Episode Details

In this briefing, Aaron Cole and Lauren Mitchell break down the security incident at the UK Police National Legal Database (PNLD), where contact information for over 100,000 police and government registrations may be at risk following a dark web leak. We examine the technical hypothesis involving Microsoft Power Pages and Dataverse table permissions. The discussion shifts to a high-risk discovery by researcher Håkon Måløy regarding Microsoft 365 Copilot, specifically how cross-domain prompt injection (XPIA) allows malicious instructions to silently infect and propagate through Word documents. We conclude with an urgent technical warning for Ruby on Rails developers regarding a critical remote code execution (RCE) path in Active Storage that leverages common image processing libraries.

Topics Covered

• 🔒 PNLD Data Breach: Analyzing the exposure of UK police contact details and the role of Microsoft Power Platform.
• ⚠️ Copilot Word Worm: Understanding how XPIA attacks allow malicious prompts to propagate through AI-drafted documents.
• 💻 Rails Active Storage RCE: A technical deep dive into CVE-2026-66066 and the 'KindaRails2Shell' exploit chain.
• 🛡️ Mitigation Strategies: Immediate steps for rotating Rails secret keys and auditing Power Pages anonymous access.

Disclaimer: This briefing is for informational purposes only and does not constitute legal or professional security advice.

Neural Newscast is AI-assisted, human reviewed. View our AI Transparency Policy at NeuralNewscast.com.

• (00:11) - Introduction
• (00:23) - UK Police Database Exposure
• (01:24) - The Microsoft Copilot Word Worm
• (02:14) - Rails Active Storage Critical RCE
• (02:58) - Conclusion