Microsoft's November 2025 Patch Tuesday addressed 63 vulnerabilities, including one zero-day (CVE-2025-62215) exploited in the wild, allowing local privilege escalation. Key vulnerabilities include CVE-2025-62199 (RCE in Office), CVE-2025-60716 (EoP in DirectX), and CVE-2025-60724 (RCE in GDI+).

A new phishing scam targets iOS users who have lost their devices, claiming to be from Apple's Find My team. Scammers send messages with details about the lost device to lure victims into clicking a link that leads to a fake login page, capturing their Apple ID credentials.

Russian threat actors are distributing the Android Remote Access Trojan, Fantasy Hub, as a subscription service. It enables extensive surveillance, intercepting SMS, contacts, and call logs, and targeting financial institutions like Alfa and Sber.

The North Korean threat actor Konni has been linked to new attacks on Android and Windows devices, utilizing Google's Find Hub to remotely wipe victim devices. The attacks involve spear-phishing emails impersonating legitimate entities to deliver malware disguised as stress-relief programs.

An analysis of 50 leading AI companies revealed that 65% had leaked verified secrets on GitHub, including API keys and sensitive credentials. The study highlighted the need for enhanced secret scanning methodologies, focusing on hidden exposures in commit histories and deleted forks.

Legislation to end the federal government shutdown includes a provision to extend the Cybersecurity Information Sharing Act of 2015 through January. This extension is crucial for legal protections that facilitate threat data sharing between businesses and the government.

Mandiant Threat Defense identified exploitation of CVE-2025-12480 in Gladinet's Triofox platform, allowing unauthenticated access to application configuration pages. This vulnerability enabled attackers to upload and execute arbitrary payloads. Exploited by threat cluster UNC6485 since Aug.

Aleksei Olegovich Volkov, a 25-year-old Russian national, pleaded guilty on October 29 to multiple charges related to his role as an initial access broker for the Yanluowang ransomware group, impacting seven U.S. businesses from July 2021 to November 2022.

The Clop Ransomware group has claimed a breach of The Washington Post, adding it to their Tor data leak site, with plans to leak stolen data soon. They criticized the newspaper for neglecting security responsibilities.

Microsoft has revealed the "Whisper Leak" attack, a side-channel vulnerability that allows adversaries to infer conversation topics from encrypted traffic between users and language models. By analyzing packet sizes and timing, attackers can identify sensitive topics, even with HTTPS encryption.

A set of nine malicious NuGet packages, published by "shanhai666" in 2023-2024, contain logic bombs set to activate between August 2027 and November 2028, impacting database operations and industrial control systems.

A phishing campaign targeting Booking.com partner accounts has been identified, exploiting hotel systems and customer data since April 2025. Attackers sent malicious emails, prompting victims to execute a PowerShell command that downloaded the PureRAT Trojan, allowing remote control and data theft.

Cybersecurity researchers identified a malicious Visual Studio Code extension named "susvsex," uploaded on November 5, 2025, which features ransomware capabilities. It automatically zips, uploads, and encrypts files from specified directories upon launch.

Unit 42 researchers identified a new Android spyware, LANDFALL, targeting Samsung devices via a zero-day vulnerability (CVE-2025-21042) in Samsung's image processing library.

ClickFix attacks have evolved to include video instructions that guide users into downloading malware, enhancing their social engineering tactics. Previously relying on text, these attacks now use embedded videos to appear less suspicious.

A cybersecurity incident has affected the Congressional Budget Office (CBO), with a suspected foreign party gaining access to communications between lawmakers and researchers. The CBO has taken immediate action to contain the breach and enhance security measures.

Cisco disclosed a new attack variant targeting devices running Cisco Secure Firewall ASA and FTD Software, exploiting CVE-2025-20333 and CVE-2025-20362, which can cause denial-of-service conditions. Both vulnerabilities were exploited as zero-days delivering malware.

Russia's Sandworm hackers have targeted Ukraine's grain industry with data-wiping malware, including Zerolot and Sting, between June and September 2023. These attacks, linked to the GRU, aim to disrupt key sectors like grain, energy, and logistics.

Cybersecurity researchers identified seven vulnerabilities in OpenAI's ChatGPT models (GPT-4o and GPT-5) that could allow attackers to extract personal data from users.

Japanese media giant Nikkei reported a breach of its internal Slack system, exposing data of over 17,300 individuals, including employees and partners. The breach, discovered in September, resulted from malware on an employee's computer that compromised login credentials.

SonicWall attributed its September security breach to state-sponsored hackers, revealing that firewall configuration files were exposed.

A critical security flaw in the "@react-native-community/cli" npm package, tracked as CVE-2025-11953, has been patched. This vulnerability, with a CVSS score of 9.8, allowed remote unauthenticated attackers to execute arbitrary OS commands via the Metro development server's "/open-url" endpoint.

A coordinated international operation led by Eurojust resulted in the arrest of 18 individuals involved in a €300 million credit card fraud scheme affecting millions across 193 countries.

CISA added two vulnerabilities to its KEV catalog: CVE-2025-11371 (CVSS 7.5) in Gladinet CentreStack and Triofox, allowing unintended file disclosure, and CVE-2025-48703 (CVSS 9.0) in Control Web Panel, enabling unauthenticated remote code execution.

Russian group Curly COMrades is exploiting Microsoft's Hyper-V to create hidden Alpine Linux VMs on compromised Windows machines, allowing them to bypass endpoint security.

