Daily Security Review

A newly disclosed exploit dubbed FileFix is redefining how attackers bypass Microsoft Windows' built-in security protections—specifically the Mark-of-the-Web (MotW) mechanism. Developed and detailed by security researcher mr.d0x , this attack takes advantage of how browsers save HTML files and how Windows handles HTA (HTML Application) files . The result? Malicious scripts can execute without warn...

The International Criminal Court (ICC), the world’s foremost tribunal for prosecuting war crimes, genocide, and crimes against humanity, has confirmed yet another sophisticated cyberattack , highlighting the persistent threat facing high-profile global institutions. This marks the second targeted intrusion against the ICC in recent years , and although the organization successfully detected and co...

In a major red flag for the industrial cybersecurity community, three newly disclosed vulnerabilities in Microsens NMP Web+ , a popular network management solution used across critical infrastructure, have revealed just how fragile many ICS environments remain. The flaws—two rated critical and one high—allow unauthenticated attackers to bypass authentication , generate forged JWTs , and execute ar...

In a stark reminder of the aviation industry's growing exposure to cyber threats, Australian airline Qantas recently confirmed a serious data breach—this time not from its own systems, but from a third-party platform used by one of its customer contact centers. The breach exposed personal data for up to six million customers , including names, dates of birth, contact details, and frequent flyer nu...

Germany’s battle over digital sovereignty and data privacy has intensified, with the Berlin Commissioner for Data Protection formally requesting that Google and Apple remove the DeepSeek AI application from their app stores. The move stems from allegations that DeepSeek, a Chinese-developed generative AI platform, violates the EU’s General Data Protection Regulation (GDPR) by unlawfully collecting...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added multiple Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog—an urgent signal for federal agencies and private enterprises alike. At the center of this update is CVE-2025-6543 , a memory overflow flaw affecting NetScaler ADC and Gateway appliances, which could lead to Denial of Service atta...

Cato Networks just raised $359 million in Series G funding , pushing its valuation past $4.8 billion and its total funding beyond the $1 billion mark—a milestone that cements its place as one of the most formidable players in the rapidly expanding Secure Access Service Edge (SASE) market. In this episode, we unpack what this massive investment means for the future of enterprise cybersecurity, AI i...

A new high-severity zero-day vulnerability in Google Chrome— CVE-2025-6554 —has sent shockwaves across the cybersecurity landscape. This episode dives into the technical details, real-world impact, and broader implications of this actively exploited flaw. Tracked as a type confusion bug in Chrome’s V8 JavaScript engine , the vulnerability allows attackers to remotely execute code by luring users t...

Russia has entered a new phase of digital authoritarianism. In a sweeping move, Russian Internet Service Providers (ISPs) have begun systematically throttling access to Cloudflare and other Western-backed services, including infrastructure giants Hetzner and DigitalOcean. This throttling is so severe that it restricts downloads to just 16 kilobytes per connection—effectively rendering affected web...

Ahold Delhaize, one of the world’s largest food retailers, is now the subject of one of the most significant ransomware breaches in recent U.S. history. Affecting over 2.2 million current and former employees , this incident—claimed by the cybercrime group INC Ransom —highlights the rising threat posed by ransomware-as-a-service operations targeting enterprise systems across critical sectors. In t...

Canada has taken a definitive stance in the escalating global scrutiny of Chinese technology, ordering surveillance giant Hikvision to cease all operations within its borders. Citing national security concerns and acting on the advice of intelligence agencies, the Canadian government has banned the use of Hikvision products across its public sector, initiated reviews of existing installations, and...

As the aviation industry becomes more digitally interconnected, its exposure to sophisticated cyber threats continues to grow. One of the most dangerous actors in this space— Scattered Spider , a financially motivated and technically skilled cybercrime group—has recently shifted its focus to target the aviation sector. With recent incidents involving Hawaiian Airlines , WestJet , and others, globa...

In a landmark case that reshapes the conversation around digital ethics, the Federal Trade Commission’s $520 million settlement with Epic Games over its Fortnite monetization tactics highlights a critical issue facing the modern digital economy: the weaponization of interface design to manipulate users . Central to the case is the use of “dark patterns”—subtle yet deceptive design strategies inten...

