Researchers find SQL injection to bypass airport TSA security checks

Security researchers discovered an SQL injection flaw in FlyCASS — a third-party system used for TSA Known Crewmember (KCM) and Cockpit Access Security System (CASS) management — that allowed adding fake crew members and could let attackers bypass screening and access aircraft cockpits; FlyCASS was disconnected and later fixed after disclosure, and the service also shows signs of a prior MedusaLocker ransomware incident.