Google’s Threat Intelligence Group (GTIG) has published a comprehensive guide to help organizations strengthen their SaaS security posture—particularly Salesforce—against UC6040’s sophisticated voice-phishing and malicious connected-app attacks. By combining identity hardening, SaaS-specific controls, and advanced logging and detection, security teams can significantly reduce the risk of credential compromise and large-scale data exfiltration. Protecting software-as-a-service (SaaS) platforms […]
Cloud providers rely on hardware-based memory encryption to keep user data safe. This encryption shields sensitive information like passwords, financial records, and personal files from hackers and curious insiders. Leading technologies such as Intel SGX and AMD SEV-SNP are designed to ensure that even if a cloud host or administrator is compromised, encrypted data remains […]
A critical zero-day vulnerability affecting thousands of Cisco firewalls is being actively exploited by threat actors in the wild.
The vulnerability, tracked as CVE-2025-20333, poses an immediate risk to organizations worldwide with a CVSS score of 9.9, representing one of the most severe security flaws discovered in enterprise firewall infrastructure this year.
According to data from The Shadowserver Foundation, over 48,800 unpatched IP addresses were identified on September 29, 2025, with the United States having received the most exposure.
The vulnerability affects Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software, specifically targeting the VPN web server component that millions of organizations rely on for remote access capabilities.
Cisco firewalls vulnerable
Buffer Overflow Vulnerability (CVE-2025-20333)
The vulnerability stems from improper validation of user-supplied input in HTTP(S) requests processed by the VPN web server.
Classified as a CWE-120 buffer overflow, the flaw allows authenticated remote attackers to execute arbitrary code with root privileges on affected devices.
This level of access essentially grants complete control over the firewall, enabling attackers to modify security policies, intercept network traffic, and establish persistent backdoors.
The attack vector requires valid VPN user credentials, which attackers can obtain through various methods including credential stuffing, phishing campaigns, or exploiting weak authentication mechanisms.
Once authenticated, attackers can send specially crafted HTTP requests containing malicious payloads that overflow memory buffers, allowing shellcode execution in the context of the root user.
Cisco’s Product Security Incident Response Team (PSIRT) has confirmed active exploitation attempts and warns that successful attacks could result in complete device compromise.
The vulnerability affects devices running vulnerable releases of ASA or FTD software with specific configurations enabled, including AnyConnect IKEv2 Remote Access, Mobile User Security (MUS), and SSL VPN services.
The affected configurations encompass critical enterprise features that organizations depend on for secure remote access. Vulnerable configurations include:
AnyConnect IKEv2 Remote Access with client services enabled
Mobile User Security (MUS) implementations
SSL VPN deployments
These configurations are standard in enterprise environments, particularly those supporting remote workforce initiatives.
The vulnerability’s severity is compounded by the fact that Cisco has confirmed no workarounds exist to mitigate the risk without applying security patches.
Missing Authorization Flaw (CVE-2025-20362)
A secondary vulnerability, CVE-2025-20362 (CVSS 6.5), accompanies the primary flaw and enables unauthenticated attackers to access restricted VPN endpoints that should require authentication.
This unauthorized access vulnerability, classified as CWE-862 (Missing Authorization), can serve as a reconnaissance tool for attackers planning more sophisticated attacks.
CVE
Title
CVSS 3.1 Score
Severity
CVE-2025-20333
VPN Web Server Remote Code Execution Vulnerability
9.9
Critical
CVE-2025-20362
VPN Web Server Unauthorized Access Vulnerability
6.5
Medium
Cisco has released emergency security updates addressing both vulnerabilities and strongly recommends immediate patching.
Organizations should prioritize these updates given the active exploitation and the critical nature of affected systems.
The company also advises reviewing threat detection configurations for VPN services to enhance protection against authentication attacks and unauthorized connection attempts.
Microsoft has officially released Windows 11, version 25H2, also known as the Windows 11 2025 Update, marking the next feature update for the operating system.
The update became available for general availability on September 30, 2025, initiating a phased rollout to eligible devices.
This new version is designed as a service, with updates delivered periodically to enhance functionality and user experience. The rollout is being conducted in a measured manner, meaning users will receive the 25H2 update when data indicates their device is ready, ensuring a smooth transition.
For users eager to upgrade, the update is available on eligible Windows 11, version 24H2 devices by enabling the “Get the latest updates as soon as they’re available” setting.
The installation process is streamlined through servicing technology, requiring only a single restart after an automatic download and installation.
What’s New in Version 25H2
Windows 11, version 25H2, integrates all features and capabilities previously delivered through continuous innovation in version 24H2, now enabled by default. Several key features that were under temporary enterprise feature control are now fully available to all users.
