SecurityWeek Briefing.

 "Google ships Android 'advanced protection' mode to thwart surveillance spyware."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents.  Accessed on 15 May 2025, 0229 UTC.

Content and Source:  Email subscription via https://feedlly.com.

https://feedly.com/i/subscription/feed%2Fhttp%3A%2F%2Ffeeds.feedburner.com%2FSecurityweek

Please check email link or scroll down to read your selections.  Thanks for joining us today.

Russ Roberts (site administrator).

https://www.hawaiicybersecurityjournal.net

SecurityWeek

87K followers47 articles per week

#security#tech

80

Today

Google Ships Android ‘Advanced Protection’ Mode to Thwart Surveillance Spyware

Android 16 introduces Advanced Protection features

•

by Ryan Naraine / 8h

Google bundles multiple safeguards under a single Android toggle to protect high-risk users from advanced mobile malware implants. The post appeared first on SecurityWeek .

Is AI Use in the Workplace Out of Control?

by Alastair Paterson / 11h

Trying to block AI tools outright is a losing strategy. SaaS and AI are increasingly inseparable, and AI isn’t limited to tools like ChatGPT or Copilot anymore. The post appeared first on SecurityWeek .

Chipmaker Patch Tuesday: Intel, AMD, Arm Respond to New CPU Attacks

6 TTPs

•

by Eduard Kovacs / 11h

•

CVE-2024-45332

Intel, AMD and Arm each published security advisories on Patch Tuesday, including for newly disclosed CPU attacks. The post appeared first on SecurityWeek .

Kosovar Administrator of Cybercrime Marketplace Extradited to US

Kosovo man extradited for cybercrime

•

by Ionut Arghire / 14h

Kosovo citizen Liridon Masurica has appeared in a US court, facing charges for his role in operating the cybercrime marketplace BlackDB.cc. The post appeared first on SecurityWeek .

EU Cybersecurity Agency ENISA Launches European Vulnerability Database

CVE program funding at risk

•

by Eduard Kovacs / 14h

Experts say the European Vulnerability Database, or EUVD, should be a good resource, but only if ENISA manages to maintain it properly. The post appeared first on SecurityWeek .

Vulnerabilities Patched by Juniper, VMware and Zoom

5 TTPs

•

by Ionut Arghire / 15h

Juniper Networks, VMware, and Zoom have announced patches for dozens of vulnerabilities across their products. The post appeared first on SecurityWeek .

Yesterday

Fortinet Patches Zero-Day Exploited Against FortiVoice Appliances

3 TTPs

•

by Ionut Arghire / 16h

•

CVE-2025-32756

Fortinet has patched a dozen vulnerabilities, including a critical flaw exploited in the wild against FortiVoice instances. The post appeared first on SecurityWeek .

Ivanti Patches Two EPMM Zero-Days Exploited to Hack Customers

2 TTPs

•

by Ionut Arghire / 18h

Ivanti has released patches for two EPMM vulnerabilities that have been chained in the wild for remote code execution. The post appeared first on SecurityWeek .

ICS Patch Tuesday: Vulnerabilities Addressed by Siemens, Schneider, Phoenix Contact

5 TTPs

•

by Eduard Kovacs / 18h

•

PatchTuesday

Industrial giants Siemens, Schneider Electric and Phoenix Contact have released ICS security advisories on the May 2025 Patch Tuesday. The post appeared first on SecurityWeek .

Adobe Patches Big Batch of Critical-Severity Software Flaws

by Ryan Naraine / 1d

Adobe Patch Tuesday headlined by a major Adobe ColdFusion update patching a wide swatch of code execution and privilege escalation attacks. The post appeared first on SecurityWeek .

Microsoft to Lay Off About 3% of Its Workforce

Microsoft lays off 3% workforce

•

by Associated Press / 1d

The tech giant didn’t disclose the total amount of lost jobs but it will amount to about 6,000 people. The post appeared first on SecurityWeek .

Zero-Day Attacks Highlight Another Busy Microsoft Patch Tuesday

4 TTPs

•

by Ryan Naraine / 1d

•

PatchTuesday

Patch Tuesday: Microsoft patches at least 70 security bugs and flagged five zero-days in the “exploitation detected” category. The post appeared first on SecurityWeek .

Sharing Intelligence Beyond CTI Teams, Across Wider Functions and Departments

by Marc Solomon / 1d

CTI, digital brand protection and other cyber risk initiatives shouldn’t only be utilized by security and cyber teams. The post appeared first on SecurityWeek .

SAP Patches Another Critical NetWeaver Vulnerability

5 TTPs

•

by Ionut Arghire / 1d

SAP has released 16 new security notes on its May 2025 Security Patch Day, including a note dealing with another critical NetWeaver vulnerability. The post appeared first on SecurityWeek .

Radware Says Recently Disclosed WAF Bypasses Were Patched in 2023

by Eduard Kovacs / 1d

The Radware Cloud WAF product vulnerabilities disclosed by CERT/CC were addressed two years ago. The post appeared first on SecurityWeek .

Marks & Spencer Says Data Stolen in Ransomware Attack

3 TTPs

•

by Ionut Arghire / 1d

•

Hackers target M&S hinting politics

Marks & Spencer has confirmed that personal information was stolen in a recent cyberattack claimed by a ransomware group. The post appeared first on SecurityWeek .

Output Messenger Zero-Day Exploited by Turkish Hackers for Iraq Spying

9 TTPs

•

by Ionut Arghire / 1d

•

CVE-2025-27920

A Turkey-affiliated espionage group has exploited a zero-day vulnerability in Output Messenger since April 2024. The post appeared first on SecurityWeek .

