-
A recently patched security flaw in Microsoft Windows Server Update Services (WSUS) has been exploited by threat actors to distribute malware known as ShadowPad. “The attacker targeted Windows Servers with WSUS enabled, exploiting CVE-2025-59287 for initial access,” AhnLab Security Intelligence Center (ASEC) said in a report published last week. “They then used PowerCat, an open-source
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sophisticated new variant of the North Korean-linked Contagious Interview campaign has emerged, featuring an unprecedented level of polish and technical sophistication designed to compromise job-seeking AI developers, software engineers, and cryptocurrency professionals. Unlike typical DPRK IT worker infiltration schemes, this operation targets real individuals through an elaborate fake recruitment platform that mimics legitimate hiring […]
The post North Korean Scam Job Platform Targets U.S. AI Developers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
High command injection vulnerabilities have been discovered in Tenda’s N300 Wi-Fi 4G LTE Router and the 4G03 Pro model, allowing authenticated attackers to execute arbitrary commands with root privileges on affected devices. With no patches currently available from the manufacturer, security experts are urging users to consider alternative solutions to protect their networks from potential […]
The post Tenda N300 Flaws Allow Attackers to Run Commands as Root appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Advanced persistent threat actors continue to develop sophisticated techniques for compromising corporate communications, with the ToddyCat APT group demonstrating remarkable evolution in their operational capabilities. Recent research from Kaspersky reveals how this highly organized espionage group has refined methods for covertly accessing internal employee communications at target organizations throughout the second half of 2024 and […]
The post ToddyCat APT Targeting Internal Employee Communications at Organizations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A high security vulnerability has been discovered in vLLM, a widely used high-throughput inference and serving engine for Large Language Models. The flaw, identified as CVE-2025-62164, enables attackers to execute arbitrary code remotely through maliciously crafted payloads sent to the Completions API endpoint. Attribute Details CVE ID CVE-2025-62164 Severity High CVSS Score 8.8/10 Affected Product vLLM […]
The post vLLM Flaw Allows Remote Code Execution Through Malicious Payloads appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
K7 Labs researchers have identified a sophisticated Python-based malware sample employing multi-stage obfuscation and process injection techniques to achieve stealthy persistence on Windows systems. The malware reconstructs a 65 MB blob, with the bulk consisting of filler content, and only a small, valid, marshalled .pyc segment at the end containing the actual malicious code. This […]
The post Python-Based Malware Enables Stealthy Process Injection into Legitimate Windows Binaries appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The Wireshark Foundation has rolled out a crucial security update for its widely used network protocol analyzer, addressing multiple vulnerabilities that could lead to denial-of-service conditions.
The latest release, version 4.6.1, specifically targets flaws discovered in the Bundle Protocol version 7 (BPv7) and Kafka dissectors. These vulnerabilities, if left unpatched, allow attackers to forcibly crash the application by injecting malicious data into a network stream or a trace file.
Dissector Crashes Expose Users to Denial of Service
The core of the recent security advisory focuses on how Wireshark parses specific network protocols. Security researchers identified a significant flaw in the BPv7 dissector, tracked as wnpa-sec-2025-05, which affects version 4.6.0.
A similar vulnerability was discovered in the Kafka dissector, designated wnpa-sec-2025-06, impacting version 4.6.0 as well as 4.4.x branch ranging from 4.4.0 to 4.4.10.
Advisory ID Component Vulnerability Type Impact Affected Versions Fixed Version wnpa-sec-2025-05 BPv7 Dissector NULL Pointer Dereference / Crash Denial of Service (DoS) 4.6.0 4.6.1 wnpa-sec-2025-06 Kafka Dissector Memory Corruption / Crash Denial of Service (DoS) 4.6.0, 4.4.0 – 4.4.10 4.6.1, 4.4.11 In both scenarios, the mechanism for exploitation involves the injection of a malformed packet. Attackers can trigger these crashes either by transmitting a specially crafted packet onto a live network interface that Wireshark is monitoring or by convincing a target analyst to open a compromised packet trace file.
While the Wireshark team discovered these issues during internal testing and is currently unaware of active exploitation in the wild, the potential for disruption remains high for security operations centers (SOCs) and network administrators who rely on the tool for continuous monitoring.
Beyond the primary security patches, the maintenance release resolves a variety of stability issues that hindered protocol analysis. Significant corrections were applied to the L2CAP dissector, which previously failed to correctly interpret retransmission modes, and the DNS HIP dissector, which erroneously labeled PK algorithms as HIT lengths.
The development team also addressed a crash in TShark triggered by Lua plugins and resolved a specific issue where the application would stall when selecting messages.
