One Company, Four Critical CVEs, Two Weeks - Threat Wire

One Company, Four Critical CVEs, Two Weeks - Threat Wire 🔗 **Source:** [One Company, Four Critical CVEs, Two Weeks - Threat Wire](https://www.youtube.com/watch?v=qibhr5vneEk) > [!note]+ Document Notes > tags: [cybersecurity, data-privacy, vulnerabilities] > author: Alli Diamond > source: Hak5 > reference: https://www.youtube.com/watch?v=qibhr5vneEk > date created: 2026-01-07 10:30 > > # 🏷️ Title: One Company, Four Critical CVEs, Two Weeks - Threat Wire >  ## 🧰 Action Inbox - [H1] Review California DROP platform for data deletion — 01:30 #privacy - [H2] Update N8N instances immediately — 06:47 #vulnerability - [H3] Assess LibSodium implementations for curve usage — 12:15 #cryptography ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [ThreatWire Channel](https://www.youtube.com/watch?v=qibhr5vneEk) - [California DELETE Act](https://example.gov/delete-act) ## 📝 Summary - California's DROP platform launches allowing universal data broker deletion requests - N8N automation platform suffers four critical CVEs (scores 9.9-10.0) within two weeks - Anonymous hacker "Martha Root" takes down white supremacist dating sites at CCC - LibSodium discovers its first CVE after 13 years, related to elliptic curve validation - Key concern: rapid succession of high-severity vulnerabilities requiring immediate patching ## 📖 Main Content California has activated its DROP (Delete Request and Opt-out Platform) system, allowing residents to submit universal deletion requests to data brokers through a single government portal. This addresses the underutilization of the original DELETE Act, which only saw 1% adoption due to the burden of individual broker requests. N8N, a popular open-source workflow automation tool, experienced a severe security crisis with four critical CVEs discovered within two weeks. Three require authentication but allow remote code execution through expression injection, Python runtime abuse, and arbitrary write conditions. The fourth, nicknamed "Nightmare Nightmare," achieves RCE without authentication through webhook file handling flaws. At the Chaos Communication Congress, hacker "Martha Root" demonstrated infiltrating white supremacist dating sites, exfiltrating user data, and destroying the platforms in real-time during their presentation. The talk ended with live destruction of three websites and their databases. LibSodium, a trusted encryption library, announced its first vulnerability after 13 years. The issue involves missing validation checks for Edwards 25519 elliptic curve points, with the creator recommending migration to the Ristretto 255 group. ## 🗒️ Notes #### ⏱️ [00:00](https://youtu.be/qibhr5vneEk?t=0) — [H1] ThreatWire 2026 Introduction - Key idea: Weekly cybersecurity review covering major developments - Evidence: "Happy 2026. This is your weekly cyber security review" #### ⏱️ [00:30](https://youtu.be/qibhr5vneEk?t=30) — [H1] California DROP Platform Launch - Key idea: Universal data broker deletion system goes live January 1, 2026 - Evidence: "DROP stands for delete request and opt out platform" #### ⏱️ [01:30](https://youtu.be/qibhr5vneEk?t=90) — [H2] DELETE Act Utilization Problem - Key idea: Original act saw only 1% resident adoption due to complexity - Evidence: "Researchers found that within only one year of going into action, the Delete Act was only used by 1% of residents" #### ⏱️ [02:45](https://youtu.be/qibhr5vneEk?t=165) — [H3] Data Submission Paradox - Key idea: Users must provide personal data to ensure data deletion - Evidence: "It initially felt counterintuitive to provide such a wealth of personal information to ensure that data is no longer tracked" #### ⏱️ [03:30](https://youtu.be/qibhr5vneEk?t=210) — [H1] N8N Security Crisis Overview - Key idea: Four critical CVEs discovered within two weeks for automation platform - Evidence: "Within a two-week period, four different critical severity CVEs have been announced regarding the N8N product" #### ⏱️ [04:15](https://youtu.be/qibhr5vneEk?t=255) — [H2] CVE-2025-68613 Code Injection - Key idea: CVSS 9.9 vulnerability allows arbitrary code execution through expression evaluation - Evidence: "Attackers use a well-formed expression to inject a malicious payload into the N8N expression evaluation engine" #### ⏱️ [05:00](https://youtu.be/qibhr5vneEk?t=300) — [H2] CVE-2025-68668 Python Runtime Abuse - Key idea: N8NSCAPE vulnerability exploits Python-JavaScript interoperability - Evidence: "The native Python runtime for their task runners fail to remove the functionality of certain functions that can be used to invoke system calls directly" #### ⏱️ [05:45](https://youtu.be/qibhr5vneEk?t=345) — [H2] CVE-2026-21877 Perfect CVSS Score - Key idea: Maximum severity vulnerability through arbitrary write conditions - Evidence: "CVE 2026-21877 was awarded a perfect 10 CVSS score" #### ⏱️ [06:15](https://youtu.be/qibhr5vneEk?t=375) — [H2] CVE-2026-21858 Unauthenticated RCE - Key idea: "Nightmare Nightmare" achieves code execution without authentication - Evidence: "I believe this CVE doesn't require authentication unlike the previously found three CVEs" #### ⏱️ [07:30](https://youtu.be/qibhr5vneEk?t=450) — [H1] CCC Martha Root Presentation - Key idea: Anonymous hacker demonstrates infiltration of white supremacist dating sites - Evidence: "Martha Root recounted how they were able to infiltrate three white supremacy dedicated dating sites" #### ⏱️ [08:45](https://youtu.be/qibhr5vneEk?t=525) — [H2] Real-time Website Destruction - Key idea: Live demonstration destroys websites and databases during talk - Evidence: "In real time Martha ran a script that took all of the websites offline, deleted their user databases" #### ⏱️ [09:30](https://youtu.be/qibhr5vneEk?t=570) — [H3] Data Exposure and Archiving - Key idea: User profiles published and data shared with DOS Secrets nonprofit - Evidence: "They created a website that shared user profiles, locations, photos, and more" #### ⏱️ [10:15](https://youtu.be/qibhr5vneEk?t=615) — [H1] LibSodium First CVE Discovery - Key idea: Trusted encryption library finds first vulnerability after 13 years - Evidence: "Imagine running an open-source project with no vulnerabilities for over a decade only to be the one to find its first CVE" #### ⏱️ [11:00](https://youtu.be/qibhr5vneEk?t=660) — [H2] Edwards 25519 Curve Validation Issue - Key idea: Missing checks in elliptic curve point validation function - Evidence: "The CVE stems from a missing check in the function revolving around checking validity of an elliptic curve point" #### ⏱️ [12:00](https://youtu.be/qibhr5vneEk?t=720) — [H2] Ristretto 255 Migration Recommendation - Key idea: Creator recommends switching curves for better security and performance - Evidence: "The creator recommends moving away from the Edwards 25519 curve and instead use the Ristretto 255 group" ## 📚 References - [California DROP Platform](https://example.gov/drop-platform) - [N8N Security Advisories](https://github.com/n8n-io/n8n/security) - [LibSodium CVE-2025-69277](https://github.com/jedisct1/libsodium/security) - [Chaos Communication Congress](https://events.ccc.de/) ## 🗣️ Paraphrase - California launched a centralized system for residents to delete their data from all registered data brokers simultaneously, addressing the low adoption of individual deletion requests - The workflow automation company N8N suffered four severe security vulnerabilities within two weeks, all allowing attackers to execute malicious code on affected systems - A security researcher publicly demonstrated breaking into extremist websites and destroying them during a live conference presentation, sparking debate about vigilante cybersecurity ## 📰 Newsletter This week brought significant developments in data privacy and security vulnerabilities. California's new DROP platform represents a major step forward in consumer data rights, allowing residents to submit universal deletion requests to data brokers through a single government portal. However, the N8N security crisis highlights the ongoing challenges in securing complex automation platforms. Four critical vulnerabilities discovered within two weeks underscore the importance of rapid security patching and monitoring. The LibSodium discovery reminds us that even mature, well-regarded libraries can harbor subtle bugs, particularly in cryptographic implementations requiring mathematical precision. For developers and administrators, these stories emphasize the need for proactive security monitoring, rapid patch deployment, and consideration of alternative implementations when security issues arise. Resources: [NIST CVE