-
Phishing-as-a-Service (PhaaS) platforms keep evolving, giving attackers faster and cheaper ways to break into corporate accounts. Now, researchers at ANY.RUN has uncovered a new entrant: Salty2FA, a phishing kit designed to bypass multiple two-factor authentication methods and slip past traditional defenses. Already spotted in campaigns across the US and EU, Salty2FA puts enterprises at
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Sophos has resolved an authentication bypass vulnerability in its AP6 Series Wireless Access Points that could allow attackers to gain administrator-level privileges.
The company discovered the issue during internal security testing and has released a firmware update to address it.
The security vulnerability allows an attacker with network access to the access point’s management IP address to bypass authentication controls. A successful exploit grants the threat actor administrator privileges on the affected device.
This elevated access could be leveraged to control the access point, intercept or manipulate network traffic, disrupt wireless connectivity, or use the compromised device as a pivot point to launch further attacks within the network.
Sophos reported that the vulnerability was found by its own team, highlighting a proactive approach to product security.
The nature of the flaw, requiring access to the management interface, suggests that the primary risk is from attackers already on the local network.
Sophos Wireless Access Points Vulnerability
This vulnerability affects Sophos AP6 Series Wireless Access Points running firmware versions prior to 1.7.2563 (MR7). To address the issue, Sophos has included a fix in firmware version 1.7.2563 (MR7), which was released after August 11, 2025.
Administrators managing these devices are urged to verify that their access points are running this version or a later one to ensure they are protected.
Any organization using older firmware versions remains vulnerable and must upgrade to receive the security fix and shield their networks from potential exploitation.
For most customers, the remediation process is automatic. Sophos AP6 devices are configured by default to install updates automatically, meaning the patched firmware will be applied without requiring manual intervention.
This default policy ensures that the majority of users are protected seamlessly. However, customers who have intentionally opted out of automatic updates must take manual action.
These users are required to upgrade their AP6 Series firmware to version 1.7.2563 (MR7) or a more recent version to apply the patch.
Failing to update leaves the wireless access points exposed to this critical authentication bypass risk.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
The post Sophos Wireless Access Points Vulnerability Let Attackers Bypass Authentication appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Sophos has released an important security advisory addressing a critical authentication bypass vulnerability in its AP6 Series Wireless Points. Attackers who can reach the management interface of an affected device may exploit this flaw to gain full administrator privileges. Sophos discovered this issue through routine internal security testing and released a firmware update to protect customers […]
The post Sophos Wireless Access Point Vulnerability Allows Attackers to Bypass Authentication appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sophisticated espionage campaign leveraging a previously unknown malware strain dubbed GONEPOSTAL, attributed to the notorious Russian state-sponsored group KTA007, better known as Fancy Bear or APT28. The malware transforms Microsoft Outlook into a covert command and control channel, representing a significant evolution in living-off-the-land attack techniques. Cybersecurity firm Kroll has uncovered a GONEPOSTAL operates […]
The post GONEPOSTAL Malware Exploits Outlook for Stealthy Command-and-Control appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Microsoft has released a warning about two serious security flaws in Windows BitLocker that could allow attackers to gain elevated privileges on affected machines. These vulnerabilities, tracked as CVE-2025-54911 and CVE-2025-54912, were publicly disclosed on September 9, 2025. Both issues are classified as use-after-free weaknesses and carry an Important severity rating. Administrators and users are […]
The post Windows BitLocker Flaw Allows Privilege Escalation by Attackers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
DarkSamural, a newly identified subspecies of the notorious OceanLotus APT, has launched a sophisticated campaign targeting high-value organizations in Pakistan. Leveraging malicious LNK files masquerading as PDF documents and sophisticated MSC containers empowered by GrimResource technology, the group delivered a multi-stage payload designed to exfiltrate critical data. After in-depth sample and correlation analysis, cybersecurity researchers […]
The post DarkSamural APT Group Deploys LNK/PDF Malware to Steal Critical Information appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Microsoft has addressed two significant elevation of privilege vulnerabilities affecting its Windows BitLocker encryption feature.
