Featured Story

Cloudflare blames this week’s massive outage on database issues

Summary

On Tuesday, Cloudflare experienced its worst outage in 6 years, blocking access to many websites and online platforms for almost 6 hours after a change to database access controls triggered a cascading failure across its Global Network.

The issue was triggered by a change to one of our database systems’ permissions which caused the database to output multiple entries into a ‘feature file’ used by our Bot Management system.

When the oversized file propagated across network machines, the Bot Management module’s Rust code triggered a system panic and 5xx errors, crashing the core proxy system that handles traffic processing.

Other News

ServiceNow AI Agents Can Be Tricked Into Acting Against Each Other via Second-Order Prompts

Summary

Malicious actors can exploit default configurations in Now Assist generative artificial intelligence (AI) platform and leverage its agentic capabilities to conduct prompt injection attacks.

The second-order prompt injection makes use of Now Assist’s agent-to-agent discovery to execute unauthorized actions, enabling attackers to copy and exfiltrate sensitive corporate data, modify records, and escalate privileges.

Critically, Now Assist agents run with the privilege of the user who started the interaction unless otherwise configured.

Google fixes new Chrome zero-day flaw exploited in attacks

Summary

Google has released an emergency security update to fix the seventh Chrome zero-day vulnerability exploited in attacks this year. Google is aware that an exploit for CVE-2025-13223 exists in the wild.

This high-severity vulnerability is caused by a type confusion weakness in Chrome’s V8 JavaScript engine, reported last week by Clément Lecigne of Google’s Threat Analysis Group.

Fraudulent email in the name of the ONSS

Summary

We are currently receiving numerous reports of phishing emails that appear to come from the National Social Security Office (ONSS).

The message tells you that you have received a document from the ONSS and invites you to click on a link to supposedly access the ONSS portal. Do not do this, as the link actually leads to a fraudulent website that will ask for your bank details.

The sender’s email address does not correspond to the ONSS at all. … The ONSS will never ask citizens or businesses for their bank details by simple e-mail.