Daily Security Review

Cybercrime is entering a new phase—one marked by AI-powered phishing attacks, the weaponization of legitimate remote access tools, and the rise of professionalized underground markets . Recent reports highlight the alarming growth of AI-driven polymorphic phishing , where malicious emails are automatically tailored, randomized, and adapted in real time. By scraping public data and mimicking commun...

The recent Salesforce data breach underscores a growing reality in cybersecurity: even when core SaaS platforms are secure, their third-party integrations often aren’t. Between August 8–18, 2025, attackers from the group UNC6395 exploited compromised OAuth tokens from the Salesloft Drift AI chat integration, systematically exporting data from hundreds of Salesforce customer instances. The stolen d...

A new and highly sophisticated cyber espionage campaign attributed to Silk Typhoon —also known as Mustang Panda, TEMP.Hex, or UNC6384 —has been uncovered, targeting diplomats and government entities across Southeast Asia. Researchers from Google’s Threat Intelligence Group (GTIG) revealed that the attackers deployed Adversary-in-the-Middle (AitM) techniques to hijack web traffic at captive portals...

The fight over encryption has entered a new phase. The Federal Trade Commission (FTC) , led by Chairman Andrew Ferguson , has issued a strong warning to major U.S. technology companies: resist foreign government demands to weaken encryption . At stake is nothing less than the security of millions of Americans’ private communications, financial data, and digital identities. This warning comes amid...

Researchers have uncovered a new form of indirect prompt injection that leverages a simple but powerful trick: image scaling . This novel attack involves hiding malicious instructions inside high-resolution images, invisible to the human eye. When AI systems automatically downscale these images during preprocessing, the hidden prompt becomes visible— not to the user, but to the AI model itself . T...

The healthcare sector has been rocked yet again by a massive cybersecurity incident. Healthcare Services Group (HCSG) , a provider of dining and laundry services to healthcare facilities, disclosed a data breach that compromised the personal information of over 624,000 individuals . Between late September and early October 2024, hackers gained unauthorized access to HCSG’s systems, exfiltrating fi...

French retail giant Auchan has confirmed a massive data breach that compromised the personal details of hundreds of thousands of customers . The stolen data includes names, addresses, phone numbers, email addresses, and loyalty card numbers—though banking details, passwords, and PINs were reportedly not affected. Despite this, the breach is serious enough that Auchan has deactivated affected loyal...

A critical vulnerability in Docker Desktop, CVE-2025-9074 , has shaken the container security world. Scoring 9.3 on the CVSS scale, this flaw exposed an unauthenticated Docker Engine API (192.168.65.7:2375) to any container running on Windows and macOS. With nothing more than a few HTTP requests—or even three lines of Python code—attackers could escape their container boundaries and manipulate hos...

The Arch Linux community has just endured more than a week of turbulence as a massive distributed denial-of-service (DDoS) attack disrupted its most critical services, including the main website, the Arch User Repository (AUR), and community forums. Beginning in mid-August 2025, the sustained volumetric and protocol-level assault overwhelmed hosting infrastructure, triggered connection resets, and...

Cyberattacks against supply chains are no longer isolated disruptions—they are systemic threats with the power to cascade across industries and nations. The recent ransomware attack on Data I/O , a chip programming firm whose customers include global giants like Apple, Microsoft, Amazon, and Bosch, demonstrates how one breach can disrupt manufacturing, shipping, and communications far beyond a sin...

The U.S. healthcare sector continues to face relentless cyberattacks, and rural hospitals are increasingly at the center of this crisis. The recent Aspire Rural Health System breach in Michigan—attributed to the BianLian ransomware group —exposed the personal and medical data of nearly 140,000 patients and staff. From Social Security numbers and financial accounts to detailed medical histories and...

Artificial Intelligence (AI) models are shaping the future of industries from healthcare and finance to autonomous vehicles and national infrastructure. But with this rise comes a hidden battlefield: adversarial attacks designed to manipulate AI systems in subtle yet devastating ways. One of the most alarming threats is the OneFlip attack , a method that exploits a hardware flaw known as Rowhammer...

The Python Package Index (PyPI), the backbone of the global Python ecosystem, has rolled out new security safeguards aimed at stopping a dangerous form of supply-chain attack: domain resurrection attacks. These attacks exploit a subtle but devastating weakness—when a maintainer’s email domain expires, attackers can re-register it, hijack the email, and reset the maintainer’s PyPI account password....