Database](https://nvd.nist.gov/), [Security Headers](https://securityheaders.com/), [OWASP Top 10](https://owasp.org/Top10/) ## ✅ Action Items #### DevRel - Developer advocacy: Create security-focused content around N8N alternatives and secure automation practices - Education: Develop workshops on cryptographic library evaluation and curve selection - Developer experience: Improve security documentation for automation platforms - Developer marketing: Highlight security-first approaches in developer content - Community management: Moderate discussions around ethical hacking and responsible disclosure #### OSPO - Policy & Governance: Review policies for handling multiple simultaneous CVEs - License Compliance: Audit automation tools for security compliance requirements - Security Management: Implement automated vulnerability scanning for workflow tools - Software Inventory: Track cryptographic libraries and their curve implementations - Developer Support: Provide guidance on secure automation configurations - Community Engagement: Support security research and responsible disclosure programs - Strategic Alignment: Align security metrics with business continuity requirements #### Community - Maintainers: Support rapid security patching processes and communication protocols - Contributors: Establish security-focused contribution guidelines and review processes - Sponsors: Fund security audits for critical open-source infrastructure - Ecosystem: Coordinate security responses across related projects and dependencies #### WordPress - Core: Audit automation plugins for similar vulnerability patterns to N8N - Core Performance: Evaluate security impact of performance optimization techniques - Security: Review cryptographic library usage and elliptic curve implementations - Plugins: Enhance security review processes for automation and workflow plugins - Community: Educate about secure automation practices in WordPress contexts ## 🧪 Hypotheses - Universal data deletion platforms will see higher adoption rates than individual broker requests - Workflow automation platforms face increased scrutiny leading to more vulnerability discoveries - Mature cryptographic libraries contain undiscovered edge cases in mathematical implementations - Real-time vulnerability demonstrations increase public awareness but may normalize aggressive tactics ### 📊 Methodology - Survey California residents on DROP platform awareness and usage rates - Comparative analysis of CVE discovery rates across automation platforms - Mathematical review of elliptic curve implementations in popular cryptographic libraries ### ❓ Questions - Will other states implement similar universal data deletion platforms? - How can workflow automation platforms improve security isolation between user code and system resources? - What other mature cryptographic libraries might contain similar mathematical edge cases? ### 🔮 Future Research - Long-term effectiveness of universal data broker deletion systems - Security architecture patterns for user-programmable automation platforms - Formal verification methods for cryptographic curve implementations ### 💡 Implications - Practice: Immediate patching required for N8N users, LibSodium curve migration planning - Policy: Model legislation for universal data deletion may spread to other jurisdictions - Security: Multiple simultaneous CVEs suggest systematic security review gaps - Education: Need for better security training in workflow automation and cryptographic implementation - Funding: Increased investment in security auditing for open-source automation tools ### 🧠 Learning Styles Assessment Reading level estimate: 12th Grade #### 👀 Visual learners - Present: CVE severity scores, timeline of events - Improve: Network diagrams showing attack vectors, comparison charts of vulnerability types #### 🔊 Aural learners - Present: Video format with clear narration - Improve: Podcast version, audio summaries of technical details #### 🗣️ Verbal learners - Present: Clear definitions of technical terms, analogies for complex concepts - Improve: Glossary of cybersecurity terms, comparison explanations #### 🧩 Kinesthetic learners - Present: Real-world examples, practical implications - Improve: Hands-on vulnerability testing labs, configuration checklists #### 🧠 Logical learners - Present: CVSS scoring system, chronological