Phishing has long been a favored weapon of cybercriminals, but a recent revelation about Microsoft 365’s Direct Send feature has elevated the threat to a new level— from inside the firewall . Designed for internal systems to send notifications without authentication, Direct Send can be abused by malicious actors to spoof emails that appear to originate from trusted internal sources. Without compro...

A critical flaw in the Open VSX Registry—an open-source alternative to the Visual Studio Code Marketplace—recently put over 8 million developers at risk of mass compromise. This vulnerability, discovered in the platform’s GitHub Actions workflow, exposed a super-admin publishing token that could have enabled malicious actors to overwrite or inject malware into any extension in the registry. Given...

A new critical vulnerability in Citrix NetScaler ADC and Gateway systems, dubbed CitrixBleed 2 (CVE-2025-5777), has emerged as a serious threat to remote access infrastructure. This memory exposure flaw allows unauthenticated attackers to extract session tokens directly from device memory — enabling session hijacking and even bypassing multi-factor authentication (MFA). With early evidence of expl...

A sophisticated cyber-espionage campaign named OneClik is actively targeting energy, oil, and gas organizations using a combination of legitimate cloud infrastructure and novel attack techniques. The campaign, attributed to an unknown but likely state-affiliated actor, leverages Microsoft's ClickOnce deployment technology to deliver custom Golang-based malware known as RunnerBeacon . The use of AW...

In October 2024, Central Kentucky Radiology (CKR), a Lexington-based imaging provider, became the latest victim of a growing trend in healthcare cyberattacks. An unauthorized actor accessed CKR’s systems over a two-day period, compromising sensitive data for approximately 167,000 individuals. The stolen information includes names, Social Security numbers, birth dates, addresses, insurance details,...

In a major development at the intersection of cybersecurity and AI governance, Israeli startup Bonfy. AI has officially launched its adaptive content security platform, backed by $9.5 million in seed funding. The company’s mission is bold and timely: to secure content generated by both humans and AI across modern SaaS ecosystems — including high-risk environments like Slack, Salesforce, and AI cha...

Cisco has disclosed two critical security vulnerabilities in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) products, both earning a maximum CVSS severity score of 10.0. These flaws—CVE-2025-20281 and CVE-2025-20282—allow unauthenticated remote attackers to execute arbitrary commands on the underlying operating system with root privileges. The vulnerabilities are u...

The U.S. House of Representatives has officially banned the use of WhatsApp on all House-managed devices, citing significant data security risks. This move places WhatsApp alongside other restricted applications like TikTok, ChatGPT, and Microsoft Copilot, reflecting an intensifying government focus on digital security and the reliability of consumer platforms used in official contexts. The House...

The healthcare industry is facing a relentless wave of cyber threats, as demonstrated by two recent breaches impacting Mainline Health Systems and Select Medical Holdings. In April 2024, Mainline Health experienced a direct ransomware attack by the Inc Ransom group, compromising sensitive data for over 101,000 individuals. Select Medical’s breach, in contrast, occurred through a third-party vendor...

This episode examines a serious conflict between Siemens’ Simatic PCS industrial control systems and Microsoft Defender Antivirus. The absence of an "alert only" mode in Defender has created a significant operational risk for plants running Siemens’ systems. Without this functionality, operators must choose between ignoring potential malware detections—remaining unaware of infections—or allowing D...

Prometei is one of the most persistent and sophisticated botnet threats in circulation today. First identified in 2020—and active since at least 2016—this modular malware continues to evolve rapidly, targeting both Windows and Linux systems across the globe. Originally designed for cryptocurrency mining, Prometei has expanded its capabilities to include credential theft, lateral movement, command...

In this episode, we dive into the 2024 McLaren Health Care data breach that compromised the sensitive information of over 743,000 individuals—just one year after a similar ransomware attack impacted 2.2 million. We’ll unpack the timeline of the attack: how cybercriminals gained unauthorized access between July 17 and August 3, exploiting vulnerabilities in McLaren’s network to steal personally ide...