Hackercool Magazine July 2025

Then you will know the truth and the truth will set you free.John 8:32 Edition 8 Issue 7 Welcome to the latest Issue of Hackercool Magazine, where we dive into the evolving landscape of digital security and the emerging threats shaping our connected world. This issue highlights some of the most critical vulnerabilities and cuttingedge topics impacting enterprises and individual users alike. We begin by exploring the fascinating yet concerning realm of hacking chatbots, with a deep dive into prompt injection attacks targeting Enterprise Large Language Models (LLMs). As AI-driven tools become integral to business operations, understanding their security implications is more important than ever. Then, we move to several high-profile vulnerabilities that have made headlines recently. The Cisco Identity Services Engine (ISE) faces serious risks with multiple CVEs (2025-20281,…

Hacking Chatbots: Prompt Injection In Enterprises LLM’s It is estimated that the global chatbot market is projected to reach approximately $10.32 billion in 2025, reflecting a compound annual growth rate (C-AGR) of 24.8% from the previous year. As enterprises adopt AI-powered assistants and copilots at a large scale, they introduce a new attack surface few traditional security teams are prepared for: the prompt. Just like code can be exploited with injections, AI chatbots can also be exploited with prompt injection. Prompt injection lets an attacker manipulate the model’s behavior, override system instructions and exfiltrate sensitive information. It’s a real and present threat to enterprise-grade AI systems. In the Red Team Hacking feature of this month, we will explain in detail about Prompt Injection in Enterprise LLMs. Let’s start with basics.…

Cisco has released an advisory about recently disclosed vulnerabilities in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) which are being actively exploited in the wild. Cisco ISE is used in network access control. About the vulnerability The vulnerabilities disclosed in this product are all critical with a CVSS Score of 10. The vulnerabilities are, 1) CVE-2025-20281 & CVE-2025-20337: Both these vulnerabilities are in a specific API that could allow unauthenticated remote attackers to execute malicious code on target system. These two vulnerabilities are a result of insufficient validation of user-supplied input. CVE-2025-20282: A vulnerability in an internal API that could allow unauthenticated remote attackers to upload malicious files to the affected devices and then execute those files on underlying operating system as root. This vulnerability is…

The makers of Parrot Security have released the latest version of their security-oriented operating system Parrot OS 6.4. Let’s see what’s all new in this latest release of the Parrot security OS. Latest features to be excited about New tools: The most important feature to be excited about in any latest release of pen testing distro is the addition of new tools. This latest release of Parrot OS also added some new tools that are available by default without the need of installing. They are, Netcat-openbsd, Wpscan. John the Ripper, subfinder and Katana. “We’re seeing a significant shift in tactics, with attackers prioritizing access to identity systems over traditional network penetration.”–Adam Meyers, SVP of Counter Adversary Operations at CrowdStrike. Tools updated to latest versions Not just new tools, this release…

A new set of vulnerabilities have been detected in Chrome browser. Google chrome has released an urgent security update that fixes the critical vulnerabilities that allow hackers to execute malicious code on user systems. About the vulnerabilities The two vulnerabilities tracked as CVE-2025-8010 and CVE-2025-8011 are both type confusion vulnerabilities of high-severity in Chrome’s V8 JavaScript engine. Type confusion vulnerabilities occur when software access resources using incorrect data types. The versions of Chrome browser vulnerable to this vulnerability are all versions prior to 138.0.7204.168/.169 for Windows and Mac and versions prior to 138.0.7204.168 for Linux. How hackers can exploit these vulnerabilities? To exploit this vulnerability, all a hacker has to do is to craft a malicious HTML page containing specially designed JavaScript code that exploits these vulnerabilities and lure in…

If you are an Android user, then this article is for you. Google has released a security patch on August 05, 2025 that fixes multiple critical security vulnerabilities, some of them already being exploited in real-world. About the vulnerabilities The number of vulnerabilities patched by Google in this release are six vulnerabilities. Let’s learn about each of them in detail. CVE-2025-48530: The most dangerous vulnerability among the lot, this vulnerability affects the core system component that could allow remote code execution without requiring any user interaction. Yes, it is a zero-click vulnerability. That means when hackers exploit this vulnerability and gain access to the Android device, user has no idea that his/her device has been compromised. Android’s system component handles fundamental device operations and security functions of Android. All Android…