🐛 COMMON VULNERABILITIES AND EXPOSURES 6[−]
16 SepPhoenix RowHammer Attack Bypasses Advanced DDR5 Memory Protections in 109 SecondsA team of academics from ETH Zürich and Google has discovered a new variant of a RowHammer attack targeting Double Data Rate 5 (DDR5) memory chips from South Korean semiconductor vendor SK Hynix. The RowHammer attack variant, codenamed Phoenix (CVE-2025-6202, CVSS score: 7.1), is…THEHACKERNEWS.COM
16 SepHybridPetya-Ransomware knackt Windows Secure Bootsrcset="https://b2b-contenthub.com/wp-content/uploads/2025/09/shutterstock_2591191835.jpg?quality=50&strip=all 3840w, https://b2b-contenthub.com/wp-content/uploads/2025/09/shutterstock_2591191835.jpg?resize=300%2C168&quality=50&strip=all 300w, https://b2b-contenthub.c…CSOONLINE.COM
16 Sep KEVApple Backports Fix for CVE-2025-43300 Exploited in Sophisticated Spyware AttackApple on Monday backported fixes for a recently patched security flaw that has been actively exploited in the wild. The vulnerability in question is CVE-2025-43300 (CVSS score: 8.8), an out-of-bounds write issue in the ImageIO component that could result in memory corruption when…THEHACKERNEWS.COM
16 SepCVE-2025-47967 Microsoft Edge (Chromium-based) for Android Spoofing VulnerabilityInsufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.MSRC.MICROSOFT.COM
16 SepCVE-2025-49728 Microsoft PC Manager Security Feature Bypass VulnerabilityCleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally.MSRC.MICROSOFT.COM
16 SepChaos-Mesh flaws put Kubernetes clusters at risk of full takeoverResearchers have found critical vulnerabilities in Chaos-Mesh, a popular platform that Kubernetes cluster owners use to simulate the impact of bugs and faults on their deployments. If exploited, the Chaos-Mesh flaws could give attackers who have access to unprivileged pods the ab…CSOONLINE.COM
⚠️ VULNERABILITY DISCLOSURE 32[−]
16 SepMustang Panda Deploys SnakeDisk USB Worm to Deliver Yokai Backdoor on Thailand IPsThe China-aligned threat actor known as Mustang Panda has been observed using an updated version of a backdoor called TONESHELL and a previously undocumented USB worm called SnakeDisk. "The worm only executes on devices with Thailand-based IP addresses and drops the Yokai backdoo…THEHACKERNEWS.COM
16 SepOpen Source CyberSOCEval Sets New Benchmark for AI in Malware Analysis and Threat IntelligenceOpen Source CyberSOCEval, a newly launched evaluation platform, is making waves in the cybersecurity community by demonstrating how artificial intelligence can transform malware analysis and threat intelligence. Developed by a group of independent security researchers, CyberSOCEv…GBHACKERS.COM
16 Sep0-Click Linux Kernel KSMBD Vulnerability Enables Remote Code Execution via N-Day ExploitA recent vulnerability in the Linux Kernel’s KSMBD module allows an attacker to execute arbitrary code on a target system without any user interaction. KSMBD is a kernel-space SMB3 server that handles network file sharing. Researchers demonstrated a stable exploit against KSMBD i…GBHACKERS.COM
16 SepSpring Framework Security Flaws Allow Authorization Bypass and Annotation Detection IssuesA pair of medium-severity vulnerabilities in the Spring Framework and Spring Security libraries were disclosed on September 15, 2025. Both flaws involve the annotation detection mechanism used by Spring Security’s method security features and can lead to authorization bypass in a…GBHACKERS.COM
16 SepCISOs grapple with the realities of applying AI to security functionsApplying artificial intelligence to strengthen cybersecurity defenses — partially propelled by industry hype — has quickly risen to the top of the agenda for many enterprise security professionals. AI offers speed, scalability, and adaptability that traditional security tools alo…CSOONLINE.COM
16 SepAISURU Botnet Fuels Record-Breaking 11.5 Tbps DDoS Attack With 300,000 Hijacked RoutersThe newly identified AISURU botnet, leveraging an estimated 300,000 compromised routers worldwide, has been pinpointed as the force behind a record-shattering 11.5 Tbps distributed denial-of-service (DDoS) attack in September 2025. This unprecedented assault eclipses the previous…GBHACKERS.COM