The U.S. Treasury sanctioned eight individuals and two companies for laundering money linked to North Korea's cybercrime and IT worker fraud schemes. Key targets include Korea Mangyongdae Computer Technology Company and Ryujong Credit Bank. The sanctions address the laundering of approximately $5.

Threat actors are increasingly using social engineering to bypass AI safeguards, as seen with Google’s Gemini model. They posed as cybersecurity researchers to extract sensitive information. Google has disabled associated assets and improved its AI protections.

Cybercriminals have claimed responsibility for a cyberattack on the University of Pennsylvania, stealing data on 1.2 million individuals, including PII and financial information. Access was gained through a compromised SSO account, allowing entry to various university systems.

Cybersecurity researchers revealed four vulnerabilities in Microsoft Teams that allow attackers to impersonate colleagues and manipulate messages without detection.

Google's AI agent, Big Sleep, discovered five vulnerabilities in Apple's Safari WebKit, including CVE-2025-43429 (buffer overflow), CVE-2025-43430 (unspecified), CVE-2025-43431 & CVE-2025-43433 (memory corruption), and CVE-2025-43434 (use-after-free).

European authorities dismantled a €600 million cryptocurrency scam network, arresting nine suspects on 27 and 29 October. The operation, led by Eurojust, involved investigators from France, Belgium, Cyprus, Spain, and Germany.

Microsoft has identified a backdoor named SesameOp that utilizes OpenAI's API for command-and-control communications. Discovered in July 2025, the malware maintains persistence in compromised environments, leveraging internal web shells and compromised Microsoft Visual Studio utilities.

U.S. prosecutors indicted Kevin Tyler Martin and an unnamed employee from DigitalMint, along with Ryan Clifford Goldberg from Sygnia, for conducting their own ransomware attacks while negotiating ransom payments for victims. They are accused of hacking at least five U.S.

Cybercriminals are targeting trucking and logistics firms using remote monitoring and management (RMM) software to steal cargo, particularly food and beverages.

A 4TB SQL Server backup file belonging to EY was found exposed on the internet due to a cloud bucket misconfiguration, leaking sensitive data including API keys and user credentials. The unencrypted BAK file was accessible for an unknown duration.

OpenAI has released Aardvark, a new AI model for automating bug hunting and patching, currently in invite-only Beta. It scans source code for vulnerabilities, assesses severity, and proposes patches, using LLM-powered reasoning instead of traditional methods.

Russian authorities arrested three individuals linked to the Meduza infostealer, which targeted at least one government network in Astrakhan. The arrests occurred in the Moscow area, with the suspects facing up to five years in prison if convicted.

Oleksii Oleksiyovych Lytvynenko, a 43-year-old Ukrainian, was extradited from Ireland to Tennessee, facing charges for conspiracy to deploy Conti ransomware from 2020 to June 2022.

Ribbon Communications experienced a cyberattack, likely by a nation-state actor, targeting corporate files. The incident, discovered in early September 2025, involved unauthorized access to four older customer files from laptops. Affected clients, including smaller customers, have been notified.

A cybersecurity incident at government contractor Conduent exposed the information of over 10 million individuals from October 21 to January 13. Affected states include Texas (400,000), Washington (76,000), South Carolina (48,000), New Hampshire (10,000), and Maine (378).

Hungarian and Belgian diplomatic entities were targeted in a cyber-espionage campaign attributed to the Chinese group UNC6384, discovered by Arctic Wolf Labs.

Cybersecurity agencies, including CISA and NSA, released guidance to enhance defenses for on-premises Microsoft Exchange Servers, following an emergency directive for CVE-2025-53786.

Proton's new Data Breach Observatory reports over 300 million compromised records linked to 794 breaches in 2023, with small to medium-sized businesses (SMBs) being heavily targeted. Retail and wholesale sectors faced 25% of breaches, followed by technology (15%) and media (11%).

A critical unpatched vulnerability in Chromium's Blink rendering engine allows attackers to crash Chromium-based browsers, affecting billions of users.

Russian-linked ransomware groups are exploiting the Adaptix penetration testing tool to deliver malware globally. Silent Push researchers discovered this while tracking the CountLoader malware, which was used in phishing campaigns posing as Ukrainian police emails.

Hacktivists have breached Canada's critical infrastructure, tampering with industrial controls at a water treatment facility, an oil and gas firm, and an agricultural facility, risking public safety.

An npm credential harvesting campaign, identified as PhantomRaven, has been active since August 2025, infecting 126 packages with 20,000 downloads. Researchers from Koi Security reported on October 29 that at least 80 infected packages remained active.

Microsoft Azure is experiencing a widespread outage affecting services like Microsoft 365, Xbox, and NatWest, disrupting operations globally. The issue began around 4 PM due to Azure Front Door problems linked to DNS errors, which hindered service accessibility.

Peter Williams, 39, pleaded guilty to selling stolen trade secrets from a U.S. defense contractor to a Russian cyber-tools broker. The stolen materials included eight sensitive cyber-exploit components intended for U.S. government use, causing over $35 million in losses.

Researchers have identified a new Android banking malware named Herodotus, developed by a hacker known as K1R0. It mimics human typing to evade detection while stealing money from banking apps. Active campaigns have been observed in Italy and Brazil, where it disguises itself as legitimate apps.