Further improvements include fixes for the TCP dissector, creating invalid packet diagrams, and corrections for LZ4-compressed output file write failures. Users working with complex network environments will benefit from the resolved conflict between endian.h and libc during plugin builds.
The update also ensures that UDP Port 853 is correctly decoded as QUIC (DoQ) and restores functionality for Omnipeek files that were previously incompatible with version 4.6.0.
Issue ID Component Description Issue 2241 L2CAP Dissector Corrected logic; the dissector now properly understands retransmission mode. Issue 20768 DNS HIP Dissector Fixed a labeling error where the PK algorithm was incorrectly identified as HIT length. Issue 20776 Build System Resolved aclang-clcompilation error inpacket-zbee-direct.c. Issue 20779 File I/O Addressed a failure when writing to an LZ4-compressed output file. Issue 20786 Plugins Fixed a conflict betweenendian.handlibcwhen building plugins. Issue 20794 TShark Resolved a crash caused by Lua plugins. Issue 20797 UI Performance Fixed an issue where Wireshark stalled for several seconds when selecting specific messages. Issue 20802 TLS Dissector Corrected handling of TLS Abbreviated Handshakes using New Session Tickets. Issue 20803 WebSocket Fixed a bug where custom WebSocket dissectors failed to run. Issue 20813 DCERPC Dissector Resolved a dissector bug inpacket-dcerpc.ctriggered byWINREG QueryValue. Issue 20817 Lua API Fixed a crash inFileHandlerwhen reading packets. Issue 20818 Filter Engine FixedApply As FilterforFT_NONE/BASE_NONEfields (single byte) to correctly use hex values. Issue 20819 UI Layout Resolved a problem in “Pane 3” preference layout when selecting “Packet Diagram” or “None”. Issue 20820 TCP Dissector Fixed the creation of invalid packet diagrams. Issue 20831 File Format Fixed an issue with too many nested VLAN tags when opening as File Format. Issue 20842 File Support Restored support for Omnipeek files, which was broken in version 4.6.0. Issue 20845 IsoBus Dissector Added support for UTF-16 strings in string operations. Issue 20849 SNMP Dissector Corrected filtering forgetBulkRequestrequest-IDs. Issue 20852 Fuzz Testing Addressed a specific fuzz job issue (fuzz-2025-11-12-12064814316.pcap). Issue 20856 QUIC/DoQ Ensure UDP Port 853 (DoQ) is correctly decoded as QUIC. Network administrators and security analysts should prioritize upgrading to Wireshark 4.6.1 or 4.4.11 immediately. The update is available for download directly from the Wireshark Foundation’s website or through respective package managers for Linux and Unix distributions.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post Wireshark Vulnerabilities Let Attackers Crash by Injecting a Malformed Packet appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to immediately address a critical security flaw in Oracle Identity Manager following reports of active exploitation.
The vulnerability, tracked as CVE-2025-61757, allows unauthenticated remote attackers to execute arbitrary code on affected systems, posing a severe threat to enterprise and government networks.
This warning comes in the wake of a massive breach earlier this year involving Oracle Cloud’s own login service, which exposed over six million records.
Security researchers at Searchlight Cyber identified this vulnerability while analyzing the attack surface of Oracle Cloud’s login host. The investigation revealed that the same software stack compromised in January, specifically the Oracle Identity Governance Suite, contained a severe pre-authentication Remote Code Execution (RCE) flaw.
This discovery highlighted a critical oversight in how the application handled authentication filters, leaving hundreds of tenants vulnerable to complete compromise without requiring any valid credentials.
The vulnerability resides within the application’s SecurityFilter mechanism found in the web.xml configuration. This filter was designed to manage authentication checks but relied on a flawed regular expression whitelist.
Developers intended to allow unauthenticated access to Web Application Description Language (WADL) files, but the implementation failed to account for how Java interprets request Uniform Resource Identifiers (URIs).
Attackers can bypass authentication entirely by appending specific matrix parameters to the URL. The research team demonstrated that adding ;.wadl to a request URI tricks the server into treating the request as a harmless WADL retrieval while the underlying Java servlet processes it as a valid API call.
This logical discrepancy grants attackers unrestricted access to restricted REST endpoints, such as /iam/governance/applicationmanagement.
Once authentication is bypassed, threat actors can leverage the groovyscriptstatus endpoint to achieve code execution. Although this endpoint is intended only to syntax-check Groovy scripts without running them, it does perform compilation.
By injecting a script containing the @ASTTest annotation, attackers can force the Java compiler to execute arbitrary code during the compilation phase. This technique effectively turns a syntax checker into a fully functional remote shell, granting control over the host system.
