SolarWinds has released a third hotfix for a critical CVSS 9.8 RCE in Web Help Desk, forcing admins to weigh urgent patching against potential operational disruption. Verify your version, apply the hotfix, and isolate helpdesk services now to shrink the attack window.
Imagine any app reading your texts — that’s the risk OnePlus users face after Rapid7 revealed a critical flaw letting unprivileged apps access SMS/MMS, a bug the company reportedly knew about but hasn’t fully fixed for over three years. How safe is your phone if authentication codes and private conversations can be siphoned silently?
SolarWinds has issued hotfixes for a critical RCE (CVE-2025-26399) in Web Help Desk—if left unpatched attackers could run arbitrary commands on affected systems. Act now: find exposed instances, apply the hotfix immediately, and review logs for any signs of compromise.
Three major cybersecurity vendors pulled out of MITRE’s ATT&CK Evaluations over methodology and transparency concerns, leaving buyers with fewer apples‑to‑apples comparisons and prompting a push for clearer, fairer testing. MITRE says it will revise the program — but rebuilding trust will take visible changes and broader industry buy‑in.
From a Chrome zero-day and AI-sped exploit tooling to an npm worm and unsettling DDR5 quirks, this week’s incidents prove attackers are iterating faster than fixes—so prioritize automated patching, supply-chain hygiene, and layered defenses before the next flaw becomes a blueprint.
Heads up: Microsoft has patched a critical Entra ID token-validation bug (CVE-2025-55241) that could let attackers impersonate Global Administrators across tenants. Apply the update, rotate credentials, and review audit logs now to reduce your risk.
Urgent: CISA found attackers exploited Ivanti EPMM flaws to push multiple malware families — if your organization uses this MDM, patch immediately and rotate admin credentials. Lock down management access with MFA and monitor console activity now to prevent a potentially wide-scale breach.
Fortra has warned of a critical “10/10” flaw in GoAnywhere MFT that’s widely used across enterprises and may already be weaponized — if you run it, treat this as an emergency: inventory systems, apply patches or mitigations now, and hunt for signs of compromise.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
CISA is warning that threat actors have exploited critical Ivanti EPMM flaws (CVE-2025-4427/4428) to drop stealthy loaders and listeners that give attackers remote control and a wide blast radius. If you manage EPMM, patch now, lock down access and credentials, and start looking for suspicious listener and remote-execution activity before it’s too late.
Google just pushed an emergency Chrome patch for a high‑severity zero‑day being actively exploited — please check your Chrome version and update now. This is the latest in a string of browser flaws that remind users and admins alike to stay vigilant and tighten protections.
A trio of critical vulnerabilities in Chaos Mesh means the very tool used to test Kubernetes resilience can be turned into a vector for arbitrary code execution — even in default setups. If you use Chaos Mesh, inventory deployments, apply patches or mitigations, and lock down RBAC and network controls now.
Researchers from Google Project Zero and ETH Zurich have uncovered a new Rowhammer-style flaw that can bypass DDR5 protections on certain AMD + SK Hynix combos, potentially letting attackers flip or read memory beyond intended bounds. If you run affected hardware, keep an eye on vendor advisories and apply firmware or microcode updates as they become available.
Google just revealed that criminals created a fraudulent account in its Law Enforcement Request System (LERS), exposing a worrying gap in the trusted channel police and courts use to obtain sensitive user data. The incident sparks a necessary push to tighten verification, protect investigations, and rebuild public confidence in the systems meant to keep us safe.
Apple has backported a fix for CVE-2025-43300 — a high‑severity ImageIO flaw actively exploited in the wild — so update now to block image‑based attacks that can crash or hijack your device. If you can’t upgrade, install Apple’s backported updates for older iOS, iPadOS and macOS builds and be extra cautious opening unexpected images.
A single plaintext file of MFA recovery codes on a desktop turned a security convenience into an org‑wide breach tied to the SonicWall attacks — a stark reminder that strong tech fails when basic procedures are ignored. Treat recovery codes like passwords: store them encrypted or offline, enforce controls, and stop letting convenience hand attackers the keys.
HybridPetya blends NotPetya-style destructive tricks with a UEFI bootkit that can survive OS reinstalls and even attempt to bypass Secure Boot, forcing teams and everyday users to rethink recovery and firmware defenses. If you assume reinstalling Windows is enough, this threat is a wake-up call to harden firmware, backups and pre-boot integrity checks.
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlog
A new proof-of-concept bootkit called HybridPetya shows Secure Boot can be bypassed, reminding us that attackers who gain control before Windows starts can hide, persist, and undermine trust at the firmware level. Patch promptly, inventory firmware, and push for hardware-level protections—because platform security now starts before the OS.
Samsung just pushed an emergency patch for a critical Android zero‑day that’s been actively exploited — install it now to stop attackers from reading messages, using your mic, or tracking your device. Even after updating, enable automatic updates and avoid installing apps from untrusted sources to stay safer.
CISA wants a bigger role running the CVE vulnerability list — promising more stability and coordination but sparking worries that government control could politicize a vital global standard.
Imagine a single image could hijack your phone — Samsung’s September security update patches CVE-2025-21043, a high-severity, actively exploited Android zero-day in the image codec; install the SMR update as soon as it’s available to protect your device.
Attackers are quietly blending in by weaponizing legitimate — often obscure — system tools and even image files to evade detection, forcing defenders to rethink the assumption that “known-good” equals safe. To stay ahead, organizations must expand telemetry, tighten allowlisting, and hunt for suspicious misuse of everyday binaries before trust becomes a vulnerability.
Think ransomware can’t survive a reinstall? Think again — HybridPetya combines Petya-style encryption with a UEFI exploit (CVE-2024-7344) to bypass Secure Boot and persist below the OS. Patch firmware, enable measured boot, and lock down backups before attackers exploit this weakness.
Imagine opening a repo and it runs code without asking — Cursor, an AI-powered editor, can be tricked into silently executing arbitrary scripts from a crafted repository, putting your machine and credentials at risk. Until safer defaults arrive, treat untrusted repos like unknown executables: sandbox them, audit files first, and enable strict prompts for project-initiated execution.
CISA just released a roadmap to modernize the CVE program, insisting on public stewardship and vendor neutrality while calling for broader industry–government collaboration to keep vulnerability tracking trustworthy and scalable. If implemented well, it could speed up patching, reduce disputes and harden defenses — but success depends on sustainable funding, transparency and real buy-in from all stakeholders.