The hacking group Crimson Collective has claimed the theft of personal information pertaining to over 1 million Brightspeed customers. The post Brightspeed Investigating Cyberattack appeared first on SecurityWeek .
Recently, a new "breed" of IP-based KVM devices has been released. In the past, IP-based KVM devices required dedicated "server-grade" hardware using IPMI. They often cost several $100 per server, and are only available for specific systems that support the respective add-on cards. These cards are usually used to provide "Lights Out" access to servers, allowing a complete reboot and interaction with the pre-boot environment via simple web-based tools. In some cases, these IPMI tools can also be used via various enterprise/data center management tools.
Hackers have compromised a file transfer system at Sedgwick’s subsidiary that serves government agencies. The post Sedgwick Confirms Cyberattack on Government Subsidiary appeared first on SecurityWeek .
CVE-2025-14346 is a critical vulnerability affecting WHILL Model C2 Electric Wheelchairs and Model F Power Chairs, where Bluetooth connections lack authentication. An attacker within Bluetooth range can pair with the device without credentials or user interaction, allowing full control over movement commands, speed settings, and configuration profiles. This vulnerability poses severe risks to user safety and privacy. The CVSS score is 9.8, reflecting high impact on confidentiality, integrity, and availability. No patches are currently available, and no exploits have been observed in the wild yet. European organizations involved in healthcare, rehabilitation centers, and mobility services using these devices are at risk. Mitigation requires disabling Bluetooth when not in use, physical security controls, and close coordination with the vendor for firmware updates. Countries with higher adoption of assistive mobility devices and strong healthcare infrastructure, such as Germany, France, the UK, and the Netherlands, are likely most affected. Immediate attention is critical to prevent potential harm to vulnerable users.
The 2-million-device-strong botnet allows monetization through DDoS attacks, app installs, and the selling of proxy bandwidth. The post Kimwolf Android Botnet Grows Through Residential Proxy Networks appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 5th January, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Two US banks, Artisans’ Bank and VeraBank, disclosed that customer data was exposed in an August ransomware attack on their vendor, Marquis Software. The vendor was breached via SonicWall vulnerability, and while […] The post 5th January – Threat Intelligence Report appeared first on Check Point Research .
WhatsApp device fingerprinting can be useful in the delivery of sophisticated spyware, but impact is very limited without a zero-day. The post Researcher Spotlights WhatsApp Metadata Leak as Meta Begins Rolling Out Fixes appeared first on SecurityWeek .
CVE-2025-15240 is a high-severity vulnerability in the QOCA aim AI Medical Cloud Platform by Quanta Computer. It allows authenticated attackers to upload arbitrary files, including web shells, leading to remote code execution on the server. The flaw stems from unrestricted file upload handling (CWE-434), enabling attackers to bypass file type restrictions. Exploitation requires authentication but no user interaction, and the vulnerability has a CVSS 4.0 score of 8.7, indicating a significant risk. No public exploits are currently known. European healthcare organizations using this platform could face data breaches, service disruption, and regulatory penalties. Mitigation involves implementing strict file validation, restricting upload permissions, and monitoring for suspicious activity. Countries with advanced healthcare IT infrastructure and known deployment of Quanta Computer products, such as Germany, France, and the UK, are most at risk.
CVE-2025-15239 is a high-severity SQL Injection vulnerability in the QOCA aim AI Medical Cloud Platform by Quanta Computer. It allows authenticated remote attackers to inject arbitrary SQL commands to read sensitive database contents. The vulnerability requires low attack complexity and no user interaction but does require authentication with limited privileges. Exploitation could lead to unauthorized disclosure of confidential medical data, impacting patient privacy and healthcare operations. No public exploits are currently known, and no patches have been released yet. European healthcare organizations using this platform are at risk, especially those with significant deployments of Quanta Computer solutions. Mitigation involves strict input validation, parameterized queries, and enhanced authentication controls. Countries with advanced healthcare infrastructure and AI medical platform adoption, such as Germany, France, and the UK, are most likely to be affected. Immediate attention is needed to prevent data breaches and maintain compliance with data protection regulations like GDPR.
CVE-2025-15238 is a high-severity SQL Injection vulnerability in the QOCA aim AI Medical Cloud Platform by Quanta Computer. It allows authenticated remote attackers with low privileges to inject arbitrary SQL commands, enabling unauthorized reading of database contents. The vulnerability requires no user interaction and can be exploited over the network. Although no known exploits are currently in the wild, the flaw poses a significant risk to the confidentiality of sensitive medical data. The vulnerability affects version 0 of the platform and has a CVSS 4.0 base score of 7.1. European healthcare organizations using this platform could face data breaches and compliance violations. Mitigation requires immediate patching once available, strict input validation, and enhanced access controls. Countries with high adoption of Quanta Computer medical solutions and strong healthcare sectors, such as Germany, France, and the UK, are most at risk.
