February 13th, 2025

A critical vulnerability in Nvidia's container software could allow attackers to gain root privileges on host servers by mounting the host’s root filesystem into a container, granting unrestricted access to all of the host’s files. This flaw affects AI applications running the vulnerable container toolkit, whether in the cloud or on-premises. Additionally, North Korean hackers are using a social engineering tactic called ClickFix, which involves deceiving victims into executing malicious PowerShell commands with administrative privileges, leading to malware infections. These attacks often involve spear-phishing emails with PDF attachments that direct targets to fake registration links. Finally, a Google vulnerability allowed the exposure of YouTube users' email addresses by chaining together exploits in YouTube and Pixel Recorder APIs. The flaw allowed access to Google Gaia IDs and then conversion into email addresses, which was a privacy risk for anonymous users.