SecurityWeek Briefing

"Russian government now actively managing cybercrime groups."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents.  Accessed on 23 October 2025, 2017 UTC.

Content and Source:  Email subscription from https://feedly.com.

 https://feedly.com/i/subscription/feed%2Fhttp%3A%2F%2Ffeeds.feedburner.com%2FSecurityweek

Please check subscription link or scroll down to read your selections.  

Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

SecurityWeek

92K followers42 articles per week

#security#tech

85

Today

Russian Government Now Actively Managing Cybercrime Groups: Security Firm

by Ionut Arghire / 5h

The relationship between the Russian government and cybercriminal groups has evolved from passive tolerance. The post appeared first on SecurityWeek .

AI Sidebar Spoofing Puts ChatGPT Atlas, Perplexity Comet and Other Browsers at Risk

by Eduard Kovacs / 7h

SquareX has shown how malicious browser extensions can impersonate AI sidebar interfaces. The post appeared first on SecurityWeek .

Vibe Coding’s Real Problem Isn’t Bugs—It’s Judgment

by Kevin Townsend / 8h

As AI coding tools flood enterprises with functional but flawed software, researchers urge embedding security checks directly into the AI workflow. The post appeared first on SecurityWeek .

Exploitation of Critical Adobe Commerce Flaw Puts Many eCommerce Sites at Risk

by Ionut Arghire / 9h

Patched in September, the SessionReaper bug could be exploited without authentication to bypass a security feature. The post appeared first on SecurityWeek .

BIND Updates Address High-Severity Cache Poisoning Flaws

by Ionut Arghire / 10h

The vulnerabilities allow attackers to predict source ports and query IDs BIND will use, and to inject forged records into the cache. The post appeared first on SecurityWeek .

Lanscope Endpoint Manager Zero-Day Exploited in the Wild

by Ionut Arghire / 10h

The bug has been exploited in the wild as a zero-day and the US cybersecurity agency CISA has added it to its KEV catalog. The post appeared first on SecurityWeek .

Yesterday

Mobile Security: Verizon Says Attacks Soar, AI-Powered Threats Raise Alarm

Mobile security risks surge globally

•

by Eduard Kovacs / 10h

Verizon’s 2025 Mobile Security Index shows that 85% of organizations believe mobile device attacks are on the rise. The post appeared first on SecurityWeek .

TARmageddon Flaw in Popular Rust Library Leads to RCE

by Ionut Arghire / 1d

The vulnerability impacts multiple Rust tar parsers, allowing attackers to smuggle additional archive entries. The post appeared first on SecurityWeek .

Critical Vulnerabilities Patched in TP-Link’s Omada Gateways

by Eduard Kovacs / 1d

One of the flaws can be exploited by remote unauthenticated attackers for arbitrary command execution. The post appeared first on SecurityWeek .

Keycard Emerges From Stealth Mode With $38 Million in Funding

Keycard secures 38M for AI agents

•

by Ionut Arghire / 1d

The company’s IAM platform identifies AI agents, supports assigning permission to them, and tracks all activity. The post appeared first on SecurityWeek .

Russian APT Switches to New Backdoor After Malware Exposed by Researchers

by Ionut Arghire / 1d

Star Blizzard started using the NoRobot (BaitSwitch) and MaybeRobot (SimpleFix) malware after public reporting on the LostKeys malware. The post appeared first on SecurityWeek .

What Makes a Great Field CXO: Lessons from the Front Lines

by Joshua Goldfarb / 1d

If you are recruiting for a Field CISO, Field CTO, etc., or are looking to leverage a resource at your company in one of these roles, what are some things you should be aware of? The post appeared first on SecurityWeek .

Fencing and Pet Company Jewett-Cameron Hit by Ransomware

2 TTPs

•

by Eduard Kovacs / 1d

Jewett-Cameron Company says hackers stole sensitive information and are threatening to release it unless a ransom is paid. The post appeared first on SecurityWeek .

Oracle Releases October 2025 Patches

by Ionut Arghire / 1d

The Critical Patch Update contains 374 new security patches that resolve many vulnerabilities. The post appeared first on SecurityWeek .

Oct 21, 2025

Hackers Earn Over $520,000 on First Day of Pwn2Own Ireland 2025

by Eduard Kovacs / 1d

Participants exploited 34 previously unknown vulnerabilities to hack printers, NAS devices, and smart home products. The post appeared first on SecurityWeek .

Gravwell Closes $15.4M Funding Round to Expand Data Analytics and Security Platform

by SecurityWeek News / 2d

The Series A round was led by Two Bear Capital and included participation from Gula Tech Adventures, Next Frontier Capital, and others. The post Gravwell Closes $15.4M Funding Round to Expand Data Analytics and Security Platform appeared first on SecurityWeek .

SBOM Pioneer Allan Friedman Joins NetRise to Advance Supply Chain Visibility

by Kevin Townsend / 2d

NetRise appointed the former CISA Senior Advisor and Strategist as a Strategic Advisor. The post appeared first on SecurityWeek .

Defakto Raises $30 Million for Non-Human IAM Platform

by Eduard Kovacs / 2d

Defakto’s Series B funding, which brings the total raised to $50 million, was led by XYZ Venture Capital. The post appeared first on SecurityWeek .

Government, Industrial Servers Targeted in China-Linked ‘PassiveNeuron’ Campaign

PassiveNeuron targets high-profile servers

•

by Ionut Arghire / 2d

A threat actor has been infecting servers of high-profile entities with backdoors to exfiltrate information and deploy additional payloads. The post appeared first on SecurityWeek .

Veeam to Acquire Data Security Firm Securiti AI for $1.7 Billion

Veeam acquires Securiti AI for $1.725B

•

by Eduard Kovacs / 2d

The acquisition will unify data resilience with DSPM, privacy, governance, and AI trust across production and secondary data. The post appeared first on SecurityWeek .

CISA Warns of Exploited Apple, Kentico, Microsoft Vulnerabilities

CISA warns of exploited vulnerabilities

•

by Ionut Arghire / 2d

Leading to code execution, authentication bypass, and privilege escalation, the flaws were added to CISA’s KEV list. The post appeared first on SecurityWeek .

Dataminr to Acquire ThreatConnect for $290 Million

by Eduard Kovacs / 2d

The goal is to combine Dataminr’s data signals platform with ThreatConnect’s deep internal data capabilities. The post appeared first on SecurityWeek .

Supply Chain Attack Targets VS Code Extensions With ‘GlassWorm’ Malware

GlassWorm targets VSCode extensions

•

by Ionut Arghire / 2d

The malware uses invisible Unicode characters to hide its code and blockchain-based infrastructure to prevent takedowns. The post appeared first on SecurityWeek .

Over 73,000 WatchGuard Firebox Devices Impacted by Recent Critical Flaw

by Ionut Arghire / 2d

Affecting the Fireware OS iked process, the vulnerability can lead to remote code execution and does not require authentication. The post appeared first on SecurityWeek .

Myanmar Military Shuts Down Major Cybercrime Center and Detains Over 2,000 People

Myanmar junta seizes 30 Starlink receivers

•

by Associated Press / 2d

Myanmar is notorious for hosting cyberscam operations responsible for bilking people all over the world. The post appeared first on SecurityWeek .