Former US Army Sergeant pleads guilty after amateurish attempt at selling secrets to China – Source: go.theregister.com

Infosec in brief A former US Army sergeant has admitted he attempted to sell classified data to China.

Joseph Daniel Schmidt last Friday pled guilty after the Feds charged him with using his top secret clearance to steal classified data that he retained until after he left the military.

Schmidt later travelled abroad and while outside the US contacted the Chinese government.

As we reported when he was apprehended a couple years ago, Schmidt’s tradecraft was amateurish as he sent emails to the Chinese government from email addresses registered in his name and used Google to search for topics such as countries that don’t extradite suspects to the USA, why phone numbers for Chinese consulates wouldn’t connect, and which subreddits included useful information on spying.

Schmidt faces up to a decade behind bars and a $250,000 fine.

Critical Libxml2 vulns reported

The widely-used XML parsing library libxml2 has a quintet of critical vulnerabilities – three of which are going to take some rewriting to fix.

Three of the vulnerabilities (CVE-2025-49794, CVE-2025-49795 and CVE-2025-49796) are all found in XML Schematron elements of the library and can lead to denial of service by pushing malformed XML documents to applications using the faulty code, causing them to crash. As noted by lead libxml2 maintainer Nick Wellnhofer in an issue post following the bug reports, Schematron is “virtually unused these days,” pushing him to call for removal of Schematron support to fix the issue.

“Such legacy code can’t be maintained indefinitely,” Wellnhofer noted.

The other two issues, CVE-2025-6021 and CVE-2025-6170, could be responsible for buffer overflows and arbitrary code execution, respectively. Developers have fixed the buffer overflow issue, but Red Hat noted the code execution bug remains unresolved.

AI improves spam

Spam emails now contain fewer spelling and grammar errors, because crooks have started using AI to write them.

Barracuda Networks, Columbia University, and the University of Chicago teamed up to analyze the content of email spam from the November 2022 launch of ChatGPT to April 2025 and found that the percentage of spam written by a bot has steadily increased to reach 51 percent.

The researchers found spam written by AI contains fewer errors than old-school spam messages, but the content is largely the same. That, says Barracuda, suggests spammers are using AI to improve their writing, but not to come up with new tricks.

Barracuda also found that scammers wrote just 14 percent of emails sent as part of business email compromise (BEC) campaigns using AI. The network security firm thinks that’s because BEC attacks require personalized emails to succeed, and AI is not good at writing such targeted texts.

Millions of medical patients’ data exposed

Unknown miscreants have stolen data describing around 5.4 million customers of healthcare technology firm Episource.

The company, which offers a range of tech services in the healthcare sector, admitted to having records stolen in a breach notification letter published last week. Episource said that the incident took place sometime between January 27 and February 6 of this year, though it didn’t specify exactly how “a cybercriminal was able to see and take copies of some data in our computer system.”

Whoever made off with the data accessed victims’ Social Security numbers, dates of birth, plus health care data including diagnoses, prescriptions, medical images, and treatment plans. The attackers also stole health insurance data.

Exploit chain can crack popular Linux distros

Threat researchers from cybersecurity firm Qualys have discovered a pair of vulnerabilities that, when chained together, can give an attacker full root access on Ubuntu, Debian, Fedora and openSUSE Leap 15 systems.

Qualys researchers discovered the vulnerabilities. One affects Pluggable Authentication Module (PAM) configuration and the other targeting libblockdev via the udisks daemon common in many Linux systems, allowed them to elevate an unprivileged attacker to full root status.

Attackers can exploit the flaws “with minimal effort” and using nothing but built-in Linux components, Qualys added.

“Given the ubiquity of udisks and the simplicity of the exploit, organizations must treat this as a critical, universal risk and deploy patches without delay,” Qualys said. Proof-of-concept exploits to validate the vulnerability are available on Qualys’ website for those that want to see if their systems are at risk.

Luckily, a simple configuration change is all that’s necessary to fix this issue – just modify the polkit rule for “org.freedesktop.udisks2.modify-device” by setting “allow_active” to “auth_admin” instead of simply “yes.” ®