Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

A new report reveals critical vulnerabilities in the systems of RBI, the parent company of Burger King and Popeyes, exposing employee accounts and systems.

A critical vulnerability (CVE-2025-42957) in SAP S/4HANA with a CVSS score of 9.9 allows attackers with minimal privileges to execute arbitrary code.

Apple has issued an urgent, unscheduled patch for a zero-click vulnerability (CVE-2025-43300) in its ImageIO framework that was being actively exploited in targeted attacks.

A new technique allows attackers to steal data directly from HTML attributes using just a single line of inline CSS, without relying on external style sheets.

A new HTTP proxy called Thermoptic disguises network requests as authentic Chrome traffic, enabling users to bypass advanced blocking systems.

A new report details a sophisticated cyberattack against Kazakhstan's national oil and gas company, revealing the tactics and tools used by a new threat group, NoisyBear.

The FTC is investigating Gmail for alleged political bias. But experts say the real reason for filtered emails is the Republican platform’s aggressive mailing practices.

X has launched an end-to-end encrypted chat service, but cryptographers warn it has critical flaws, including server-stored keys and no forward secrecy.

A new report details GhostAction, a major supply chain attack that injected malicious code into GitHub repositories, stealing thousands of secrets.

Wealthsimple confirms a security incident affecting less than 1% of its clients due to a third-party software compromise. No funds or passwords were lost.

A new botnet called NightshadeC2 uses "UAC Prompt Bombing" to force users to approve malicious actions, bypassing Windows Defender and analysis sandboxes.

Havoc is a modern and malleable post-exploitation command and control framework. It handles the listeners, teamserver authentication and payload generation

A new remote access trojan, CastleRAT, has been discovered. It's part of a growing MaaS ecosystem and is being used to distribute stealers and other malware.

The EU has fined Google €2.95B for favoring its own ad tech services, a practice that distorted competition and harmed rivals, advertisers, and publishers.

A hacker group is threatening to leak Google's databases unless the company fires two of its security staff and ceases its investigations.

The arrest of XSS.is administrator "Toha" has thrown the cybercrime underground into turmoil. A new report details the forum's downfall and its fractured community.

Siemens has disclosed a critical flaw in its SIVaaS platform. A network share is exposed without authentication, allowing unauthenticated attackers to access or alter sensitive data.

Ivanti has released a security update for Endpoint Manager, patching two high-severity RCE flaws (CVSS 8.8) that could allow unauthenticated attackers to execute code.

Frankfurt am Main, Germany, 9th September 2025, CyberNewsWire