16 SepEndpoint Security Firm Remedio Raises $65 Million in First Funding RoundThe bootstrapped company will invest in an AI-powered unified enterprise platform combining configuration, compliance, patching, and vulnerability management. The post Endpoint Security Firm Remedio Raises $65 Million in First Funding Round appeared first on SecurityWeek .SECURITYWEEK.COM
16 SepApple Rolls Out iOS 26, macOS Tahoe 26 With Patches for Over 50 VulnerabilitiesApple has announced major mobile and desktop platform releases and addressed an exploited bug in older platforms. The post Apple Rolls Out iOS 26, macOS Tahoe 26 With Patches for Over 50 Vulnerabilities appeared first on SecurityWeek .SECURITYWEEK.COM
16 SepHow OWASP's GenAI Security Project keeps up with the pace of AI/Agentic changes - Scot... - ASW #348This week, we chat with Scott Clinton, board member and co-chain of the OWASP GenAI Security Project. This project has become a massive organization within OWASP with hundreds of volunteers and thousands of contributors. This team has been cranking out new tools, reports and guid…YOUTUBE.COM
16 SepThreat Actors Exploit MCP Servers to Steal Sensitive DataUnvetted Model Context Protocol (MCP) servers introduce a stealthy supply chain attack vector, enabling adversaries to harvest credentials, configuration files, and other secrets without deploying traditional malware. The Model Context Protocol (MCP)—the new “plug-in bus” for AI …GBHACKERS.COM
16 SepMicrosoft Still Uses RC4Senator Ron Wyden has asked the Federal Trade Commission to investigate Microsoft over its continued use of the RC4 encryption algorithm. The letter talks about a hacker technique called Kerberoasting , that exploits the Kerberos authentication system.SCHNEIER.COM
16 SepWordPress Plugin Vulnerability Let Attackers Bypass Authentication via Social LoginA critical vulnerability in the Case Theme User plugin for WordPress allows unauthenticated attackers to hijack any account on vulnerable sites, including administrative accounts, by exploiting the social login feature. Site owners are urged to update immediately. On May 31, 2025…GBHACKERS.COM
16 SepHow AI-powered ZTNA will protect the hybrid futureIn my ten years building enterprise security systems — from early network access control implementations to now architecting F5’s modern application delivery solutions — I’ve witnessed many security transformations that promised simplification. Most delivered more complexity inst…CSOONLINE.COM
16 SepFrom prevention to rapid response: The new era of CISO strategyWhat keeps CISOs up at night isn’t if a breach will happen — it’s what comes next. Welcome to the new age of cybersecurity. The old playbook of total prevention has given way to a more pragmatic mindset: Breaches will happen, so how do we deal with the fallout? CISOs are now spen…CSOONLINE.COM
16 SepApple backports zero-day patches to older iPhones and iPadsApple has released security updates to backport patches released last month to older iPhones and iPads, addressing a zero-day bug that was exploited in "extremely sophisticated" attacks. [...]BLEEPINGCOMPUTER.COM
16 SepCobaltStrike’s AI-native successor, ‘Villager,’ makes hacking too easyAn AI-native red-teaming framework called Villager is sounding alarms across the security community after racking up more than 10,000 downloads in just two months. Developed by a shadowy Chinese firm, Cyberspike, the tool is being seen as an AI-powered successor to Cobalt Strike …CSOONLINE.COM
16 SepAPT28 Exploits Signal Messenger to Deploy eardShell and Covenant MalwareSekoia.io’s Threat Detection and Response (TDR) team has uncovered a sophisticated campaign by APT28 that weaponizes Signal Messenger to deploy two previously undocumented malware families—BeardShell and the Covenant framework. In early 2025, a trusted partner supplied samples th…GBHACKERS.COM
