Akamai finds new Docker malware blocking rivals on exposed APIs, replacing cryptominers with tools that hint at early botnet development.

Silver Spring, USA, 9th September 2025, CyberNewsWire

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

A new report reveals critical vulnerabilities in the systems of RBI, the parent company of Burger King and Popeyes, exposing employee accounts and systems.

A critical vulnerability (CVE-2025-42957) in SAP S/4HANA with a CVSS score of 9.9 allows attackers with minimal privileges to execute arbitrary code.

Apple has issued an urgent, unscheduled patch for a zero-click vulnerability (CVE-2025-43300) in its ImageIO framework that was being actively exploited in targeted attacks.

A new technique allows attackers to steal data directly from HTML attributes using just a single line of inline CSS, without relying on external style sheets.

A new HTTP proxy called Thermoptic disguises network requests as authentic Chrome traffic, enabling users to bypass advanced blocking systems.

A new report details a sophisticated cyberattack against Kazakhstan's national oil and gas company, revealing the tactics and tools used by a new threat group, NoisyBear.

The FTC is investigating Gmail for alleged political bias. But experts say the real reason for filtered emails is the Republican platform’s aggressive mailing practices.

X has launched an end-to-end encrypted chat service, but cryptographers warn it has critical flaws, including server-stored keys and no forward secrecy.

A new report details GhostAction, a major supply chain attack that injected malicious code into GitHub repositories, stealing thousands of secrets.

Wealthsimple confirms a security incident affecting less than 1% of its clients due to a third-party software compromise. No funds or passwords were lost.

A new botnet called NightshadeC2 uses "UAC Prompt Bombing" to force users to approve malicious actions, bypassing Windows Defender and analysis sandboxes.

Havoc is a modern and malleable post-exploitation command and control framework. It handles the listeners, teamserver authentication and payload generation

A new remote access trojan, CastleRAT, has been discovered. It's part of a growing MaaS ecosystem and is being used to distribute stealers and other malware.

The EU has fined Google €2.95B for favoring its own ad tech services, a practice that distorted competition and harmed rivals, advertisers, and publishers.