Aggregator

<p>If you’ve administered Active Directory (AD) for any significant time, chances are you’ve come across the primaryGroupID attribute. Originally developed as a method for AD to support Portable Operating System Interface…</p>

Day Two of Pwn2Own Automotive 2026 was packed with action, and the stakes continued to rise. Security researchers returned to the Pwn2Own stage, probing and challenging the latest automotive systems as the competition intensified. New exploits, unexpected twists, and standout performances emerged throughout the day - follow along here for daily updates as the race for Master of Pwn heats up. 

Following an action-packed Day One, where $516,500 USD was awarded for 37 unique 0-day vulnerabilities, Day Two added another $439,250 USD and 29 unique 0-days, bringing the event totals to $955,750 USD with 66 unique vulnerabilities overall. Fuzzware.io holds a commanding lead for Master of Pwn, but with one day to go, anything can still happen. We’ll see what the final day of the contest brings. 

Stay up to date throughout Day Two by following us on Twitter, Mastodon, LinkedIn, and Bluesky, and join the conversation using #Pwn2Own Automotive and #P2OAuto. 

SUCCESS - Inhyung Lee, Seokhun Lee, Chulhan Park, Wooseok Kim, and Yeonseok Jang of Team MAMMOTH exploited a command injection vulnerability against the Alpine iLX-F511, earning $10,000 USD and 2 Master of Pwn points.

FAILURE - Autocrypt - Hoyong Jin, Jaewoo Jeong, Chanhyeok Jung, Minsoo Son, and Kisang Choi - targeted the Grizzl‑E Smart 40A with the Charging Connector Protocol/Signal Manipulation add‑on but were unable to demonstrate the vulnerability within the allotted time.

SUCCESS - Julien COHEN‑SCALI of FuzzingLabs (@FuzzingLabs) targeted the Phoenix Contact CHARX SEC‑3150, chaining two vulnerabilities - an authentication bypass and privilege escalation - to earn $20,000 USD and 4 Master of Pwn points.

SUCCESS - Neodyme AG (@Neodyme) exploited a buffer overflow vulnerability (CWE‑120) in Round 3 to achieve privileged code execution on the Sony XAV‑9500ES, earning $10,000 USD and 2 Master of Pwn points. #Pwn2Own #P2OAuto

SUCCESS - Hank Chen (@hank0438) of InnoEdge Labs exploited an exposed dangerous method against the Alpitronic HYC50 – Lab Mode, earning $40,000 USD and 4 Master of Pwn points.

SUCCESS / COLLISON - Nguyen Thanh Dat (@rewhiles) of Viettel Cyber Security (@vcslab) targeted the Alpine iLX-F511, hitting a one-vulnerability collision with a previous attempt and earning $2,500 USD and 1 Master of Pwn point.

SUCCESS / COLLISON - BoredPentester (@BoredPentester) targeted the Grizzl‑E Smart 40A with the Charging Connector Protocol/Signal Manipulation add‑on, combining two bugs to earn $20,000 USD and 3 Master of Pwn points. #Pwn2Own #P2OAuto

SUCCESS / COLLISON - Bongeun Koo (@kiddo_pwn) and Evangelos Daravigkas (@freddo_1337) of Team DDOS targeted the Kenwood DNR1007XR, exploiting an n‑day command injection to earn $4,000 USD and 1 Master of Pwn point.

SUCCESS - Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) targeted the Kenwood DNR1007XR in Round 6, exploiting a command injection vulnerability to earn $5,000 USD and 2 Master of Pwn points.

SUCCESS / COLLISON - Kazuki Furukawa (@N4NU) of GMO Cybersecurity by Ierae targeted the Alpine iLX-F511, hitting a one-vulnerability collision with a previous attempt and earning $2,500 USD and 1 Master of Pwn point. #Pwn2Own #P2OAuto

SUCCESS / COLLISON - Donggeon Kim (@gbdngb12), Hoon Nam (@pwnstar96), Jaeho Jeong (@jeongZero), Sangsoo Jeong (@sangs00Jeong), and Wonyoung Jung (@nonetype_pwn) of 78ResearchLab targeted the Kenwood DNR1007XR, exploiting one n-day vulnerability along with two collisions to earn $2,500 USD and 1 Master of Pwn point.

SUCCESS - Xilokar ([email protected]) targeted the Alpitronic HYC50 – Lab Mode, exploiting one bug to earn $20,000 USD and 4 Master of Pwn points.