CVE-2025-43706 is a high-severity vulnerability affecting multiple Samsung Exynos processors used in mobile devices, wearables, and modems. The flaw arises from incorrect handling of RRC (Radio Resource Control) packets at the L2 layer, which can be exploited remotely without authentication or user interaction to cause a Denial of Service (DoS). This vulnerability impacts the availability of affected devices by potentially crashing or disabling network connectivity. Although no known exploits are currently reported in the wild, the ease of exploitation and broad device usage pose a significant risk. European organizations relying on Samsung-based mobile and IoT devices could face operational disruptions, especially in sectors dependent on continuous connectivity. Mitigation requires close collaboration with device manufacturers for firmware updates and network-level protections. Countries with high Samsung device penetration and advanced mobile infrastructure, such as Germany, France, the UK, Italy, and Spain, are most likely to be affected. Given the vulnerability’s characteristics, the severity is assessed as high, emphasizing the need for proactive defense measures.
CVE-2025-49495 is a high-severity buffer overflow vulnerability in the WiFi driver of Samsung Mobile Processors Exynos 1380, 1480, 2400, and 1580. It arises from improper handling of NL80211 vendor commands, allowing an attacker with local access to potentially execute arbitrary code or cause denial of service without requiring user interaction or privileges. The vulnerability impacts confidentiality, integrity, and availability of affected devices. No known exploits are currently reported in the wild. European organizations using devices with these Exynos processors, especially in sectors relying on mobile communications, may face risks if unpatched. Mitigation involves applying vendor patches once available, restricting local access to WiFi driver interfaces, and monitoring for anomalous device behavior. Countries with high Samsung mobile device penetration and critical infrastructure reliance on mobile connectivity, such as Germany, France, and the UK, are most likely affected. Given the ease of exploitation and broad impact, the threat severity is high.
CVE-2025-52515 is a medium severity vulnerability affecting the issimian device driver in Samsung Mobile and Wearable Processors (Exynos 1330, 1380, 1480, 2400, 1580, 2500). It arises from a race condition causing out-of-bounds memory access, resulting in denial of service (DoS). The vulnerability requires local access with high attack complexity and no privileges or user interaction. While it does not impact confidentiality or integrity, it can disrupt device availability. No known exploits are currently reported in the wild, and no patches have been published yet. European organizations using devices with these processors, especially in sectors relying on mobile and wearable technology, could face operational disruptions. Mitigation involves monitoring for vendor patches, restricting local access to trusted users, and applying strict device usage policies. Countries with high Samsung device adoption and advanced mobile infrastructure, such as Germany, France, and the UK, are most likely affected. The vulnerability’s medium severity reflects its limited scope and exploitation difficulty but notable impact on availability.
The ShinyHunters threat actor claims to have breached US cybersecurity firm Resecurity, allegedly gaining internal access as evidenced by screenshots shared publicly. This breach involves unauthorized access to sensitive internal systems of a cybersecurity company, which could expose confidential client data and internal security methodologies. Although detailed technical specifics and affected versions are not disclosed, the breach is considered high severity due to the nature of the victim and potential data sensitivity. No known exploits or patches are currently available, and the discussion around this incident remains minimal. European organizations relying on Resecurity’s services or sharing threat intelligence with them could face indirect risks from this breach. Mitigation requires heightened vigilance around any data or communications linked to Resecurity, enhanced monitoring for suspicious activity, and verification of the integrity of shared threat intelligence. Countries with strong cybersecurity sectors and significant use of Resecurity’s services, such as the UK, Germany, and France, are more likely to be impacted. Given the breach involves unauthorized internal access without known exploitation details, the suggested severity is high due to potential confidentiality and integrity impacts and the strategic importance of the victim. Defenders should prioritize incident response readiness and scrutinize any data originating from Resecurity until further details emerge.
The RondoDox botnet is actively exploiting the React2Shell vulnerability to compromise thousands of unpatched devices. This threat leverages a known code execution flaw to hijack vulnerable systems, primarily targeting those that have not applied available patches. While exploitation in the wild is not yet widely confirmed, the botnet's activity indicates a growing risk of large-scale device compromise. European organizations with unpatched infrastructure are at risk of device hijacking, leading to potential service disruption and data integrity issues. The threat is medium severity but could escalate if exploitation becomes widespread. Mitigation requires immediate patching of affected systems and enhanced network monitoring for unusual botnet-related traffic. Countries with high IoT and enterprise device usage, especially those with historically targeted sectors, are more likely to be affected. The threat does not require user interaction but targets unpatched systems, increasing its potential impact. Defenders should prioritize vulnerability management and incident response readiness to mitigate this evolving botnet threat.
During the Christmas holiday period, thousands of exploit attempts targeting ColdFusion servers were detected, indicating heightened attacker activity against this platform. Although no specific affected versions or CVEs were detailed, the volume and timing suggest attackers are actively scanning and attempting to exploit known or unknown vulnerabilities in ColdFusion installations. No confirmed exploits in the wild have been reported yet, but the high number of attempts raises concern for organizations running ColdFusion, especially those with exposed or unpatched systems. European organizations using ColdFusion for web applications or internal services could face increased risk of compromise, data breaches, or service disruption. Mitigation requires immediate review of ColdFusion server configurations, patching to the latest supported versions, and enhanced monitoring for suspicious activity. Countries with significant ColdFusion usage in government, finance, or critical infrastructure sectors, such as Germany, France, and the UK, are likely more exposed. Given the ease of exploitation attempts and potential impact on confidentiality and availability, the threat severity is assessed as high. Defenders should prioritize detection and response capabilities to mitigate potential exploitation during this period of increased attacker activity.
