Finally, a Golang Supply Chain Attack – ThreatWire

Summary: The video discusses recent security challenges faced by Dogecoin’s website due to hacking incidents, a newly discovered zero-day vulnerability in Palo Alto Network’s software, potential bypass vulnerabilities in Apple’s USB restricted mode, and a significant supply chain attack on the Go programming language’s package management system.

Keypoints:

• The Dogecoin website was hacked twice by web development experts probing its security.
• Doge’s security issues stem from sloppy coding practices and reliance on third-party database access.
• A new zero-day vulnerability (CVE-20250-0108) in Palo Alto’s software allows attackers to bypass authentication.
• Apple’s USB restricted mode may be bypassed through physical attacks, particularly targeting specific individuals.
• A supply chain attack involving a typo-squatted version of the Bolt DB Go package enabled remote code execution.
• Firebase “Go module proxy service” design allowed malicious code to persist despite source code changes.
• The malicious package has since been removed and reported to the Go vulnerability database.