SUCCESS / COLLISON - Hyeongseok Lee (@fluorite_pwn), Yunje Shin (@YunjeShin), Chaeeul Hyun (@yskm_Gunter), Ingyu Yang (@Mafty5275), Hoseok Kang (@cl4y419), Seungyeon Park (@vvsy46), and Wonjun Choi (@won6_choi) of BoB::Takedown targeted the Grizzl-E Smart 40A, hitting one collision and one unique 0-day, earning $15,000 USD and 3 Master of Pwn points.

SUCCESS - Tobias Scharnowski (@ScepticCtf), Felix Buchmann (@diff_fusion), and Kristian Covic (@SeTcbPrivilege) of Fuzzware.io targeted the Phoenix Contact CHARX SEC-3150 in Round 5, exploiting three bugs with two add-ons to earn $50,000 USD and 7 Master of Pwn points.

SUCCESS / COLLISON - Slow Horses of Qrious Secure (@qriousec) targeted the Alpine iLX-F511, resulting in a single vulnerability collision with a previous attempt, earning $2,500 USD and 1 Master of Pwn point.

FAILURE - Autocrypt (Hoyong Jin, Jaewoo Jeong, Chanhyeok Jung, Minsoo Son, and Kisang Choi) targeted the Autel MaxiCharger AC Elite Home 40A with the Charging Connector Protocol/Signal Manipulation add-on, but ran out of attempts before the exploit could be demonstrated.

SUCCESS - BoredPentester (@BoredPentester) targeted the Kenwood DNR1007XR, demonstrating a command injection vulnerability to earn $5,000 USD and 2 Master of Pwn points.

SUCCESS - Rob Blakely of Technical Debt Collectors targeted Automotive Grade Linux, chaining three bugs - an out-of-bounds read, memory exhaustion, and a heap overflow - to earn $40,000 USD and 4 Master of Pwnpoints. #Pwn2Own #P2OAuto

SUCCESS / COLLISON - PHP Hooligans / Midnight Blue (@midnightbluelab) targeted the Autel MaxiCharger AC Elite Home 40A with the Charging Connector Protocol/Signal Manipulation add-on, hitting a full collision on a two-bug chain, earning $20,000 USD and 3 Master of Pwn points. #Pwn2Own #P2OAuto

SUCCESS - Synacktiv (@synacktiv) targeted the Autel MaxiCharger AC Elite Home 40A with the Charging Connector Protocol/Signal Manipulation add‑on. In Round 2, they exploited one stack‑based buffer overflow, earning $30,000 USD and 5 Master of Pwn points.

SUCCESS - Tobias Scharnowski (@ScepticCtf), Felix Buchmann (@diff_fusion), and Kristian Covic (@SeTcbPrivilege) of Fuzzware.io targeted the ChargePoint Home Flex (CPH50-K) with the Charging Connector Protocol/Signal Manipulation add-on, exploiting one command injection bug to earn $30,000 USD and 5 Master of Pwn points. #Pwn2Own #P2OAuto

FAILURE - PetoWorks (@petoworks) targeted the Alpine iLX-F511 but was unable to demonstrate their exploit within the allotted time.

SUCCESS - Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) targeted the ChargePoint Home Flex (CPH50-K) with the Charging Connector Protocol/Signal Manipulation add-on, exploiting two bugs to earn $30,000 USD and 5 Master of Pwn points.

SUCCESS / COLLISON - PetoWorks (@petoworks) targeted the Kenwood DNR1007XR, hitting one bug collision earning $2,500 USD and 1 Master of Pwn point.

SUCCESS / COLLISON - Tobias Scharnowski (@ScepticCtf), Felix Buchmann (@diff_fusion), and Kristian Covic (@SeTcbPrivilege) of Fuzzware.io targeted the Grizzl-E Smart 40A with the Charging Connector Protocol/Signal Manipulation add-on, resulting in two bug collisions and earning $15,000 USD and 3 Master of Pwn points.

SUCCESS / COLLISON - Bongeun Koo (@kiddo_pwn) and Evangelos Daravigkas (@freddo_1337) of Team DDOS targeted the Phoenix Contact CHARX SEC-3150 with the Charging Connector Protocol/Signal Manipulation add-on, demonstrating six bugs but encountering a collision, still earning $19,250 USD and 4.75 Master of Pwn points.

SUCCESS - Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) targeted the Alpine iLX-F511, exploiting two unique vulnerabilities to gain root access, earning $5,000 USD and 2 Master of Pwn points.

