Digest · Tuesday

Security digest: August 12, 2025

1 editorial brief and 3 known exploited (cisa kev) additions.

All digests · RSS · Markdown

Take stock

Check exposure: YOLO mode. Admins of Visual Studio 2022 17.14 fleets below 17.14.12, and anyone whose user or workspace settings contain chat.tools.autoApprove set to true.
Do you run any of these? RARLAB WinRAR, Microsoft Internet Explorer, Microsoft Office. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-09-02.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

Aug 12, 2025 · AI agent security · CVE-2025-53773

GitHub Copilot "YOLO Mode" Prompt Injection RCE

Patched in August 2025 and not known to be exploited, but enterprise Visual Studio installs lag and the autoApprove setting can still be turned on by hand, so verify both.

Must act: Admins of Visual Studio 2022 17.14 fleets below 17.14.12, and anyone whose user or workspace settings contain chat.tools.autoApprove set to true.

Can relax: Developers on auto-updated VS Code and Copilot Chat, and Visual Studio 17.14.12 or later, who haven't enabled auto-approval.

Update Visual Studio 2022 to 17.14.12 or later via the Visual Studio Installer.
Keep VS Code and the GitHub Copilot Chat extension on current releases.
Search user and workspace settings for `"chat.tools.autoApprove": true` and remove it unless deliberately set in an isolated environment.

Read the brief →

Known exploited (CISA KEV) 3

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2025-8088	RARLAB WinRAR RARLAB WinRAR Path Traversal Vulnerability Ransomware	2025-09-02
CVE-2013-3893	Microsoft Internet Explorer Microsoft Internet Explorer Resource Management Errors Vulnerability	2025-09-02
CVE-2007-0671	Microsoft Office Microsoft Office Excel Remote Code Execution Vulnerability	2025-09-02

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.