Attackers phished NPM maintainers with convincing 2FA-themed emails and slipped crypto-stealing code into multiple highly popular JavaScript packages. Investigators say the tainted releases propagated widely, touching roughly 10% of monitored cloud environments, underscoring how fast supply-chain compromises can spread. Teams should audit dependencies for recent version drift, rotate tokens/credentials tied to CI/CD, and pin/verify package versions before redeploying.
Source: SecurityWeek
Emergency patch: Adobe Commerce/Magento “SessionReaper” flaw enables account takeover
Adobe fixed CVE-2025-54236, a critical improper input validation bug (CVSS 9.1) in Commerce and Magento Open Source that can let attackers hijack customer accounts. Shops should patch immediately, invalidate active sessions, enable MFA for admin/customer logins, and comb logs for suspicious session reuse and checkout anomalies.
Source: The Hacker News
Patch Tuesday: Microsoft fixes 80+ flaws, SAP and Adobe ship critical updates
Microsoft’s September release addresses over 80 vulnerabilities across Windows, Office, Azure, SQL Server, Hyper‑V and more; none are reported exploited at release. In parallel, SAP issued critical NetWeaver fixes and Adobe shipped multiple security updates—security teams should fast-track patches for identity/NTLM, internet‑exposed services, and business‑critical SAP components.
Source: Help Net Security
SonicWall SSL VPNs actively exploited; Akira-linked activity prompts urgent mitigations
Australian cyber authorities warn of in-the-wild exploitation of CVE‑2024‑40766 against SonicWall SSL VPN appliances, with some intrusions tied to Akira ransomware affiliates. Admins should update firmware, reset migrated local accounts, enforce MFA, restrict WAN management access, and monitor for brute-force attempts; note that some end-of-life models will not receive patches.
Source: Cyble
Apple’s new iPhone memory protections target advanced spyware techniques
Apple introduced Memory Integrity Enforcement (MIE) on A19-based iPhone 17 models, providing always‑on memory safety across the kernel and dozens of userland processes. The hardware‑assisted control aims to blunt memory corruption exploits used by sophisticated surveillance operators, raising the baseline for mobile device resilience.
Source: SecurityWeek
Chinese APT debuts ‘EggStreme’ fileless framework against Philippine military target
Bitdefender uncovered a multi‑stage, fileless espionage toolset dubbed EggStreme that persists by injecting code into memory and abusing DLL sideloading. The campaign, attributed to a China‑based APT, highlights growing reliance on in‑memory tradecraft; defenders should hunt for anomalous sideloaded DLLs, validate signed binaries, and tune EDR for reflective loading behaviors.
Source: The Hacker News
Jaguar Land Rover confirms data breach after disruptive cyberattack
Following factory and dealer outages, JLR now acknowledges a data breach stemming from its recent cyber incident. The admission elevates the risk of downstream fraud and supply‑chain exposure; partners and customers should watch for targeted phishing and consider credential resets where JLR identities are reused.
Source: SecurityWeek
You May Also Be Interested In...
Wyden urges FTC probe into Microsoft over ‘gross cybersecurity negligence’
Researchers warn of remote Apple CarPlay attack vector
US offers $10M reward for alleged ransomware kingpin