(For a video version of the introduction below, click here.)
Hello all,
This past week was Patch Tuesday for Microsoft and several other vendors. Apparently feeling that it should be Patch Week instead of just one day, Juniper and VMware chose different days to unleash required fixes. There’s lots of other items to talk about as well, so let’s get to them.
Headline NEWS:
- Apple has been the subject of a not-so-secret legal case in the UK, where the limeys are demanding back door access to encrypted customer data. Apple has essentially refused and has instead turned off data protections for UK citizens in response. Apple brought an appeal of the order before the Investigatory Powers Tribunal, which ruled that the case, or at least portions of it will be heard by the public and will not be kept secret. This should be interesting. In a related note, across the pond, it was reported this past week that the State of Florida is also looking to gain back door access to encrypted communications, under the guise of protecting minors.
- Fortinet, Ivanti, and Juniper all released patches to fix defects in their products this past week. If you have any of these under your care, check your vendor’s sites for updates and follow their guidance.
- Microsoft unleashed fixes for 126 or134 flaws last week, depending on which report you’re reading. At least one of these, a zero day in the Common Log File System, is already under active exploitation. Naturally, now that there are published fixes, they will be quickly scrutinized by threat actors to find what was plugged so they can exploit the holes. Vet the patches quickly and apply them fast.
- Microsoft Teams is now requiring you to keep your version up to date. If you are more than 90 days behind the latest release, you won’t be allowed to connect until you update, nagging you every 30 days until you do so.
- US Bank Regulator Office of the Comptroller of the Currency has been in the news because of a massive and lengthy breach of its email system. Unknown threat actors had access to over 150,000 emails since at least June of 2023. The intrusion was detected and stopped in February 2025. At least one news source is reporting that one of the targeted executives didn’t have MFA on their account. Due to the time that’s elapsed from intrusion to detection, we may never know if that was the smoking gun, but dang, a regulator with no MFA, come on!
- VMware (Broadcom) released updates for 47 vulnerabilities in multiple VMware Tanzu Greenplum products. A few are severe, so if you use this check yours for updates fast. If you can’t patch immediately, VMware does have mitigation guidance.
- WhatsApp for Windows has a defect that could allow an attacker to send a specially crafted file to victims that would enable the bad guy to gain remote code execution. The fix is to update to the latest version.
- Zoom Workplace Apps has a defect that could allow for evil action via a Cross Site Scripting (XSS) attack. If you use any flavor of Zoom, including Zoom Rooms, check for and apply any updates to mitigate this hole.
In Ransomware, Malware, and Vulnerabilities News:
- China has apparently confirmed that they have indeed been hacking the United States in response to the US’s support of Taiwan, which China claims is their own. If this was any other form of attack, that would have been considered an admission of ongoing warfare. We need to pray this conflict stays in the digital realm.
- Someone Hacked Ransomware Gang Everest’s Leak Site in a bit of vigilante justice, their site was altered to say, “Don’t do crime CRIME IS BAD xoxo from Prague.” If it was from Prague, well done – Czech-mate. It would be amazing if others followed suit and gave out more hugs and kisses to similar evil dirtbags.
In Other News Events of Note and Interest:
- AI dominates the news in tech lately and we have a significant number of links to articles that talk about standards for interoperability, new tools, studies on AI motivations and mistakes, ways to use AI, and new hardware related to Artificial Intelligence.
Musings:
Backups are not sexy, but they are vital. I recall a personal incident from a number of years ago. I had literally just finished a full image backup of my personal system and went to bed. I came back to it the next day and my hard drive had irretrievably died. I was so grateful that I had a full and exact copy of everything and lost nothing of my years of digital life. Since that time backup software has gotten significantly more granular and less taxing on system resources. I have several forms of backup in active use, Microsoft One Drive continuously backs up my important files, and I have an offline backup that runs every evening that safeguards my digital life. How about you? Do you know if you could recover your documents, spreadsheets, vacation, wedding, first-steps, or graduation photos in the event of a failure, or God-forbid, a successful encryption attack? Physical spinning hard-drives used to give you some warning of when they were at risk of failing, current solid-state drives just up and quit, usually without any prior indication. Are you prepared?
Keep the shields up!
