Škoda Auto E-shop Hacked

Škoda Auto’s e-shop got hacked and customer data was pulled, TrustFall — which can compromise every popular AI tool, Instagram has ended end-to-end encryption, and the student who stopped four high-speed trains. Welcome to Security Sunday, the weekly recap from the world of CyberSecurity.

On May 8, the German branch of Škoda Auto announced a security incident concerning its official e-shop. According to the statement, attackers exploited a vulnerability in the software the e-shop runs on and gained temporary access to the system.

The problem was discovered by Škoda’s internal security team, and the German branch immediately took the shop offline.

According to the official statement, the affected system stored typical e-shop data — names, postal and email addresses, telephone numbers, order information, and login credentials (email + password) for customer accounts.

The good news is that passwords were not stored in plaintext, so attackers did not get them directly in readable form. Payment card information is not stored by the shop system at all — payments are processed by payment gateway providers, so based on the forensic analysis so far, there is no risk of direct access to this data.

Škoda’s response was textbook from an incident response perspective. After detection, the shop was preventively shut down, the vulnerability was patched, and the incident was handed over to a specialized forensic team.

There is one unpleasant flaw in the whole process. Škoda openly admits that, due to the nature of the available logs, it is not possible to retroactively reconstruct in detail whether and to what extent attackers actually copied data. Even though Škoda does not yet have specific evidence of data misuse, it has sent a warning email to customers.

Two attack vectors against customers emerge from this incident. The first is targeted phishing. The attacker knows your actual orders, name, and address, so they can write a credible email that looks like legitimate communication from Škoda or a courier and lure further information out of you, or get you to click a malicious link. The second threat is credential stuffing, where attackers try the email-and-password combination on other services as well. With weak hashes, revealing the password may not even be a problem.

TrustFall: One Keystroke Is Enough to Compromise Four AI Tools

On May 7, security researchers from Adversa AI published an analysis of a vulnerability named TrustFall, which affects four popular agentic AI assistants — Anthropic’s Claude Code, Google’s Gemini CLI, Cursor CLI, and GitHub’s Copilot CLI. The attack allows a malicious repository to self-approve execution of arbitrary code on a developer’s computer.

The mechanism is based on the MCP feature, which is meant to let the AI assistant communicate with auxiliary external programs (database connectors, search tools, and the like). These auxiliary programs can be defined directly inside the project in two JSON files: .mcp.json and .claude/settings.json. The attacker only needs to place an auxiliary program with a commonly-sounding name in the repository and automatically approve it in the project settings using the enableAllProjectMcpServers or enabledMcpjsonServers keys. Moreover, the payload can be inserted directly inside the configuration via the command parameter (for example, node -e with inline JavaScript), so there does not need to be any suspicious script in the repository that a static scanner would catch.

The MCP server runs as a native OS process with full user permissions. It is not sandboxed and is not restricted to the project directory. The attacker can therefore read private SSH keys in ~/.ssh/, AWS credentials in ~/.aws/, shell history, and source code from other projects stored on the computer, or open a persistent C2 channel.

Anthropic rejected the security report on the grounds that it lies outside its threat model. According to the company’s position, by clicking “Yes, I trust this folder,” the user consents to the entire project configuration. Adversa AI, however, points out a change in the dialog. In versions of Claude Code before 2.1, the trust dialog explicitly warned that .mcp.json could execute code and offered a third option, "trust the folder with MCP disabled." This option, however, has been removed.

The researchers emphasize that this is not an isolated bug from a single vendor. All four tested tools have the same problem, and all have a dialog with the default choice “Yes/Trust.” They differ only in how much information they show the user: Gemini CLI is the most transparent — it warns about MCP servers and lists them by name. Cursor CLI displays a general MCP warning without an enumeration of individual servers. Copilot CLI and Claude Code do not mention MCP at all.

The End of End-to-End Encryption on Instagram

On Friday, May 8, Meta officially ended support for end-to-end encryption in direct messages on Instagram. The feature, which guaranteed users that the content of their communication could not be read by anyone except the sender and recipient, had been available on the platform since 2023. As of Friday, the company therefore has the technical ability to access the content of DMs between users, and this data may be shared with law enforcement authorities worldwide on the basis of valid legal requests.

Encryption on Instagram was, from the start, designed as a feature the user had to activate manually. A Meta spokesperson told The Guardian that the reason for the discontinuation is low adoption.

Privacy experts call this argument hypocritical. If a manufacturer hides a security feature deep in the settings, does not enable it by default, and does not inform its own users of its existence, low adoption cannot then be presented as a sign of disinterest. Critics point out that effective privacy protection has to be enabled by default — the way Meta handles it on WhatsApp, where E2EE works as an automatic standard for all conversations.

Student Stop Four High-Speed Trains

On April 5, the control center of Taiwan’s high-speed railway (THSR) intercepted a “General Alarm” signal — the highest-priority message in the TETRA system, which immediately forces train drivers to switch to manual emergency braking. Four trains stopped for 48 minutes. Behind the attack was 23-year-old Lin, a student who ordered the necessary equipment online.

Lin obtained a software-defined radio (SDR) and connected it between an antenna and a laptop. He intercepted traffic on THSR’s TETRA network, decoded the parameters, and then programmed them into ordinary handheld radios, which then acted as legitimate beacons in the network.

When he had everything ready, he transmitted a spoofed GA signal, which the system accepted despite the fact that THSR is supposed to have seven layers of authentication.

The case is not a technical first, but rather a continuation of a story that the expert community has known for years. In 2023, the Dutch company Midnight Blue published TETRA:BURST — a set of five vulnerabilities, including a backdoor in the TEA1 algorithm that reduces the original 80-bit key to a size breakable in minutes. In August 2025, the same team added another batch of vulnerabilities at Black Hat USA called 2TETRA:2BURST, including CVE-2025–52944, which allows injection of arbitrary messages into the TETRA network because the protocol lacks message authentication.

TETRA is deployed in more than 100 countries by police, military, critical infrastructure, and transportation services. The Taiwanese student therefore did not use any zero-day vulnerability — he merely exploited a systemic weakness that researchers have been warning about for years.