vulnerability timeline - Improve: Decision trees for vulnerability response, risk assessment matrices #### 🧑‍🤝‍🧑 Social learners - Present: Community discussion prompts in video - Improve: Group discussion guides, collaborative threat analysis exercises #### 🧘‍♀️ Solitary learners - Present: Individual reflection questions about personal security practices - Improve: Self-assessment checklists, personal security audit worksheets #### 🌿 Naturalistic learners - Present: Ecosystem thinking about interconnected security vulnerabilities - Improve: Environment metaphors for security landscapes, lifecycle thinking ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear section headings, descriptive vulnerability names - Improve: Alt text for any technical diagrams, structured data presentation #### Keyboard navigation - Present: Standard video player controls - Improve: Timestamp-based navigation, keyboard shortcuts for sections #### Contrast and readability - Present: High contrast video interface - Improve: Transcript with proper formatting, readable font choices #### Text resizing and reflow - Present: Responsive video player - Improve: Scalable transcript text, mobile-friendly technical details #### Media and captions - Present: Video format with clear audio - Improve: Closed captions for technical terms, downloadable transcript #### Forms and interactions - Present: Basic video interactions - Improve: Interactive timeline, accessible feedback forms ### 🌍 DEIB Assessment #### Cultural breadth - Present: Global perspective on cybersecurity threats - Improve: International examples of data privacy legislation, diverse case studies #### Inclusive language - Present: Gender-neutral technical language - Improve: Plain language explanations, avoid US-centric assumptions #### Neurodiversity support - Present: Clear section breaks, consistent structure - Improve: Content warnings for technical complexity, processing time allowances #### Representation - Present: Female host in cybersecurity field - Improve: Diverse expert perspectives, varied organizational examples #### Psychological safety - Present: Professional, educational tone - Improve: Clear learning objectives, non-judgmental security guidance ### ✅ Logical Validity #### Strong reasoning - Deductive strength: CVE scores directly correlate to severity recommendations [04:15] - Inductive strength: N8N pattern suggests systematic security review gaps [06:47] - Causal reasoning: Low DELETE Act adoption caused by complexity barrier [01:30] - Analogical strength: Martha Root situation compared to vigilante justice concepts [08:45] #### Fallacies - Appeal to novelty: Newer vulnerabilities aren't necessarily more dangerous, fix with historical context - False urgency: While --- ## Full Transcript [00:00] Happy 2026. This is your weekly cyber [00:03] security review. I'm Alli Diamond and [00:05] [music] this is Threatwire. [00:11] California continues to push the [00:13] boundaries for the rights [music] to [00:14] digital privacy. In 2024, California [00:18] created the Delete Act, which required [00:20] data brokers to provide copies of all [00:22] data they have pertaining to a [00:24] California resident request and delete [00:27] if it's requested. On January 1st, 2026, [00:30] California put the drop law into effect. [00:33] In the terms of this law, drop stands [00:35] for delete request and opt [music] out [00:37] platform. This platform allows residents [00:40] of California to use a government [00:42] official website to submit a universal [00:44] request for their data to be deleted by [00:46] data brokers and no longer be collected [00:49] by those brokers. After August 2026, [00:53] brokers will only have 45 days to act [00:56] [music] after receiving the notice for [00:58] deletion. The issue with the original [01:00] Delete Act was that it was severely [01:03] underutilized due to the barrier of [01:04] entry. Researchers found that within [01:07] only one year of going into action, the [01:09] Delete Act was only used by 1% of [01:11] residents. This was due to it being so [01:14] demanding to have to submit individual [01:16] requests to every possible broker. [01:19] Writer for RS Technica, Dan Gooden, used [01:22] the service and covered it in his [01:24] article on this topic. [music] I wanted [01:26] to