A new vulnerability, tracked as CVE-2025-20393, has been discovered in Cisco's Secure Email Gateway and Secure Email and Web Manager appliances. This zero-day flaw is reportedly being exploited by hackers linked to China, posing a significant risk to organizations using these products. The vulnerability allows attackers to bypass security controls, potentially leading to unauthorized access and data breaches. Companies using these Cisco appliances should prioritize patching and monitoring their systems to mitigate the risks associated with this exploit. The discovery of this flaw is particularly concerning given the ongoing cyber threats targeting critical infrastructure and enterprise environments.
Hackread – Cybersecurity News, Data Breaches, AI, and More
Actively Exploited
A 22-year-old man has been arrested in France following a cyberattack on the Interior Ministry's systems. The hacker claimed to have gained access to sensitive information, including police records, tax data, and criminal histories. This breach raises serious concerns about the security of government systems and the potential misuse of personal data. The incident highlights vulnerabilities within public sector cybersecurity and the ongoing risks posed by cybercriminals targeting sensitive government infrastructure. Authorities are likely to enhance security measures in response to this breach to protect citizen data.
At the Zeroday Cloud hacking competition held in London, cybersecurity researchers were awarded a total of $320,000 for identifying 11 serious remote code execution vulnerabilities in cloud infrastructure components. These vulnerabilities could potentially allow attackers to execute malicious code on affected systems, posing significant risks to cloud service providers and their customers. The event showcased the importance of proactive security measures in cloud computing, as vulnerabilities like these can lead to data breaches and service disruptions. By encouraging the discovery of such flaws, the competition aims to strengthen the overall security of cloud environments. Companies relying on cloud infrastructure should stay vigilant and address any reported vulnerabilities promptly to safeguard their systems.
French authorities have arrested a 22-year-old man in connection with a cyberattack that targeted the Ministry of the Interior earlier this month. The attack raised concerns about the security of sensitive government information and the potential for disruption to public services. While details about the specific nature of the attack have not been disclosed, the incident is significant as it highlights vulnerabilities within government systems. Cyberattacks on public institutions can erode trust in government operations and compromise citizen data. This arrest is part of ongoing efforts by law enforcement to combat cybercrime and ensure the security of critical infrastructure.
The U.S. Department of Justice (DOJ) has announced the takedown of a money laundering platform allegedly used by various cybercriminal groups. A Russian national has been indicted for operating this platform, which facilitated the movement of illicit funds linked to cybercrime activities. This operation underscores the ongoing efforts by law enforcement to disrupt financial networks that support cybercriminal enterprises. By taking down such platforms, authorities aim to hinder the operations of hackers and scammers who rely on these services to convert stolen funds into usable currency. The action is part of a broader strategy to combat cybercrime and protect victims from financial fraud.
Attackers are exploiting WhatsApp's device-linking feature to hijack user accounts in a campaign known as GhostPairing. This method relies on pairing codes that are supposed to allow users to link devices securely. However, malicious actors are taking advantage of this feature to gain unauthorized access to accounts. This situation affects WhatsApp users, as their personal messages and information can be compromised. Users should be vigilant about sharing their pairing codes and consider enhancing their account security with two-factor authentication to prevent such attacks.
Cisco has issued a warning regarding a serious zero-day vulnerability in its AsyncOS software that is currently being exploited in the wild. This flaw affects Cisco's Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances, leaving customers vulnerable to potential attacks. The zero-day has been classified with maximum severity, indicating the urgency for organizations using these products to take action. As of now, there are no patches available to address this vulnerability, which raises concerns about the security of email communications for affected users. Companies that rely on these Cisco products should closely monitor their systems and implement any available security measures to mitigate risks until a fix is released.
A new botnet named Kimwolf has compromised around 1.8 million Android-based devices, including TVs, set-top boxes, and tablets. Researchers from QiAnXin XLab report that this botnet may be linked to another one known as AISURU. Kimwolf is built using the Native Development Kit (NDK), which allows attackers to control these devices and use them for large-scale distributed denial-of-service (DDoS) attacks. This incident raises concerns about the security of smart devices, as many consumers may not realize their equipment can be hijacked in this way. Users of affected devices should be vigilant and consider measures to secure their systems against such threats.
