{"uuid": "9911758f-c0d4-4943-bb4e-0ba487df47a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-12999", "type": "seen", "source": "https://gist.github.com/ichintu/b0ff4b467c604a3012760cd37eb92671", "content": "This threat intelligence digest highlights critical vulnerabilities, advanced threats, and AI-driven industry shifts:\n\n**Vulnerabilities:** A severe Open VSX cache poisoning flaw (CVE-2025-12999) enables extension supply chain attacks via header injection. Godot reports three memory-safety bugs in its file parsers, though maintainers dispute the security impact. BioStar\u2019s BIOS utility contains a publicly exploited write-what-where IOCTL flaw (CVE-2026-94146) amid vendor silence.\n\n**Threat Actor Activity:** GraphWorm, a China-linked APT, uses cloud-hosted Microsoft Graph/OneDrive C2 with instant credential rotation, rendering standard token revocation ineffective; mitigation requires targeting app registrations and identity telemetry. ChainScript RAT is delivered via ClickFix lures impersonating legitimate software by the Blackpoint APG.\n\n**AI Security & Workforce Trends:** Rapid model drift makes one-time security testing obsolete, necessitating continuous, automated validation. Concurrently, AI is reshaping the cybersecurity job market by automating routine tasks, consolidating leadership roles, and widening skills gaps, while exposing foundational control deficiencies and shrinking entry-level talent pipelines.", "creation_timestamp": "2026-09-21T12:02:45.117353Z"}