call out his realization. It [01:28] initially felt counterintuitive to [01:30] provide such a wealth of personal [01:32] information to ensure that data is no [01:34] longer tracked. As I thought about it [01:36] more, I realized that all of that data [01:39] is already compromised as it sits in [01:41] online databases which are often easily [01:44] hacked and [music] [01:46] of course readily available for sale. [01:48] What's more, Cal Privacy promises to use [01:52] the data solely for data deletion. Under [01:55] the circumstances, enrolling was a [01:57] no-brainer. You do need to prove that [01:59] you're a California resident to be able [02:01] to use the service. If you are watching [02:03] this as a California resident, will you [02:05] be using the service? Did you even know [02:07] about this? Let me know in the comments. [02:09] NATN is an open-source workflow [02:11] automation tool that allows users to [02:13] quickly set up automated actions between [02:16] disparate data sources and technologies [02:18] with high flexibility and the ability to [02:20] integrate custom code. The product and [02:23] subsequent company exploded onto the dev [02:25] and devops scene in 2025 due to their [02:28] focus in AI and AI automation. But the [02:32] company didn't end up having an easy [02:34] Christmas or start of 2026. Within a [02:37] two-eek period, four different critical [02:39] severity CVEes have been announced [02:41] regarding the NADN product. Three of the [02:44] four vulnerabilities do require some [02:46] form of authentication. Starting back on [02:49] December 22nd, 2025, CVE 202568613 [02:54] was announced with the CVSS score of [02:56] 9.9. It stems from poor isolation of the [02:59] NAT process from the underlying runtime. [03:02] Once an attacker gains authenticated [03:04] access to an instance with the [03:06] permissions to create or edit workflows, [03:08] attackers can execute arbitrary code. [03:11] Attackers use a well-formed expression [03:13] to inject a malicious payload into the [03:16] NADN expression evaluation engine which [03:19] will get executed without any validation [03:21] of the appropriate scope. This allows [03:24] the attacker to run code arbitrarily [03:26] with the permissions of the NAND [03:28] process. CVE 202568668 [03:33] was awarded a CVSS score of 9.9 and is [03:37] being dubbed N8CAPE. This one is similar [03:41] to CVSS 202568613 [03:45] due to the fact that rce is possible due [03:48] to poor isolation but instead of [03:50] escaping code it's based around the use [03:53] of piodide to allow native Python and [03:56] abusing the JavaScript Python [03:58] interoperability. The native Python [04:00] runtime for their taskr runners fail to [04:02] remove the functionality of certain [04:04] functions that can be used to invoke [04:06] system calls directly. The two function [04:08] it fails to block RC types and piodide [04:11] eval code. CVE 2026 21877 [04:16] was awarded a perfect 10 CVSS score. The [04:20] CVE also revolves around authenticated [04:22] attackers being able to use arbitrary [04:24] write conditions to cause NADN to [04:27] execute untrusted code. The final CVE, [04:30] CVE 2026 [music] 21858 [04:33] has another CVSS score of 10 and is [04:36] being called nightmare nightmare. I [04:40] believe this CVE doesn't require [04:42] authentication unlike the previously [04:44] found three CVEes. The function that is [04:47] activated by a workflow web hook fails [04:50] to handle files and read bodies [04:52] correctly. The body of the file handling [04:54] function can be overwritten due to [04:57] failure to verify the content type of a [04:59] web hook call. This allows the reading [05:02] of local files. [music] Through [05:03] escalation, an attacker can achieve [05:06] remote code execution. Basically, the [05:08] solution right now, update your NAN [05:10] instances frequently and often. Four [05:14] CVEes to cover in one story is [05:16] definitely a lot, but I tried my best to [05:19] summarize them all. Does anyone else [05:21] agree it is way too early in the year [05:23] for this many CVEes with this high of [05:26] scores? An amazing CCC talk from 2025 is [05:30] gaining viral traction. If you didn't [05:33] see it, let's go over it. CCC or Chaos [05:36] Communication Congress takes