SUCCESS / COLLISON - Evan Grant (@stargravy) targeted the Grizzl-E Smart 40A with the Charging Connector Protocol/Signal Manipulation add-on, hitting two bug collisions, still earning $15,000 USD and 3 Master of Pwn points.

SUCCESS / COLLISON - Hyeonjun Lee (@gul9ul), Younghun Kwon (@d0kk2bi), Hyeokjong Yun (@dig06161), Dohwan Kim (@neko__hat), Hanryeol Park (@hanR0724), Hyojin Lee (@meixploit), Jinyeong Yoon, and Youngmin Cho (@ZIEN0621) of ZIEN, Inc. targeted the ChargePoint Home Flex (CPH50-K), demonstrating two unique bugs (symlink following and command injection) but encountered a collision with a previous attempt - still earning $16,750 USD and 3.5 Master of Pwn points.

SUCCESS / COLLISON - Hyeongseok Lee (@fluorite_pwn), Yunje Shin (@YunjeShin), Chaeeul Hyun (@yskm_Gunter), Ingyu Yang (@Mafty5275), Hoseok Kang (@cl4y419), Seungyeon Park (@vvsy46), and Wonjun Choi (@won6_choi) of BoB::Takedown targeted the Phoenix Contact CHARX SEC-3150, demonstrating three bugs, but ran into two collisions, earning $6,750 USD and 2.75 Master of Pwn points.

A vulnerability classified as critical has been found in Celestialsoftware AbsoluteTelnet 11.24. This vulnerability affects unknown code. The manipulation leads to out-of-bounds write. This vulnerability is listed as CVE-2021-47765. The attack must be carried out locally. In addition, an exploit is available.

A vulnerability, which was classified as problematic, has been found in Bdtask Isshue Shopping Cart 3.5. Impacted is an unknown function. This manipulation of the argument Title causes cross site scripting. This vulnerability is registered as CVE-2021-47769. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability marked as problematic has been reported in sveltejs kit up to 2.49.4. This affects an unknown part. The manipulation leads to uncontrolled memory allocation. This vulnerability is uniquely identified as CVE-2026-22803. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in sveltejs kit up to 2.49.4. This impacts an unknown function of the component Environment Variable Handler. The manipulation of the argument ORIGIN leads to uncaught exception. This vulnerability is referenced as CVE-2025-67647. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability was found in Altium 365 up to 4.4.5. It has been classified as problematic. This vulnerability affects unknown code of the component Post Handler. This manipulation causes cross site scripting. This vulnerability appears as CVE-2026-1181. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in Changjetong Information T+ up to 16.x and classified as critical. Impacted is an unknown function of the file /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel of the component AjaxPro Endpoint. The manipulation results in deserialization. This vulnerability was named CVE-2023-7334. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability marked as critical has been reported in Celestialsoftware AbsoluteTelnet 11.24. Affected by this issue is some unknown functionality. Performing a manipulation results in out-of-bounds write. This vulnerability is identified as CVE-2021-47764. The attack is only possible with local access. Additionally, an exploit exists.

A vulnerability was found in orval up to 8.0.1. It has been classified as critical. Affected by this vulnerability is the function getEnumImplementation. Performing a manipulation of the argument enumDescriptions results in command injection. This vulnerability was named CVE-2026-23947. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

YAMAGoya (Yet Another Memory Analyzer for malware detection and Guarding Operations with YARA and Sigma) is a C# application

The post YAMAGoya: The Ultimate Open-Source Shield for Memory and System Defense appeared first on Penetration Testing Tools.

Securing the Future: Practical Approaches to Digital Sovereignty in Google Workspace
madhav
Thu, 01/22/2026 - 04:35

In today’s rapidly evolving digital landscape, data privacy and sovereignty have become top priorities for organizations worldwide. With the proliferation of cloud services and the tightening of global data protection regulations, security professionals face mounting pressure to ensure their data remains secure, compliant, and under their control. The recent Thales and Google Workspace webinar, “Empowering Digital Sovereignty: Google Workspace Client-Side Encryption and Thales CipherTrust,” delivered a wealth of actionable insights for those navigating these challenges.