Both Google and Mozilla have rolled out urgent security updates to patch multiple high-severity vulnerabilities in their flagship browsers—Google Chrome and Mozilla Firefox—underscoring the constant arms race between developers and cyber attackers. Google’s update addresses a critical out-of-bounds write vulnerability (CVE-2025-9132) within Chrome’s V8 JavaScript engine, which could allow attacker...

A major international clash over encryption has come to a dramatic resolution. Earlier this year, the U.K. government, acting under its controversial Investigatory Powers Act of 2016 (IPA)—better known as the “Snoopers’ Charter”—issued a secret Technical Capacity Notice to Apple, demanding that the company weaken its Advanced Data Protection (ADP) system to allow government access to encrypted iCl...

In early 2025, Microsoft and security researchers uncovered PipeMagic, a modular and memory-resident backdoor that has been quietly leveraged in ransomware campaigns worldwide. Disguised as a legitimate ChatGPT desktop application, this sophisticated malware granted persistent access, precise control, and stealthy communication channels to its operators. Attributed to Storm-2460, a financially mot...

In late 2024, Intel faced a major cybersecurity wake-up call when security researcher Eaton Zveare uncovered a series of vulnerabilities inside the company’s internal systems—flaws that exposed employee and supplier data at unprecedented scale. These vulnerabilities, later confirmed and patched by Intel, included authentication bypasses in web applications and the use of hardcoded credentials, som...

In July 2025, Allianz Life Insurance Company of North America confirmed a data breach impacting over 1.1 million customers, financial professionals, and employees—a stark reminder of how vulnerable even the most established financial institutions remain to evolving cyber threats. The breach stemmed from a third-party vendor compromise, specifically a cloud-based Salesforce CRM platform, where atta...

The U.S. Department of Justice has closed the chapter on one of the most audacious cloud fraud and cryptojacking schemes in recent years. Charles O. Parks III, known online as “CP3O” and the self-styled “MultiMillionaire,” has been sentenced for orchestrating a multimillion-dollar scam that defrauded leading cloud providers out of more than $3.5 million in computing resources. His scheme highlight...

A new wave of state-sponsored cyber espionage is sweeping across South Korea, targeting foreign embassies through highly tailored, multi-stage spearphishing campaigns . Security researchers at Trellix have uncovered that this operation—likely linked to North Korea’s Kimsuky (APT43) group but with indicators of Chinese involvement —has been active since March, successfully compromising sensitive di...

A groundbreaking security study from the Singapore University of Technology and Design has revealed a major vulnerability in 5G networks that allows attackers to bypass traditional defenses—without even needing a rogue base station. The newly released Sni5Gect attack framework demonstrates how adversaries within range of a victim can intercept and inject malicious messages during the unencrypted p...

SAP NetWeaver, one of the world’s most critical enterprise platforms, is under active attack from both ransomware groups and state-backed hackers. A newly released exploit combines two devastating vulnerabilities—CVE-2025-31324 and CVE-2025-42999—to bypass authentication and execute malicious code with full administrative privileges. With CVSS scores of 10.0 and 9.1, these flaws rank among the mos...

Ransomware gangs are no longer just encrypting files and demanding payment—they are actively targeting the very defenses meant to stop them. Recent reports reveal a dramatic surge in the use of EDR killer tools, specialized malware designed to disable Endpoint Detection and Response (EDR) and antivirus systems at the kernel level. By silencing these crucial tools, attackers gain stealth, persisten...

Taiwan continues to face an unprecedented wave of cyberattacks, with new intelligence exposing two distinct but sophisticated campaigns linked to Chinese threat actors. Together, they underscore Beijing’s increasingly aggressive cyber posture against Taiwan’s digital and critical infrastructure. The first campaign, attributed to UAT-7237, a subgroup of the China-aligned UAT-5918, has been active s...

Colt Technology Services, a major UK-based telecommunications provider with operations in over 40 countries, has confirmed that the WarLock ransomware group is behind the cyberattack that struck its systems on August 12, 2025. The attack caused multi-day outages across Colt’s hosting, porting, Voice API, and customer support services, while sparing its core network infrastructure. Initially dismis...