The US is shifting its cyber strategy to focus on influencing adversary behavior through consequences and aggressive responses. This change indicates a more offensive approach to cybersecurity, emphasizing the need for proactive measures against potential threats.
Latest Cybersecurity Threats
Real-time threat intelligence from trusted sources
Actively Exploited
A critical unauthenticated remote code execution vulnerability, identified as CVE-2025-61757, has been discovered in Oracle Identity Manager. This flaw poses significant risks as it may be exploited as a zero-day, allowing attackers to execute arbitrary code without authentication.
The GridEx VIII exercise saw participation from over 370 organizations, marking a significant increase of nearly 50% from the previous iteration two years ago. This highlights a growing recognition of the importance of cybersecurity in both cyber and physical grid security among various stakeholders.
Google has updated its Quick Share service to enable compatibility with Apple's AirDrop, facilitating easier file sharing between Android and iPhone devices. This feature is currently available for the Pixel 10 lineup and is expected to expand to other devices in the future.
SonicWall has addressed high-severity vulnerabilities in its firewalls and email security appliances that could lead to denial-of-service attacks, arbitrary code execution, or unauthorized file access. The urgency of these patches highlights the critical nature of securing network infrastructure against potential exploitation.
Actively Exploited
CISA has added CVE-2025-61757, a critical vulnerability in Oracle Fusion Middleware, to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation. This vulnerability poses significant risks to federal networks, prompting CISA to urge timely remediation by all organizations to mitigate potential cyberattacks.
Chinese cyberspies, identified as APT24, are using supply chain attacks to deploy a malware known as 'BadAudio'. This poses a significant threat as it allows for the installation of additional malicious payloads, highlighting the growing sophistication of cyber espionage tactics.
SquareX has alleged a vulnerability in the Comet browser that allows for the execution of local commands through a hidden API, while Perplexity disputes these claims, labeling the research as fake. This disagreement highlights potential security concerns regarding the Comet browser and the credibility of vulnerability disclosures in the cybersecurity community.
Why IT Admins Choose Samsung for Mobile Security
The Hacker News
IT admins face the challenge of securing corporate data while maintaining employee productivity in a mobile environment. Samsung is increasingly chosen by enterprises for its mobile security solutions, addressing the need for effective protection against risks associated with mobile devices.
Critical
APT24 Deploys BADAUDIO in Years-Long Espionage Hitting Taiwan and 1,000+ DomainsThe Hacker News
Actively Exploited
APT24, a China-nexus threat actor, has been deploying a new malware called BADAUDIO to maintain persistent access to compromised networks over a nearly three-year espionage campaign. This shift to more sophisticated attack vectors poses significant risks to targeted entities, particularly in Taiwan and over 1,000 domains.
Runlayer has recently emerged from stealth mode after four months of operation, securing $11 million in funding. The company has already acquired dozens of customers, including eight unicorns, indicating strong market interest and potential impact in the cybersecurity landscape.
The article discusses the ToddyCat APT attacks that target corporate email systems, highlighting the use of advanced tools like TomBerBil, TCSectorCopy, and XstReader. The severity of these attacks lies in their method of stealing access tokens from Outlook, posing significant risks to corporate security.
Actively Exploited
The ShinyHunters hackers have successfully compromised Salesforce instances through vulnerabilities in customer-managed Gainsight applications, leading to significant data theft. This incident highlights the critical need for enhanced security measures in integrations between third-party applications and major platforms like Salesforce.
The SEC has dropped its lawsuit against SolarWinds and its CISO Timothy G. Brown, which accused the company of misleading investors regarding its security practices related to the 2020 supply chain attack. This decision marks the end of a lengthy scrutiny period, raising questions about accountability in cybersecurity practices within major firms.
Salesforce has detected unusual activity linked to Gainsight applications that may have led to unauthorized access to customer data. The company has responded by revoking all active access to mitigate potential risks.