Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. F5 Breach Exposes BIG-IP Source Code — Nation-State Hackers Behind Massive Intrusion
Published: 2025-10-15
U.S. cybersecurity company F5 disclosed that unidentified threat actors broke into its systems and stole files containing some of BIG-IP’s source code and information related to undisclosed vulnerabilities, attributing the activity to a highly sophisticated nation-state threat actor with long-term persistent access.
2. Over 100 VS Code Extensions Exposed Developers to Hidden Supply Chain Risks
Published: 2025-10-15
New research uncovered that publishers of over 100 Visual Studio Code extensions leaked access tokens that could be exploited by bad actors to update the extensions, posing a critical software supply chain risk to a cumulative 150,000 install base.
3. Two New Windows Zero-Days Exploited in the Wild — One Affects Every Version Ever Shipped
Published: 2025-10-15
Microsoft released fixes for 183 security flaws, including three vulnerabilities under active exploitation, with two Windows zero-days affecting every version, as support for Windows 10 ends unless enrolled in the Extended Security Updates program.
4. Two CVSS 10.0 Bugs in Red Lion RTUs Could Hand Hackers Full Industrial Control
Published: 2025-10-15
Cybersecurity researchers disclosed two critical security flaws in Red Lion Sixnet remote terminal unit products that allow unauthenticated attackers to execute commands with root privileges, impacting industrial automation in sectors like energy and manufacturing.
5. Hackers Target ICTBroadcast Servers via Cookie Exploit to Gain Remote Shell Access
Published: 2025-10-15
A critical security flaw in ICTBroadcast versions 7.4 and below enables unauthenticated remote code execution through improper input validation of session cookie data, with approximately 200 online instances exposed to active exploitation.
6. New SAP NetWeaver Bug Lets Attackers Take Over Servers Without Login
Published: 2025-10-15
SAP rolled out fixes for 13 security issues, including a maximum-severity deserialization vulnerability in NetWeaver AS Java that allows unauthenticated attackers to execute arbitrary OS commands via the RMI-P4 module.
7. Chinese Hackers Exploit ArcGIS Server as Backdoor for Over a Year
Published: 2025-10-14
Chinese state-sponsored hacking group Flax Typhoon compromised an ArcGIS system and turned it into a backdoor for more than a year by modifying a Java server object extension into a web shell with hardcoded access controls embedded in system backups.
8. RMPocalypse: Single 8-Byte Write Shatters AMD’s SEV-SNP Confidential Computing
Published: 2025-10-14
AMD released fixes for a security flaw called RMPocalypse that exploits incomplete protections in the Reverse Map Paging table, allowing a single memory write to undermine Secure Encrypted Virtualization with Secure Nested Paging confidential computing guarantees.
Stay Vigilant
Cyber threats are evolving rapidly. Subscribe to our newsletter for daily updates, and consider using advanced security tools to monitor and protect your systems from vulnerabilities and attacks. Stay safe online!