RESEARCH
August 2025: conflicting vulnerability scores, poisoned models, cloned voices
Supply chainRansomwareOT and industrial security
August 2025 questions some basic tools. CVSS, EPSS and other scoring systems rank the same vulnerabilities very differently, and AI model scanners miss most ways of poisoning them. Cloned-voice calls can be unmasked with listening challenges, and password strength meters reveal the passwords they were trained on.
Archive: reconstruction written in November 2026
1. Conflicting Scores, Confusing Signals: An Empirical Study of Vulnerability Scoring Systems
ACM Conference on Computer and Communications Security · Viktoria Koscinski, Mark Nelson, Ahmet Okutan, Robert Falso et al. · AI & LLM Security
In short: Across 600 real vulnerabilities, CVSS, SSVC, EPSS and the Exploitability Index set very different priorities.
The first large-scale, outcome-linked comparison pits CVSS, SSVC, EPSS and the Exploitability Index against 600 vulnerabilities from four months of Microsoft Patch Tuesday. The systems rank the same vulnerabilities very differently and capture real-world exploitation risk to different degrees, affecting the decisions of anyone relying on these scores.
Why it matters. Many underwriting questionnaires and patch plans rely on a single score: the choice of system changes which flaws get fixed first.
2. The Art of Hide and Seek: Making Pickle-Based Model Supply Chain Poisoning Stealthy Again
arXiv · Tong Liu, Guozhu Meng, Peng Zhou, Zizhuang Deng et al. · Software Supply Chain
In short: AI model scanners miss 19 of 22 ways to load a poisoned pickle model.
Many AI frameworks save models with pickle, a format that can run code on load, and sharing platforms amplify the risk. The first systematic study finds 22 loading paths across five frameworks, 19 missed by existing scanners, a bypass technique with 7 variants that evade every scanner, and 133 exploitable functions.
Why it matters. Automated scanning of downloaded models is no guarantee: safe formats and rules on which models reach production are needed.
3. NodeShield: Runtime Enforcement of Security-Enhanced SBOMs for Node.js
ACM Conference on Computer and Communications Security · Eric Cornelissen, Musard Balliu · Software Supply Chain
In short: NodeShield enforces a Node.js app's SBOM at runtime and limits the resources each dependency can reach.
The Node.js ecosystem is a frequent supply-chain target. NodeShield uses the SBOM as the source of truth for dependencies and extends it with a capability list, the CBOM, recording which system resources each component may access. It enforces both at runtime without changing the code, stopping components from using undeclared dependencies or resources.
Why it matters. The SBOM moves from compliance document to active control: a compromised package stays confined to its declared resources.
4. PITCH: AI-assisted Tagging of Deepfake Audio Calls using Challenge-Response
ACM Asia Conference on Computer and Communications Security · Govind Mittal, Arthur Jakobsson, Kelly Ann Marshall, Chinmay Hegde et al. · Policy, Law & Society
In short: Listening challenges during a call help unmask cloned voices in real time.
Real-time voice cloning bypasses voice-based phone authentication. PITCH proposes 20 listening challenges based on hearing, linguistics and environment, tested on 1.6 million fake samples from 100 people. The challenges raise automated detection to 88.7% AUROC, and a human-AI system tags suspicious calls as 'Deepfake-likely'.
Why it matters. Bank and insurer call centres that authenticate by voice are exposed to identity fraud: active checks during the call are needed.
5. On the Account Security Risks Posed by Password Strength Meters
ACM Asia Conference on Computer and Communications Security · Ming Xu, Weili Han, Jitao Yu, Jing Liu et al. · Identity & Authentication
In short: Password strength meters leak the passwords they were trained on and help attackers.
Of 11 password strength meters, 5 data-driven ones are open to membership inference that exposes 10,000 to 100,000 training passwords, and 3 rule-based ones disclose their blocked passwords in clear. On sites using the popular Zxcvbn meter, a meter-aware attack compromises 5.84% more accounts within 10 attempts.
Why it matters. A component meant to strengthen passwords becomes an information source for anyone trying to break into accounts.
6. MoEcho: Exploiting Side-Channel Attacks to Compromise User Privacy in Mixture-of-Experts LLMs
ACM Conference on Computer and Communications Security · Ruyi Ding, Tianhong Xu, Xinyi Shen, Aidong Adam Ding et al. · Hardware & Side Channels
In short: Hardware traces from Mixture-of-Experts models reveal users' prompts and responses.
