Exploited Vulnerabilities
Executive Summary
Apple has confirmed that vulnerabilities are being actively exploited in older iOS versions, urging users to update to iOS 26, which includes the "Liquid Glass" interface, to receive critical security patches. These vulnerabilities, including those in WebKit, could allow for arbitrary code execution.
Vulnerability Details
Affected Product: iPhones running versions prior to iOS 26
Instagram users experienced a surge of password reset emails amidst reports of a data leak. A threat actor scraped data from approximately 17.5 million accounts by exploiting an API vulnerability.
Attack Overview
Attack Path: An Instagram API vulnerability dating back to 2024 was exploited to scrape user data.
Attacker: Solonik
Impact Assessment
Data Stolen: 17.5 million Instagram accounts had data scraped, including usernames, names, email addresses, phone numbers, and partial physical addresses.
Detection & Hunting
IOCs: Monitor for activity related to the threat actor "Solonik" on hacking forums.
Target has implemented an emergency lockdown of its internal Git servers (git.target.com) effective January 9, 2026, following credible reports that 860GB of proprietary source code is being sold online. Current and former employees have verified the authenticity of the leaked data.
Attack Overview
Attack Path: Intelligence suggests the breach stems from a compromised employee workstation infected by infostealer malware in late September 2025.
Vector: The compromised device reportedly had extensive access to internal IAM, Confluence, and Jira services, allowing the threat actor to exfiltrate data months before attempting to monetize it.
Attribution: While not yet formally attributed, the pattern matches groups that utilize data extortion tactics post-exfiltration.
Impact Assessment
Data Stolen:Approximately 860GB of data, including source code, internal documentation, and proprietary "blossom IDs" (project identifiers).
Verification: Leaked samples contain references to internal systems ("BigRED", "TAP"), CI/CD pipelines based on Vela, and supply-chain infrastructure like JFrog Artifactory.
Strategic Takeaway
This incident highlights the "Long-Tail" risk of infostealer infections. A device compromised in September can lead to a massive intellectual property leak in January. Organizations must correlate endpoint alerts with abnormal heavy data egress from developer environments.
Relevant professional terms
Infostealer
Malware designed to harvest sensitive information (credentials, cookies, tokens) from a victim's computer.
CI/CD Pipeline
A set of automated processes (Continuous Integration/Continuous Delivery) used by developers to build, test, and deploy code.
VoidLink is a cloud-first malware framework targeting Linux systems, discovered in December 2025 and believed to originate from a Chinese-affiliated development environment. The malware is designed for persistent and stealthy operation within cloud infrastructure, potentially targeting software engineers and cloud infrastructure operators.
Key TTPs
Defense Evasion: Employs adaptive stealth, runtime code encryption, and self-deletion mechanisms upon detecting tampering or security monitoring.
Campaign Analysis
VoidLink is written in Zig and features a modular architecture with over 30 plugin modules, demonstrating exceptional technical sophistication. The framework adapts to major cloud providers and containerized environments, suggesting potential espionage or supply-chain attacks.
Targeting & Infrastructure
Target Profile: Software engineers and cloud infrastructure operators.
Infrastructure: Cloud environments, including AWS, GCP, Azure, Alibaba, and Tencent, as well as Docker and Kubernetes containers.
Relevant Terms
Rootkit: A set of software tools that allow an unauthorized user to gain privileged access to a computer system while concealing its presence.
C2 Framework: Command and Control framework, which is infrastructure and software used by attackers to control compromised systems within a target network.
Attackers are using the Browser-in-the-Browser (BitB) technique to target Facebook users and steal their login credentials. This method involves creating a fake login window within a legitimate browser session, making it difficult for users to distinguish from the real Facebook login page.
Key TTPs
Initial Access: Phishing emails, often disguised as legal notices or account alerts, contain shortened URLs that redirect to fake Meta captcha pages.
Execution: JavaScript code is used to create a simulated browser window that mimics the appearance of a legitimate login page.
Defense Evasion: Attackers are hosting phishing pages on trusted cloud platforms like Netlify and Vercel to bypass security filters.
Campaign Analysis
The BitB technique represents a significant escalation in phishing sophistication, making it harder for users to detect fake login prompts. This method exploits the trust users place in familiar login pop-ups, increasing the likelihood of credential theft.
Targeting & Infrastructure
Target Profile: Facebook users are the primary target, due to the platform's large user base.
Infrastructure: Attackers are abusing legitimate cloud platforms (e.g., Netlify, Vercel) and URL shorteners (e.g., Lnk[.]ink, rebrand[.]ly) to host and distribute phishing pages.
The Amsterdam Court of Appeal sentenced a Dutch national to seven years in prison for hacking the ports of Rotterdam and Antwerp. The hacker facilitated drug trafficking by compromising port systems.
The Scheme
TTP 1: Gained initial access by using employees to insert USB sticks containing malware.
TTP 2: Planted a remote access tool on internal systems.
TTP 3: Performed data exfiltration from databases and intercepted data during transmission.
The Players
Facilitators Arrested: Davy de Valk (44-year-old Dutch national).
The Consequence
Outcome: Seven-year prison sentence.
Strategic Takeaway
Compromising port systems can have significant implications for international trade and security, enabling illicit activities such as drug trafficking.
Relevant Terms
Data Exfiltration: The unauthorized transfer of data from a computer or network.
Remote Access Tool: Software that allows a user to access and control a computer from a remote location.
