Threats Day: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More

Summary: Check Point reverse engineered Microsoft's signed Defender Boot-Time Removal driver (BTR.sys) and showed it can be repurposed as a kernel operation engine to bypass endpoint security during the "golden window" between system start and user mode initialization, without a bring-your-own-vulnerable-driver approach. The U.S. DOJ charged 17 members of Iran's Mabna Institute, which since at least 2013 targeted more than 100,000 professor accounts across 144 U.S. and 178 foreign universities, at least 42 U.S. companies and five government agencies, compromising roughly 8,000 accounts and stealing over 31 TB of academic data for the IRGC.
Bottom line: A legitimate Microsoft-signed driver that signature-based blocking cannot stop is now a demonstrated path around endpoint security, and the State Department is offering $10 million for information on five Mabna defendants whose contractor model sold stolen university research to paying customers.

Read the original at The Hacker News ↗