CVE-2025-54236 on DanSec Daily

Cybersecurity Brief – 2025-10-24

Fri, 24 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Toys “R” Us Canada has notified customers of a data breach involving leaked customer records previously stolen from its systems.
Collin’s Aerospace suffered a cyberattack impacting check-in and passenger systems at several European airports in late September 2025, resulting in significant delays and flight cancellations.
The Universe Browser, downloaded millions of times, has been identified as behaving like malware, with links to Asian cybercrime and illegal gambling networks.
Jingle Thief, a cybercriminal group, has been observed exploiting cloud infrastructure in the retail and consumer services sectors to steal millions in gift cards.
WIRED reported that hacked Deckmate 2 card shufflers enabled a mob-related poker scam that resulted in millions of dollars in losses.

Newly Discovered Vulnerabilities

Microsoft released emergency out-of-band patches for a critical Windows Server Update Service (WSUS) remote code execution flaw, which has publicly available proof-of-concept exploit code.
CISA and researchers reported active exploitation of a critical zero-day vulnerability in Motex Lanscope Endpoint Manager, prompting inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog.
A critical vulnerability (CVE-2025-54236, “SessionReaper”) in Adobe Commerce (Magento) is being actively exploited to hijack user sessions on e-commerce platforms, affecting thousands of online stores.
BIND released security updates addressing high-severity cache poisoning vulnerabilities, which could allow attackers to predict source ports and query IDs and inject forged DNS records.
Microsoft has disabled File Explorer’s preview pane for downloaded files to mitigate NTLM credential theft attacks via malicious documents.
OpenAI’s Atlas and Perplexity’s Comet browsers are vulnerable to sidebar spoofing attacks, allowing malicious extensions to impersonate AI sidebar interfaces and mislead users.

Notable Threat Actor Activity

North Korean Lazarus Group targeted at least three European defense companies with Operation DreamJob, leveraging fake job offers to compromise systems and steal drone-related intellectual property.
Russian government involvement with cybercrime groups has shifted from passive tolerance to active management, according to recent security firm analysis.
The “Smishing Triad,” a Chinese cybercriminal group, has shifted tactics to lower-frequency, higher-impact government impersonation SMS phishing attacks.
Researchers identified a new infostealer targeting Android devices, as part of an ongoing expansion in the infostealer threat landscape.
YouTube continues to be leveraged by threat actors as a malware distribution network, with evolving tactics for wider reach.

Trends, Tools, or Tactics of Interest

A phishing campaign is impersonating password managers (LastPass and Bitwarden) with fake breach notifications to steal credentials.
Phishing emails targeting cloud accounts, often in French and English, have been observed, warning recipients about purported payment issues to lure credentials.
Enterprises are increasingly abandoning static secrets in favour of managed identities to address risks associated with machine identities in cloud environments.
The Verizon 2025 Mobile Security Index reports that 85% of organizations believe mobile device attacks are increasing, with AI-powered threats raising particular concern.
AI sidebar spoofing, where browser extensions imitate trusted AI interfaces, is an emerging attack vector against users of AI-enabled browsers.
Zero Trust models are facing challenges in governing AI agents, with new blind spots emerging as AI agents gain broader access and autonomy.
Security researchers at Pwn2Own Ireland 2025 exploited 73 zero-day vulnerabilities, earning over $1 million in rewards, highlighting the ongoing prevalence of unknown flaws in widely used software.
Meta has enhanced scam protection features on WhatsApp and Messenger, as part of efforts to combat impersonation and fraud, following the removal of over 21,000 fake customer support pages from Facebook.
AI coding tools are introducing security risks by generating functional but flawed code, prompting calls for embedding security checks directly into AI development workflows.

Regulatory or Policy Developments Affecting the Security Industry

The UK Competition and Markets Authority (CMA) is considering measures that may require Apple to allow rival app stores on iPhones, challenging its current “walled garden” approach.
A $14 billion cryptocurrency seizure by US authorities signals increased regulatory scrutiny on the use of cryptocurrencies by cybercrime syndicates.
HP withdrew a software update for Windows 11 AI PCs after it caused the deletion of Microsoft certificates necessary for Entra ID authentication, disrupting organizational access.

