Hello all,
As expected, Microsoft and a cadre of other vendors unleashed updates this past week. I shouldn’t be surprised that the quantity appears to be increasing, but I am. With the concerted push for the past few years on zero-trust, and memory safe software, shouldn’t the defects be decreasing? Microsoft, for their part, plugged two zero-day defects, one of which was already under active exploitation. Our Headline News section will get into a few more details and list some other vendors. With the non-tech news of national and world events chronicling significant unrest, expect that threat actors will be taking advantage and launching fresh click-bait, phishing, and malware attacks. Definitely keep the shields up.
As usual, my commentary is followed by a plethora of links to other items that are worth skimming to see if they interest you or pertain to your particular environment or of those you support. There is a lot more than what is provided in these opening comments, just scroll down a bit.
Headline NEWS:
- Google Chrome patched several more vulnerabilities this week. You know the drill by now, close and reopen your browser, or go to help and about to check for updates. And expect that Chromium browsers, such as Microsoft Edge, will be updating shortly as well.
- Fortinet has revealed several high-severity vulnerabilities in FortiManager, FortiAnalyzer, FortiAnalyzer-BigData, FortiOS SSL-VPN web-mode, FortiClientEMS, FortiClient for Windows, FortiPAM, FortiSRA, FortiSASE, FortiPortal, FortiProxy, and FortiWeb. Basically, if you have anything Fortinet, look for updates and apply them quickly as this vendor is a favorite of enterprising threat actors.
- Ivanti has unleashed fixes for three defects in their Workspace Control product. To quote their announcement, “Ivanti has released updates for Ivanti Workspace Control which address three high severity vulnerabilities. Successful exploitation could lead to credential compromise…” You’d think they would have found all of these things by now, since they’ve been doing code review for the past couple of years. Thankfully, there are no reports of active exploitation of these vulnerabilities yet.
- Microsoft Patch Tuesday provided 66 defect fixes with at least one actively exploited zero-day receiving a patch. There are some doozies in the list of defects such as a Windows SMB Client Elevation vulnerability, Remote Desktop, Netlogon, windows Cryptographic services, and a goodly number in the Office suite. Needless to say, vet these quickly and apply them as soon as you can. If you’re interested in an excellent review of the history of Microsoft vulnerabilities, check out the Beyond Trust report link in our Ransomware, Malware, and Vulnerabilities section.
- Salesforce has had five zero-days revealed, along with quite a few misconfiguration issues that can lead to data leakage and compromise. The zero-days were fixed by Salesforce, but the misconfiguration issues, which apparently are rather common, need to be fixed at the client end. If you use any of the Salesforce Industry Cloud offerings, you should immediately check the link for details on how to fix the holes.
- SAP has patched 14 defects that span a wide range of their products. Some of the flaws that were plugged are rated critical, such at in NetWeaver, so again, vet and apply quickly.
In Ransomware, Malware, and Vulnerabilities News:
- INTERPOL, working with 26 different countries as part of Operation Secure, just took down over 20,000 IP addresses and domains, along with 41 servers and over 100GB of data. This operation took down 79% of the malicious infrastructure and saw the arrests of 32 individuals linked to the criminal network. Score a nice win for the good guys!
- Supply Chain Attacks have massive downline impacts, as can be witnessed by the recent successful ransomware event at United Natural Foods, a distributor to over 30,000 stores and supermarkets in the USA and Canada. Whole Foods, UFC, Safeway, Central Co-op, and more are all experiencing product shortages. Trucks are sitting idle since they are not able to receive orders and fulfill deliveries. Fuel for those trucks will not be purchased, Farmers that have produce piling up cannot get it to market, and the list goes on. We need to realize that these type of supply-chain attacks have far-reaching impacts that, if not remedied quickly, can have devastating economic impacts.
In Other News Events of Note and Interest:
- Denmark and German state dumping Microsoft. Citing “Digital Sovereignty” as the reasoning, a desire to not be dependent upon foreign countries or powers for their computing and technological needs, The Danish government and the German state of Schleswig-Holstein have said that they will transition from Microsoft to Linux and Libre Office, joining France’s gendarmerie, and India’s defense ministry. These moves are part of a growing trend and echoes the European Commission (EC) call to take action to reduce the region’s reliance on foreign-owned digital services and infrastructure. If this continues, it could be an interesting time for Big Redmond.