This vulnerability is particularly dangerous because it requires no prior access or credentials. The combination of a trivial authentication bypass and a reliable method for code execution makes it an attractive target for ransomware groups and state-sponsored actors.
Organizations running Oracle Identity Governance Suite 12c are advised to apply the relevant patches immediately or isolate the affected services from the public internet.
CVE ID Affected Product Vulnerability Type Impact Severity CVE-2025-61757 Oracle Identity Governance Suite 12c (12.2.1.4.0) Pre-Authentication RCE Remote Code Execution, Full System Compromise Critical (9.8) CVE-2021-35587 Oracle Access Manager Pre-Authentication RCE Data Exfiltration, Tenant Compromise Critical Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post CISA Warns of Oracle’s Identity Manager RCE Vulnerability Actively Exploited in Attacks appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
SCHOFIELD BARRACKS, Hawaii—Inside a mud-splattered tent, the Army’s vice chief and the commander of the 25th Infantry Division watched on two giant TV screens as the division attempted to repel an enemy attack from the sea. Just outside, the service’s first launched-effects battery used an unmanned reconnaissance glider that arrived about a month before to provide a picture of the simulated assault, while the division’s new HIMARS rocket launchers shot down “enemy” drones.
“We have old stuff, we have new stuff, and we’re fighting in a new way,” said Col. Dan Von Benken, the division’s artillery commander.
It was the last day of a two-week Joint Pacific Multinational Readiness Center exercise, and this constructed amphibious battle was the end of a scenario in which the soldiers worked with partner forces to defend an archipelago and take back islands seized by the enemy.
The exercise involved 75 experiments and incorporated every U.S. service branch plus seven partner nations. It kicked off with soldiers from the 11th Airborne Division’s 2nd Infantry Brigade Combat Team flying from Alaska to the island of Hawaii, where they parachuted into a training area with close-air support from the Hawaii Air National Guard. It included a nighttime long-range maritime air assault mission and another mission that flew four HIMARS aboard C-17s from Hawaii to Wake Island, unloaded them for a simulated raid, and then flew them back again.
“We basically create a world in which we’re dealing with not just the land forces that have arrived, but their naval forces that can help support them, and then other long-range fires that they have. Because that’s the reality that we live in, is that the threats that land forces will deal with, just like our naval and our air, are truly multi-domain,” Maj. Gen. Jay Bartholomees, commander of 25th ID, told reporters.
The experimentation is part of the Army’s “transformation in contact” initiative, a rapid modernization effort that started last year with three brigades and has now spread throughout the force. One of those original three brigades is part of the 25th Infantry Division, and after the initial push, the service expanded the effort to every brigade in the division. At the end of the exercise, 25th ID Command Sgt. Maj. Shuan Curry said, “the entire division will have restructured itself.”
Mingus traveled here to see how the exercise was going, to check in on several of the experiments, and to get feedback from soldiers at all ranks about what is working—and what isn’t.
Hours before they watched the simulated enemy attack, Mingus and Bartholomees climbed into a Black Hawk helicopter at Fort Shafter, flying over mountains and pineapple fields to reach the Kahuku training area. There, standing next to a new infantry squad vehicle draped in camouflage netting, a captain in wrap-around sunglasses and a fighting load carrier reported that the vehicle was able to produce enough power to charge multiple laptops, drones, Starlink receivers, and more for two weeks without “any outside sustainment.”
“We’ve been completely self-reliant,” said Capt. Nathan Ley.
Not everything went so smoothly. The effects platoon’s gun trucks have been hard to conceal. New tech has sped up the rate of transmissions about targeting, but a “reluctance to assume risk on fires” has slowed down approval to around an hour in some cases. It’s “a classic example of where we introduced tech, but we didn’t go back and update the process,” Mingus said.
But the point of trying all these new things is to find those problems, so they can be fixed within weeks, instead of years.
On a different training range, the division’s artillery was testing a lot of new things at once—including loitering munitions and the HIMARS. It’s helped the unit shoot farther, sense farther, and strike farther, Von Benken said. And the beauty of the steep learning curve is that “I’m able to fail fast.”
“If you rewind the tape to six months ago, and you look at doctrine, my ability to strike wasn’t matching up with what I was being asked to do,” he said. Now, “I think we’re really hitting our stride in terms of how to fight as a division.”
The days of using only “traditional tubed artillery” in a fight are likely over, Mingus told Defense One. “We don’t know what the exact numbers are, but we know that it’s going to have rockets, traditional artillery, and then…an organization that employs a series of different special effects—launched effects. Loitering munitions, one-way attack drones, spy drones, spoof drones, ones that can do electronic warfare.”
