Cybersecurity News Weekly Newsletter \u2013 Windows, Chrome, and Apple 0-days, Kali Linux 2025.4, and MITRE Top 25
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
As 2025 nears its close, the cybersecurity landscape shows no signs of slowing down. This week\u2019s developments highlight how rapidly the threat environment continues to evolve with major zero-day vulnerabilities targeting Windows, Chrome, and Apple devices, each actively exploited in the wild.<\/p>\n
These high-risk flaws underline the continued importance of swift patching, layered defense, and continuous threat monitoring across enterprise ecosystems.<\/p>\n
Meanwhile, offensive security professionals received a major update as Kali Linux 2025.4<\/a> rolled out with new tools, kernel upgrades, and enhanced cloud integration, reinforcing its position as a cornerstone for penetration testing and digital forensics in both research and operational security settings.<\/p>\n On the defensive front, MITRE released its annual Top 25 Most Dangerous Software Weaknesses of 2025<\/a>, spotlighting recurring coding errors that adversaries frequently weaponize. From inadequate input validation to risky resource management, the list serves as a vital reminder that secure coding is still the first line of defense against complex exploitation techniques and chained attack vectors.<\/p>\n Across the board, this week reflects a convergence of aggressive exploitation activity and heightened community response. Organizations are urged to prioritize visibility, validate software supply chains, and stay aligned with evolving security frameworks. Whether patching systems affected by 0-days, assessing exposure through MITRE\u2019s latest findings, or adopting the latest features of Kali Linux, the takeaway is clear \u2014 cyber resilience depends on agility, awareness, and readiness.<\/p>\n Stay ahead of the threat curve with this week\u2019s highlights, advisories, and actionable updates across infrastructure, endpoint, and application security domains.<\/p>\n A long-running supply chain attack abused typo\u2011squatted Go packages \u200bRead more: https:\/\/cybersecuritynews.com\/malicious-go-packages-as-googles-uuid-library\/<\/a><\/p>\n Researchers showed how attackers can publish malicious extensions to Visual Studio Code and AI IDEs like Cursor with minimal friction, exemplified by a typo\u2011squatted \u201cPiithon-linter\u201d that passed marketplace checks. Once installed, such extensions can auto\u2011execute on IDE launch, evade AV\/EDR via environment checks, exfiltrate environment variables (secrets, tokens), and deploy Merlin C2 agents across Windows, macOS, and Linux.\u200b<\/p>\n Read more: https:\/\/cybersecuritynews.com\/hackers-compromising-developers-with-malicious-vs-code\/<\/a><\/p>\n An Android app called \u201cDocument Reader \u2013 File Manager\u201d on Google Play, with over 50,000 installs, was found to act as a dropper for the Anatsa (TeaBot) banking trojan. The app fetches the payload from a remote server, uses emulator\u2011evasion and obfuscation techniques, abuses accessibility permissions, and overlays fake banking interfaces to steal credentials and enable fraudulent transactions against hundreds of financial institutions worldwide.<\/p>\n Read more: https:\/\/cybersecuritynews.com\/malicious-document-reader-app-google-play\/<\/a><\/p>\n A previously unknown Linux backdoor dubbed GhostPenguin evaded all engines on VirusTotal for months while providing attackers with remote shell access and full file\u2011system operations over encrypted UDP. The malware uses RC5 encryption with a dynamically assigned session ID over UDP port 53, employs multi\u2011stage communication, heartbeat\u2011based C2, and supports around 40 commands, illustrating how bespoke, low\u2011noise backdoors can slip past conventional detection.<\/p>\n Read more: https:\/\/cybersecuritynews.com\/ghostpenguin-backdoor-with-zero-detection\/<\/a><\/p>\n Recent reporting highlights a sharp rise in ransomware campaigns explicitly targeting Microsoft Hyper\u2011V and VMware ESXi environments, often to maximize impact by encrypting virtual machine images at scale. Threat actors increasingly abuse misconfigurations, flat network access, weak admin credentials, and inadequate segmentation around hypervisors to gain control of virtualization layers and disrupt entire fleets of workloads in a single operation.