Daily News, Aug 19th - critical Windows IKE Extension flaw

We cover active exploitation of a critical Windows IKE Extension flaw, a drop-everything-and-patch situation. The FBI reports over 500 critical infrastructure organizations hit by Medusa ransomware since 2021, and the Clop gang is using custom web shells against PTC Windchill and FlexPLM servers.Key risks include unpatched infrastructure, supply chain vulnerabilities, and the evolving threat from sophisticated ransomware and custom attack tools. We also discuss a critical, zero-click GitLab flaw with limited public details, making detection challenging for self-managed instances.Beyond threats, we explore important developments in the tech landscape, including Mojo's open-source release, OpenAI's democratic oversight initiative for AI in national security, and the ModelMap tool for visualizing HuggingFace model architectures.Practical takeaways include immediately reviewing Windows IKE and GitLab exposure, auditing your supply chain for third-party software risks, and ensuring robust access controls for new AI agentic tools. These insights are designed to help you maintain a tight security perimeter and navigate the rapid shifts in cloud and AI technologies.