16 SepLG WebOS TV Vulnerability Enables Full Device Takeover by Bypassing AuthenticationA security vulnerability has been discovered in LG WebOS TV systems that allows attackers to gain complete control over affected devices by bypassing authentication mechanisms. The vulnerability, disclosed during the TyphoonPWN 2025 LG Category competition where it won first plac…GBHACKERS.COM
16 SepThreat Actors and Code Assistants: The Hidden Risks of Backdoor InjectionsAI code assistants integrated into IDEs, like GitHub Copilot, offer powerful chat, auto-completion, and test-generation features. However, threat actors and careless users can exploit these capabilities to inject backdoors, leak sensitive data, and produce harmful code. Indirect …GBHACKERS.COM
16 SepTop 10 Best Privileged Access Management (PAM) Companies in 2025In an increasingly complex digital landscape, where cloud migrations, remote work, and a distributed workforce have become the norm, the traditional security perimeter has all but disappeared. The most valuable and vulnerable assets of any organization are the privileged accounts…GBHACKERS.COM
16 SepThe AI Fix #68: AI telepathy, and rights for robotsIn episode 68 of The AI Fix, our hosts open the show by launching the thing nobody asked for but everybody wanted: our shiny new merch store - yes, including the “Would YOU trust a pigeon???” t-shirt for when you need fashion alongside health and safety. Meanwhile, AI hoaxers sen…GRAHAMCLULEY.COM
16 SepSlopAds Fraud Ring Exploits 224 Android Apps to Drive 2.3 Billion Daily Ad BidsA massive ad fraud and click fraud operation dubbed SlopAds ran a cluster of 224 apps, collectively attracting 38 million downloads across 228 countries and territories. "These apps deliver their fraud payload using steganography and create hidden WebViews to navigate to threat a…THEHACKERNEWS.COM
16 SepSamsung patches zero-day security flaw used to hack into its customers’ phonesThe Galaxy phone maker said it was notified in August that hackers are actively exploiting the security flaw to target Samsung customers.TECHCRUNCH.COM
16 SepLLM + Fuzzer = End of Zero-Days? 🔥In this short, Mike and John break down how AI is changing AppSec forever. They explore what happens when a Large Language Model is paired with a fuzzer to not only find vulnerabilities but also fix them. Could this mean the end of zero-days as we know it? With the AI Cyber Chall…YOUTUBE.COM
16 SepCISA Releases Eight Industrial Control Systems AdvisoriesCISA released eight Industrial Control Systems (ICS) advisories on September 16, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-259-01 Schneider Electric Altivar Products, ATVdPAC Module, ILC…CISA.GOV
16 SepChaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster TakeoverCybersecurity researchers have disclosed multiple critical security vulnerabilities in Chaos Mesh that, if successfully exploited, could lead to cluster takeover in Kubernetes environments. "Attackers need only minimal in-cluster network access to exploit these vulnerabilities, e…THEHACKERNEWS.COM
16 SepSophos supports Objective-See Foundation to advance macOS security and inclusive cybersecurity educationDedicated to building a stronger, more inclusive Apple security community through open-source security tools Sophos is proud to be a gold friend of the Objective-See Foundation, supporting its mission to expand access to cybersecurity education and foster innovative community-dri…SOPHOS.COM
16 SepCrowdStrike bets big on agentic AI with new offerings after $290M Onum buyIn late August, cybersecurity giant CrowdStrike announced that it agreed to acquire real-time telemetry pipeline management company Onum for $290 million. The company said the acquisition would transform the security operations center (SOC) for the agentic AI era by turbocharging…CSOONLINE.COM
16 SepWarning: Hackers have inserted credential-stealing code into some npm librariesDozens of npm libraries, including a color library with over 2 million downloads a week, have been replaced with novel self-replicating credential-stealing code in yet another wave of a supply chain attack that again stresses the need for contributors to open source repositories …CSOONLINE.COM