The flaws, tracked as CVE-2025-54911 and CVE-2025-54912, were disclosed on September 9, 2025, and carry an “Important” severity rating.
Both vulnerabilities could allow an authorized attacker to gain full SYSTEM privileges on a compromised machine, bypassing the security layers that BitLocker is designed to enforce.
Microsoft has noted that exploitation is considered “less likely,” and as of the disclosure, the vulnerabilities have not been publicly detailed or seen exploited in the wild.
BitLocker Escalation of Privilege Vulnerability
Both CVE-2025-54911 and CVE-2025-54912 are classified as “Use-After-Free” vulnerabilities, a common and dangerous type of memory corruption bug.
This weakness, cataloged under CWE-416, occurs when a program continues to use a pointer to a memory location after that memory has been freed or deallocated.
When an attacker can influence the data written to this deallocated space, they can often manipulate the program’s execution flow.
In this scenario, a malicious actor could leverage this control to execute arbitrary code, leading to a complete system takeover.
The presence of two distinct “Use-After-Free” bugs in a critical security component like BitLocker highlights the ongoing challenges in maintaining memory safety in complex software.
Successful exploitation of either vulnerability results in a full privilege escalation. An attacker who leverages these flaws could gain SYSTEM-level access, the highest level of privilege on a Windows system.
This would grant them the ability to install programs, view, change, or delete data, and create new accounts with full user rights.
According to the CVSS metrics provided by Microsoft, an attack requires an adversary to have low-level privileges on the target system already.
Furthermore, some form of user interaction is necessary for the exploit to succeed, meaning an attacker would need to trick an authorized user into performing a specific action.
This prerequisite makes remote, automated attacks more difficult but does not diminish the risk in scenarios where an attacker has already gained an initial foothold.
Mitigations
In response to the discovery, Microsoft has fixed the vulnerabilities in the September 2025 Patch Tuesday update. The company has urged users and administrators to apply the latest updates promptly to protect their systems from potential attacks.
While the exploitability is currently assessed as less likely, the severity of the potential impact necessitates immediate action.
The discovery of CVE-2025-54912 was credited to Hussein Alrubaye, working with Microsoft, indicating a collaborative effort between the company and external security researchers to identify and resolve critical security issues.
Users are advised to check for updates through the standard Windows Update service to ensure their systems are no longer susceptible to these privilege escalation flaws.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
The post Windows BitLocker Vulnerability Let Attackers Elevate Privileges appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A critical vulnerability CVE-2025-42922 has been discovered in SAP NetWeaver that allows an authenticated, low-privileged attacker to execute arbitrary code and achieve a full system compromise.
The flaw resides in the Deploy Web Service upload mechanism, where insufficient access control validation permits the upload and execution of malicious files.
This vulnerability poses a significant risk to organizations relying on affected SAP systems, as it can be exploited to gain complete control over the server.
SAP NetWeaver Vulnerability
According to Vahagn Vardanian, the root cause of the vulnerability is an insecure file upload function within the Deploy Web Service.
The service incorrectly accepts
multipart/form-datarequests without proper Role-Based Access Control (RBAC) enforcement or validation of the file type and content.This oversight is due to incorrect authentication annotations and insufficient role checks in the application’s code.
SAP NetWeaver Vulnerability Consequently, an attacker who has obtained any valid low-level user credentials can bypass security controls that should restrict file deployment capabilities to administrative users only, Vahagn Vardanian said.
The mechanism fails to verify if the authenticated user has the necessary permissions to perform such a sensitive operation, creating a direct path to code execution.
An attacker can exploit this vulnerability by first gaining access to a low-privileged user account.
Using these credentials, they can authenticate to the vulnerable Deploy Web Service and craft a multipart request containing a malicious file, such as a JavaServer Pages (JSP) script.
The application improperly accepts and uploads this file to a directory on the server where it can be executed.
