Hello all,
As expected, Patch Tuesday was quite large. Microsoft recently warned that for the foreseeable future the amount of patches, and potentially even the frequency of patch releases, would be significantly higher, and they weren’t kidding. This month brought roughly 400 patches across most everything they offer. Not to be outdone, vendors from A to Z – Adobe to Zoom, and a slew of others in between, such as AMD, Cisco, Docker, Google, Fortinet, Mozilla, Palo Alto, Red Hat, SAP, and WordPress all announced patches for issues.
In Good News, there is a story about DEFCON hackers protecting the nation’s water utility infrastructure, a report of a honeypot operation to catch North Koreans looking to infiltrate companies by impersonating western workers, news of the USA giving permission to hack back, and some news of successful law enforcement activity against some of the evil underbelly of cybercriminals. Let’s take a look at a few of the items in a bit more detail.
Headline NEWS:
- A to Z vulnerabilities found and patched. Adobe, Cisco, Fortinet, Microsoft, WordPress, and Zoom all announced patches for critical or severe vulnerabilities in their products this past week. Some of these require no action on the part of the victim, so be sure to check out the full articles for attack vectors, mitigation, patching instructions, and how to detect if you’ve been exploited. Or just enable auto-updates for anything that supports it, and check that you’re on the latest versions. If the product doesn’t support auto-updating, look for an alternative or ensure that you stay aware of, and perform updates, whenever a patch is needed. It is high time that every product, software and hardware, had reliable auto updating, and failed update rollback, capabilities.
In Ransomware, Malware, and Vulnerabilities News:
- Delta Airlines reported a Wi-Fi Pineapple was detected on a flight. DEFCON, aka hacker summer camp, ended the day prior, and on a flight from that event, it seems that one of the participants decided to try out his (or her) newly acquired skills and/or toy. The message from the cockpit to Air Traffic control read, “A HEY ALERT CORP SECURITY WE HAVE A PAX ON THAT HAS CREATED A SCAM WIFI CALLED DELTA WIFI FAST WE BELIEVE THEY ARE TRYING TO SCAM THE OTH PAX”. And “NO INFO AS OF NOW WE HAVE A BUNCH OF PAX THAT WERE AT A CYBER CONFRENCE IN LAS THE WERE ABLE TO JAM OUR WIFI AND BRODCAST THERE SIGNIAL”. Terse language and bad grammar aside, I’m amazed that this doesn’t happen more often. It probably does, but this one received news coverage due to the proximity to DEFCON, Black Hat, and BSidesLV. If you’ve been paying attention to the cyber news you would recall that quite a few hotel Wi-Fi networks are being similarly attacked worldwide right now. It isn’t safe out there, always use a VPN when connecting over any public form of Wi-Fi. Spoofing a legitimate one and routing all traffic for capture and later decryption and inspection is now quite trivial.
In Other News Events of Note and Interest:
- Social media addiction lawsuits against Meta and TikTok can proceed, court rules. Companies such as Google, Facebook, Instagram, Snapchat, and TikTok are facing a nightmare scenario as the courts are permitting lawsuits to go through that remove personal responsibility and ask the content creation hosts to be the parent and guardian and limit what consumers can view, how, and how much. They are being accused of having “developed and refined a set of psychologically manipulative platform features designed to maximize young users’ time spent on its social media platforms”. I would counter that it is the responsibility of the company to their investors to do exactly that! The company isn’t the nanny, they are there to get clicks, views, likes, shares, and the most profit possible. It is the parents’ responsibility to monitor and limit their children’s access, content, and time spent. But our society has devolved to the point that it must be someone else’s fault, and there’s always a lawyer willing to go for it. This is why we can’t have nice things for long. I predict this will not end well for the social media companies.
Musings
The social media addiction lawsuits brought by a handful of US states against Alphabet, Meta, Snap, ByteDance and similar have been given the green light by the 9th Circuit Court of Appeals to proceed. This is dangerous, irresponsible, and unwarranted. While it is undeniably true that the companies do indeed design their systems to keep viewers engaged and on their platforms, clicking, liking, sharing, commenting, and posting as much as possible; that is their obligation to their shareholders and investors. Any company that doesn’t maximize whatever their product is designed to do will ultimately fail against one that does. This lawsuit, and thousands like it, is an abdication of personal and parental responsibility. Nobody made you install that app on your phone; nobody made you center your life around clicks, watches, and likes; nobody made you keep doing it; and to contend that the manufacturer is responsible for your choices and any potentially negative personal result is wrong.
