CVE-2025-59287 is a critical remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS) affecting versions from Windows Server 2012 through 2025 with the WSUS role enabled. It allows unauthenticated attackers to execute code with system privileges by targeting WSUS instances exposed on ports 8530 and 8531. Initial patches released on October 14, 2025, were incomplete, requiring an emergency update on October 23. Exploitation has been observed shortly after patch release, with attackers using malicious PowerShell commands for reconnaissance and data exfiltration. Approximately 5,500 WSUS instances are exposed globally, posing a significant risk, especially to European organizations. The vulnerability facilitates initial access and lateral movement within networks. Immediate patching and reducing network exposure are critical to mitigate this threat.
A dual cyber campaign targets GlobalProtect VPN portals and SonicWall APIs, aiming to exploit potential weaknesses in these widely used remote access and network security products. The campaign is currently reported with medium severity and has minimal public technical details or known exploits in the wild. Attackers may be attempting to gain unauthorized access or disrupt services by leveraging vulnerabilities or misconfigurations in these platforms. European organizations using GlobalProtect or SonicWall products could face risks to confidentiality and availability if targeted. Mitigation requires focused hardening of VPN portals and API endpoints, including strict access controls, monitoring, and patch management. Countries with significant deployments of these technologies and critical infrastructure reliance, such as Germany, France, and the UK, are more likely to be affected. Given the medium severity and lack of known exploits, the threat should be taken seriously but is not currently critical. Defenders should prioritize detection and response capabilities while awaiting further technical details or patches.
Barts Health NHS has confirmed a data breach linked to the Cl0p ransomware group targeting Oracle E-Business Suite (EBS) systems. The incident involves unauthorized access and exfiltration of sensitive data, impacting healthcare operations and patient confidentiality. Cl0p ransomware is known for exploiting vulnerabilities to deploy ransomware and steal data for extortion. This breach highlights the risks posed by ransomware groups targeting critical healthcare infrastructure. European healthcare organizations using Oracle EBS should be vigilant for similar attacks. Immediate containment, forensic analysis, and enhanced monitoring are critical. The breach poses significant risks to confidentiality and availability of healthcare data. No CVSS score is available, but the threat severity is assessed as high due to the impact and ransomware involvement. Countries with large NHS or Oracle EBS deployments are most at risk. Proactive mitigation and incident response planning are essential to reduce exposure.
A critical vulnerability named React2Shell has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog following confirmed active exploitation. This flaw affects React2Shell, a component presumably related to React or JavaScript environments, enabling attackers to execute arbitrary code remotely. Although specific affected versions and patch links are not provided, the threat is rated critical due to its exploitation in the wild and potential for severe impact. European organizations using affected React2Shell components are at risk of compromise, data breaches, or service disruption. Mitigation requires immediate identification of vulnerable systems, application of vendor patches once available, and enhanced monitoring for exploitation attempts. Countries with significant technology sectors and high adoption of React-based technologies, such as Germany, France, and the UK, are most likely to be impacted. Given the critical severity, ease of exploitation, and active exploitation status, this vulnerability demands urgent attention from cybersecurity teams across Europe.
The FBI has issued a warning about virtual kidnapping scams that leverage altered social media photos to extort victims. Attackers manipulate images to create convincing fake scenarios, claiming to have kidnapped a loved one and demanding ransom payments. These scams rely heavily on social engineering and psychological pressure rather than technical exploits. European organizations and individuals could be targeted due to widespread social media use and the potential for financial extortion. The threat does not involve direct system compromise but poses significant risks to personal security and financial integrity. Mitigation requires public awareness campaigns, verification protocols for ransom claims, and cooperation with law enforcement. Countries with high social media penetration and significant expatriate or immigrant populations may be more vulnerable. Given the ease of exploitation and high impact on victims, the threat severity is assessed as high. Defenders should focus on education, incident response readiness, and monitoring for related fraud attempts.