Viscount Jan Broucinek
Red Dot Security News
Headline NEWS
- UK’s attempt to keep details of Apple ‘backdoor’ case secret… denied
- Fortinet Urges FortiSwitch Upgrades to Patch Critical Admin Password Change Flaw
- Ivanti Security Updates – RCE Vulnerabilities Allow Attackers to Exploit Ivanti Products for Remote Access
- Juniper Networks Patches Dozens of Junos Vulnerabilities
- Microsoft April 2025 Patch Tuesday fixes exploited zero-day, 134 flaws
- Microsoft Patches 126 Flaws Including Actively Exploited Windows CLFS Vulnerability
- Microsoft will block Teams access if you don’t update the app this week
- US bank regulator’s email system breached
- US Bank Regulator Hack: OCC Didn’t Have Safeguard on Attacked Email Account
- VMware Patches 47 Vulnerabilities VMware Tanzu Greenplum Backup & Components
- WhatsApp Vulnerability Could Facilitate Remote Code Execution
- Zoom Workplace Apps Vulnerability Enables Malicious Script Injection Through XSS Flaws
Ransomware, Malware, and Vulnerabilities News
- CISA Adds CrushFTP Vulnerability to KEV Catalog Following Confirmed Active Exploitation
- CISA Warns of CentreStack’s Hard-Coded MachineKey Vulnerability Enabling RCE Attacks
- China acknowledges its role in years of cyberattacks against US over support of Taiwan
- NIST to Implement ‘Deferred’ Status to Dated Vulnerabilities
- Florida’s New Social Media Bill Says the Quiet Part Out Loud and Demands an Encryption Backdoor
- Brothers Behind Rydox Dark Web Market Extradited to US
- Scattered Spider Member Pleads Guilty to Cyber Charges
- Google Pushing ‘Sec-Gemini’ AI Model for Threat-Intel Workflows
- Xanthorox AI Surfaces on Dark Web as Full Spectrum Hacking Assistant
- AI tool for cybercrime claims advanced capabilities without jailbreaks
- The CVE Database: Curated Vulnerability Intelligence by Wiz
- Native cloud firewalls failed security tests, report finds
- Fortinet: Hackers retain access to patched FortiGate VPNs using symlinks
- Palo Alto Networks Warns of Brute-Force Attempts Targeting PAN-OS GlobalProtect Gateways
- PAN-OS Firewall DoS Vulnerability Let Attacker Reboot Firewall Repeatedly
- SonicWall Patches High-Severity Vulnerability in NetExtender
- Why Companies Don’t Fix Bugs
- AMD Zen 5 CPUs also affected by microcode vulnerability — Granite Ridge, Turin, Ryzen AI 300, and Fire Range at risk
- Incomplete Patch in NVIDIA Toolkit Leaves CVE-2024-0132 Open to Container Escapes
- Industrial-strength April Patch Tuesday covers 135 CVEs
- Hackers lurked in Treasury OCC’s systems since June 2023 breach
- Attackers Use ‘Spam Bombing’ to Hide Malicious Motives
- ‘Phishing, smishing and brushing’: USPS warns against scams following uptick in mail crimes
- Remote access tools most frequently targeted as ransomware entry points
- Texas State Bar warns of data breach after INC ransomware claims attack
- Critical pgAdmin Vulnerability Let Attackers Execute Remote Code
- Python JSON Logger Vulnerability Allows Remote Code Execution – PoC Released
- AI image generator’s data leak exposed thousands of prompts — and it’s a wake-up call for anyone using AI tools
- Oracle quietly confirms public cloud data breach, customer data stolen
- Customer info allegedly stolen from compromised supplier of Royal Mail, Samsung
- Fall River schools network hacked; security, police investigating
- Fortune 500 firms at risk in Wolters Kluwer data leak
- Berkshire’s NetJets Investigates Data Breach After Hacker Stole Client Data
- Cyberattack hits Oregon Department of Environmental Quality
- Massive Europcar data breach affects around 200,000 customers
- UMMC sued over a security breach
- HellCat Ransomware Hits 4 Firms using Infostealer-Stolen Jira Credentials
- Medusa Ransomware Claims NASCAR Breach in Latest Attack
- Sensata Technologies hit by ransomware attack impacting operations
- Exploitation of CLFS zero-day leads to ransomware activity
- Hackers target SSRF bugs in EC2-hosted sites to steal AWS credentials
- That massive GitHub supply chain attack? It all started with a stolen SpotBugs token