Musings:
This weekend my wife and I took a train trip for a mini vacation. While on the train, I noticed that I was able to see the screen of the gentleman seated alone in front of me. I clearly saw his name (I’ll call him Carlos) in about 24-point type in an Outlook email signature. He was working on replies to emails, financial spreadsheets, forecasts, and a PowerPoint presentation that dealt with recent sales visits. At one point he took a phone call and got up to go to the restroom at the front of the train car. He left his computer open, screen on, and unlocked. I kept looking at my watch to see how long he was away and completely out of sight of his computer. He was gone for over five minutes. When Carlos returned, I waited until his phone call ended and then I moved one seat forward and introduced myself to him, calling him by name. I explained that I work in cyber security and told him how I knew his name. Then I explained that in the time that he was gone, had I been a threat actor, I would have had more than ample time to install a malicious keylogger that would have compromised his computer and subsequently his entire company. He was very appreciative and said that he’d share what he’d just learned with his colleagues. I then showed him how to set up Dynamic Lock on this computer so that when he leaves its proximity it automatically locks the screen. As Cyber Matt Lee says, #LockItUp. Doing my part to keep the world a bit safer.
Keep the shields up.
Viscount Jan Broucinek
Red Dot Security News
Headline NEWS
- Multiple Chrome Vulnerabilities Allow Attackers to Execute Malicious Code Remotely
- Fortinet OS Command Injection Vulnerability Lets Attackers Execute Unauthorized Code on Forti-Products
- FortiOS SSL-VPN Vulnerability Let Attackers Access full SSL-VPN settings
- Fortinet, Ivanti Patch High-Severity Vulnerabilities
- Ivanti Workspace Control hardcoded key flaws expose SQL credentials
- Microsoft June 2025 Patch Tuesday fixes exploited zero-day, 66 flaws
- Microsoft Releases June 2025 Patch Tuesday Updates
- Five Zero-Days, 15 Misconfigurations Found in Salesforce Industry Cloud
- Critical SOQL Injection 0-Day Vulnerability in Salesforce Affects Millions Worldwide
- SAP June 2025 Patch Day – 14 Vulnerabilities Patched Across Multiple Products
- Critical Vulnerability Patched in SAP NetWeaver
Ransomware, Malware, and Vulnerabilities News
- ConnectWise rotating code signing certificates over security concerns
- CISA, Microsoft warn of Windows zero-day used in attack on ‘major’ Turkish defense org
- USPS warning customers of ‘brushing’ scams
- INTERPOL Dismantles 20,000+ Malicious IPs Linked to 69 Malware Variants in Operation Secure
- Europe just launched DNS4EU, a public DNS resolver with privacy and security options
- Chinese AI outfits smuggling suitcases full of hard drives to evade U.S. chip restrictions — training AI models in Malaysia using rented servers
- Microsoft Vulnerabilities Report 2025 from BeyondTrust
- Software vulnerabilities pile up at government agencies, research finds
- ‘Major compromise’ at NHS temping arm never disclosed
- Roundcube RCE: Dark web activity signals imminent attacks
- Critical flaw in Microsoft Copilot could have allowed zero-click attack
- Microsoft Outlook Vulnerability Let Attackers Execute Arbitrary Code Remotely
- Over 80,000 Microsoft Entra ID Accounts Targeted Using Open-Source TeamFiltration Tool
- Windows SMB Client Zero-Day Vulnerability Exploited Using Reflective Kerberos Relay Attack
- Windows Task Scheduler Vulnerability Let Attackers Escalate Privileges
- Google fixes bug that could reveal users’ private phone numbers
- iPhone spyware campaign may have hit politicians, journalists: iVerify
- Graphite Caught: First Forensic Confirmation of Paragon’s iOS Mercenary Spyware Finds Journalists Targeted
- Hacking the Hackers: When Bad Guys Let Their Guard Down
- 40,000 Security Cameras Exposed to Remote Hacking
- New Eleven11bot Hacked 86,000 IP Cameras for Massive DDoS Attack
- New Secure Boot flaw lets attackers install bootkit malware, patch now
- Found in the wild: 2 Secure Boot exploits. Microsoft is patching only 1 of them.