Suspected DoppelPaymer Ransomware Group Member Arrested

Moldovan man arrested for ransomware

•

by Ionut Arghire / 1d

A 45-year-old individual was arrested in Moldova for his suspected involvement in DoppelPaymer ransomware attacks. The post appeared first on SecurityWeek .

Orca Snaps Up Opus in Cloud Security Automation Push

by Ryan Naraine / 1d

Orca positioned the deal as an expansion of its capabilities into the realm of AI-based autonomous remediation and prevention. The post appeared first on SecurityWeek .

May 12, 2025

CISA Warns of Flaw in TeleMessage App Used by Ex-National Security Advisor

Collection (Enterprise TA0009)

•

by Eduard Kovacs / 1d

An information exposure flaw in TeleMessage has been added to CISA’s Known Exploited Vulnerabilities catalog. The post appeared first on SecurityWeek .

Apple Patches Major Security Flaws in iOS, macOS Platforms

2 TTPs

•

by Ryan Naraine / 2d

Apple rolls out iOS and macOS platform updates to fix serious security bugs that could be triggered simply by opening an image or video file. The post appeared first on SecurityWeek .

Security Firm Andy Frain Says 100,000 People Impacted by Ransomware Attack

by Eduard Kovacs / 2d

Andy Frain was targeted by the Black Basta ransomware group in 2024 and the hackers have stolen a wide range of information. The post appeared first on SecurityWeek .

Google Agrees to $1.3 Billion Settlement in Texas Privacy Lawsuits

Google settles Texas privacy lawsuits

•

by Ionut Arghire / 2d

Google has agreed to a $1.375 billion settlement with Texas in lawsuits over location and private browsing tracking, and biometric data collection. The post appeared first on SecurityWeek .

437,000 Impacted by Ascension Health Data Breach

2 TTPs

•

by Ionut Arghire / 2d

•

Ascension data breach affects 430000 patients

Ascension Health has notified the HHS that more than 437,000 people were affected by a recently disclosed data breach. The post appeared first on SecurityWeek .

Asus DriverHub Vulnerabilities Expose Users to Remote Code Execution Attacks

2 TTPs

•

by Ionut Arghire / 2d

•

ASUS patches critical DriverHub vulnerabilities

Two vulnerabilities in ASUS’s pre-installed software DriverHub can be exploited for remote code execution. The post appeared first on SecurityWeek .

US Deportation Airline GlobalX Confirms Hack

Collection (Enterprise TA0009)

•

by Eduard Kovacs / 2d

•

GlobalX airline hacked by Anonymous

Global Crossing Airlines is investigating a cybersecurity incident after Anonymous hackers targeted its systems. The post appeared first on SecurityWeek .

May 11, 2025

German Authorities Take Down Crypto Swapping Service eXch

Germany seizes 34M euros from eXch

•

by Ionut Arghire / 2d

German authorities seized the servers of crypto-swapping service eXch for laundering approximately $1.9 billion in fraudulent assets. The post appeared first on SecurityWeek .

US Announces Botnet Takedown, Charges Against Russian Administrators

3 TTPs

•

by Eduard Kovacs / 2d

•

Botnet dismantled using IoT devices

Anyproxy and 5socks, websites offering proxy services through devices ensnared by a botnet, have been disrupted in a law enforcement operation. The post appeared first on SecurityWeek .

May 9, 2025

In Other News: India-Pakistan Cyberattacks, Radware Vulnerabilities, xAI Leak

by Eduard Kovacs / 5d

Noteworthy stories that might have slipped under the radar: surge in cyberattacks between India and Pakistan, Radware cloud WAF vulnerabilities, xAI key leak. The post appeared first on SecurityWeek .

Popular Scraping Tool’s NPM Package Compromised in Supply Chain Attack

2 TTPs

•

by Ionut Arghire / 5d

•

Malicious code found in rand-user-agent

Supply chain attack compromises the popular rand-user-agent NPM package to deploy and activate a backdoor. The post appeared first on SecurityWeek .

160,000 Impacted by Valsoft Data Breach

Collection (Enterprise TA0009)

•

by Ionut Arghire / 5d

VMS firm Valsoft Corporation says the personal information of over 160,000 people was compromised in a February 2025 data breach. The post appeared first on SecurityWeek .

Malicious NPM Packages Target Cursor AI’s macOS Users

Malicious npm packages target Cursor users

•

by Ionut Arghire / 5d

Three NPM packages posing as developer tools for Cursor AI code editor’s macOS version contain a backdoor. The post appeared first on SecurityWeek .

Rising Tides: Kelley Misata on Bringing Cybersecurity to Nonprofits

by Jennifer Leggio / 5d

Sightline Security’s founder explains why nonprofits need cybersecurity solutions tailored to their unique missions — and why vendors need to listen. The post appeared first on SecurityWeek .

SAP Zero-Day Targeted Since January, Many Sectors Impacted

by Ionut Arghire / 5d

Hundreds of SAP NetWeaver instances hacked via a zero-day that allows remote code execution, not only arbitrary file uploads, as initially believed. The post appeared first on SecurityWeek .

Company and Personal Data Compromised in Recent Insight Partners Hack

Insight Partners data breach confirmed

•

by Eduard Kovacs / 5d

VC firm Insight Partners is informing partners and employees that their information was exposed in the January 2025 cyberattack. The post appeared first on SecurityWeek .