Testing and experimenting with these different systems at JPMRC helps get the Army closer to knowing what the right combination of all of those is, he said.
“We see in Ukraine every day…they’re still pumping four to five thousand rounds of 155 [millimeter artillery shells], and 130 to 150,000 rounds a month. So traditional artillery still has a role, but how much?” Mingus said.
Long-range fires are becoming ever-more important, “especially here in the Indo-Pacific given the ranges,” he added.
While drones and artillery tend to get the headlines, Mingus is also deeply interested in another less-flashy topic: next-generation command and control. The service has been working on it for a few years, he said, but previously had only introduced it during Project Convergence. This year, the Army decided to introduce it in two full infantry divisions: the 25th and the 4th.
“It’s very exciting, because the chief [of staff of the Army, Gen. Randy George] and I both have lived with a network in the Army that hasn’t worked very well.…And we have an opportunity here to really get it right.”
With the old network, he said, “when you would cross the line of departure and go on a mission, everybody would have great shared understanding, but the minute that you move out, that shared understanding starts to come down. Much of that is…because our ability to stay connected has been not where it probably should be.…If we can think faster, shoot faster, trust each other, that we’re doing the right thing, maintain that broad shared understanding across an organization, we will be faster than our adversaries.”
Incorporating so many new technologies is not without its own set of challenges. Speaking to Mingus next to an “ISV-heavy” full of communications systems, 3rd Mobile Brigade commander Col. Adisa King described the “cognitive overload” he’s witnessed.
Though his brigade has a variety of new tech, including electronic-warfare packs, “what I realized real quick, when all the power goes out, I have to reach into here,” he said, reaching into a pocket to pull out a map, “and that’s where I find out what was real.”
Right now, Mingus said, everything is new. But once it all starts to come together, the skills senior leaders have grown up with will start to erode.
“So how do you keep everybody masters of the science, but enabled by technology? I don’t have the answer, but you guys are going to have to figure that out.”
During his day-long tour of the island, Mingus watched a laser kill a drone, visited Indo-Pacific Command’s Forge facility, and spoke to dozens of soldiers about how the exercise and the experiments were going. Shortly before leaving for a meeting of Five Eyes army vice chiefs in Australia, he told Defense One that the 25th ID is unique “because it lives in the very environment that we’re trying to optimize for,” and also has an “amazing innovation culture.”
Transformation in Contact has already radically changed the Army, he said, and has gone from a 1.0 and 2.0 model to “continuous transformation.”
“As we continue to make our Army more modern, more lethal, more agile… having a much faster ability to respond to whatever the nation needs it to do. After 15, 18 years of war, fighting a war that was for all the right reasons, and we had to transform to be able to deal with that environment, we’ve got to unravel a lot of that. And so this journey is long from over. It will never end.”
]]>¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Welcome to this week’s edition of the Cybersecurity News Weekly Newsletter, where we analyze the critical incidents defining the current threat landscape.
If this week has taught us anything, it is that the stability of our digital infrastructure is just as volatile as the security of the software running upon it.
We are witnessing a multi-front battle where availability concerns are colliding with critical vulnerability management. The massive Cloudflare outage served as a stark reminder of the internet’s centralized fragility, disrupting global operations and forcing organizations to re-evaluate their resilience strategies against single points of failure in the cloud ecosystem.
However, while network reliability faltered, threat actors wasted no time exploiting software weaknesses. The disclosure of new Chrome zero-day flaws has triggered yet another urgent patching race, highlighting the relentless targeting of browser-based entry points. Simultaneously, enterprise perimeters are under siege as critical vulnerabilities in Fortinet appliances continue to surface, offering adversaries potential avenues for remote compromise if left unmitigated.
Perhaps the most complex narrative this week involves the Salesforce and Gainsight breach. This incident reinforces the treacherous nature of modern supply chain security, demonstrating how trusted third-party integrations can become high-value vectors for data exfiltration.
In this issue, we dissect these events, providing the technical context, indicators of compromise, and mitigation steps necessary to secure your environment against these evolving risks.
Vulnerabilities
Fortinet FortiWeb 0‑Day (CVE‑2025‑58034)
Fortinet disclosed a command injection flaw in FortiWeb (CWE‑78) that lets authenticated attackers execute arbitrary OS commands via crafted HTTP requests or CLI, gaining system‑level privileges and potentially pivoting deeper into protected networks. The bug affects FortiWeb 8.0 (up to 8.0.1), 7.6 (up to 7.6.5), 7.4 (up to 7.4.10), 7.2 (up to 7.2.11), and 7.0 (up to 7.0.11), with exploitation observed since early October, including PoC circulation and creation of rogue admin accounts on internet‑facing panels. Fortinet urges upgrading to 8.0.2, 7.6.6, 7.4.11, 7.2.12, or 7.0.12, tightening exposure of management interfaces, and auditing admin users for unauthorized additions.
