Tel Aviv, Israel, 24th November 2025, CyberNewsWire

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

CyberArmor exposed Autumn Dragon, a China-nexus APT using a WinRAR path traversal flaw (CVE-2025-8088) and DLL sideloading to deploy a Telegram C2 backdoor for espionage in Southeast Asia.

A Critical (CVSS 9.8) RCE flaw in Sneeit Framework is actively exploited. The bug allows unauthenticated attackers to run arbitrary code via call_user_func and take over WordPress sites. Update to v8.4 immediately.

A High-severity flaw (CVE-2025-13357, CVSS 7.4) in the Vault Terraform Provider allows unauthenticated access via LDAP null binds due to an insecure deny_null_bind default setting. Update to v5.5.0.

A critical, unpatched flaw in EOL Vivotek IP Cameras allows unauthenticated RCE via command injection in eventtask.cgi. Firmware versions 0100c–0305a4 are vulnerable and will not receive fixes.

A Critical (CVSS 9.8) Auth Bypass flaw (CVE-2025-63207) in R.V.R Elettronica TEX broadcast hardware allows unauthenticated attackers to reset all user passwords (Admin/Operator) via a simple HTTP request.

Kaspersky exposed ToddyCat APT's evolution: the group steals M365 OAuth tokens from memory and uses TCSectorCopy to steal locked Outlook OST files, allowing covert access to cloud email outside the perimeter.

ENKI exposed a Kimsuky APT campaign using a dual PE/PowerShell payload that switches based on Windows Defender status to deploy KimJongRAT. The malware steals Chrome AppBound keys via GitHub Releases C2.

K7 Labs exposed a Brazilian campaign using a Python WhatsApp worm for self-propagation. The in-memory AutoIt loader deploys a banking trojan that uses IMAP email as a covert C2 channel to steal banking credentials.

ShinyHunters claims responsibility for the Salesforce ecosystem breach, using OAuth tokens stolen from a previous attack to infiltrate Gainsight and access hundreds of customer instances.

Threat actors are actively exploiting the critical WSUS RCE flaw (CVE-2025-59287) to gain SYSTEM access and deploy the powerful, Chinese-linked ShadowPad espionage backdoor.

Matrix Push C2 is a new subscription service fueling fileless phishing campaigns by using deceptive browser push notifications to deliver malicious links and steal credentials.

SitusAMC, a key mortgage market contractor, suffered a breach that may have exposed client data from major banks like JPMorgan and Citi, raising fears of supply chain risk.

NVIDIA is adding 1.6 Tbps networking support to the Linux 6.19 kernel via the Mellanox MLX5 driver, utilizing eight 200 Gbps lanes for next-gen data center speed.

A critical chain of Fluent Bit vulnerabilities allows RCE, path traversal, and log tampering by exploiting tag handling and an auth bypass. Update to v4.1.1 now.

Apache warned of a Critical flaw (CVE-2025-65998) in Syncope. When AES is enabled for password storage, a hard-coded key allows attackers with database access to decrypt all user passwords. Update immediately.

CISA issued an urgent alert: Commercial spyware is actively exploiting zero-click flaws and malicious QR codes to hijack messaging apps (Signal, WhatsApp) for espionage against government and civil society targets.