Keep the shields up!
Viscount Jan Broucinek
Red Dot Security News
Headline NEWS
- Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
- Cisco Patches Critical SD-WAN, IOS XE, FMC Vulnerabilities
- Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
- Cisco Patches Firewall Zero-Day Exploited for DoS Attacks
- Fortinet Patches Authentication Flaws in FortiWeb and FortiManager
- Microsoft’s Patch Tuesday Deluge Continues With August Updates
- Critical WordPress RCE Vulnerability Allows Authors to Execute Code via Malicious PNG File
- Zoom Patches “Zoomsday” Zero-Click Flaw Enabling Remote Code Execution
- Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee’s Client
Ransomware, Malware, and Vulnerabilities News
- Good News, Government News, and Interesting
- DEF CON hackers add new muscle to water utility protection
- CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs
- North Korean remote IT staffer worked for US government agency, says FBI
- China rejects New Zealand spy allegations as false
- Researchers Create Fake Startup to Dupe North Koreans Looking for Remote Gigs
- Donald Trump empowers US private companies to conduct cyber-attacks
- Portuguese hacker to face trial for malicious ChatGPT clone
- Hackers arrested over €30M bank fraud exploiting service provider flaw
- Ukraine shuts down 94 fraudulent call centers, seize millions in cash
- Vulnerabilities and Exploits
- Royal Navy’s K3 Scout vessel had firmware sending data back to China
- 18-Year-Old Linux Kernel Vulnerability Enables Root Access and Container Escape
- Hackers Actively Scanning to Exploit VMware VCenter Vulnerabilities
- Red Hat ACM Privilege Escalation Vulnerability Lets Attackers Gain Full Cluster-Admin Access
- Delta investigating after someone set up fake Wi-Fi network mid-flight
- Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo
- This bizarre email flaw is leaking corporate secrets to anyone who buys the right domain
- Microsoft Outlook Vulnerability Allows Attackers to Execute Malicious Code Remotely
- After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug
- Windows 11, Windows 10, Windows Server affected by in-the-wild exploit, here’s what to do
- Hackers leverage new Microsoft SharePoint exploit in attacks
- Cisco warns of high-severity ClamAV flaws with public exploits
- SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code
- GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE
- Hackers exploit critical Adobe Commerce flaw to hijack customer accounts
- Microsoft Exchange Server Vulnerabilities Enables DoS, Privilege Escalation and RCE Attacks
- Microsoft patches LegacyHive Windows zero-day vulnerability
- Palo Alto Networks Patches 11 New Vulnerabilities Across PAN-OS, GlobalProtect, and Prisma Access
- Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius
- An Advanced Attacker Is Targeting Salesforce and ServiceNow
- Docker CopyEscape Vulnerability Enables Host File Overwrite and Root Code Execution
- Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave
- New Evooo1Bot Linux botnet turns routers into traffic relay nodes
- AMD confirms high-severity Ryzen TPM vulnerability and details fixes
- Phishing, Malware, and Similar
- Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks
- Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development
- Fake popular sites offer a free app, instead take over PCs
- Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
- Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
- Sexual predators targeting online accounts for intimate images, FBI warns
- 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies
- AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS
- CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps
- New Pass-ta-key attack reveals all the things we didn’t know about passkeys
- Fake GitHub download targets Mac browsers
- Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth
- Hackers exploit macOS Screen Sharing flaw to deploy Monero miner
- Critical VMware vCenter RCE flaw exploited for reverse SSH access
- Bring Your Own EDR Attack Turns SentinelOne Into PPL-Protected Trojan Horse to Shield Malware
- Breaches, Leaks, and Ransomware
- UK manufacturers face rising hacking risk as survey shows 30% were hit last year
- The State of Ransomware Q2 2026 – Check Point Research
- Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack
- Trezor discloses data breach affecting nearly 14,000 customers
- Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine
- Multistate Water System Attacks Widen, Iran Suspected
- LexisNexis blames outage on ‘unusual server activity’
- New StormEncryptor ransomware used by former Medusa affiliate
- Valve notifies Steam hardware customers of a data breach
- Cyberattack on logistics giant Ceva hits retailers and Steam customers across Europe
- A data breach at shipping giant Ceva Logistics is rippling across banks, retailers, Steam gamers, and beyond
- RingCentral data breach exposed info of 1.6 million accounts
- Ransomware Attacks Are Targeting Managers and other Business Leaders
- City Declares Local Emergency After Cyberattack Disrupts 911 Calls
- Gunra Ransomware Exploits Fortinet VPN Flaws to Bypass MFA and Steal Enterprise Data
- Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA
- US and South Korea warn of Gunra ransomware targeting govt agencies
- DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
- Uber Freight reportedly investigating after hacking group claims data breach
- Akira ransomware scum blocked victim’s security tools – and broke their own encryptor
- New StormEncryptor ransomware used by former Medusa affiliate
- Shell investigates ‘potential incident’ after Clop data theft claims
Other News Events of Note and Interest
- Cool Tool: Sysinternals Suite 2026.12.08
- PC-1: The 1954 Computer With No Tubes, Relays, Or Transistors
- Social media addiction lawsuits against Meta and TikTok can proceed, court rules
- Everybody Says Curiosity Is the Skill. Nobody Tells You How to Deliver It
- The hierarchy of competence
- Linux Mint’s new kernel cleanup feature makes it even more appealing for people escaping Windows
- Serving the most critical missions- Cloudflare for Government achieves FedRAMP Class D (High) Certified status
- Everything I Learned Shipping Device Bound Session Credentials
- Elon Musk’s New Texas Factory Will Be the Largest Building on Earth, If All Goes According to Plan
- Why patching networks against cyberattacks is ‘very scary’ in the age of AI
- PQC in Plaintext: Google Cloud’s post-quantum cryptography roadmap
- Musk Hints Starlink Is Coming to Future Teslas as Cybercab Shows Integrated Dish
- VLC blames Windows 11 bug for slow performance, defends open source and calls out Microsoft
- AI, LLM’s, and Skynet
- Cisco thinks Mythos means instant death for unsupported networking kit
- Responding to the next frontier of critical cyber capabilities
- Expanding Daybreak as the Cyber Defense Window Narrows
- Anthropic to start watermarking Claude-generated text, images
- Anthropic sees AI risks rising, no plan to release stronger “Model 2”
- Introducing Muse Glimmer: An Open Agentic Model That Runs on Your Device
- Mark Zuckerberg Lays Out New AI Vision in 6,500-Word Essay
- OpenAI’s GPT-5.6-Cyber answers 95% of exploit requests, up from 1.5% for Sol
- Token-maxxing is dead. Agentic memory is what comes next
- Gemini becomes Google’s fastest-growing product ever as it hits 1B users
- SpaceXAI launches OpenClaw-style Grok Bot that can work across apps on its own
- SpaceXAI debuts Grok 4.6, overtaking Kimi K3’s performance and matching GPT-5.6 Sol
- Off-by-1 Labs Research: AI-generated vulnerability patches require human review
- Microsoft
- Why Microsoft Patch Tuesday Updates Suddenly Have So Many More Fixes
- Are Microsoft preparing license enforcement for Entra ID?
- Microsoft gives in to backlash, will let Windows 11 users remove OneDrive Photos AI app without breaking synced files
- Windows 11 is pulling picture passwords and pushing people to PINs, passwords, and biometrics
- Microsoft Hikes Windows OEM Licensing Fees 7-10%, Pushing PC Prices Up Another 5% This Quarter
- Microsoft Entra Tenant Governance is now generally available
- Microsoft explains the recent Xbox outage and outlines upcoming fixes
- Here are all the new Entra features Microsoft rolled out to IT admins recently
- Windows 11 KB5121003 & KB5120240 cumulative updates released
- Microsoft releases Windows 10 KB5120249 extended security update
- Released: August 2026 Exchange Server Security Updates
- The little-known winstart.bat batch file
- Microsoft releases Visual Studio Code 1.133, here’s what’s new
- Microsoft is limiting Microsoft 365 & OneDrive on Windows 10 to push holdouts to Windows 11
- Microsoft urges IT admins to consider using Entra ID instead of Active Directory
- Why Active Directory alone is no longer enough
- Windows 11 24H2, Windows Server 2022, Windows 10 Ent. LTSB 2016 get 60-day cut off warnings