Read more: https://cybersecuritynews.com/fortiweb-0-day-code-execution-vulnerability/
XWiki RCE Exploited in the Wild (CVE‑2025‑24893)
A critical RCE in XWiki’s SolrSearch endpoint is being heavily exploited to deploy botnets, coin miners, and persistent access, with multiple independent threat actors now abusing Groovy scripting to download and run arbitrary payloads. CISA added CVE‑2025‑24893 to the KEV catalog just two days after initial disclosure, while canary systems and VulnCheck observed rapid growth in scanning, reverse shells, and multi‑stage infection chains from diverse global IPs. Defenders should urgently patch XWiki, monitor SolrSearch requests, watch for suspicious outbound connections or mining activity, and restrict internet exposure and segment networks to shrink the attack surface.
Read more: https://cybersecuritynews.com/xwiki-vulnerability-exploited-in-the-wild/
Chrome V8 Type Confusion Zero‑Day (CVE‑2025‑13223)
Google pushed an emergency Chrome Stable update (142.0.7444.175 for Windows/Linux and 142.0.7444.176 for macOS) to fix two high‑severity type confusion bugs in the V8 engine, with CVE‑2025‑13223 already exploited in the wild. Successful exploitation can enable remote code execution, sandbox escape, data theft, or malware delivery without user interaction, and Google’s TAG involvement suggests potential links to APT‑level operators. With over 65% of global browsers running Chrome, Google urges users to enable auto‑updates and avoid risky links as fuzzing tools like Big Sleep and AddressSanitizer continue to surface such memory corruption issues.
Read more: https://cybersecuritynews.com/chrome-type-confusion-zero-day/
Imunify AI‑Bolit Arbitrary Code Execution
A serious flaw in the AI‑Bolit component of Imunify products allowed crafted files or database entries to trigger malicious PHP execution as root via unsafe deobfuscation logic and unfiltered input. Specifically, deobfuscateDeltaOrd and deobfuscateEvalHexFunc passed attacker‑controlled strings into Helpers::executeWrapper(), enabling arbitrary function calls and privilege escalation if an adversary could plant payloads on the scanned server. Imunify silently shipped a fix on October 23, 2025, reports no in‑the‑wild exploitation, and advises users to ensure AI‑Bolit is updated and automatic updates remain enabled.
Read more: https://cybersecuritynews.com/imunify-ai-bolit-vulnerability/
SolarWinds Serv‑U RCE Chain (CVE‑2025‑40547/40548/40549)
SolarWinds patched three critical Serv‑U vulnerabilities in version 15.5.3 that allow admins to escalate into arbitrary code execution via logic abuse, broken access control, and path restriction bypass. While exploitation requires administrative access, Linux deployments face critical CVSS 9.1 impact due to typical service privileges, and legacy Serv‑U releases are now end‑of‑life, heightening operational risk. Upgrading to 15.5.3 or later brings both the CVE fixes and added defenses such as ED25519 key support, stronger IP blocking, account lockouts, HSTS, X‑Forwarded‑For protections, and minimum password policies.
Read more: https://cybersecuritynews.com/solarwinds-serv-u-vulnerabilities/
Twonky Server Authentication Bypass (CVE‑2025‑13315 & CVE‑2025‑13316)
Rapid7 disclosed two critical Twonky Server flaws in version 8.5.2 that let unauthenticated attackers gain full admin access by abusing an alternate API route and hardcoded Blowfish keys. Using the
/nmc/rpc/prefix, an adversary can hit the log_getfile endpoint without auth, extract encrypted admin credentials, and then decrypt them using twelve static keys embedded in the binary. With the vendor indicating no patches are forthcoming, organizations should treat 8.5.2 as permanently vulnerable, restrict Twonky access to trusted IPs, rotate credentials, and leverage Rapid7’s Metasploit and detection content to identify exposed systems.Read more: https://cybersecuritynews.com/twonky-server-vulnerabilities/
Windows Graphics JPEG RCE (CVE‑2025‑50165)
A critical RCE in the Windows Graphics Component (windowscodecs.dll) lets attackers weaponize crafted JPEG images to seize control of systems with a CVSS score of 9.8 and no user interaction beyond opening or previewing a file. Zscaler ThreatLabz discovered the issue via targeted fuzzing of the Windows Imaging Component, tracing an untrusted pointer dereference in JPEG encode/decode paths that allows heap spraying, ROP chains, and Control Flow Guard bypass on 64‑bit systems. Microsoft patched affected Windows Server 2025 and Windows 11 24H2 builds on August 12, 2025, and admins are urged to prioritize those updates, limit automatic image previews, sandbox untrusted content, and harden high‑value assets before widespread exploitation emerges.