Data Security

Scotti Woolery-Price | Partner Marketing Manager, Thales
More About This Author >

In today’s rapidly evolving digital landscape, data privacy and sovereignty have become top priorities for organizations worldwide. With the proliferation of cloud services and the tightening of global data protection regulations, security professionals face mounting pressure to ensure their data remains secure, compliant, and under their control. The recent Thales and Google Workspace webinar, “Empowering Digital Sovereignty: Google Workspace Client-Side Encryption and Thales CipherTrust,” delivered a wealth of actionable insights for those navigating these challenges.

The Digital Sovereignty Imperative

Digital sovereignty is more than a buzzword. It’s the ability to control your organization’s digital destiny, including the data, hardware, and software you rely on and create. According to the World Economic Forum, over 92% of all data in the Western world is stored on U.S.-owned servers, creating significant dependency and resilience challenges for businesses. New regulations such as GDPR, Schrems II, Gaia-X, and DORA are emerging to advance digital sovereignty for organizations operating in regulated industries.

The Regulatory Landscape: Privacy Laws on the Rise

Over 80% of the world’s population is now covered by some form of national data privacy law, and the pace of regulation is accelerating according to a study by IAPP. Over 260 new global regulations are in the legislative process, with 150 in the EU and U.S. alone. For CISOs and IT leaders, this means that the world’s data is more regulated than ever before, and compliance is no longer optional, it’s a license to operate.

Google Workspace: A Holistic Approach to Sovereignty and Compliance

Google Workspace stands out by offering a cloud-only, zero trust architecture designed to address sovereignty and compliance requirements. Key features include:

• Client-Side Encryption (CSE): Data is encrypted before leaving the client server, and customers have sole control over encryption keys, to enable them to act as arbiters of all access to their data.
• Local Data Storage and Data Regions: Organizations can choose where their data is stored and processed, helping to ensure compliance with geographical regulations.
• Access Controls and Context-Aware Access: Admins can control IP, device, and geographic origin, keeping sensitive data within required regions.
• Zero Trust Secure Architecture: Secure infrastructure and practices inherently reduce risks.
• End-to-End Encrypted Gmail: Secure email for enterprise users.

Key Management and Encryption Approaches in Google Workspace

Organizations seeking to enhance data security and sovereignty in cloud environments often consider several key management and encryption strategies. For example:

• External Key Management (EKM):
  Integrating external key management solutions allows organizations to maintain master encryption keys outside the cloud provider’s environment, often using certified hardware security modules. This approach enables secure creation, control, and storage of encryption keys, separate from where sensitive data is hosted. It can also support a variety of use cases across cloud platforms.
• Client-Side Encryption Workflow:
  With client-side encryption, documents are encrypted within the user’s browser using internally generated data encryption keys (DEKs). These DEKs are then encrypted with keys managed by an external key manager. Only authorized users can decrypt the DEKs to access documents, helping to ensure that the cloud provider cannot access data in plaintext. Support for multiple identity providers can further enable secure sharing and collaboration across organizations.
• Operational and Data Sovereignty:
  By maintaining control over encryption keys and access policies, organizations can address regulatory requirements and mitigate risks related to subpoenas, cross-border data access, and privileged user threats. Solutions that enable discovery, classification, and encryption of sensitive data—along with customer-managed key and access controls—can help organizations meet compliance standards and pass security audits.
• Quantum-Resilient Data Protection including Gmail:
  As quantum computing advances, some solutions are beginning to incorporate quantum-resilient encryption standards to help ensure that sensitive data remains protected against future threats. Google, with  support from Thales, offers a cloud productivity suite that protects your data from quantum attacks like Harvest Now, Decrypt Later.

Real-World Impact: Compliance and Resilience

A notable case in France demonstrated the effectiveness of legal and technical safeguards. Thales contributed to a solution that enabled a healthcare client to use public cloud services while retaining control over encryption keys, ensuring compliance with EU GDPR and mitigating risks from foreign access requests. The court’s decision underscored the importance of holding encryption keys in the proper geographic jurisdiction and leveraging trusted third-party key management.

Strategies for Stronger Cloud Control

The webinar outlined several key strategies for securing data in the cloud:

• Native Encryption Services: Managed by cloud service providers (CSPs), offering basic protection but limited customer control.
• Bring Your Own Key (BYOK): Customers generate and import their own keys, gaining more control but still relying on CSP-hosted key management.
• Hold Your Own Key (HYOK): Organizations maintain full control over their encryption keys, even when using third-party cloud services.
• Bring Your Own Encryption (BYOE): Customers manage both keys and encryption outside the CSP environment.
• End-to-End Data Protection (E2EDP): Protects data while in use, in motion, and at rest using confidential computing.