- Palo Alto Networks Patches Privilege Escalation Vulnerabilities
- Palo Alto GlobalProtect App: Interception in Endpoint Traffic Policy Enforcement
- Cyberattacks on smartphones hit new high – here’s how to stay safe
- GitLab patches high severity account takeover, missing auth issues
- 295 Malicious IPs Launch Coordinated Brute-Force Attacks on Apache Tomcat Manager
- Next-Gen Developers Are a Cybersecurity Powder Keg
- SmartAttack uses smartwatches to steal data from air-gapped systems
- Global Heroku Outage Disrupts Web Platforms Worldwide
- FIN6 hackers pose as job seekers to backdoor recruiters’ devices
- While in mourning, hacker used Maine mom’s Facebook to ‘sell’ her late daughter’s items
- Major US grocery distributor warns of disruption after cyberattack
- Whole Foods sees shortages after United Natural Foods cyberattack
- Cyberattack at massive grocery distributor hitting Capitol Hill-area stores large and small
- Eggs in a Cloudy Basket: Skeleton Spider’s Trusted Cloud Malware Delivery
- Dangerous new MacOS malware is targeting Apple users everywhere
- Old solar gadgets, rogue modules, and risky firmware could be the cyber timebomb inside your solar system
- Misconfigured HMIs Expose US Water Systems to Anyone With a Browser
- OpenAI Bans ChatGPT Accounts Used by Russian, Iranian, and Chinese Hacker Groups
- PoC Exploit Released for Fortinet 0-Day Vulnerability that Allows Remote Code Execution
- New Mirai botnet infect TBK DVR devices via command injection flaw
- Two Distinct Botnets Exploit Wazuh Server Vulnerability to Launch Mirai-Based Attacks
- Cybercriminals turn to “residential proxy” services to hide malicious traffic
- Microsoft Outlook to block more risky attachments used in attacks
- Cybercriminals love this ancient Windows tool, but a little-known CLI utility is their new secret weapon
- New Rust Based InfoStealer Extracts Sensitive Data from Chromium-based Browsers
- CyberEYE RAT Disables Windows Defender Using PowerShell and Registry Manipulations
- Nearly 300,000 crash records stolen from Texas transportation department
- Hacker Strikes Mortgage Firm, Steals Personal Info From 30,453 People, Including Security Numbers, Names and Account Details
- Major data breach at popular hookup app leaks data on millions of users
- Erie Insurance confirms cyberattack behind business disruptions
- Cyber security expert weighs in on cyber-attack on local DA’s offices
- Hackers claim fresh T-Mobile data breach
- WestJet investigates cyberattack disrupting internal systems
- China-Backed Hackers Target SentinelOne in Attack Spree
- Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets
- From Whole Foods to Victoria’s Secret, cyberattacks impact shoppers
- Victoria’s Secret restores critical systems after cyberattack
- The Cost of a Call: From Voice Phishing to Data Extortion
- Online orders working again at M&S, 46 days later
- Belarusian hackers taunt Kaspersky over report detailing their attacks
- Sophisticated Skitnet Malware Actively Adopted by Ransomware Gangs to Streamline Operations
- George warns of malicious links after hackers breach local business emails
- Sensata Technologies says personal data stolen by ransomware gang
- Arkana Ransomware Group Claims Major Breach of Ticketmaster Databases
- Anubis ransomware adds wiper to destroy files beyond recovery
Other News Events of Note and Interest
- Cool Tool: Rufus 4.8 brings performance boost for Windows ISOs
- Cool Tool: I started editing all my PDF files with this free, self-hosted tool, and I’m not going back
- Old but gold: Paper tape and punched cards still getting the job done – just about
- Why Denmark is dumping Microsoft Office and Windows for LibreOffice and Linux
- ‘We’re done with Teams’: German state hits uninstall on Microsoft
- “Localhost tracking” explained. It could cost Meta 32 billion.
- Fears of a Bubble for Legal Tech AI Are Growing
- Google Cloud goes down, takes Cloudflare with it
- Google DeepMind just changed hurricane forecasting forever with new AI model
- Google has a new AI model and website for forecasting tropical storms
- Apple WWDC 2025: the 13 biggest announcements
- Apple renames its operating systems
- Apple Researchers Just Released a Damning Paper That Pours Water on the Entire AI Industry
- Apple (AAPL) Targets Spring 2026 for Release of Delayed Siri AI Upgrade
- Enterprises are getting stuck in AI pilot hell, say Chatterbox Labs execs
- OpenAI signs surprise deal with Google Cloud despite fierce AI rivalry
- The Gentle Singularity – Sam Altman
- Anthropic’s AI-generated blog dies an early death
- Agent-based computing is outgrowing the web as we know it
- How to get the most out of Google’s free AI Studio
- China shuts down AI tools during nationwide college exams
- Goodbye to confidentiality – court ruling forces ChatGPT chats to be saved and digital privacy alarms are raised
- IBM is building a large-scale quantum computer that ‘would require the memory of more than a quindecillion of the world’s most powerful supercomputers’ to simulate
- Wireshark Certified Analyst – Official Certification for Network Professionals
- FAA to eliminate floppy disks used in air traffic control systems – Windows 95 also being phased out
- Barclays to Roll Out Microsoft 365 Copilot to 100,000 Staff
- Copilot Vision brings Microsoft’s screen-watching AI to everyday Windows tasks
- Microsoft gives a sassy reminder to Apple that Vista had “Liquid Design” almost 20 years ago
- Microsoft Edge gets new password feature and security fixes
- Microsoft fixes unreachable Windows Server domain controllers
- Microsoft creates separate Windows 11 24H2 update for incompatible PCs
- Windows 11 KB5060842 and KB5060999 cumulative updates released