Read more: https://cybersecuritynews.com/critical-windows-graphics-vulnerability/
Tools
TaskHound: New Windows Scheduled Task Security Tool
A new open-source security tool called TaskHound has been released to help penetration testers and security professionals identify high-risk Windows scheduled tasks that could expose systems to attacks. The tool automatically discovers tasks running with privileged accounts and stored credentials, making it a valuable addition to security assessments. TaskHound stands out by automating the discovery of dangerous scheduled tasks across Windows networks, scanning remote machines over SMB and parsing task XML files to identify security weaknesses. The tool integrates with BloodHound for correlating scheduled tasks with attack path data and supports both modern BloodHound Community Edition and legacy formats.
Read more: https://cybersecuritynews.com/taskhound-windows-scheduled-task-tool/
Microsoft Threat Intelligence Briefing Agent Now in Defender Portal
Microsoft has unveiled significant enhancements to threat intelligence at Ignite 2025, bringing the Threat Intelligence Briefing Agent directly into the Defender portal. This integration marks a pivotal shift in how security teams approach cyber defense, moving from reactive responses to proactive threat anticipation. The tool delivers daily customized briefings that combine Microsoft’s global threat intelligence with organization-specific insights, saving analysts countless hours previously spent manually gathering information from multiple sources. Microsoft has also expanded access to its comprehensive threat intelligence library through Threat Analytics, now available to both Defender XDR and Sentinel-only customers in Public Preview at no additional cost.
Read more: https://cybersecuritynews.com/microsoft-threat-intelligence-with-defender/
Sysmon Coming Natively to Windows
Microsoft is bringing native Sysmon functionality directly into Windows, eliminating the need for manual deployment and separate downloads. Starting next year, Windows 11 and Windows Server 2025 will include System Monitor capabilities, transforming how security teams detect threats and investigate incidents. For years, Sysmon has been the go-to tool for IT administrators, security professionals, and threat hunters seeking deep visibility into Windows systems. The native integration solves critical pain points by providing instant threat visibility with automated compliance through standard Windows Update and official customer service support. Key detection capabilities include process creation monitoring, network connection tracking, credential access detection, file system monitoring, and WMI persistence tracking.
Read more: https://cybersecuritynews.com/sysmon-tool-windows/
Cyberattack
Iranian SpearSpecter espionage campaign
Iran’s IRGC‑linked operators, tracked as APT42/Mint Sandstorm, are targeting senior government and defense officials with the “SpearSpecter” campaign, using fake conference invites and trust-building WhatsApp conversations to deliver malware. The attack chain abuses the Windows
search‑msprotocol to access a malicious WebDAV share, dropping the in‑memory TAMECAT PowerShell backdoor to steal credentials, capture screenshots, and exfiltrate data via Telegram and Discord while evading detection.Read more: https://cybersecuritynews.com/iranian-spearspecter-attacking-high-value-officials/
Record 15.7 Tbps DDoS against Azure
Microsoft Azure successfully mitigated a record-breaking 15.72 Tbps DDoS attack targeting a customer in Australia, orchestrated by the Aisuru botnet which mobilized over 500,000 compromised IoT devices. The attack, which peaked at 3.64 billion packets per second, utilized UDP floods and randomized ports, but was neutralized by Azure’s global scrubbing centers without causing service downtime, continuing a trend of escalating hyper-scale attacks.
Read more: https://cybersecuritynews.com/ddos-attack-azure-network/
Lazarus “ScoringMathTea” RAT targets UAV firms
The North Korean Lazarus APT group has deployed a new remote access trojan dubbed “ScoringMathTea” to target defense industrial base entities, specifically those involved in UAV production. This sophisticated C++ malware employs advanced evasion techniques, including loading payloads directly into memory to avoid disk detection and using a custom C2 communication protocol that mimics legitimate traffic to maintain persistent access for espionage.
Read more: https://cybersecuritynews.com/lazarus-apt-group-new-scoringmathtea-rat/
Massive bulletproof hosting takedown
Dutch authorities have seized approximately 250 servers backing thousands of virtual domains in a major operation against a “bulletproof” hosting provider used extensively for ransomware, phishing, and command-and-control infrastructure. The takedown disrupts a critical logistical node for cybercriminals who relied on the host’s refusal to cooperate with law enforcement, potentially yielding significant intelligence on multiple threat actor groups.
