Cybersecurity — May 15, 2025

### Emerging Vulnerabilities #### Microsoft Patch Tuesday Updates – Critical Security Flaws Addressed Microsoft released its May 2025 Patch Tuesday updates addressing 70 vulnerabilities, including five actively exploited zero-day flaws. This patching is crucial as numerous companies rely on these updates to secure their infrastructure immediately. Cybersecurity professionals should prioritize applying these patches to mitigate potential threats. [Read more](https://krebsonsecurity.com/2025/05/patch-tuesday-may-2025-edition/). #### Fortinet Zero-Day Vulnerability Exploited in the Wild A new zero-day vulnerability, CVE-2025-32756, has been identified and exploited in the wild affecting multiple Fortinet products such as FortiVoice, FortiRecorder, and FortiMail. This vulnerability allows remote code execution, urging immediate update and mitigation actions by all operators of these systems. [Read more](https://therecord.media/cyber-incident-forces-nucor-steel-to-take-systems-offline). ### Industry Impact #### Russia-Linked Espionage Operation Targeting Ukraine ESET researchers have uncovered Operation RoundPress, a cyber espionage campaign by Russia-linked Sednit (APT28) using XSS vulnerabilities to infiltrate webmail servers. Targets largely pertain to the ongoing conflict in Ukraine, including government entities and defense companies. This requires heightened vigilance and strategic cybersecurity measures from affected sectors. [Read more](https://www.helpnetsecurity.com/2025/05/15/espionage-operation-roundpress-webmail-servers/). #### Nucor Steel Hit by Cybersecurity Incident Nucor, the largest steel manufacturer in the U.S., suffered a cybersecurity incident that led to a production shutdown. This highlights urgent cyber risks within critical infrastructure sectors, necessitating robust incident response strategies. [Read more](https://therecord.media/cyber-incident-forces-nucor-steel-to-take-systems-offline). ### Evolving Threats #### Google Chrome Vulnerability Exploited in the Wild Google has patched a severe vulnerability in Chrome browser (CVE-2025-4664) exploited in the wild. Professionals should ensure their users are updating to the latest version of Chrome as a defensive measure against potential breaches via this vulnerability. [Read more](https://www.securityweek.com/chrome-136-update-patches-vulnerability-with-exploit-in-the-wild/). ### Policy Developments #### Google Fined Over Privacy Violations The state of Texas secured a $1.38 billion settlement from Google over privacy violations concerning user data. This settlement underscores the increasing regulatory scrutiny tech companies face over data privacy, influencing policy frameworks globally. [Read more](https://www.malwarebytes.com/blog/news/2025/05/google-to-pay-1-38-billion-over-privacy-violations). ### You May Also Be Interested In... - **ISC Stormcast** – Daily podcast highlights ongoing cybersecurity incidents affecting various sectors. [Listen here](https://isc.sans.edu/podcastdetail/9452) - **New Blockchain Security Standards** – Standards to elevate trust in digital assets recently launched by BSSC. [Explore here](https://www.helpnetsecurity.com/2025/05/15/new-blockchain-security-standards/) - **Samsung Patches Vulnerability** – CVE-2025-4632, actively exploited in the wild, fixed in MagicINFO 9 Server. [More details](https://thehackernews.com/2025/05/samsung-patches-cve-2025-4632-used-to.html)

A clearer view of today.

Your briefing

A clearer view of today.

Your briefing

Make room for a smarter morning.