16 SepSamsung patches zero-day security flaw used to hack into its customers' phonessubmitted by nemeski to cybersecurity 2 points | 0 comments https://techcrunch.com/2025/09/16/samsung-patches-zero-day-security-flaw-used-to-hack-into-its-customers-phones/SH.ITJUST.WORKS
16 SepHybridPetya: The Petya/NotPetya copycat comes with a twistHybridPetya is the fourth publicly known real or proof-of-concept bootkit with UEFI Secure Boot bypass functionalityWELIVESECURITY.COM
16 SepMultiple Vulnerabilities in Mozilla Products Could Allow for Arbitrary Code ExecutionMultiple vulnerabilities have been discovered in Mozilla products, the most severe of which could allow for arbitrary code execution. Mozilla Firefox is a web browser used to access the Internet. Mozilla Firefox ESR is a version of the web browser intended to be deployed in large…CISECURITY.ORG
📋 SECURITY BULLETINS 1[−]
16 SepApple Releases Security Update Patching Multiple Vulnerabilities in iOS 26 and iPadOS 26Apple has released a comprehensive security update for iOS 26 and iPadOS 26, addressing 27 vulnerabilities across multiple system components. The update, released on September 15, 2025, targets devices including iPhone 11 and later models, along with various iPad genera…GBHACKERS.COM
📢 SECURITY ADVISORIES 4[−]
16 SepRussian hackers target Polish hospitals and city water supplysubmitted by Hotznplotzn to cybersecurity 1 points | 0 comments https://www.ft.com/content/3e7c7a96-09e7-407f-98d7-a29310743d28 cross-posted from: lemmy.sdf.org/post/42362500 Archived Poland is increasing its cyber security budget to a record €1bn this year, after Russian sabotag…INFOSEC.PUB
16 SepRussian hackers target Polish hospitals and city water supplysubmitted by Hotznplotzn to cybersecurity 1 points | 0 comments https://www.ft.com/content/3e7c7a96-09e7-407f-98d7-a29310743d28 cross-posted from: lemmy.sdf.org/post/42362500 Archived Poland is increasing its cyber security budget to a record €1bn this year, after Russian sabotag…SH.ITJUST.WORKS
🔥 INCIDENT REPORTING 15[−]
16 SepMiljödata - 870,108 breached accountsIn August 2025, the Swedish system supplier Miljödata was the victim of a ransomware attack . Following the attack, data was subsequently published on the dark web and included 870k unique email addresses across various compromised files. Data also included names, phone numbers, …HAVEIBEENPWNED.COM
16 Sep40 npm Packages Compromised in Supply Chain Attack Using bundle.js to Steal CredentialsCybersecurity researchers have flagged a fresh software supply chain attack targeting the npm registry that has affected more than 40 packages that belong to multiple maintainers. "The compromised versions include a function (NpmModule.updatePackage) that downloads a package tarb…THEHACKERNEWS.COM
16 SepPopular NPM Package ‘ctrl/tinycolor’ with 2M Weekly Downloads and 40+ Others Compromised in Supply Chain AttackThe NPM ecosystem is under attack once again, with a sophisticated supply chain compromise targeting the widely-used @ctrl/tinycolor package and over 40 other JavaScript packages. This latest incident represents a significant escalation in supply chain threats, featuring self-pro…GBHACKERS.COM
16 SepSmokeLoader Employs Optional Plugins to Steal Data and Launch DoS AttacksActive since 2011, SmokeLoader (also known as Smoke or Dofoil) has cemented its reputation as a versatile malware loader engineered to deliver second-stage payloads, including trojans, ransomware, and information stealers. Over the years, it has evolved to evade detection and opt…GBHACKERS.COM
16 SepTop 10 Best MSSP (Managed Security Service Providers) in 2025In today’s complex digital landscape, the volume and sophistication of cyber threats have outpaced the ability of most organizations to manage their security on their own. The escalating costs of in-house security teams, the global cybersecurity skills gap, and the 24/7 nat…GBHACKERS.COM