SonicWall has issued a warning regarding a newly discovered vulnerability in the SMA1000 Appliance Management Console (AMC) that is being exploited in zero-day attacks. This vulnerability allows attackers to escalate privileges, potentially giving them unauthorized access to sensitive systems. Organizations using SonicWall's SMA1000 appliances need to take immediate action to protect their networks. The company advises users to apply patches as soon as possible to mitigate the risk associated with this security flaw. The urgency of this situation is heightened by the fact that the vulnerability is currently being actively exploited in the wild, making prompt remediation essential for affected users.
A serious vulnerability in the Motors WordPress theme has been discovered, which affects over 20,000 websites. This flaw allows low-privileged users to gain full administrative control of the affected sites. As a result, attackers could exploit this weakness to alter site content, steal sensitive information, or even take the site offline. Website owners using this theme should take immediate action to secure their sites and prevent unauthorized access. The issue underlines the importance of regularly updating themes and plugins to protect against potential security risks.
SonicWall has issued a hotfix for a local privilege escalation vulnerability, identified as CVE-2025-40602, that affects its Secure Mobile Access (SMA) 1000 appliances. This flaw is currently being exploited by attackers, particularly in combination with another vulnerability, CVE-2025-23006, which allows for unauthenticated remote code execution with root privileges. Organizations using SMA 1000 appliances are at risk, as this could enable unauthorized access and control over their systems. SonicWall is urging all customers to apply the patch promptly to mitigate the risk of exploitation. The situation highlights the ongoing need for vigilance and timely updates in cybersecurity practices.
A ransomware group has taken advantage of a serious vulnerability in React2Shell, identified as CVE-2025-55182, to infiltrate corporate networks. Once they gain access, they deploy their file-encrypting malware in under a minute, making the attack extremely swift and damaging. This incident highlights the urgency for organizations to address this vulnerability, as it poses a significant risk to corporate data security. Companies using systems that incorporate React2Shell need to remain vigilant and take immediate action to protect their networks from potential exploitation. The rapid nature of these attacks underlines the necessity for robust security measures and timely updates.
Researchers have identified a new attack method called 'Lies-in-the-Loop' (LITL) that targets agentic AI systems by manipulating the prompts these systems use to obtain human approval. This technique can lead to compromised decision-making processes within these AI applications, raising concerns about their reliability and safety. As AI systems become more integrated into various sectors, including healthcare and finance, the implications of such vulnerabilities could be significant, potentially leading to harmful outcomes or misinformed decisions. The discovery emphasizes the need for enhanced security measures in AI development to prevent exploitation of these weaknesses. Developers and organizations utilizing AI should be aware of this risk and take steps to fortify their systems against such manipulative tactics.
In the React2Shell incident, the emergence of non-functional proof-of-concept (PoC) exploits has caused confusion among security professionals. These PoCs are often trivial and do not pose real threats, yet they can create a misleading sense of security among users. The challenge lies in managing the influx of these PoCs, as they can distract from genuine vulnerabilities that require attention. This situation underscores the need for clearer communication within the cybersecurity community to differentiate between serious threats and those that are merely theoretical. Users and organizations must remain vigilant and not let the presence of ineffective PoCs give them a false sense of safety.
French prosecutors are investigating a suspected cyberattack on the GNV ferry Fantastic, which operates between Sète, France, and North Africa. Authorities are particularly concerned about the possibility of a remote hijack, indicating that attackers may have attempted to gain control over the vessel's systems. The investigation is ongoing, and details about how the attack was executed or the extent of the compromise have not been disclosed yet. This incident raises alarms about the security of maritime transportation, highlighting vulnerabilities that could potentially threaten passenger safety and disrupt services. The situation is being closely monitored as more information becomes available.