My Mother the Car, AI Slop, Nginx, Polyscope, Drupal, , GitHub, Aaran Leyland... - SWN #582

A modern car is no longer just a vehicle—it's a data-harvesting computer on wheels, and that's just one of the alarming trends explored in this week's Security Weekly News. The episode opens with a stark warning: if you expose any system online, even obscure industrial control systems like automatic tank gauges used at gas stations, you're inviting attackers—this time, Iran—into your network. These systems, often unpatched and passwordless, are now vulnerable to remote code execution, potentially leading to overfilling tanks or disabling safety alarms. The episode then dives into a cascade of critical vulnerabilities: a decades-old buffer overflow in Nginx, a critical flaw in Universal Robots' PolyScope OS, and an imminent Drupal security update that could be exploited within hours of release. But the real theme is the new era of AI-powered cyber threats—malicious NPM packages like 'Chalk' and 'Tempalette' are being weaponized with AI-generated code, spreading through developer ecosystems like a digital vampire. These 'vibe-coded' attacks, published by a group called Team PCP, are not subtle, not obfuscated, and are now open-sourced, inviting copycats to join the chaos. Meanwhile, bug bounty programs are drowning in low-quality AI-generated reports, forcing companies like Curl to suspend their programs. The takeaway? The attack surface is expanding faster than ever, and the tools to exploit it are now accessible to anyone with a GitHub account and a free AI model.