Author: Staff Writer

Fast Facts A critical vulnerability (CVE-2025-59287) in Microsoft’s WSUS allows unauthenticated attackers to execute remote code with SYSTEM privileges via unsafe deserialization of encrypted cookies, affecting all supported Windows Server versions (2012-2025). The flaw exploits the use of legacy BinaryFormatter deserialization on decrypted AES-128-CBC encrypted data, enabling attackers to craft malicious payloads that trigger arbitrary code execution without user interaction. A publicly available PoC demonstrates how attackers can send tampered SOAP requests to the WSUS endpoint, leading to system compromise, highlighting the wormable potential of this vulnerability. Microsoft urges immediate patching and recommends isolating WSUS servers, restricting access, monitoring traffic,…

Essential Insights China accuses the U.S. NSA of a "premeditated" cyberattack on the National Time Service Center (NTSC), aimed at stealing secrets and sabotaging critical infrastructure. The attack involved exploiting security flaws in mobile SMS services, infiltration using stolen credentials, and deploying a sophisticated cyber warfare platform with 42 targeted tools. The MSS claims China successfully thwarted the U.S. cyber operations that sought to disrupt Beijing Time and damaging national security. China condemns U.S. cyber aggressions globally, accusing Washington of hypocrisy, technological interference, and manipulating the narrative around Chinese cyber threats. What’s the Problem? Recently, China publicly accused the U.S.…

Top Highlights LAPSUS$-linked groups leaked millions of Salesforce customer records after the company refused ransom payments, with data published from several major clients including Qantas and Vietnam Airlines. The FBI and French authorities dismantled some cybercrime forums used in the Salesforce breach, but the ongoing extortion is unlikely to be significantly impacted due to the continued operation of unseized sites. A major ransomware attack on SimonMed Imaging affected over 1.2 million people, with stolen data including Social Security numbers and medical records, after the Medusa group demanded ransom. The Dutch government froze Chinese semiconductor firm Nexperia over security concerns about…

Top Highlights Legacy Windows protocols LLMNR and NetBIOS still pose security risks by enabling credential theft through local network attacks; disabling these protocols and enforcing stronger authentication methods are recommended. A critical flaw in Fortra’s GoAnywhere MFT software has been actively exploited in ransomware campaigns, raising concerns about attackers accessing targeted private keys. China has intensified cyberattack and disinformation efforts against Taiwan, with over 2.8 million daily intrusion attempts and widespread fake social media content, involving state-level actors. Android’s Pixnapping vulnerability allows attackers to steal on-screen data, including 2FA codes, without app permissions, with a fix expected from Google in…

Quick Takeaways Super Cyber Friday on October 31, 2025, will focus on understanding how security leaders prioritize decisions based on self-interest rather than purely technical factors. Key topics include evaluating vendor fit beyond technology, the real impact of security tools, and the organizational realities influencing security decision-making. The discussion aims to reveal insights about the differences between managing security risk and career risk, and how organizational pragmatism influences CISO actions. Participants will engage in interactive conversations, games, and networking, with an emphasis on aligning vendor practices with how CISOs actually evaluate security solutions. The Issue On October 31, 2025, the…

Top Highlights China accused the U.S. NSA of cyberattacks on its National Time Service Center, risking disruptions to critical networks and services. The U.S. allegedly exploited vulnerabilities in foreign mobile messaging to steal sensitive staff information in 2022 and used 42 cyberattack tools targeting internal systems. The time center is vital for China’s standard time and essential industries like finance, power, and defense, with China warning of potential widespread impacts. China claims the U.S. is falsely accusing China of cyber threats while allegedly engaging in similar malicious activities, heightening tensions between the two nations. Underlying Problem On Sunday, China publicly…

Fast Facts MANGO experienced a data breach via a compromised external vendor, exposing personal customer details but not financial or identity data, with authorities notified and support provided to affected customers. Chinese-backed threat group Jewelbug infiltrated a Russian IT provider, accessing code repositories and using stealthy methods like cloud services and credential dumping over five months. F5’s systems were compromised by a nation-state actor stealing source code and vulnerabilities, prompting urgent patching directives from CISA due to the significant threat posed to U.S. federal networks. A security flaw in Windows Server 2025’s updates disrupts Active Directory synchronization, with Microsoft developing…

Fast Facts Effective cloud security hinges on holistic Non-Human Identity (NHI) management that encompasses discovery, ongoing monitoring, and lifecycle control to reduce breaches and ensure compliance. Collaboration between security and R&D teams, fostered through open communication, shared responsibility, and cross-functional decision-making, is essential to bridge departmental gaps and fortify cloud defenses. Automating routine NHI tasks like secrets rotation and decommissioning enhances efficiency, reduces operational costs, and enables security teams to focus on strategic, threat-responsive initiatives. Leveraging innovative technologies such as AI, ML, and cloud-based solutions empowers organizations to proactively detect, respond to threats, and adapt to evolving cybersecurity challenges, thereby…

Quick Takeaways Proper management of Non-Human Identities (NHIs) is crucial for cloud cybersecurity, enabling organizations to reduce risks, improve compliance, and enhance visibility across industries such as healthcare and finance. Innovative strategies like automated governance, AI-driven threat detection, dynamic secrets management, and zero trust models are transforming NHI security, making it more adaptive, proactive, and resilient. Integrating NHI management with DevOps and SOC teams bridges security and operational workflows, ensuring continuous verification, rapid threat response, and compliance with regulations. Overcoming management challenges—such as complexity, regulatory changes, and resource allocation—requires centralized automation, ongoing staff training, and fostering an informed security culture…

Fast Facts Sotheby’s experienced a cyberattack on July 24, resulting in the theft of sensitive data, despite advanced security measures. Exploiting a Cisco SNMP flaw, hackers created “Zero Disco” attacks deploying Linux rootkits, affecting older systems but with no known threat actor tied to the campaign. Microsoft disrupted a ransomware campaign by revoking over 200 digital certificates used by Vice Society to sign malware, thwarting their deployment. Windows 11 updates have caused issues with localhost HTTP/2 connections, disrupting developer and application functionalities on affected systems. The Core Issue Recently, multiple significant cybersecurity incidents have highlighted the evolving landscape of digital…