> TODAY'S SUMMARY (14 articles)
Today's cybersecurity news highlights several critical developments. Scammers are leveraging replies to unsolicited texts to confirm active phone numbers, increasing the risk of fraud. A significant cyberattack utilized 51 AI agents to compromise 429 WordPress sites and steal sensitive Ukrainian data in just over a minute. Additionally, low-cost Android phones are being shipped with pre-installed malware, turning them into tools for ad fraud and other malicious activities. Mozilla has launched Firefox Enterprise, offering enhanced management tools for organizations, while VMware's patch management concerns indicate a growing need for better security tools. Lastly, Booz Allen's AI models successfully navigated all defined attack objectives in a controlled test, showcasing the evolving capabilities of AI in cybersecurity.
|
// AI-powered summary generated at 08:01
Patched in September, the SessionReaper bug could be exploited without authentication to bypass a security feature.
The post Exploitation of Critical Adobe Commerce Flaw Puts Many eCommerce Sites at Risk appeared first on SecurityWeek.
As machine identities explode across cloud environments, enterprises report dramatic productivity gains from eliminating static credentials. And only legacy systems remain the weak link.
For decades, organizations have relied on static secrets, such as API keys, passwords, and tokens, as unique iden...
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)Â added a Motex LANSCOPE flaw, tracked as CVE-2025-61932 (CVSS v4 score of 9.3), to its Known Exploited...
This is part of its broader push to fight impersonation and fraud, after removing more than 21,000 fake customer-support pages from Facebook.
The vulnerabilities allow attackers to predict source ports and query IDs BIND will use, and to inject forged records into the cache.
The post BIND Updates Address High-Severity Cache Poisoning Flaws appeared first on SecurityWeek.
Amped FIVEâs latest update boosts workflow consistency, version control, and evidence insight.
Trend Micro believe security teams should anticipate increased Vidar 2.0 prevalence in campaigns through Q4 2025
Global smishing activity tracked by Unit 42 includes impersonation of many critical services. Its unique ecosystem allows attackers to quickly scale.
The post The Smishing Deluge: China-Based Campaign Flooding Global Text Messages appeared first on Unit 42.
The Continuous Diagnostics and Mitigation program is oft-praised, but there are areas where it doesnât yet excel, as a recent CISA emergency directive shows.
The post F5 vulnerability highlights weak points in DHSâs CDM program appeared first on CyberScoop.
The China-linked operation has grown from a phishing kit marketplace into an active and growing community supporting a decentralized large-scale phishing ecosystem.
The post Researchers track surge in high-level Smishing Triad activity appeared first on CyberScoop.
Cisco Talos Incident Response observed a surge in attacks exploiting public-facing applications â mainly via ToolShell targeting SharePoint â for initial access, with post-exploitation phishing and evolving ransomware tactics also persisting this quarter.
TL;DR
AI-powered vulnerability remediation often fails because it lacks context about how your applications actually work. Runtime intelligence solves this by providing AI with real-world application behavior data, architecture insights, and dependency information. This context-aware approach...
The bug has been exploited in the wild as a zero-day and the US cybersecurity agency CISA has added it to its KEV catalog.
The post Lanscope Endpoint Manager Zero-Day Exploited in the Wild appeared first on SecurityWeek.
The Universe Browser is believed to have been downloaded millions of times. But researchers say it behaves like malware and has links to Asiaâs booming cybercrime and illegal gambling networks.
Criminal outfits had been using Musk's broadband beacons to run cyber-slavery scams across Southeast Asia SpaceX says it has shut down thousands of Starlink terminals that were powering Myanmar's notorious scam compounds after its satellite network was found to be keeping human trafficking and cyber...
Hackers exploit CVE-2025-54236 in Adobe Commerce and Magento to hijack accounts via REST API. Over 250 attacks in 24 hours. E-commerce security company Sansec researchers warn that threat actors are exploiting a critical flaw in Adobe Commerce and Magento, tracked as CVE-2025-54236 (CVSS 9.1), to hi...
Verizonâs 2025 Mobile Security Index shows that 85% of organizations believe mobile device attacks are on the rise.
The post Mobile Security: Verizon Says Attacks Soar, AI-Powered Threats Raise Alarm appeared first on SecurityWeek.
Cybersecurity researchers have shed light on a cybercriminal group called Jingle Thief that has been observed targeting cloud environments associated with organizations in the retail and consumer services sectors for gift card fraud.
"Jingle Thief attackers use phishing and smishing to steal credent...
AuditBoard has reached a definitive agreement to acquire FairNow. The addition of FairNow enhances AuditBoardâs capabilities with intelligent, automated, step-by-step AI compliance guidance. As AI governance requirements expand globally, AuditBoard customers are now uniquely positioned to maintain c...
The attack on Jaguar Land Rover costs the UK economy $2.5B, marking its most damaging cyber incident, says CMC. In early September, Jaguar Land Rover shut down systems to mitigate a cyberattack that disrupted production and retail operations. The attack also impacted systems at the Solihull producti...