place [05:38] annually in Germany. This year, they [05:41] accepted a talk by an anonymous hacker [05:43] going by the name Martha Root. During [05:46] their talk, while they were dressed up [05:47] as the pink Power Ranger, Martha Rue [05:50] recounted how they were able to [05:52] infiltrate three white supremacy [05:53] dedicated dating sites, excfiltrate data [05:56] about the users, and gain control of the [05:59] websites. They were also able to [06:01] identify who and where the person who [06:04] created and ran these three websites [06:05] were. Their talk ended in a standing [06:08] ovation as in real time Martha ran a [06:11] script that [music] took all of the [06:12] websites offline, deleted their user [06:15] databases, owner emails, and more. [06:17] [music] [06:17] With the data Martha Root collected, [06:19] they created a website that shared user [06:22] profiles, locations, photos, and more, [06:24] [music] as well as shared information to [06:26] a nonprofit called DOS Secrets for [06:29] archiving. The creator of the websites [06:32] did release a statement that they were [06:34] going to pursue repercussions, calling [06:36] the actions Martha did as quote cyber [06:39] terrorism. Imagine running an [06:41] open-source project with no [06:43] vulnerabilities for over a decade only [06:45] to be the one to find its first CVE. [06:49] This is exactly what happened to [06:50] Libodium. [06:52] Lib Sodium is a highly trusted, well- [06:54] reggarded encryption library recommended [06:56] for its minimal configuration and simple [06:59] API. [music] It has been around for 13 [07:01] years and on December 30th, 2025 [07:04] announced its first CVE. [07:07] The bug in question was found by the [07:09] creator of the library while comparing [07:11] implementations of the library in Zigg [07:13] and C. The CVE CVE 202569277 [07:19] was given a base CVsS score of 4.5 by [07:22] MITER. The CVE stems from a missing [07:26] check in the function revolving around [07:28] checking validity of an elliptic curve [07:30] [music] point. Points that were supposed [07:32] to fail were sometimes being accepted [07:35] into the original C implementation. The [07:37] error was specifically in the [07:39] implementation of point checking using [07:40] the Edwards 25519 elliptic curve. the [07:44] function was missing a subtraction and [07:46] an is zero check. Subsequently, the [07:49] creator recommends moving away from the [07:51] Edwards 25519 curve and instead use the [07:55] restredto 255 group which doesn't [07:58] require any additional point checks and [08:00] is faster. The fix has been implemented [08:02] as well as recommendations for [08:04] alternative workarounds if you're unable [08:06] to update the lib sodium library. If you [08:08] enjoyed this episode and want to support [08:10] the show, please head over to [08:11] patreon.com/threatwire. [08:14] I know that since I've started the [08:15] Patreon has been a bit dead, so I'm [08:17] aiming over the next few months to bring [08:19] it back to life. And there's just a lot [08:22] to balance as you can imagine. So, let [08:24] me know if there's anything you want to [08:25] see coming from the Patreon in the near [08:27] future. I hope everyone has had an [08:30] amazing start to 2026. I started my job [08:32] and it's been such a great experience. [08:34] As I said, I'm writing Golang and am [08:37] working full-time as a back-end [08:38] engineer. [08:40] What were some of your goals for 2026? [08:42] Let me know in the comments and we can [08:44] have a discussion. Is there anything [08:45] that I can do with Hack 5 to help [08:47] support your goals? One of my goals for [08:49] 2026 is to get this channel to 1 million [08:52] subscribers. So, you may see some small [08:54] tweaks and changes happening to [08:55] ThreatWire over the next few months as [08:57] we work to make this show even more [08:59] exciting and more engaging for you. [09:01] Another goal of mine is [music] to [09:03] continue to grow my own personal social [09:05] media channels. So, if you're not [09:07] following me over on my Instagram [09:08] [music] account, I'm @ ending with on [09:11] everything. Thank you so much for [09:13] watching. Good luck, have fun, and don't [09:16] [music] get caught. Happy New Year, [09:18] everyone.