16 SepApple Patches 18 Vulnerabilities in visionOS 26 Allowing Access to Sensitive User DataApple has released visionOS 26, addressing eighteen security flaws that could allow unauthorized access to sensitive user data. The update, issued on September 15, 2025, covers a wide range of components in the Apple Vision Pro platform. Apple’s policy is to confirm securit…GBHACKERS.COM
16 SepAWSDoor: New Persistence Technique Attackers Use to Hide in AWS Cloud EnvironmentsAs more companies move their critical systems and data to Amazon Web Services (AWS), attackers are finding new ways to stay hidden inside cloud environments. AWSDoor is a tool designed to simplify and automate persistence techniques in AWS. Persistence lets an attacker maintain a…GBHACKERS.COM
16 SepWebinar: Your browser is the breach — securing the modern web edgeThe web browser has quietly become one of the most critical components of enterprise infrastructure—and one of the most dangerous. Join BleepingComputer, SC Media, and Push Security on September 29 at 12:00 PM ET for a live webinar on how attackers are targeting the browser to hi…BLEEPINGCOMPUTER.COM
16 SepMillions of Customer Records Stolen in Cyberattack on Gucci, Balenciaga, and Alexander McQueenLuxury retail giant Kering has confirmed a major data breach affecting its top fashion houses, including Gucci, Balenciaga, and Alexander McQueen. The cybercriminal group known as Shiny Hunters claims to have stolen private details tied to as many as 7.4 million unique email addr…GBHACKERS.COM
16 SepFinWise Data Breach: 700K Customer Records Accessed by Ex-EmployeeA major data breach at American First Finance, LLC has exposed sensitive information for nearly 700,000 customers. The breach, which occurred on May 31, 2024, was discovered over a year later on June 18, 2025. An ex-employee of the financial services firm is responsible for the u…GBHACKERS.COM
16 SepCrowdStrike npm Packages Hit by Supply Chain AttackA new supply chain attack has compromised multiple npm packages maintained by the crowdstrike-publisher account, marking a worrying continuation of the so-called “Shai-Halud attack.” Developers and organizations using these packages should take immediate action to safeguard crede…GBHACKERS.COM
16 SepJaguar Land Rover extends shutdown after cyberattack by another weekJaguar Land Rover (JLR) announced today that it will extend the production shutdown for another week, following a devastating cyberattack that impacted its systems at the end of August. [...]BLEEPINGCOMPUTER.COM
16 SepLuxury fashion brands Gucci, Balenciaga and Alexander McQueen hacked – customer data stolenLuxury fashion group Kering - owner of the prestigious Gucci, Balenciaga, and Alexander McQueen brands, amongst others - has confirmed that hackers stole customer data from its systems in June 2025. Read more in my article on the Hot for Security blog.BITDEFENDER.COM
16 SepSelf-propagating supply chain attack hits 187 npm packagesSecurity researchers have identified at least 187 npm packages compromised in an ongoing supply chain attack. The coordinated worm-style campaign dubbed 'Shai-Hulud' started yesterday with the compromise of the @ctrl/tinycolor npm package, and has now expanded to CrowdStrike's np…BLEEPINGCOMPUTER.COM
16 SepBreachForums hacking forum admin resentenced to three years in prisonConor Brian Fitzpatrick, the 22-year-old behind the notorious BreachForums hacking forum, was resentenced today to three years in prison after a federal appeals court overturned his prior sentence of time served and 20 years of supervised release. [...]BLEEPINGCOMPUTER.COM
🕵️ THREAT INTELLIGENCE 29[−]
16 SepISC Stormcast For Tuesday, September 16th, 2025 https://isc.sans.edu/podcastdetail/9614, (Tue, Sep 16th)(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.ISC.SANS.EDU
16 SepMicrosoft Resolves Bluetooth Audio Problem in Windows 11 24H2 UpdateMicrosoft has addressed a widespread audio issue affecting Bluetooth speakers, headsets, and integrated laptop speakers in Windows 11 version 24H2. The problem stemmed from an incompatibility with Dirac Audio software on certain devices, causing audio devices to go silent and app…GBHACKERS.COM
