A novel, highly sophisticated malware strain targeting vulnerable React Server Components, signaling a significant evolution in how state-sponsored threat actors are exploiting the critical React2Shell vulnerability disclosed just days earlier. On December 5, 2025, just two days after the disclosure…
Category: Cyber Security News
Gemini Zero-Click Vulnerability Let Attackers Access Gmail, Calendar, and Docs
A critical zero-click vulnerability dubbed “GeminiJack” in Google Gemini Enterprise and previously Vertex AI Search that let attackers steal sensitive corporate data from Gmail, Calendar, and Docs with minimal effort. According to Noma Labs, it was considered an architectural flaw…
CISA Warns of WinRAR 0-Day RCE Vulnerability Exploited in Attacks
A high-priority warning regarding a critical security flaw in WinRAR, the popular file compression tool used by millions of Windows users. The vulnerability, tracked as CVE-2025-6218, is currently being exploited by attackers to compromise systems and execute malicious code. The specific…
Windows PowerShell 0-Day Vulnerability Let Attackers Execute Malicious Code
Security update addressing a dangerous Windows PowerShell vulnerability that allows attackers to execute malicious code on affected systems. The vulnerability, tracked as CVE-2025-54100, was publicly disclosed on December 9, 2025, and represents a significant security risk for organizations worldwide. The…
Windows Cloud Files Mini Filter Driver 0-Day Vulnerability Exploited in the Wild to Escalate Privileges
Microsoft has released urgent security updates to address a zero-day vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys) that is currently being exploited in the wild. Assigned the identifier CVE-2025-62221, this elevation of privilege flaw affects a wide…
Microsoft 365 Services Disruption in Australia: Users Face Access Issues in Accessing Services
Users across Australia are currently grappling with significant disruptions to critical business tools as Microsoft 365 services experience a widespread outage. The incident, which began on the morning of December 10, 2025, is preventing a large number of enterprise and…
FortiOS, FortiWeb, and FortiProxy Vulnerability Lets Attackers Bypass FortiCloud SSO Authentication
Fortinet has issued an urgent security advisory regarding a critical vulnerability affecting its FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager product lines. The security flaw, identified as an Improper Verification of Cryptographic Signature (CWE-347), could allow an unauthenticated attacker to bypass the…
Ivanti Security Update: Patch for Code Execution Vulnerabilities in Endpoint Manager
Ivanti has officially released urgent security updates for its Endpoint Manager (EPM) solution to address four distinct security flaws. The latest advisory highlights one critical vulnerability and three high-severity issues that could allow attackers to execute arbitrary code, write files…
Threat Actors Poisoning SEO Results to Attack Organizations With Fake Microsoft Teams Installer
A sophisticated cyber campaign is exploiting search engine optimization (SEO) to distribute a malicious installer disguised as Microsoft Teams, targeting unsuspecting organizations. This campaign, active since November 2025, uses a fake Microsoft Teams website to lure users into downloading a…
Makop Ransomware Exploits RDP Systems with AV Killer and Other Exploits
Makop ransomware, a strain of the Phobos malware family first spotted in 2020, continues to evolve into a significant threat to businesses worldwide. Recent analysis reveals that attackers are combining brute-force RDP attacks with sophisticated privilege escalation techniques and security…
Microsoft December 2025 Patch Tuesday – 56 Vulnerabilities Fixed Including 3 Zero-days
Microsoft released its final Patch Tuesday updates of 2025 on December 9, addressing 56 security vulnerabilities across Windows, Office, Exchange Server, and other components. This batch includes three zero-day flaws: two publicly disclosed remote code execution issues and one actively…
GOLD BLADE Using Custom QWCrypt Locker that Allows Data Exfiltration and Ransomware Deployment
The GOLD BLADE threat group has shifted from pure espionage to a hybrid model that combines data theft with targeted ransomware attacks using a custom locker called QWCrypt. This shift follows a long-running campaign tracked as STAC6565, which hit almost…
Microsoft Teams New feature Allows Users to Flag Malicious Calls
Microsoft is set to introduce a significant security enhancement to its Teams platform that will empower users to flag potentially malicious or unsolicited calls. This upcoming feature, “Report a Suspicious Call,” is designed to strengthen the platform’s defenses against fraudulent…
See Cyber Threats to Your Company’s Industry & Region in 2 Seconds
Security teams today struggle with a paradox. Threat volumes keep climbing, but most of what hits SIEMs and inboxes is noise: indicators stripped of meaning, alerts detached from context, and threat data that treats every organization as if it faces the same risks. For…
Ransomware Targeting Hyper-V and VMware ESXi Surges as Akira Group Exploits System Vulnerabilities
A new wave of ransomware attacks targeting virtual machine platforms has emerged, with the Akira ransomware group leading a campaign against Hyper-V and VMware ESXi systems. These attacks pose a growing threat to enterprise environments that rely on virtualization for…
Proofpoint Acquires Hornetsecurity in $1.8 Billion Deal to Strengthen SMB Cybersecurity
Proofpoint, Inc., a pioneer in human-centric cybersecurity, has finalized its $1.8 billion acquisition of Hornetsecurity Group, a dominant European provider of AI-driven Microsoft 365 security solutions. The deal, announced today, catapults Proofpoint’s reach into the SMB market via MSP channels,…
New Prompt Injection Attack via Malicious MCP Servers Let Attackers Drain Resources
Security researchers have uncovered critical vulnerabilities in the Model Context Protocol (MCP) sampling feature. Revealing how malicious servers can exploit LLM-integrated applications to conduct resource theft, conversation hijacking, and unauthorized system modifications. Attack Vector Mechanism Impact Resource theft Hidden instructions…
Ruby SAML Library Vulnerability Let Attackers Bypass Authentication
A critical vulnerability has been discovered in the Ruby SAML library that could allow attackers to bypass authentication mechanisms in affected applications completely. The flaw, tracked as CVE-2025-66567, impacts all versions up to and including 1.12.4 and has been assigned…
New Vishing Attack Leverages Microsoft Teams Call and QuickAssist to Deploy .NET Malware
A sophisticated new vishing campaign has emerged, blending traditional voice phishing with modern collaboration tools to deploy stealthy malware. Attackers are leveraging Microsoft Teams calls and the remote support tool QuickAssist to bypass security perimeters. By impersonating senior IT staff,…
Critical Emby Server Vulnerability Let Attackers Gain Admin Access
A critical vulnerability has been discovered in Emby Server that allows unauthenticated attackers to gain full administrative access to affected systems. Tracked as CVE-2025-64113 with a severity score of 9.3 out of 10 (CVSS v4), this weakness affects both stable and beta…