- PipeMagic Trojan Exploits Windows Zero-Day Vulnerability to Deploy Ransomware
- Threat Actors Setting Up Persistent Access to Hosts Hacked in CrushFTP Attacks
- New TCESB Malware Found in Active Attacks Exploiting ESET Security Scanner
- Flaw in ESET security software used to spread malware from ToddyCat group
- Bitdefender GravityZone Console Flaw Let Attackers Execute Arbitrary Commands
- Threat Actors Using Fake CAPTCHAs & CloudFlare Turnstile to Deliver LegionLoader
- Threat Actors Use Windows Screensaver Files as Malware Delivery Method
- Windows Active Directory Vulnerability Enables Unauthorized Privilege Escalation
- Windows Defender Antivirus Bypassed Using Direct Syscalls & XOR Encryption
- Phishing kits now vet victims in real-time before stealing credentials
- AkiraBot Targets 420,000 Sites with OpenAI-Generated Spam, Bypassing CAPTCHA Protections
- Who’s calling? The threat of AI-powered vishing attacks
- Hackers Exploiting Windows .RDP Files For Rogue Remote Desktop Connections
- Thousands of North Korean IT workers have infiltrated the Fortune 500—and they keep getting hired for more jobs
- Fake job seekers use AI to interview for remote jobs, tech CEOs say
- Someone hacked ransomware gang Everest’s leak site
- US sensor giant Sensata admits ransomware derailed ops
- Food giant WK Kellogg discloses data breach linked to Clop ransomware
- Hackers exploit WordPress plugin auth bypass hours after disclosure
- Hacker Claims WooCommerce Data Breach, Selling 4m User Records
Other News Events of Note and Interest
- Cool Tool: Download Phone Link/Link to Windows (free) for Windows, Android, APK and iOS
- CISA Releases NICE Workforce Framework Version 2.0.0 Released
- PCI DSS 4.0.1: A Cybersecurity Blueprint by the Industry, for the Industry
- OpenSSL prepares for a quantum future with 3.5.0 release
- Elon Musk enables satellite calls on iPhones and Androids worldwide
- Samsung is finally releasing Ballie, its rolling home robot
- Google says it’ll embrace Anthropic’s standard for connecting AI models to data
- Google Cloud Next: Google Workspace announces new AI tools
- Report to Congress on Generative Artificial Intelligence
- MIT study finds that AI doesn’t, in fact, have values
- LLMs can’t stop making up software dependencies and sabotaging everything
- US adults see AI largely as a threat, revealing Apple’s opportunity
- IBM releases a new mainframe built for the age of AI
- Sam Altman wants to help coders with AI, not replace them
- Cursor, “vibe coding,” and Manus: the UX revolution that AI needs
- Artisan, the ‘stop hiring humans’ AI agent startup, raises $25M — and is still hiring humans
- Dell refreshes storage and server lines for AI workloads
- Microsoft’s Passwordless Security Push to Affect Over 1 Billion Users
- Microsoft blocks latest Windows 11 24H2 update due to driver crashes
- Microsoft delays WSUS driver sync deprecation indefinitely
- Microsoft fixes auth issues on Windows Server, Windows 11 24H2
- Microsoft: Windows 11 KB5055523 fixes Kerberos bug that won’t let passwords change
- Microsoft’s worst software flop was secretly packed with Windows for years
- Microsoft: April 2025 updates break Windows Hello on some PCs
- Microsoft shares detailed guide for admins on how to fix Windows 11/10 feature update issues
- Microsoft is about to launch Recall for real this time
- Microsoft Defender will isolate undiscovered endpoints to block attacks
- April’s security update for older Office version is causing app crashes
- Microsoft releases emergency update to fix Office 2016 crashes
- Microsoft says Edge browser is now 9% faster after optimizations
- Windows 11 Update Finally Lets You Install on Older PCs
- Windows 11 tests sharing apps screen and files with Copilot AI
- Windows 11 April update unexpectedly creates new ‘inetpub’ folder
- Windows 11 adoption grows as businesses finally get around to upgrading their devices
- Windows 10 KB5055518 update fixes random text when printing
- Windows 11 24H2 April 2025 Update fixes File Explorer menu opening in opposite direction