16 SepNew Maranhão Stealer Targets Users Through Pirated Software and Cloud ServicesA sophisticated new information-stealing malware campaign dubbed Maranhão Stealer has emerged, targeting gaming enthusiasts through malicious pirated software distributed via cloud-hosted platforms. The campaign, first identified by security researchers in May 2025, represents a …GBHACKERS.COM
16 SepMicrosoft Releases Fix for Windows 11 24H2 Bluetooth Audio Malfunction Affecting Headsets and SpeakersMicrosoft has successfully resolved a critical audio compatibility issue that left thousands of Windows 11 version 24H2 users without functioning Bluetooth headsets, speakers, and integrated laptop audio devices. The company released a targeted driver update on September 12, 2025…GBHACKERS.COM
16 SepNew Phoenix Rowhammer Attack Bypasses DDR5 Chip ProtectionsA new variation of the Rowhammer attack, named Phoenix, breaks through the built-in defenses of modern DDR5 memory modules. Researchers reverse-engineered the in-DRAM protections on SK Hynix chips and found blind spots that let them flip bits despite the most advanced hardwa…GBHACKERS.COM
16 SepFraud Prevention Company SEON Raises $80 Million in Series C FundingThe company will invest in its AI and real-time detection platform, in global expansion, and in strategic partnerships. The post Fraud Prevention Company SEON Raises $80 Million in Series C Funding appeared first on SecurityWeek .SECURITYWEEK.COM
16 SepChatGPT’s New Calendar Integration Can Be Abused to Steal EmailsEdisonWatch researchers demonstrated the new hack after OpenAI added support for MCP tools in ChatGPT. The post ChatGPT’s New Calendar Integration Can Be Abused to Steal Emails appeared first on SecurityWeek .SECURITYWEEK.COM
16 SepRowhammer Attack Demonstrated Against DDR5Researchers devise Phoenix, a new Rowhammer attack that achieves root on DDR5 systems in less than two minutes. The post Rowhammer Attack Demonstrated Against DDR5 appeared first on SecurityWeek .SECURITYWEEK.COM
16 SepNeon Cyber Emerges from Stealth, Shining a Light into the BrowserNeon Cyber argues that phishing, social engineering, and insider threats demand protections that follow users into the browser, where most attacks now begin. The post Neon Cyber Emerges from Stealth, Shining a Light into the Browser appeared first on SecurityWeek .SECURITYWEEK.COM
16 SepSecurity Industry Skeptical of Scattered Spider-ShinyHunters Retirement ClaimsThe notorious cybercrime groups claim they are going dark, but experts believe they will continue their activities. The post Security Industry Skeptical of Scattered Spider-ShinyHunters Retirement Claims appeared first on SecurityWeek .SECURITYWEEK.COM
16 SepRay Security Emerges From Stealth With $11M to Bring Real-Time, AI-Driven Data ProtectionTel Aviv, Israel-based Ray Security emerged from stealth with $11 million seed funding and a desire to change the way corporate data is protected. The funding was co-led by Venture Guides and Ibex Investors. The post Ray Security Emerges From Stealth With $11M to Bring Real-Time,…SECURITYWEEK.COM
16 SepWindows Users Hit by VenomRAT in AI-Driven RevengeHotels AttackRevengeHotels, also known as TA558, has escalated its long-standing cybercrime campaign by incorporating artificial intelligence into its infection chains, deploying the potent VenomRAT malware against Windows users. Active since 2015, this threat actor has traditionally targeted…GBHACKERS.COM
16 SepSecurity Analytics Firm Vega Emerges From Stealth With $65M in FundingVega provides security analytics and operations solutions designed to help organizations detect and respond to threats. The post Security Analytics Firm Vega Emerges From Stealth With $65M in Funding appeared first on SecurityWeek .SECURITYWEEK.COM
16 SepTop 10 Best Dynamic Application Security Testing (DAST) Platforms in 2025In today’s fast-paced software development world, where applications are released at an unprecedented rate, ensuring their security is more critical than ever. Dynamic Application Security Testing (DAST) has emerged as a fundamental practice for modern development teams. DA…GBHACKERS.COM