The attacker then simply needs to trigger the execution of the uploaded file by accessing its URL. Successful exploitation results in arbitrary code execution with the privileges of the SAP service account.
This allows the threat actor to escalate privileges, move laterally across the network, exfiltrate sensitive data, or deploy further malware, leading to a complete server takeover.
Mitigations
To address this critical issue, organizations are strongly urged to apply the patches released in SAP Security Note 3643865 immediately.
Before patching, administrators should perform a dependency analysis as outlined in SAP Note 1974464. For systems that cannot be patched right away, SAP has provided a temporary workaround in KBA 3646072.
As a supplementary measure, access to the Deploy Web Service should be restricted to administrative users only.
Security teams should audit system logs for Indicators of Compromise (IOCs), such as HTTP POST requests to DeployWS endpoints from non-administrative accounts,
multipart/form-datasubmissions containing executable file types (JSP, WAR, EAR), or deployment activities occurring at unusual hours.A sample filter for logs or a Web Application Firewall (WAF) could be
source.user != "admin" AND http.method == "POST" AND http.path CONTAINS "DeployWS".Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
The post Critical SAP NetWeaver Vulnerability Let Attackers Execute Arbitrary Code And Compromise System appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A critical security vulnerability has been discovered in SAP NetWeaver AS Java Deploy Service that enables authenticated attackers to execute arbitrary code and potentially achieve complete system compromise. The flaw, tracked as CVE-2025-42922, affects the Deploy Web Service component and poses significant risks to organizations running affected SAP environments. Vulnerability Details and Attack Vector The vulnerability stems from insecure […]
The post Critical SAP NetWeaver Flaw Allows Attackers to Execute Arbitrary Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Microsoft is set to enhance the Windows user experience by integrating new AI-powered capabilities directly into File Explorer.
This upcoming feature, named “AI actions in File Explorer,” will allow users to perform tasks like editing images and summarizing documents with a simple right-click, streamlining workflows and leveraging artificial intelligence without needing to open separate applications.
The new AI actions are designed to be intuitive and accessible. By right-clicking on a file, users will find a new “AI actions” option in the context menu.
.webp)
Windows AI File Explorer Selecting this will reveal a list of available AI-powered tasks tailored to the selected file type. This integration aims to keep users in their flow, providing powerful editing and analysis tools directly within the file management interface.
New Image Editing Capabilities
Initially, Microsoft is rolling out four AI actions specifically for images, supporting .jpg, .jpeg, and .png file formats. These features integrate with existing Windows applications like Photos and Paint, but are now accessible directly from File Explorer.
The four image actions available for Windows Insiders to test are:
Bing Visual Search: This tool allows you to use an image as a search query. It can find similar images online, identify products, landmarks, plants, and even famous people. It also incorporates features like on-screen translation and homework assistance.
Blur Background: This action opens the selected image in the Photos app, where the AI automatically detects and blurs the background to make the subject stand out. Users can adjust the intensity of the blur or use a brush tool to refine the blurred areas.
Erase Objects: Leveraging the Generative Erase feature in the Photos app, this action lets you remove unwanted objects or distractions from your photos. By selecting or highlighting an element, the AI will intelligently fill in the space, cleaning up the image.
Remove Background: This feature uses Microsoft Paint to automatically remove the background from an image with a single click. It can detect the main subject on the canvas or work within a user-defined selection to create a clean cutout.
Other Updates And Changes
Alongside the AI actions in File Explorer, Microsoft is reintroducing a highly requested feature from Windows 10: a larger clock with a seconds display in the notification center. This can be enabled in the “Time & language” settings.
In a move toward greater transparency and user control over AI, a new page in the “Privacy & security” settings will show which third-party applications have recently used generative AI models provided by Windows.
This allows users to monitor and manage which apps are permitted to leverage these on-device AI capabilities.
The update also includes various fixes for issues related to “Reset this PC,” File Explorer display problems in dark mode, and performance improvements for Windows Management Instrumentation (WMI).
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
The post Microsoft To Introduce New AI Actions In Windows File Explorer appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