Key features enabled by default include:
AI Actions in File Explorer: Enhances file management with integrated artificial intelligence capabilities.
Improved Windows Search: A Copilot+ PC feature that offers a more intelligent and context-aware search experience.
Click to Do: Another Copilot+ PC feature designed to streamline workflows with actionable suggestions.
Agent in Settings: This Copilot+ PC feature provides an intelligent agent within the Settings app to assist users.
Beyond these AI-powered enhancements, version 25H2 introduces significant connectivity and administrative improvements. The update adds support for Wi-Fi 7 enterprise connectivity, offering faster speeds and more reliable connections for business environments.
Additionally, IT administrators gain the ability to remove select preinstalled Microsoft Store applications using new policies, providing greater control over enterprise device configurations.
Known Issues and Staying Updated
As with any major software release, Microsoft is actively monitoring the rollout of version 25H2 for any potential issues. A complete list of all updates released for this version of Windows is available on the official Windows release information page.
Users and IT administrators can find detailed information on known issues and the status of the rollout on the Windows release health dashboard.
For real-time updates and announcements, Microsoft recommends following the @WindowsUpdate account on X (formerly Twitter). IT professionals who need to programmatically access this information can use the Windows Updates API in Microsoft Graph.
For immediate assistance with any update-related problems, users on a Windows device can use the Get Help application or visit the official Microsoft support website.
Installing the latest update ensures that devices not only receive new features but also all previous updates, which include critical security fixes.
The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of new targeted cyber attacks in the country using a backdoor called CABINETRAT.
The activity, observed in September 2025, has been attributed to a threat cluster it tracks as UAC-0245. The agency said it spotted the attack following the discovery of software tools taking the form of XLL files, which refer to Microsoft Excel
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about critical vulnerabilities in Cisco’s IOS and IOS XE Software SNMP subsystem that are actively being exploited by threat actors. CVE-2025-20352, which involves a stack-based buffer overflow in the Simple Network Management Protocol (SNMP) implementation, has been officially added to CISA’s Known Exploited Vulnerabilities […]
A new Android banking trojan has emerged that combines traditional overlay attacks with a stealthy hidden Virtual Network Computing (VNC) server to achieve full remote control of compromised devices.
First detected in late September 2025, the malware is distributed through SMS-based phishing campaigns that lure victims into installing a fake “security” app.
Once granted the necessary permissions, the trojan encrypts its payload, evading static detection, and initiates a background VNC server that remains invisible to the user’s launcher.
Cleafy analysts identified the malware after observing unusual network traffic from several European banks’ mobile users. Upon installation, the trojan immediately requests Accessibility and Device Administrator privileges under the guise of optimizing device performance.
Installation process (Source – Cleafy)
These permissions allow it to intercept touch input, capture screen information, and silently render bogus overlays on legitimate banking applications.
At the same time, the VNC module initializes a hidden framebuffer, enabling threat actors to remotely view and manipulate the device in real time.
While overlay-based banking trojans have been around for years, this new strain’s integration of a headless VNC server represents a significant escalation.
Rather than relying solely on screen overlays, attackers can now navigate the device interface as if they were holding it in their hand—opening apps, entering one-time passwords, and installing additional payloads.
Enabling Accessibility Services (Source – Cleafy)
Early cases suggest that victims remain unaware of the remote session, as the trojan suppresses all visual indicators and logs user interactions to blend with legitimate activity.
Once entrenched, the trojan employs multiple persistence tactics. It registers a broadcast receiver for BOOT_COMPLETED to restart the VNC service on device reboot and hooks into the AccessibilityService to monitor screen state changes.
The malware also disables Google Play Protect by exploiting hidden system APIs, preventing updates or scans that might disrupt its operations.
These layers of defense ensure that the remote access remains active until manually removed—a task complicated by the trojan’s ability to hide its icon and camouflages itself under system-level names.
Infection Mechanism
The infection chain begins with a deceptive SMS message containing a download link to a trojanized APK named “BankGuard.apk.”
When the user installs this package, they are prompted to enable two critical permissions: AccessibilityService and Device Administrator.
The following snippet illustrates how the trojan invokes the Accessibility permission request:-
Intent intent = new Intent(Settings.ACTION_ACCESSIBILITY_SETTINGS);
context.startActivity(intent);
Once granted, the malware programmatically registers its AccessibilityService:-
With these hooks in place, the trojan silently launches its VNC server:-
VNCServer vnc = new VNCServer(context);
vnc.startServer(5900); // Standard VNC port
This headless server captures framebuffer data and listens for incoming remote control commands.
Attackers connect using off-the-shelf VNC clients, gaining unfettered interactive control over the victim’s device.