16 SepCyberheistNews Vol 15 #37 [New Report] Shadow AI Threats Are Increasing. Here's How to Spot ThemKNOWBE4.COM
16 SepLas Vegas, United States, September 16th, 2025, CyberNewsWireSeraphic today announced at Fal.Con 2025 that its Secure Enterprise Browser (SEB) solution is now available for purchase in the CrowdStrike Marketplace, a one-stop destination for the world-class ecosystem of CrowdStrike-compatible security products. This availability enables cus…GBHACKERS.COM
16 SepMicrosoft Purview innovations for your Fabric data: Unify data security and governance for the AI eraThe Microsoft Fabric and Purview teams are thrilled to participate in the European Microsoft Fabric Community Conference Sept. 15-18, 2025 in Vienna, Austria. The event is Microsoft’s largest tech conference in Europe, where data professionals gather to connect and share insights…MICROSOFT.COM
16 SepTop 10 Best MCP (Model Context Protocol) Servers in 2025The rise of large language models (LLMs) has revolutionized how we interact with technology, but their true potential has always been limited by their inability to interact with the real world. LLMs are trained on vast, static datasets, meaning they have no direct access to real-…GBHACKERS.COM
16 SepOpenSSL Conference 2025: Just 21 Days Until It BeginsNewark, New Jersey, United States, September 16th, 2025, CyberNewsWire The OpenSSL Conference 2025 will take place on October 7 – 9 in Prague. The program will bring together lawyers, regulators, developers, and entrepreneurs to discuss security and privacy in a global …GBHACKERS.COM
16 SepCheck Point to Acquire AI Security Firm LakeraMove highlights rising demand for AI-native security as enterprises face new risks from generative models and autonomous agents The post Check Point to Acquire AI Security Firm Lakera appeared first on SecurityWeek .SECURITYWEEK.COM
16 SepCyberheistNews Vol 15 #37 [New Report] Shadow AI Threats Are Increasing. Here's How to Spot ThemKNOWBE4.COM
16 SepAI Nuns, Steganography, You're fired, VoidProxy, C++, Carplay Apriso, Josh Marpet... - SWN #512AI Nuns, Steganography, You're fired, VoidProxy, C++, Carplay Apriso, Josh Marpet, and more on the Security Weekly News. Visit https://www.securityweekly.com/swn for all the latest episodes! Show Notes: https://securityweekly.com/swn-512YOUTUBE.COM
16 SepSelf-Replicating Worm Hits 180+ Software Packagessubmitted by cm0002 to cybersecurity 1 points | 0 comments https://krebsonsecurity.com/2025/09/self-replicating-worm-hits-180-software-packages/INFOSEC.PUB
16 SepCrowdStrike to Acquire Pangea to Launch AI Detection and Response (AIDR)Acquisition extends CrowdStrike’s Falcon platform into AI security, introducing AI Detection and Response (AIDR) to protect enterprise models, agents, and applications across the full AI lifecycle. The post CrowdStrike to Acquire Pangea to Launch AI Detection and Response (AIDR) …SECURITYWEEK.COM
16 SepNews alert: Seraphic integrates with CrowdStrike Marketplace, extends SIEM protection to browsersLas Vegas, Sept. 16, 2025, CyberNewswire — Seraphic today announced at Fal.Con 2025 that its Secure Enterprise Browser (SEB) solution is now available for purchase in the CrowdStrike Marketplace , a one-stop destination for the world-class ecosystem of CrowdStrike-compatible secu…LASTWATCHDOG.COM
16 SepNews alert: OpenSSL 2025 kicks off in 3 weeks, global leaders to chart the future of cryptographyNewark, NJ, Sept. 16, 2025, CyberNewswire — The OpenSSL Conference 2025 will take place on October 7 – 9 in Prague. The program will bring together lawyers, regulators, developers, and entrepreneurs to discuss security and privacy in a global context.… (more…) The post News…LASTWATCHDOG.COM
16 SepFIRESIDE CHAT: The case for AI-Native SOCs built to take action, not just observe and alertThe raw attack surface isn’t just growing. It’s fragmenting. Logs from SaaS apps, cloud workloads, and third-party services flood security stacks already straining to keep up. Security teams are buried in alerts they can’t triage fast enough. Meanwhile, adversaries probe … …LASTWATCHDOG.COM
