VulnHub

A serious vulnerability in Dolby's software for Android devices has been identified, tracked as CVE-2025-54957. Discovered by Google researchers in October 2025, this flaw could potentially allow attackers to exploit the Dolby audio processing capabilities on affected devices. Users of Android devices utilizing Dolby technology should be particularly cautious, as the vulnerability poses risks to their audio functionality and overall device security. Immediate action is recommended to ensure that devices are updated to the latest software versions that include the necessary patches to fix this issue. This discovery emphasizes the need for regular updates and vigilance among users and security teams alike.

A serious vulnerability has been found in n8n, an open-source workflow automation platform, which could allow authenticated users to run arbitrary system commands on the server. This vulnerability, identified as CVE-2025-68668, has a high severity score of 9.9 according to the CVSS system, indicating a significant risk. It stems from a failure in the protection mechanisms that should keep the system secure. Users of n8n should be particularly concerned as this issue could lead to unauthorized control over their systems. The affected versions include all versions prior to the patch that addresses this vulnerability, making it crucial for users to update their installations promptly to prevent potential exploitation.

Email continues to be the main entry point for cyber attackers, with significant increases in various types of email threats. Malware delivered through email surged by over 130% year-over-year, while phishing scams rose by more than 20% and other scams increased by 30%. These alarming trends expose vulnerabilities across different industries, indicating that many security teams are still missing critical gaps in their defenses. As attackers increasingly exploit email for impersonation and account takeover, companies must reassess their email security strategies to better protect sensitive information and prevent breaches. The growing reliance on email as a communication tool makes it essential for organizations to prioritize security measures in this area.

A serious security flaw known as 'MongoBleed' has been identified in MongoDB servers, allowing attackers who are not authenticated to access sensitive information like passwords and tokens. This vulnerability is currently being exploited in the wild, raising significant concerns for organizations using MongoDB. The issue stems from a memory leak that can be exploited by attackers to extract confidential data directly from the servers. Companies running affected versions of MongoDB should prioritize patching their systems to mitigate the risk of unauthorized data access. Given the potential for serious data breaches, immediate action is essential for any organization relying on MongoDB for data storage.

Flights in Greece were grounded for several hours due to a communication issue reported on multiple air traffic control channels. Initially, there were concerns about a potential cyberattack causing the disruption, but authorities have since deemed that scenario unlikely. The noise interference led to significant delays and cancellations, affecting travelers across the country. The incident raises questions about the reliability of air traffic communication systems and the importance of maintaining secure and functional infrastructure. While the immediate cause was not linked to malicious activity, it serves as a reminder of the vulnerabilities within critical communication networks.

Sedgwick has confirmed that hackers have breached a file transfer system within its subsidiary that caters to government agencies. This compromise raises serious concerns about the security of sensitive data handled by the subsidiary, as it primarily deals with information from various government entities. The incident highlights ongoing vulnerabilities in systems that support critical infrastructure and public services. As investigations continue, the extent of data accessed or stolen remains unclear. This attack serves as a reminder for organizations, especially those dealing with government contracts, to bolster their cybersecurity measures to protect against similar threats.

The article discusses ongoing cyber espionage activities by China and Russia targeting the United States' critical infrastructure and government networks. China is reportedly stealing sensitive information and embedding tools into key systems, allowing for future leverage against the U.S. Similarly, Russia is ramping up its operations to test the resilience of American infrastructure. This situation poses significant risks not only to national security but also to the integrity of essential services that millions of people rely on. Experts emphasize the urgent need for stronger cybersecurity measures to protect against these persistent threats.

Disney has agreed to pay a $10 million settlement with the Department of Justice (DOJ) and the Federal Trade Commission (FTC) for violating children's privacy laws on YouTube. The charges stem from breaches of the Children's Online Privacy Protection Act (COPPA), which mandates strict guidelines on how companies can collect and manage data from children under 13. This settlement is significant as it not only holds Disney accountable but also emphasizes the importance of protecting children's data online. In response to these violations, Disney is implementing new rules to ensure compliance with COPPA and better safeguard children's privacy. This incident serves as a reminder to all companies about the critical need to adhere to privacy regulations, especially when dealing with vulnerable populations like children.

