CyberSecurity Updates

14 Aug

Vulnerabilities in Xerox Print Orchestration Product Allow Remote Code Execution

Information, News

Two serious vulnerabilities were patched recently by Xerox in its FreeFlow Core print orchestration platform.  According to pentesting company Horizon3, whose researchers discovered the flaws, FreeFlow Core is affected by an XXE injection flaw (CVE-2025-8355) and a path traversal issue (CVE-2025-8356). The researchers discovered that the vulnerabilities could allow an unauthenticated, remote attacker to execute arbitrary code on affected FreeFlow Core instances. The potential impact has been demonstrated with an exploit that placed a webshell…

Read More
14 Aug

CISA Releases Thirty-Two Industrial Control Systems Advisories

Attacks, Insights, Malware

CISA released thirty-two Industrial Control Systems (ICS) advisories on August 14, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-226-01 Siemens SIMATIC RTLS Locating Manager ICSA-25-226-02 Siemens COMOS ICSA-25-226-03 Siemens Engineering Platforms ICSA-25-226-04 Siemens Simcenter Femap ICSA-25-226-05 Siemens Wibu CodeMeter Runtime ICSA-25-226-06 Siemens Opcenter Quality ICSA-25-226-07 Siemens Third-Party Components in SINEC OS ICSA-25-226-08 Siemens RUGGEDCOM CROSSBOW Station Access Controller ICSA-25-226-09 Siemens RUGGEDCOM APE1808 ICSA-25-226-10 Siemens SIPROTEC 5 ICSA-25-226-11 Siemens SIMATIC S7-PLCSIM ICSA-25-226-12 Siemens SIPROTEC 4 and SIPROTEC 4 Compact ICSA-25-226-13 Siemens…

Read More
14 Aug

How the always-on generation can level up its cybersecurity game

Information

Kids Online Digital natives are comfortable with technology, but may be more exposed to online scams and other threats than they think Phil Muncaster 12 Aug 2025  •  , 5 min. read It’s International Youth Day on August 12, a moment to celebrate the contribution of young people to society. A big part of this contribution is digital, according to the United Nations, which also notes that “young people are leading the charge in digital…

Read More
14 Aug

Supply-chain dependencies: Check your resilience blind spot

Information

Business Security Does your business truly understand its dependencies, and how to mitigate the risks posed by an attack on them? Tony Anscombe 12 Aug 2025  •  , 4 min. read A panel discussion at DEF CON 33 last week, titled “Adversaries at war: Tactics, technologies, and lessons from modern battlefields”, offered several thought-provoking points, as well as a clear takeaway: while digital tactics such as misinformation and influence campaigns are useful in modern conflict,…

Read More
13 Aug

CISA and Partners Release Asset Inventory Guidance for Operational Technology Owners and Operators

Attacks, Insights, Malware

CISA, along with the National Security Agency, the Federal Bureau of Investigation, Environmental Protection Agency, and several international partners, released comprehensive guidance to help operational technology (OT) owners and operators across all critical infrastructure sectors create and maintain OT asset inventories and supplemental taxonomies.  An asset inventory is a regularly updated, structured list of an organization’s systems, hardware, and software. It includes a categorization system—a taxonomy—that classifies assets based on their importance and function. This…

Read More
12 Aug

Microsoft Patch Tuesday, August 2025 Edition

Information, Insights

Microsoft today released updates to fix more than 100 security flaws in its Windows operating systems and other software. At least 13 of the bugs received Microsoft’s most-dire “critical” rating, meaning they could be abused by malware or malcontents to gain remote access to a Windows system with little or no help from users. August’s patch batch from Redmond includes an update for CVE-2025-53786, a vulnerability that allows an attacker to pivot from a compromised…

Read More
12 Aug

Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability

Information

ESET researchers have discovered a previously unknown vulnerability in WinRAR, being exploited in the wild by Russia-aligned group RomCom. This is at least the third time that RomCom has been caught exploiting a significant zero-day vulnerability in the wild. Previous examples include the abuse of CVE-2023-36884 via Microsoft Word in June 2023, and the combined vulnerabilities assigned CVE‑2024‑9680 chained with another previously unknown vulnerability in Windows, CVE‑2024‑49039, targeting vulnerable versions of Firefox, Thunderbird, and the…

Read More
12 Aug

WinRAR zero-day exploited in espionage attacks against high-value targets

Information

The attacks used spearphishing campaigns to target financial, manufacturing, defense, and logistics companies in Europe and Canada, ESET research finds 11 Aug 2025 ESET researchers have uncovered a previously unknown vulnerability in WinRAR, actively being exploited by Russia-aligned group RomCom. Tracked as CVE-2025-8088, the path traversal flaw affects WinRAR’s Windows version and lets threat actors execute arbitrary code by crafting malicious archive files. This marks at least the third time RomCom has leveraged a significant…

Read More
10 Aug

Android adware: What is it, and how do I get it off my device?

Information

Mobile Security Is your phone suddenly flooded with aggressive ads, slowing down performance or leading to unusual app behavior? Here’s what to do. Phil Muncaster 08 Aug 2025  •  , 5 min. read There are various bad things that could end up on your smartphone. Spyware designed to turn your phone into a secret surveillance device. Trojans that could harvest your banking logins or credit card data, possibly via a novel method that relays NFC…

Read More
10 Aug

Black Hat USA 2025: Is a high cyber insurance premium about your risk, or your insurer’s?

Information

Business Security A sky-high premium may not always reflect your company’s security posture Tony Anscombe 08 Aug 2025  •  , 3 min. read When a cyber risk insurance quote lands on your desk and the premium is sky high, it’s natural to assume that the insurer is judging your environment to be high risk. So, when the next quote lands and is more acceptable, does it mean they viewed your risk differently? According to one…

Read More