Read more: https://cybersecuritynews.com/authorities-seized-thousands-of-servers/
Malicious “free VPN” Chrome extensions with 9M installs
A cluster of malicious Chrome extensions marketed as “Free Unlimited VPN” tools has been removed after accumulating 9 million installs while secretly turning user browsers into a proxy botnet. These extensions intercepted navigation events and injected malicious JavaScript to monetize user traffic, highlighting the continued risk of granting broad permissions to unverified browser add-ons.
Read more: https://cybersecuritynews.com/malicious-free-vpn-extension-with-9-million-installs/
Operation WrtHug hijacks ASUS routers
Operation WrtHug has compromised thousands of ASUS routers globally by exploiting a chain of vulnerabilities in older firmware versions to install a custom botnet. The attackers leverage these compromised edge devices as residential proxies to mask malicious traffic and launch further attacks, emphasizing the critical need for users to replace end-of-life hardware and apply firmware updates.
Read more: https://cybersecuritynews.com/wrthug-asus-routers/
Active RCE exploitation in 7‑Zip
Attackers are actively exploiting a remote code execution vulnerability (CVE-2025-11001) in the popular 7-Zip file archiver, which allows arbitrary code execution via malicious archives. The flaw stems from improper handling of symlinks, and with proof-of-concept code public, organizations are urged to update to the latest version (25.00+) immediately to prevent compromise via email or web downloads.
Read more: https://cybersecuritynews.com/7-zip-rce-vulnerability-exploited/
Brute-force wave on Palo Alto GlobalProtect
Cybersecurity researchers have detected a massive spike in brute-force attacks targeting Palo Alto Networks GlobalProtect VPN portals, aiming to breach enterprise networks via credential stuffing. The campaign focuses on identifying valid user accounts for initial access, prompting defenders to enforce multi-factor authentication (MFA) and monitor for anomalous login failures on their VPN gateways.
Read more: https://cybersecuritynews.com/palo-alto-vpn-under-attack/
Threats
Outlook NotDoor Backdoor Detection Techniques – APT28/Fancy Bear-linked malware exploits Outlook macros for persistence and data theft, using DLL sideloading and registry modifications to establish command-and-control communications while evading detection.
Read more: https://cybersecuritynews.com/techniques-to-detect-outlook-notdoor/
Yurei Ransomware Encryption Analysis – Go-based ransomware uses ChaCha20-Poly1305 and secp256k1-ECIES dual-layer encryption, targeting transportation, IT, marketing, and food industries in Sri Lanka and Nigeria with case-by-case ransom demands.
Read more: https://cybersecuritynews.com/yurei-ransomware-file-encryption/
Xanthorox AI Generates Unrestricted Malware – Darknet AI tool built on Google’s Gemini Pro model generates ransomware and malicious code without safety restrictions, charging $300 monthly for basic access and $2,500 annually for advanced features.
Read more: https://cybersecuritynews.com/threat-actors-can-use-xanthorox-ai-tool/
UNC1549 Iranian Group Deploys TWOSTROKE Backdoor – Iranian-backed threat group targets aerospace, aviation, and defense sectors with custom backdoors featuring unique hashes per deployment, exploiting DLL search order hijacking in FortiGate, VMWare, Citrix, Microsoft, and NVIDIA executables.
Read more: https://cybersecuritynews.com/unc1549-hackers-with-custom-tools/
Remcos RAT Command-and-Control Network Mapped – Over 150 active Remcos C2 servers tracked worldwide, primarily operating on port 2404 with additional activity on ports 5000, 5060, 5061, 8268, and 8808, hosted on COLOCROSSING, RAILNET, and CONTABO infrastructure.
Read more: https://cybersecuritynews.com/remcos-rat-c2-activity-mapped/
WhatsApp Screen-Sharing Scam Exploits Users – Social engineering attack impersonates bank representatives and Meta support to trick users into sharing screens during video calls, leading to account takeovers and financial losses including one HK$5.5 million case in Hong Kong.
Read more: https://cybersecuritynews.com/whatsapp-screen-sharing-scam/
npm Malware Uses Adspect Cloaking Technology – Threat actor dino_reborn created seven malicious npm packages with fingerprinting systems that distinguish victims from researchers, displaying fake CAPTCHAs to victims while showing blank pages to analysts.
Read more: https://cybersecuritynews.com/new-npm-malware-campaign/
Nova Stealer Swaps macOS Crypto Applications – Bash-based malware replaces legitimate Ledger Live, Trezor Suite, and Exodus applications with fake versions that steal seed phrases in real-time, using LaunchAgent persistence and detached screen sessions.