Resecurity recently caught a group known as ShinyHunters, also referred to as Scattered Lapsus$ Hunters, using decoy accounts to target various sectors including airlines, telecommunications, and law enforcement in September 2025. This detection took place through a honeypot operation, where fake accounts were set up to lure attackers. The activities of ShinyHunters are concerning as they indicate a growing trend of sophisticated cyber attacks aimed at critical industries. The group is known for stealing sensitive data and selling it on the dark web, which poses significant risks to both organizations and individuals. Resecurity's findings emphasize the need for enhanced cybersecurity measures across these sectors to prevent future breaches.

The latest Security Affairs Malware newsletter outlines several concerning cybersecurity incidents. Notably, the Evasive Panda APT group has been reported to poison DNS requests to deploy MgBot, a type of malware. Additionally, there is a spear-phishing campaign that targets U.S. and allied manufacturing and healthcare organizations by exploiting vulnerabilities in the npm registry. Furthermore, details have emerged about a supply chain incident involving EmEditor, where information-stealing malware has been distributed. These incidents demonstrate the ongoing threat posed by sophisticated cyber actors, particularly in sectors critical to national security and public health.

A cargo ship named Fitburg has been detained by Finnish authorities following the severing of an undersea internet cable connecting Finland and Estonia. Two crew members were arrested after investigators discovered sanctioned steel on board. Authorities are now looking into whether the cable break was a result of an accident or a deliberate act that could be linked to hybrid warfare tactics. This incident raises concerns about potential threats to critical infrastructure and the security of internet communications in the region, highlighting the vulnerabilities of undersea cables that are essential for global connectivity.

The European Space Agency (ESA) has confirmed a data breach after a hacker, known as '888', attempted to sell stolen data online. The breach involved external science servers, raising concerns about the security of sensitive information related to ESA's projects. This incident highlights the risks that organizations face from cybercriminals looking to exploit vulnerabilities for financial gain. The ESA's acknowledgment of the breach indicates that they are taking steps to address the situation, but the full scope of the data compromised remains unclear. As this breach could potentially affect ongoing scientific research and collaborations, it underscores the need for robust cybersecurity measures in institutions handling critical data.

The RondoDox botnet has been identified exploiting a serious vulnerability known as React2Shell (CVE-2025-55182) to compromise Next.js servers. This flaw allows attackers to inject malware and cryptominers into systems that have not been properly secured. Organizations using Next.js frameworks are particularly at risk, as the botnet targets these servers directly. This incident underscores the necessity for companies to regularly update their software and apply security patches to prevent such attacks. The ongoing exploitation of this vulnerability poses significant risks to data integrity and can lead to unauthorized resource usage, impacting both performance and costs for affected users.

IBM has identified a serious vulnerability in its API Connect software, classified as CVE-2025-13915. Rated 9.8 out of 10 on the CVSS scale, this flaw allows remote attackers to bypass authentication, potentially granting them unauthorized access to the application. This issue poses a significant risk to organizations using API Connect, as it could lead to data breaches and other malicious activities. Users of the software are advised to take immediate action to protect their systems. With this vulnerability being so critical, it is essential for companies to stay informed and apply any necessary updates or patches as soon as they become available.

IBM has issued a warning about a serious authentication bypass vulnerability in its API Connect platform. This flaw could allow attackers to gain unauthorized access to applications remotely, putting sensitive data at risk. Businesses using this enterprise tool should prioritize applying the necessary patches to safeguard their systems. The vulnerability affects various versions of the API Connect platform, making it critical for companies to act swiftly to prevent potential breaches. Ignoring this issue could lead to significant security incidents and data compromises.