Google shipped Chrome 142 to fix CVE-2025-13223, a V8 type confusion bug exploited in the wild and likely tied to a commercial spyware operator, according to Google TAG. Enterprises should push the update across all Chromium-based browsers, enable site isolation, and monitor for suspicious renderer crashes or unexpected child processes that can indicate V8 exploitation.
Source: SecurityWeek
CISA orders rapid fixes for exploited Fortinet FortiWeb flaw
US federal agencies have one week to patch a critical, actively exploited path traversal vulnerability in Fortinet FortiWeb (CVE-2025-64446). Internet-facing WAF appliances are being targeted; organizations should update immediately, hunt for post-exploitation webshells, and restrict management interfaces to trusted networks.
Source: The Record by Recorded Future
Logitech confirms breach tied to third‑party zero‑day; Cl0p claims responsibility
Logitech disclosed that attackers exploited a zero‑day in a third‑party software platform to copy data from internal systems, aligning with earlier claims from the Cl0p group linked to Oracle E‑Business Suite. The incident underscores escalating supply‑chain risk; review exposure of partner integrations, rotate credentials, and watch for targeted phishing leveraging stolen contact data.
Source: SecurityWeek
Microsoft blocks record 15.7 Tbps DDoS against Azure
Azure DDoS Protection mitigated the largest cloud DDoS observed to date, peaking at 15.72 Tbps and 3.64 billion pps, attributed to the Aisuru/TurboMirai botnet. The scale highlights the need for layered DDoS defenses, pre‑provisioned mitigation with your cloud provider, and hardening of home/IoT devices frequently conscripted into these botnets.
Source: Security Affairs
Dutch police seize 250 servers in bulletproof hosting takedown
Netherlands authorities dismantled a criminal bulletproof hosting hub linked to more than 80 cybercrime investigations since 2022, seizing 250 servers. Expect threat actors to migrate infrastructure and rebrand quickly; update blocklists, track DNS and ASN shifts, and validate detections for known malware families that relied on this hosting.
Source: Security Affairs
Five plead guilty in scheme placing North Korean IT workers at US firms
US prosecutors secured guilty pleas from five individuals who helped DPRK workers bypass hiring controls and funnel proceeds to sanctioned entities. Companies should tighten remote hiring and contractor vetting with device attestation, identity proofing, geo‑risk controls, and continuous user behavior monitoring to detect proxy use and account sharing.
Source: SecurityWeek
Iran‑linked UNC1549 targets aerospace/defense via third‑party access and custom tools
Mandiant reports UNC1549 abused trusted relationships and VDI breakouts to breach high‑maturity targets, then used DLL search‑order hijacking and custom tooling (e.g., TWOSTROKE, LIGHTRAIL) for persistence, tunneling, and DCSync‑style credential theft. Defenders should harden vendor access paths, monitor for Azure Web Apps C2, detect abnormal DC password resets and DCSync events, and restrict RDP/PowerShell remoting.
Source: Google Cloud Threat Intelligence (Mandiant)
You May Also Be Interested In...
Widespread Exploitation of XWiki Vulnerability ObservedIranian Hackers Target Defense and Government Officials in Ongoing Campaign
Critical Imunify360 AV vulnerability threatens widespread website compromise