Tired of airport security queues? SQL inject yourself into the cockpit, claim researchers

Security researchers discovered a SQL injection flaw in the FlyCASS third‑party system used for Known Crewmember (KCM) and Cockpit Access Security System (CASS) verification, which allowed authenticated admin access and the ability to add unauthorized crew entries—potentially enabling bypass of airport security checkpoints and cockpit jumpseat access; FlyCASS was subsequently disconnected from the programs. The report also highlights a possible L54/Medusa-derived ransomware infection observed on FlyCASS, raising additional operational and data-security concerns.