The Shared Responsibility Model

Security in the cloud is a shared responsibility. While providers secure the infrastructure, customers must address defense in depth, anti-malware, network security controls, secure coding practices, and comprehensive logging and alerting. The Cloud Security Alliance (CSA) offers guidance and standards to help organizations prepare for cloud migration and ensure robust security controls.

Take Control of Your Data Sovereignty

As organizations accelerate cloud adoption and digital transformation, the need for robust data sovereignty and security controls has never been greater. Thales CipherTrust Cloud Key Management, in collaboration with Google Workspace, empowers security leaders to take control of their sensitive data, meet regulatory requirements, and build resilient, compliant cloud environments.

Flexible Deployment Options

CipherTrust Cloud Key Management for Google CSE can be deployed in the cloud, on-premises, across hybrid environments, and as a service. To enable a free trial, please visit CCKM as a service from the Thales DPoD Marketplace.

Ready to secure your data?

Explore Thales CipherTrust Data Security Platform solutions and start your journey toward digital sovereignty today.

• Take a self-guided product tour of Thales cloud key management solutions for Google Cloud and Google Workspace
• Read our integrated solution brief
• Visit our webpage: Google Cloud Platform Security

Schema {
"@context": "https://schema.org",
"@type": "BlogPosting",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://cpl.thalesgroup.com/blog/data-security/digital-sovereignty-google-workspace"
},
"headline": "Practical Approaches to Digital Sovereignty in Google Workspace | Thales",
"description": "Learn how digital sovereignty, client-side encryption, and external key management help organizations secure Google Workspace data and meet global regulations.",
"image": "",
"author": {
"@type": "Person",
"name": "Scotti Woolery-Price",
"url": "https://cpl.thalesgroup.com/blog/author/swoolery"
},
"publisher": {
"@type": "Organization",
"name": "Thales Group",
"description": "The world relies on Thales to protect and secure access to your most sensitive data and software wherever it is created, shared, or stored. Whether building an encryption strategy, licensing software, providing trusted access to the cloud, or meeting compliance mandates, you can rely on Thales to secure your digital transformation.",
"url": "https://cpl.thalesgroup.com",
"logo": "https://cpl.thalesgroup.com/sites/default/files/content/footer/thaleslogo-white.png",
"sameAs": [
"https://www.twitter.com/ThalesCloudSec",
"https://www.linkedin.com/company/thalescloudsec",
"https://www.youtube.com/ThalesCloudSec"
]
},
"datePublished": "2025-01-22",
"dateModified": "2025-01-22"
} studio THALES BLOG Securing the Future: Practical Approaches to Digital Sovereignty in Google Workspace

January 22, 2026

The post Securing the Future: Practical Approaches to Digital Sovereignty in Google Workspace appeared first on Security Boulevard.

LastPass has issued a formal admonition regarding a nascent phishing campaign wherein unidentified actors endeavor to usurp users’

The post The 24-Hour Trap: LastPass Issues Alert Over Master Password Phishing Spree appeared first on Penetration Testing Tools.

Самый сложный объект во Вселенной находится между вашими ушами.

Three critical vulnerabilities have been unearthed within the official Git Model Context Protocol (MCP) server, a project spearheaded

The post AI’s Open Door: Critical RCE Flaws Found in Anthropic’s Git MCP Server appeared first on Penetration Testing Tools.

In recent weeks, personnel within Afghan governmental institutions have become the recipients of missives harboring documents that ostensibly

The post Nomad Leopard Rising: New FALSECUB Malware Targets Afghan Ministries appeared first on Penetration Testing Tools.

Software developers remain a paramount objective for cyber-adversaries, as burgeoning malicious campaigns increasingly exploit the very instruments and

The post Poisoned Plugins: Evelyn Stealer Hits Developers via VS Code Marketplace appeared first on Penetration Testing Tools.

立即查看详情 →

A vulnerability described as critical has been identified in Oracle WebCenter Portal 12.2.1.3.0/12.2.1.4.0. This affects an unknown function of the component Portlet Services. The manipulation results in xml external entity reference. This vulnerability is reported as CVE-2020-10683. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability categorized as critical has been discovered in Oracle Health Sciences Empirica Signal 9. This affects an unknown part of the component User Interface. Such manipulation leads to xml external entity reference. This vulnerability is referenced as CVE-2020-10683. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.