Cybersecurity Brief – 2025-10-23

Thu, 23 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Over 250 Magento and Adobe Commerce stores were compromised overnight through active exploitation of the critical “SessionReaper” vulnerability (CVE-2025-54236), with hundreds of attack attempts recorded.
FinWise suffered a data breach attributed to insider threat activity, exposing sensitive data.
Jewett-Cameron, a fencing and pet company, was hit by ransomware, with attackers exfiltrating sensitive information and threatening to release it unless a ransom is paid.
More than 100 Chrome extensions were found to be abusing WhatsApp Web for bulk messaging, violating both Chrome and WhatsApp anti-spam policies.
Ukraine war relief organizations and regional government entities were targeted in a spear-phishing campaign (“PhantomCaptcha”) delivering remote access malware via weaponized PDFs and fake Zoom meeting invitations.
Home Depot customers were targeted by a phishing campaign using fake Halloween giveaways, leveraging tracking pixels and compromised websites.
A fake Nethereum NuGet package using homoglyph attacks was discovered stealing cryptocurrency wallet keys via a supply chain attack.
The North Korean Lazarus Group is conducting cyber-espionage campaigns targeting European drone manufacturing data.
The Iranian MuddyWater APT group targeted over 100 global government and private organizations with the Phoenix backdoor, leveraging compromised mailboxes and phishing with macro-enabled documents.

Newly Discovered Vulnerabilities

Critical “SessionReaper” vulnerability (CVE-2025-54236) in Adobe Commerce and Magento Open Source is being actively exploited for unauthorized access and session hijacking.
A high-severity remote code execution vulnerability (“TARmageddon”) was identified in the abandoned async-tar Rust library and its forks, potentially affecting any dependent software.
Critical vulnerabilities in TP-Link’s Omada Gateways were patched, including a flaw allowing remote unauthenticated arbitrary command execution.
Zero-click Dolby audio bug (CVE-2025-54957) allows code execution via audio files on Android and Windows devices.
Motex Lanscope Endpoint Manager has a critical security flaw now listed in CISA’s Known Exploited Vulnerabilities catalog, confirmed to be under active attack.
Oracle released its October 2025 Critical Patch Update addressing 374 vulnerabilities across its product suite.
Microsoft SharePoint’s ToolShell vulnerability (CVE-2025-53770) is being exploited by Chinese threat actors even after public disclosure and patch release.

Notable Threat Actor Activity

Iranian APT MuddyWater used the Phoenix backdoor in a global espionage campaign, targeting government, financial, and industrial organizations, primarily in the Middle East and Africa.
Chinese threat actors associated with the ToolShell campaign exploited a SharePoint vulnerability to compromise organizations across government, telecom, and education sectors on four continents.
Russian APT Star Blizzard shifted to new backdoors (NoRobot/BaitSwitch and MaybeRobot/SimpleFix) after their previous malware, LostKeys, was exposed by researchers.
Lazarus Group (North Korea) is actively seeking sensitive data from European drone manufacturers.
APT group PassiveNeuron, identified by Kaspersky, is targeting government, financial, and industrial entities in Asia, Africa, and Latin America using custom malware (Neursite, NeuralExecutor).

Trends, Tools, or Tactics of Interest

Attackers are abusing X’s generative AI bot Grok to spread phishing links by manipulating the AI into responding with malicious URLs.
Threat actors are exploiting public cloud outages (e.g., AWS) to launch themed phishing attacks against affected users.
Researchers demonstrated that poisoning large language models (LLMs) can be achieved with as few as 250 documents, significantly lowering the barrier for AI model manipulation.
Data sprawl and the prevalence of hardcoded credentials, access tokens, and API keys are increasing the risk of data breaches due to over-privileged secrets.
Burp Suite’s new agentic Burp AI capabilities were tested for automated vulnerability discovery, showing notable effectiveness in identifying web application flaws.
Meta introduced new anti-scam tools for WhatsApp and Messenger to enhance user protection against scams.
Over 100 Chrome extensions are circumventing anti-spam controls on WhatsApp Web, indicating ongoing abuse of browser platforms for message automation.
Supply chain attacks continue to target package managers, as evidenced by the malicious Nethereum NuGet package.
Pwn2Own Ireland 2025 saw researchers exploit 90 previously unknown vulnerabilities across two days, earning over $1.3 million in rewards, highlighting the ongoing discovery of zero-days in widely used devices and platforms.

Regulatory or Policy Developments

Canada fined Cryptomus, a digital payments platform, $176 million for facilitating transactions with Russian cryptocurrency exchanges and cybercrime-linked websites.
WhatsApp secured a permanent ban on NSO Group after a six-year legal battle, with NSO ordered to pay $4 million in damages and prohibited from reverse-engineering WhatsApp or creating new accounts.
Russia is increasing enforcement actions against domestic hackers, reassessing its approach to providing safe haven in response to Western law enforcement pressure.