The Intellexa leaks have exposed zero-day vulnerabilities and an innovative attack vector using advertisements to deliver Predator spyware. This spyware is highly sophisticated, leveraging undisclosed vulnerabilities to infiltrate target systems without detection. The attack vector involves malicious ads that, when interacted with or simply viewed, can trigger the exploitation of zero-day flaws to install spyware. Although no known exploits are currently active in the wild, the potential for targeted espionage and surveillance is significant. European organizations, especially those in sensitive sectors, face elevated risks due to the spyware's stealth and advanced capabilities. Mitigation requires proactive threat hunting, enhanced monitoring of ad traffic, and collaboration with intelligence agencies to detect and block such campaigns. Countries with high adoption of affected platforms and strategic geopolitical importance are most likely targets. Given the high impact on confidentiality and the complexity of detection, this threat is assessed as high severity. Defenders should prioritize awareness, network segmentation, and zero-day vulnerability management to reduce exposure.
Cloudflare experienced a critical outage caused by an emergency patch deployment addressing the React2Shell vulnerability. The incident highlights the risks associated with urgent patching of severe security flaws in widely used web technologies. Although no known exploits are currently active in the wild, the React2Shell vulnerability is considered critical due to its potential impact on confidentiality, integrity, and availability. European organizations relying on Cloudflare services or affected React frameworks may face service disruptions or increased exposure if patches are not applied correctly. Mitigation requires careful testing of emergency patches in staging environments, comprehensive monitoring during deployment, and ensuring fallback mechanisms to minimize downtime. Countries with high Cloudflare adoption and significant web infrastructure, such as Germany, the UK, France, and the Netherlands, are most likely to be impacted. Given the critical nature of the vulnerability and the complexity of emergency patching, the suggested severity is critical. Defenders should prioritize controlled patch management processes and maintain communication with service providers to mitigate risks effectively.
A new variant of the ClayRat Android spyware has been identified, capable of seizing full control over infected devices. This spyware targets Android platforms and is designed to stealthily gain extensive access, potentially compromising user confidentiality, integrity, and device availability. Although no known exploits are currently active in the wild, the variant represents an evolution in spyware capabilities with increased control over the device. European organizations using Android devices are at risk, especially those with sensitive data or high-value targets. Mitigation requires enhanced mobile security hygiene, including restricting app installations to trusted sources, employing mobile threat defense solutions, and monitoring for unusual device behavior. Countries with high Android adoption and significant digital infrastructure, such as Germany, France, and the UK, are more likely to be affected. Given the spyware’s ability to fully control devices without requiring user interaction or authentication, the threat severity is assessed as high. Defenders should prioritize detection and response capabilities tailored to mobile spyware threats.
This is a web-based Server-Side Request Forgery (SSRF) payload generator tool designed to assist penetration testers in fuzzing and testing SSRF vulnerabilities, particularly in PDF generators that may process HTML tags. The tool generates a variety of SSRF payloads using different URI schemes and HTML templates to simulate diverse SSRF attack vectors. It is intended as a testing aid rather than a direct threat or exploit. No known exploits in the wild are associated with this tool, and it does not itself represent a vulnerability but rather a resource to identify SSRF weaknesses. The tool operates client-side without tracking or ads and is shared on a Reddit NetSec forum. While SSRF vulnerabilities can be critical, this tool facilitates their discovery rather than causing harm directly. European organizations using PDF generation software or web applications that process user-supplied URLs should be aware of SSRF risks and use such tools responsibly for security testing. Given the nature of the tool, the severity of the threat it represents is medium, as it requires an existing SSRF vulnerability to be effective and does not itself exploit systems.
This entry discusses the conceptual distinction between whitebox (simulation) and blackbox (red team) phishing approaches, highlighting common misunderstandings that can lead to ineffective phishing campaigns. It is a writeup aimed at clarifying phishing methodologies rather than describing a specific active threat or vulnerability. No direct exploit or attack campaign is detailed, and no affected software versions or known exploits are reported. The content originates from a Reddit NetSec post and serves more as educational or strategic guidance for phishing operations rather than a new or emergent threat. Given the lack of concrete threat indicators or exploit data, this is not a direct security threat but rather an informational discussion on phishing tactics. The severity is marked medium, but this relates to the general impact of phishing as a threat category, not this specific writeup. European organizations should remain vigilant against phishing broadly but this post does not introduce new actionable threat intelligence. Mitigation remains standard anti-phishing best practices. Countries with high phishing incident rates and large digital economies, such as the UK, Germany, and France, remain most relevant to phishing risk overall.