16 SepCyberRiskTV Live Coverage from Oktane 2025 - Day 2CyberRisk Alliance's Security Weekly broadcasting live from the CyberRiskTV Studio at Oktane 2025 at Caesars Forum in Las Vegas! Schedule (PT): 9:40am - Daily Intro ft. Mandy Logan & Adrian Sanabria 10:10am - How to detect, contain, and respond to today’s threats ft. Matt Immler,…YOUTUBE.COM
16 SepCyberRiskTV Live Coverage from Oktane 2025 - Day 1CyberRisk Alliance's Security Weekly broadcasting live from the CyberRiskTV Studio at Oktane 2025 at Caesars Forum in Las Vegas! Schedule (PT): 5:10pm - Show Intro ft. Mandy Logan & Adrian Sanabria 5:40pm - How to strengthen your security posture and manage privileged access in t…YOUTUBE.COM
🌐 CYBER THREAT LANDSCAPE 4[−]
16 SepNew FileFix attack uses steganography to drop StealC malwareA newly discovered FileFix social engineering attack impersonates Meta account suspension warnings to trick users into unknowingly installing the StealC infostealer malware. [...]BLEEPINGCOMPUTER.COM
16 SepNew FileFix Variant Delivers StealC Malware Through Multilingual Phishing SiteCybersecurity researchers have warned of a new campaign that's leveraging a variant of the FileFix social engineering tactic to deliver the StealC information stealer malware. "The observed campaign uses a highly convincing, multilingual phishing site (e.g., fake Facebook Securit…THEHACKERNEWS.COM
16 SepSelf-Replicating Worm Hits 180+ Software PackagesAt least 187 code packages made available through the JavaScript repository NPM have been infected with a self-replicating worm that steals credentials from developers and publishes those secrets on GitHub, experts warn. The malware, which briefly infected multiple code packages …KREBSONSECURITY.COM
16 SepGoogle nukes 224 Android malware apps behind massive ad fraud campaignA massive Android ad fraud operation dubbed "SlopAds" was disrupted after 224 malicious applications on Google Play were used to generate 2.3 billion ad requests per day. [...]BLEEPINGCOMPUTER.COM
📡 INFOSEC NEWS 8[−]
16 SepSophos tops G2 Fall 2025 Reports: #1 Overall in MDR and Firewall#1 Ranked in 47 Global ReportsSOPHOS.COM
16 SepSecuring the Agentic Era: Introducing Astrix's AI Agent Control PlaneAI agents are rapidly becoming a core part of the enterprise, being embedded across enterprise workflows, operating with autonomy, and making decisions about which systems to access and how to use them. But as agents grow in power and autonomy, so do the risks and threats. …THEHACKERNEWS.COM
16 SepTeam-Wide VMware Certification: Your Secret Weapon for SecurityOne VMware-certified pro is a win. An entire certified team? That's a security multiplier. VMUG Advantage makes team-wide certification practical—building collaboration, resilience, and retention. [...]BLEEPINGCOMPUTER.COM
16 SepMicrosoft: WMIC will be removed after Windows 11 25H2 upgradeMicrosoft has announced that the Windows Management Instrumentation Command-line (WMIC) tool will be removed after upgrading to Windows 11 25H2 and later. [...]BLEEPINGCOMPUTER.COM
16 SepResponding to npm package compromise by the Shai-Hulud worm.How to recognize a Shai-Hulud worm attack on npm packages. Detection and response measures.KASPERSKY.COM
16 SepMicrosoft rolls out Copilot Chat to Microsoft 365 Office appsMicrosoft is rolling out Copilot Chat to Word, Excel, PowerPoint, Outlook, and OneNote for paying Microsoft 365 business customers. [...]BLEEPINGCOMPUTER.COM
16 SepNot all Endpoint protection is created equalWhen people ask us, “Aren’t all endpoint solutions the same these days?” — our answer is simple: No. They're not.SOPHOS.COM
16 SepWhy You Need Phishing Resistant Authentication NOW., (Tue, Sep 16th)The recent (and still ongoing) phishing of NPM developer accounts showed yet again that even technically sophisticated and aware users are falling for phishing lures. Anybody will fall for phishing if a well-targeted e-mail is used.
ISC.SANS.EDU