Mixture-of-Experts architectures activate only some sub-models depending on token meaning, and this routing leaves traces in hardware. MoEcho identifies four new side channels on CPUs and GPUs, including performance counters and the TLB, and uses them for attacks that infer prompts and rebuild responses of MoE-based LLMs and vision-language models.
Why it matters. On shared infrastructure, large-model efficiency opens a path to read others' conversations: a risk for multi-tenant AI services.
7. Minerva: A File-Based Ransomware Detector
ACM Asia Conference on Computer and Communications Security · Dorjan Hitaj, Giulio Pagnotta, Fabio De Gaspari, Lorenzo De Carli et al. · Malware & Threat Intelligence
In short: Minerva detects ransomware from file activity, resists evasion and flags it within half a second.
Process-based behavioural ransomware detectors are vulnerable to evasion. Minerva is built to resist it through its architecture and feature choices, and works on file activity. It identifies ransomware of many types, including unseen variants and ones built to evade it, and over 99% of detections happen within 0.52 seconds of activity.
Why it matters. Sub-second detection limits the files encrypted and so the damage: the kind of control that lowers the average severity of a ransomware claim.
8. QUIC-Exfil: Exploiting QUIC's Server Preferred Address Feature to Perform Data Exfiltration Attacks
ACM Asia Conference on Computer and Communications Security · Thomas Grübl, Weijie Niu, Jan von der Assen, Burkhard Stiller · Network Security
In short: A QUIC feature lets attackers exfiltrate data disguised as a normal connection migration.
QUIC now carries a significant share of Internet traffic, and its design makes it hard for firewalls to manage. QUIC-Exfil abuses the server preferred address feature to send stolen data to a malicious server, disguised as a server-side migration. Five anomaly classifiers trained on about 700,000 connections struggle to detect it.
Why it matters. Exfiltration controls built for TLS and DNS do not cover QUIC: it is worth checking whether perimeter defences actually inspect it.
9. Virtual Reality, Real Problems: A Longitudinal Security Analysis of VR Firmware
ACM Conference on Computer and Communications Security · Vamsi Shankar Simhadri, Yichang Xiong, Habiba Farrukh, Xiaokuan Zhang · CPS & IoT Security
In short: 300 firmware versions of Quest and Pico headsets show missing kernel protections and inconsistent permissions.
VR headsets collect rich sensor data and run customised Android. The first comprehensive analysis of their firmware examines over 300 Meta Quest and Pico versions at the kernel, system binary and application layers. It finds missing kernel security features, weak binary hardening, inconsistent permission enforcement and insufficient SELinux policies.
Why it matters. Headsets are entering training, healthcare and work: the biometric and motion data they collect make a breach more serious than for an ordinary device.
Trends of the month
Software Supply Chain
11 papers this month on this topic
The software supply chain is widening to AI models. Scanners meant to block poisoned pickle models miss most attack paths, while for Node.js the SBOM becomes an active control confining each dependency to its declared resources. The direction is the same: moving from inventory to limiting what each component can do.
Papers cited:
- The Art of Hide and Seek: Making Pickle-Based Model Supply Chain Poisoning Stealthy Again
- NodeShield: Runtime Enforcement of Security-Enhanced SBOMs for Node.js
Malware & Threat Intelligence
54 papers this month on this topic
Three papers touch everyday defence tools. Vulnerability scoring systems disagree on priorities, a file-based ransomware detector reacts in half a second and resists evasion, and QUIC offers an exfiltration channel that controls built for TLS and DNS miss. When assessing a company, which tools are used matters, not just whether they exist.
Papers cited:
- Conflicting Scores, Confusing Signals: An Empirical Study of Vulnerability Scoring Systems
- Minerva: A File-Based Ransomware Detector
- QUIC-Exfil: Exploiting QUIC's Server Preferred Address Feature to Perform Data Exfiltration Attacks
Identity & Authentication
50 papers this month on this topic
Authentication remains where fraud gets in. Real-time voice cloning challenges call centres that identify customers by phone, while password strength meters, meant as a help, reveal information useful to attackers. In both cases defence needs active checks, not just trust in the channel.
Papers cited:
- PITCH: AI-assisted Tagging of Deepfake Audio Calls using Challenge-Response
- On the Account Security Risks Posed by Password Strength Meters
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1434.