Cybersecurity Brief – 2025-09-10

Wed, 10 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Plex has disclosed a data breach affecting emails, usernames, password hashes, and authentication data stored in a database. Users have been urged to reset their passwords.
Wayne Memorial Hospital suffered a breach in May 2024, with hackers stealing names, Social Security numbers, financial information, and protected health information of approximately 160,000 individuals.
Qantas reduced executive pay following a data breach earlier this year in which threat actors compromised a third-party platform and accessed customer personal information.

Newly Discovered Vulnerabilities

Adobe patched a critical vulnerability (CVE-2025-54236, also called SessionReaper) in its Commerce and Magento Open Source platforms, which allows attackers to take over customer accounts. This is described as one of the most severe flaws in the platform’s history. Adobe also released fixes for critical vulnerabilities in ColdFusion.
SAP released updates for 21 vulnerabilities, including three critical issues in NetWeaver (CVSS up to 10.0) that could enable remote code execution and privilege escalation, as well as high-severity flaws in S/4HANA.
Microsoft’s September 2025 Patch Tuesday addressed 81–86 vulnerabilities (depending on source), including two publicly disclosed zero-day flaws and numerous escalation of privilege bugs. No vulnerabilities were reported as actively exploited prior to release.
Researchers disclosed “catastrophic” vulnerabilities in the platforms operated by Restaurant Brands International (RBI) for Burger King, Tim Hortons, and Popeyes.
Microsoft released Windows 10 (KB5065429) and Windows 11 (KB5065426, KB5065431) cumulative updates, addressing security vulnerabilities and system issues.
Microsoft is investigating an anti-spam bug causing Exchange Online and Teams to mistakenly block URLs and quarantine emails.

Notable Threat Actor Activity

A TOR-based cryptojacking campaign is expanding, targeting exposed Docker APIs. Attackers mount host filesystems in new containers, fetch malicious scripts via TOR, and block Docker API access. Tooling updates suggest efforts to build a complex botnet.
A Kosovo national pleaded guilty to running BlackDB.cc, a cybercrime marketplace active since 2018.
The U.S. charged a Ukrainian national for administering the LockerGoga, MegaCortex, and Nefilim ransomware operations.
A threat actor has been identified as connected to Play, RansomHub, and DragonForce ransomware, deploying multiple malware families, backdoors, a proxy tunneller, and reconnaissance tools.
A large NPM supply chain attack involved phishing the Qix NPM account and publishing malicious versions of 18 popular open source packages, collectively receiving over 2 billion weekly downloads.

Trends, Tools, or Tactics of Interest

Axios HTTP client abuse and Salty 2FA phishing kits are being combined with Microsoft’s Direct Send feature in advanced Microsoft 365 phishing campaigns, creating highly efficient attack pipelines.
The Salty2FA phishing kit is being used at an enterprise level, with adversaries employing advanced strategy and planning.
RatOn Android malware has evolved from conducting NFC relay attacks to a sophisticated remote access trojan with Automated Transfer System (ATS) banking fraud capabilities.
Recent phishing campaigns are delivering MostereRAT, a banking malware now functioning as a remote access trojan, using a variety of evasion and delivery techniques.
Ransomware losses are increasing, with trends including triple extortion and more sophisticated social engineering, as reported in midyear insurance claims analysis.
The browser is increasingly viewed as a critical endpoint, with rising usage prompting calls for improved browser-focused security controls.
Shadow AI agents are proliferating within enterprise environments, raising risks related to detection and control.
External Attack Surface Management (EASM) is highlighted as a key approach for identifying and prioritizing remediation of unknown internet-facing assets.
Microsoft is testing new AI-powered features in Windows 11 File Explorer to improve file handling capabilities.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury imposed sanctions on networks of cyber scam operations in Southeast Asia, responsible for stealing over $10 billion from Americans in the past year. Firms in Burma and Cambodia cooperating with these cybercrime syndicates are also facing enforcement actions.
A court ordered Google to pay $425 million in a class action lawsuit for misleading users about their online privacy.
Mitsubishi Electric announced the acquisition of industrial cybersecurity firm Nozomi Networks for nearly $1 billion.
The Public Service Alliance launched a new platform offering privacy and threat monitoring tools to public servants.
Attaullah Baig, former WhatsApp security chief, filed a lawsuit against Meta, alleging retaliation over critical cybersecurity failures.