Risk
-
Researchers report surge in scans targeting Palo Alto Networks login portals
GreyNoise reported a roughly 500% rise in IP addresses scanning Palo Alto Networks GlobalProtect and PAN-OS profiles, peaking at over 1,285 addresses on Oct. 3; GreyNoise classed most IPs as suspicious and also flagged separate Grafana exploitation attempts tied to CVE-2021-43798.
-
Trend Micro: SORVEPOTEL self‑propagating malware spreads via WhatsApp, hits Brazil hard
Trend Micro researchers said a self‑propagating malware campaign called SORVEPOTEL is spreading via WhatsApp and email to Windows desktops, concentrating in Brazil; it propagates through malicious ZIP attachments and PowerShell, aims for rapid spread rather than data theft, and has led to mass spam and account suspensions.
-
Renault and Dacia inform UK customers of data exposure after third‑party breach
Renault and Dacia told UK customers that personal data held by a third‑party provider was taken in a cyberattack, exposing names, contact details and vehicle identifiers; Renault said banking data was not exposed and declined to name the supplier or say how many customers were affected.
-
DrayTek warns of remote code execution bug in Vigor routers
DrayTek has warned that multiple Vigor router models are affected by CVE-2025-10547, an uninitialized stack vulnerability that can lead to memory corruption and, in some cases, remote code execution; firmware updates are available and administrators are urged to apply them.
-
Researchers Say YoLink Smart Hub Vulnerabilities Could Let Attackers Control Locks
Researchers at Bishop Fox have disclosed multiple vulnerabilities in the YoLink Smart Hub v0382 that can bypass authorization, expose credentials over unencrypted MQTT, and allow attackers to control devices including smart locks; the manufacturer has not yet issued a patch.
-
Adobe says Analytics ingestion bug caused some customers’ data to appear in other tenants
Adobe said an ingestion bug in Analytics Edge caused some organisations’ data to appear in other customers’ analytics instances between Sept. 17 and Sept. 18, 2025; Adobe is cleaning impacted datasets and a customer advisory seen by BleepingComputer instructs deletion of affected data and backups.
-
High-severity flaw in Red Hat OpenShift AI could allow full cluster takeover, vendor warns
Red Hat warned that a CVE-2025-10725 flaw in OpenShift AI, scored 9.9 by CVSS, could let a low-privileged authenticated user escalate to cluster administrator, enabling data theft, service disruption and full platform takeover; Red Hat and a Bugzilla report provided mitigation steps and urged urgent patching and investigation.
-
Okta says North Korean ‘IT worker’ scam is targeting healthcare, finance and AI hiring
Okta Threat Intelligence reported that nearly half of companies targeted by a North Korean-linked fake remote-worker scheme are outside IT, with rising activity in healthcare, finance and AI hiring; the firm tracked over 130 identities tied to more than 6,500 interviews from 2021 to mid-2025 and warned the sample likely understates the full scale.
-
Researchers say low-cost DDR4 interposer can bypass Intel and AMD memory protections
Researchers at KU Leuven and the University of Birmingham say a low-cost DDR4 interposer called Battering RAM can redirect physical addresses to bypass Intel SGX and AMD SEV-SNP protections in cloud confidential computing, potentially allowing plaintext reads, data corruption and persistent backdoors.
-
Unit 42 says China-aligned actor ‘Phantom Taurus’ has targeted government and telecom organisations in Africa, Middle East and Asia
Palo Alto Networks’ Unit 42 said a China-aligned actor it calls ‘Phantom Taurus’ has conducted an ongoing espionage campaign against government and telecom organisations across Africa, the Middle East and Asia, using bespoke .NET malware against IIS servers and tools to exfiltrate database content.
