Latest CyberSec News by @thecyberpicker

Ransomware gangs have recently joined ongoing attacks targeting a Microsoft SharePoint vulnerability chain, part of a broader exploitation campaign that has already led to the breach of at least 148 organizations worldwide.

MITM attacks silently steal data from users via spoofed networks and weak encryption. Learn how to stop them.

This week’s threats don’t shout — they blend in, borrow trust, and drain wallets.

An Arizona woman was sentenced to eight-and-a-half years in prison for her role helping North Korean workers infiltrate US companies by pretending to be US workers. From an article: According to court documents, Chapman hosted the North Korean IT workers’ computers in her own home between October 2020 and October 2023, creating a so-called “laptop farm” which was used to make it appear as though the devices were located in the United States. The North Koreans were hired as remote software and application developers with multiple Fortune 500 companies, including an aerospace and defense company, a major television network, a Silicon Valley technology company, and a high-profile company...

Everyone's an IT decision-maker now. Here's how to keep your organization safe in the world of Shadow IT.

Mozilla has warned browser extension developers of an active phishing campaign targeting accounts on its official AMO (addons.mozilla.org) repository.

Dans une étude publiée fin juillet 2025, les chercheurs de Sonatype annoncent avoir détecté une vaste campagne d’espionnage menée au sein des écosystèmes open source. Aux commandes : Lazarus, un groupe cybercriminel affilié à l’État nord-coréen, connu depuis plus d’une décennie pour des détournements spectaculaires

Lovense fixed bugs exposing emails and allowing account takeovers. Company CEO may take legal action after the flaws were publicly disclosed.

The Pwn2Own competition is offering a $1m reward to any teams able to unearth a WhatsApp code execution exploit

Threat hunters saw North Korean operatives almost daily, reflecting a 220% year-over-year increase in activity, CrowdStrike said in a new report.

State-backed group CL-STA-0969 hit Southeast Asian telecoms in 2024, targeting critical infrastructure, says Palo Alto Networks' Unit 42.

CrowdStrike revealed the surge in cloud intrusions was partly driven by a 40% increase in Chinese-state actors exploiting these environments

A list of topics we covered in the week of July 28 to August 3 of 2025

New Android malware PlayPraetor infects 11,000+ devices, targeting banking users via fake Play Store links.

A threat actor has been abusing link wrapping services from reputed technology companies to mask malicious links leading to Microsoft 365 phishing pages that collect login credentials.

The Senate voted to confirm Sean Cairncross as national cyber director Saturday, giving the Trump administration one of its top cyber officials after a more than five-month process.

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Sean Cairncross, a political veteran without significant cybersecurity experience, could turn the relatively new White House office into a major player in the administration

Microsoft Virtual Hard Disk (VHDX) 11 - Remote Code Execution (RCE). CVE-2025-49683 . local exploit for Windows platform

Swagger UI 1.0.3 - Cross-Site Scripting (XSS). CVE-2025-8191 . remote exploit for Multiple platform

LPAR2RRD 8.04 - Remote Code Execution (RCE). CVE-2025-54769 . webapps exploit for Multiple platform

Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation. CVE-2023-3460 . webapps exploit for Multiple platform

Gandia Integra Total 4.4.2236.1 - SQL Injection. CVE-2025-41373 . webapps exploit for Multiple platform

Copyparty 1.18.6 - Reflected Cross-Site Scripting (XSS). CVE-2025-54589 . webapps exploit for Multiple platform

Microsoft Edge (Chromium-based) 135.0.7049.114/.115 - Information Disclosure. CVE-2025-49741 . remote exploit for Windows platform

State-backed hackers breached Southeast Asia telecoms using advanced tools—no data stolen, but stealth access achieved.

Undetected for a year, Plague malware targets Linux PAM to hijack SSH access and erase forensic traces.

OpenAI isn't just working on GPT-5. It looks like OpenAI is also preparing to release new open-source weights, living up to its name, OpenAI.'

Anthropic says it has revoked OpenAI's access to the Claude API after ChatGPT's engineers were found using Claude's coding tools.