Read more: https://cybersecuritynews.com/new-nova-stealer-attacking-macos-users/
Xillen Stealer v4/v5 Evades AI Detection – Python-based cross-platform stealer targets 100+ browsers and 70+ cryptocurrency wallets, implementing AIEvasionEngine with behavioral mimicking, polymorphic code transformation, and P2P C2 over blockchain and Tor networks.
Read more: https://cybersecuritynews.com/xillen-stealer-with-new-advanced-features/
Data Breach
Princeton University donor database breach
Attackers accessed a Princeton University Advancement database on November 10, 2025, exposing personal details of alumni and donors, though financial data and Social Security numbers were not compromised.
Read more: https://cybersecuritynews.com/princeton-university-data-breach/Eurofiber France ticketing platform compromise
A vulnerability in Eurofiber France’s ticket management system allowed hackers to steal customer data on November 13, 2025, but banking information remained secure and services continued without interruption.
Read more: https://cybersecuritynews.com/eurofiber-data-breach/DoorDash social engineering–driven data breach
DoorDash confirmed that a social engineering attack on an employee exposed user names, addresses, and phone numbers, though no financial or government ID information was accessed.
Read more: https://cybersecuritynews.com/doordash-confirms-data-breach/WhatsApp contact discovery flaw exposes 3.5 billion numbers
Researchers exploited a weakness in WhatsApp’s contact discovery feature to enumerate 3.5 billion active phone numbers and scrape public profile data across 245 countries.
Read more: https://cybersecuritynews.com/whatsapp-vulnerability-exposes-3-5-billion-users/Salesforce–Gainsight OAuth Abuse
Salesforce warned that attackers are abusing compromised OAuth tokens from Gainsight applications to access customer data via trusted integrations, highlighting significant SaaS supply chain risks.
Read more: https://cybersecuritynews.com/salesforce-gainsight-breach/Tech News
Google to Penalize Battery-Draining Apps
Google is introducing strict battery efficiency standards for the Play Store starting March 1, 2026, utilizing a new “excessive partial wake locks” metric in Android vitals. Apps that hold wake locks for more than two cumulative hours in 5% of sessions over 28 days may face reduced visibility and warning labels to protect user device life.
Read more: https://cybersecuritynews.com/google-flag-apps-on-play-store/cybersecuritynewsCloudflare Global Outage Disrupts Major Platforms
A significant internal service degradation at Cloudflare on November 18, 2025, triggered widespread HTTP 500 errors and disrupted core services including the dashboard and API. The outage impacted millions of users across major platforms like X, ChatGPT, and Spotify, underscoring the fragility of centralized internet infrastructure.
Read more: https://cybersecuritynews.com/cloudflare-global-outage-breaks-internet/cybersecuritynewsMicrosoft Teams Adds False-Positive Reporting
Microsoft Teams is rolling out a feature that allows users to report messages they believe were incorrectly flagged as security threats, directly improving detection models. Organizations with Defender for Office 365 or Defender XDR can now centralize these user submissions in the Defender portal to refine AI threat classification.
Read more: https://cybersecuritynews.com/microsoft-teams-report-messages-feature/cybersecuritynewspi GPT Tool for Local AI Management
The newly launched pi GPT tool integrates OpenAI’s ChatGPT with Raspberry Pi devices, enabling users to manage and code on their devices via natural language prompts without cloud dependency. By using noBGP’s deterministic networking, it offers secure, local control for tasks like restarting servers or debugging scripts directly from chat.
Read more: https://cybersecuritynews.com/pi-gpt-tool-for-raspberry-pi/cybersecuritynewsWindows 11 Hides Crash Errors on Public Displays
Microsoft introduced a new Windows 11 mode for public-facing screens that suppresses the Blue Screen of Death (BSOD) and error dialogs to prevent public embarrassment. Critical errors are displayed for only 15 seconds for diagnostics before the screen turns black, requiring manual interaction to reactivate.
Read more: https://cybersecuritynews.com/windows-11-hide-crash-errors/Windows 11 24H2 Update Breaks Shell Components
Microsoft confirmed that the Windows 11 version 24H2 update (KB5062553) causes critical failures in the Start Menu, Taskbar, and Settings due to a race condition in XAML package registration. The issue, prominent in VDI environments, requires manual PowerShell re-registration of dependency packages or synchronous logon scripts to resolve.
Read more: https://cybersecuritynews.com/windows-11-24h2-features-broken/The post Cybersecurity News Weekly Newsletter – Fortinet, Chrome 0-Day Flaws, Cloudflare Outage and Salesforce Gainsight Breach appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