Fraud attempts details (Source – Cleafy)
Through this mechanism, the trojan bypasses traditional overlay detection by avoiding UI injection altogether, relying instead on genuine touch emulation via remote commands.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
Cisco has confirmed two serious vulnerabilities impacting its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) firewalls. Tracked as CVE-2025-20333 and CVE-2025-20362, both issues allow attackers to run arbitrary code on unpatched devices. Cisco security advisories warn that exploits for both flaws are already in the wild. Organizations worldwide are urged to check their devices and apply […]
The OpenSSL Project has released a critical security advisory, addressing three significant vulnerabilities that could allow attackers to execute remote code and potentially recover private cryptographic keys.
These flaws affect multiple OpenSSL versions across different platforms and could lead to memory corruption, denial of service attacks, and unauthorized access to sensitive cryptographic materials.
The most severe vulnerability involves out-of-bounds memory operations in RFC 3211 Key Encryption Key (KEK) unwrap functionality, tracked as CVE-2025-9230 with moderate severity.
This flaw occurs when applications attempt to decrypt Cryptographic Message Syntax (CMS) messages using password-based encryption (PWRI).
The vulnerability triggers both out-of-bounds read and write operations, potentially leading to memory corruption that attackers could exploit to execute arbitrary code or cause system crashes.
Memory Corruption Vulnerability (CVE-2025-9230)
The first vulnerability, CVE-2025-9230, affects OpenSSL versions 3.5, 3.4, 3.3, 3.2, 3.0, 1.1.1, and 1.0.2 through improper handling of CMS message decryption.
When applications process maliciously crafted password-based encrypted CMS messages, the vulnerability triggers out-of-bounds memory access operations.
The out-of-bounds write component can cause memory corruption, potentially allowing attackers to overwrite critical memory regions and execute shellcode or arbitrary commands.
Security researchers from Aisle Research, led by Stanislav Fort, discovered this vulnerability on August 9th, 2025. The exploit requires specific conditions, including password-based encryption usage in CMS messages, which limits the attack surface since PWRI encryption support is rarely implemented in production environments. However, successful exploitation could result in complete system compromise through remote code execution capabilities.
The vulnerability exists in the KEK unwrap algorithm implementation, where insufficient bounds checking allows memory operations beyond allocated buffer boundaries.
Attackers can craft malicious CMS payloads that trigger integer overflow conditions, resulting in buffer overflows during decryption processes.
The FIPS modules remain unaffected since CMS implementation operates outside the OpenSSL FIPS boundary.
Timing Side-Channel Flaw (CVE-2025-9231)
The second critical flaw, CVE-2025-9231, introduces a timing side-channel vulnerability in the SM2 cryptographic algorithm implementation on 64-bit ARM platforms.
This vulnerability allows remote attackers to recover private keys through timing analysis of signature computation operations, according to the OpenSSL advisory.
While OpenSSL doesn’t directly support SM2 certificates in Transport Layer Security (TLS) contexts, custom providers could expose this vulnerability in production environments.
Timing side-channel attacks exploit variations in cryptographic operation execution times to extract sensitive information.
The SM2 algorithm implementation exhibits timing discrepancies during signature generation processes, creating measurable patterns that attackers can analyze to reconstruct private key material.
CVE
Title
Severity
CVE-2025-9230
Out-of-bounds read & write in RFC 3211 KEK Unwrap
Moderate
CVE-2025-9231
Timing side-channel in SM2 algorithm on 64 bit ARM
Moderate
CVE-2025-9232
Out-of-bounds read in HTTP client no_proxy handling
Low
This attack vector requires network access to measure timing variations across multiple cryptographic operations, making it feasible for remote exploitation scenarios.
The vulnerability affects OpenSSL versions 3.5, 3.4, 3.3, and 3.2 specifically on 64-bit ARM architectures. Earlier versions, including 3.1, 3.0, 1.1.1, and 1.0.2, remain unaffected due to different implementation approaches.
Additionally, CVE-2025-9232 involves out-of-bounds read operations in HTTP client no_proxy handling for IPv6 addresses, though this presents a lower risk with denial-of-service impact only.
Organizations using custom cryptographic providers with SM2 support should prioritize immediate patching to prevent private key compromise through timing analysis attacks.
Immediate remediation requires upgrading to patched versions: OpenSSL 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.1.1zd (premium support), and 1.0.2zm (premium support).
Organizations face an ever-evolving cyberthreat landscape marked by faster, more complex attacks. Today, Microsoft is answering this call with the general availability of an agentic security platform built on Microsoft Sentinel. This new wave of innovation combines data, context, automation, and intelligent agents to help security teams detect, investigate, and respond at AI speed. The rise of […]
.webp)
.webp)
.webp)