Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. Urgent: Cisco ASA Zero-Day Duo Under Attack; CISA Triggers Emergency Mitigation Directive
Published: 2025-09-25
Cisco is addressing two zero-day vulnerabilities in its Secure Firewall Adaptive Security Appliance and Threat Defense Software, which are being exploited to execute arbitrary code and access restricted endpoints, prompting an emergency mitigation directive from CISA. CISA has added these vulnerabilities to the Known Exploited Vulnerabilities catalog and urged federal agencies to mitigate potential compromises within 24 hours, linking the exploitation to the advanced threat actor UAT4356, also known as Storm-1849.
2. Threatsday Bulletin: Rootkit Patch, Federal Breach, OnePlus SMS Leak, TikTok Scandal & More
Published: September 2025
The Threatsday Bulletin covers recent cybersecurity issues including a firmware update by SonicWall to remove rootkit malware from SMA 100 series devices, a federal breach exploiting a GeoServer vulnerability, and a permission bypass vulnerability in OnePlus OxygenOS allowing unauthorized access to SMS/MMS data. It also highlights arrests related to the Scattered Spider cybercrime group and a TikTok scandal involving the collection of sensitive data from Canadian children under 13.
3. Vane Viper Generates 1 Trillion DNS Queries to Power Global Malware and Ad Fraud Network
Published: 2025-09
Vane Viper, a threat actor operating through a complex network of shell companies, has generated about 1 trillion DNS queries over the past year to support widespread malvertising, ad fraud, and cyberthreat proliferation, leveraging compromised websites and malicious ads. The operation, linked to companies like PropellerAds and AdTech Holding, uses techniques such as abusing push notification permissions to deliver threats, including malware and fake apps, while maintaining plausible deniability as an advertising network.
4. Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection
Published: 2025-09
Salesforce has patched a critical vulnerability named ForcedLeak in its Agentforce platform, which could allow attackers to exfiltrate sensitive CRM data through AI prompt injection via the Web-to-Lead functionality. The flaw, discovered by Noma Security and reported on July 28, 2025, enabled attackers to leak data to an expired, attacker-controlled domain by exploiting weaknesses in context validation and content security policy.
5. North Korean Hackers Use New AkdoorTea Backdoor to Target Global Crypto Developers
Published: 2025-09
North Korean hackers, linked to the Contagious Interview campaign, are using a new backdoor called AkdoorTea, along with tools like TsunamiKit and Tropidoor, to target global cryptocurrency and Web3 developers across Windows, Linux, and macOS, primarily through fake job offers and malicious coding exercises. The campaign, tracked as DeceptiveDevelopment, involves initial outreach via platforms like LinkedIn and delivers malware such as BeaverTail and WeaselStore to exfiltrate sensitive data and maintain persistent access.
6. CTEM’s Core: Prioritization and Validation
Published: 2025-09
The article discusses Continuous Threat Exposure Management (CTEM), emphasizing prioritization and validation to focus on exposures that pose real business risks, moving away from traditional vulnerability management overwhelmed by numerous alerts. It highlights the use of Adversarial Exposure Validation (AEV) technologies, such as Breach and Attack Simulation (BAS) and Automated Penetration Testing, to validate and prioritize critical vulnerabilities in dynamic environments.
7. Tech Overtakes Gaming as Top DDoS Attack Target, New Gcore Radar Report Finds
Published: September 2025
The latest Gcore Radar report for Q1–Q2 2025 shows a 41% year-on-year increase in DDoS attack volume, with the largest attack reaching 2.2 Tbps, and reveals that the technology sector has now surpassed gaming as the most targeted industry, while financial services face heightened risks.
8. Malicious Rust Crates Steal Solana and Ethereum Keys — 8,424 Downloads Confirmed
Published: September 2025
Two malicious Rust crates, faster_log and async_println, were found impersonating the legitimate fast_log library to steal Solana and Ethereum wallet keys, amassing 8,424 downloads before being removed by crates.io maintainers. The crates included functional logging code but embedded routines to scan and exfiltrate private keys to a command and control endpoint.
Stay Vigilant
Cyber threats are evolving rapidly. Subscribe to our newsletter for daily updates, and consider using advanced security tools to monitor your systems for vulnerabilities and automate patches. Stay safe online!