Vulnerabilities
-
N-able N-central: More Than 800 On-Premises Servers Remain Unpatched as Two Critical Flaws See Active Exploitation
More than 800 N-able N-central servers remain unpatched against two critical, actively exploited flaws (CVE-2025-8875 and CVE-2025-8876), prompting federal and private-sector action as researchers warn that thousands of instances remain exposed online. Patch guidance and regulatory responses are being rolled out as investigations continue into the scope of exploitation.
-
Noodlophile Infostealer Campaign Uses Legal-Threat Phishing to Target Businesses, Researchers Warn
Security researchers warn of a spear-phishing campaign leveraging legal-threat prompts to deploy the Noodlophile infostealer, using DLL side-loading in legitimate applications and malicious archives to exfiltrate cookies, payment data and system information across global targets.
-
Taiwan Web Infrastructure Targeted by UAT-7237, Cisco Talos Says
Cisco Talos links a China-aligned APT cluster, UAT-7237, to attacks on Taiwan’s web infrastructure, using customized open-source tooling and a SoundBill shellcode loader to deploy backdoors and credentials-stealing utilities. The operation, active since 2022 and considered a sub-group of UAT-5918, also employs VPN persistence and RDP access, with updates to embed Mimikatz and broader lateral…
-
Dutch Public Prosecution Service Begins Phased Relaunch After Cyberattack Delays Speed-Camera Network
Dutch prosecutors have begun a phased relaunch after a July cyberattack tied to Citrix vulnerabilities, with dozens of speed cameras still offline. The outage follows the first step in restoring services, including email access, as authorities coordinate with the judiciary and victim-support organizations amid ongoing concerns about system-wide interconnections.
-
Norway says pro-Russian hackers sabotaged Bremanger dam to demonstrate capabilities
Norwegian authorities accuse pro-Russian hackers of taking control of Bremanger dam’s operations and opening outflow valves in what officials describe as a demonstration of Moscow’s ability to disrupt critical infrastructure, prompting warnings about hybrid threats.
-
Unicode homoglyph phishing campaign uses Japanese character to spoof Booking.com, delivering MSI malware
Security researchers warn of a phishing campaign that uses the Japanese character ん to visually imitate Booking.com in order to redirect users to a lookalike domain and deliver MSI malware; a separate Lntuit/Intuit-themed campaign is also observed, underscoring the evolving use of homoglyphs in brand impersonation and malware delivery.
-
Canada’s House of Commons Investigates Data Breach Tied to Reported Microsoft Vulnerability Exploitation
Canada’s House of Commons is investigating a data breach after a cyberattack reportedly exposed employee information. The Cyber Centre is assisting, and authorities caution that attribution remains complex. The incident comes as Canada and other nations grapple with recently disclosed Microsoft vulnerabilities, including CVE-2025-53770 (ToolShell) and CVE-2025-53786, which have seen active exploitation by various threat…
-
PhantomCard Android Trojan Uses NFC Relay to Enable Fraudulent Banking Transactions in Brazil
Authorities warn of PhantomCard, a new Android trojan that uses NFC relay technology to siphon card data and complete fraudulent banking transactions in Brazil. Distributed via fake card-protection apps on phishing pages, the threat is linked to a broader ecosystem of NFC fraud tools and a network of threat actors, underscoring rising global risk to…
-
CISA Adds Two N-able N-central Vulnerabilities to KEV; MSP Patch Push Underway
U.S. authorities added two vulnerabilities in N-able N-central to the Known Exploited Vulnerabilities catalog, while noting no public exploitation has been reported. The flaws—CVE-2025-8875 (insecure deserialization) and CVE-2025-8876 (command injection)—require authentication and have been patched in N-central versions 2025.3.1 and 2024.6 HF2, with upgrades urged for on-premises deployments.
-
Zoom and Xerox patch critical Windows and FreeFlow Core flaws that could enable privilege escalation and remote code execution
Zoom and Xerox released patches for critical vulnerabilities in Zoom Clients for Windows and FreeFlow Core, including a high-severity privilege-escalation flaw (CVE-2025-49457) in Windows Zoom clients and two severe flaws in FreeFlow Core (CVE-2025-8355 and CVE-2025-8356) that could enable remote code execution, prompting enterprise patches and risk-mitigation guidance.