CISA has reported that hackers linked to the People's Republic of China (PRC) are using a malware toolset named BRICKSTORM to maintain persistent, long-term access within U. S.government and critical infrastructure systems. This campaign involves stealthy intrusion techniques aimed at espionage and data exfiltration. Although no known exploits are currently in the wild, the threat is considered high severity due to the advanced persistent threat (APT) nature and potential impact on confidentiality and integrity. European organizations with ties to U. S.entities or similar critical infrastructure sectors may also be targeted or affected. Mitigation requires enhanced network monitoring, strict access controls, and threat hunting focused on detecting BRICKSTORM indicators. Countries with significant U.
Cloudflare recently mitigated a new record-breaking Aisuru attack that peaked at 14.1 Bpps. The post Aisuru Botnet Powers Record DDoS Attack Peaking at 29 Tbps appeared first on SecurityWeek .
JPCERT has confirmed active command injection attacks targeting Array AG Gateway devices. These attacks allow remote adversaries to execute arbitrary commands on vulnerable gateways, potentially leading to full system compromise. The threat is considered high severity due to the critical role these gateways play in network security and traffic management. Although no specific affected versions or patches have been disclosed yet, organizations using Array AG Gateways should be vigilant. The attacks do not currently have known public exploits but are actively observed in the wild. European organizations relying on these gateways for secure remote access and traffic control are at risk of confidentiality, integrity, and availability breaches. Immediate mitigation involves monitoring network traffic for anomalies, restricting access to management interfaces, and applying any forthcoming vendor advisories. Countries with significant deployments of Array AG Gateways and critical infrastructure sectors are more likely to be targeted. Given the ease of exploitation via command injection and the potential for broad impact, the suggested severity is high. Defenders should prioritize detection and containment efforts to prevent lateral movement and data exfiltration.
AutoIT3[1] is a powerful language that helps to built nice applications for Windows environments, mainly to automate tasks. If it looks pretty old, the latest version was released last September and it remains popular amongst developers, for the good… or the bad! Malware written in AutoIt3 has existed since the late 2000s, when attackers realized that the language was easy to learn (close to basic) but can also compiled into standalone PE files! From a malware point of view, such executables make an extended use of packed data, making them more stealthy.
Predator spyware has introduced a new infection vector enabling zero-click attacks, which do not require any user interaction to compromise a target device. This advancement increases the stealth and effectiveness of the spyware, allowing attackers to silently infiltrate devices and exfiltrate sensitive data. Although no known exploits are currently observed in the wild, the high severity rating reflects the potential risk posed by this novel attack method. European organizations, especially those in sectors with high-value targets such as government, defense, and critical infrastructure, could face significant confidentiality and integrity risks. Mitigation requires proactive monitoring for unusual device behavior, applying security updates promptly, and employing advanced endpoint detection solutions capable of identifying zero-click attack patterns. Countries with high adoption of mobile and IoT technologies, and those with strategic geopolitical importance, are more likely to be targeted. Given the ease of exploitation without user interaction and the potential for broad impact, this threat is assessed as high severity. Defenders should prioritize awareness and readiness to detect and respond to such sophisticated spyware threats.
The Ministry of Communications on had asked smartphone makers to install the government’s “Sanchar Saathi” app within 90 days and to prevent users from disabling it. The post India Rolls Back Order to Preinstall Cybersecurity App on Smartphones appeared first on SecurityWeek .
Second order prompt injection attacks targeting ServiceNow's Now Assist involve malicious inputs that are initially benign but later trigger harmful behavior when processed by the AI assistant. These attacks exploit the AI's prompt handling by injecting payloads that activate in subsequent interactions, potentially leading to unauthorized command execution or data leakage. Although no known exploits are currently in the wild, the medium severity rating reflects the risk posed by this novel attack vector. European organizations using ServiceNow Now Assist should be aware of this threat due to its potential impact on confidentiality and integrity. Mitigation requires careful input validation, monitoring AI outputs for anomalous behavior, and restricting AI assistant permissions. Countries with high ServiceNow adoption and critical infrastructure reliance on ITSM platforms, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the attack complexity and lack of authentication bypass, the suggested severity is medium. Defenders should prioritize understanding AI prompt injection risks and implement layered controls to reduce exposure.