<\/p>\n Read more: https:\/\/cybersecuritynews.com\/ransomware-targeting-hyper-v-and-vmware-esxi-surges\/<\/a><\/p>\n Threat actors are abusing legitimate ChatGPT and Grok conversation links, which rank highly in search results, to lure macOS users into running malicious Terminal commands that install Atomic macOS Stealer (AMOS). The attack uses base64\u2011encoded payloads, leverages Read more: https:\/\/cybersecuritynews.com\/chatgpt-and-grok-conversations-weaponized\/<\/a><\/p>\n New research traces how credentials harvested via phishing move through a multi\u2011stage underground economy, from initial collection on fake pages to distribution via email, Telegram bots, or phishing\u2011as\u2011a\u2011service panels like BulletProofLink and Caffeine. Stolen data is aggregated, traded, and repeatedly reused for account takeover, fraud, and follow\u2011on intrusions, meaning even \u201cold\u201d phished credentials can continue to pose long\u2011term risk if not properly revoked and monitored.<\/p>\n Read more: https:\/\/cybersecuritynews.com\/what-happens-to-data-stolen-in-a-phishing-attack\/<\/a><\/p>\n A critical unsafe deserialization flaw in the React Server Components Flight protocol, dubbed \u201cReact2Shell\u201d (CVE-2025-55182), is under active exploitation across React and Next.js deployments. Attackers are using automated Mirai-style botnet kits, PowerShell \u201ccheap math\u201d probes for RCE validation, and encoded download\u2011and\u2011execute stagers that bypass AMSI by flipping Read more: https:\/\/cybersecuritynews.com\/react2shell-rce-vulnerability\/<\/a><\/p>\n OceanLotus (APT32) is conducting a focused surveillance campaign against China\u2019s \u201cXinchuang\u201d IT stack, abusing domestic hardware\/software supply chains once considered resilient to foreign espionage. The group uses spear\u2011phishing with malicious Read more: https:\/\/cybersecuritynews.com\/oceanlotus-hacker-group-targeting-xinchuang-it-ecosystems\/<\/a><\/p>\n A new \u201cSpiderman\u201d phishing framework is enabling low\u2011skill threat actors to build pixel\u2011perfect clones of dozens of European banking and crypto portals through a point\u2011and\u2011click interface. The kit centralizes support for major banks, adds real\u2011time session control, and includes dedicated modules to capture 2FA codes such as PhotoTAN and OTPs while operators watch sessions live.\u200b Read more: https:\/\/cybersecuritynews.com\/spiderman-phishing-kit-bank-login\/<\/a><\/p>\n A new macOS campaign abuses sponsored Google Ads and fake ChatGPT \u201csupport\u201d sessions to deliver AMOS InfoStealer under the guise of terminal troubleshooting commands. Victims looking to fix sound issues are funneled into a convincing chat flow that instructs them to run a single terminal line which silently downloads and executes a remote script to install AMOS and set up persistence.\u200b Read more: https:\/\/cybersecuritynews.com\/threat-actors-leverage-chatgpt\/<\/a><\/p>\n Two Chinese operators, Yuyang and Qiu Daibing, formerly standout Cisco Network Academy participants, have been identified as key figures behind the Salt Typhoon campaign targeting Cisco infrastructure worldwide. Leveraging deep familiarity with Cisco IOS and ASA firewalls, the operation compromised over 80 telecom providers, intercepting unencrypted communications involving US presidential candidates, staffers, and policy experts.<\/p>\n The campaign also abused lawful\u2011intercept (CALEA) infrastructure for large\u2011scale intelligence collection, raising hard questions about the geopolitical risks of vendor training programs in adversarial markets.\u200b<\/p>\n Read more: https:\/\/cybersecuritynews.com\/chinese-hackers-attacking-cisco-devices\/<\/a><\/p>\n ValleyRAT (aka Winos\/Winos4.0) has evolved into a modular backdoor with an embedded kernel\u2011mode rootkit that can retain valid signatures and load on fully patched Windows 11 systems. Following the public leak of its builder, detections have surged, with roughly 85% of samples observed in the last six months and increasing use by diverse threat actors. Read more: https:\/\/cybersecuritynews.com\/valleyrat-malware-uses-stealthy-driver-install\/<\/a><\/p>\n Pro\u2011Russia group CyberVolk has resurfaced with VolkLocker, a cross\u2011platform ransomware\u2011as\u2011a\u2011service written in Go that targets both Linux and Windows environments. Despite rushed development and leftover test artifacts, the platform combines Telegram\u2011based automation with robust encryption, giving affiliate operators an easy path to broad infrastructure compromise. Read more: https:\/\/cybersecuritynews.com\/cybervolk-hackers-group-with-new-volklocker-payloads\/<\/a><\/p>\n WatchGuard Firebox appliances received fixes for ten vulnerabilities, including multiple out-of-bounds write bugs in the CLI and certificate daemon that let authenticated admins gain arbitrary code execution, a high-severity XPath injection exposing configuration data, and several stored XSS bugs in third\u2011party integrations. Patches are available in Fireware OS 2025.1.3, 12.11.5, and 12.5.14, and organizations with exposed management interfaces or legacy IPSec setups are urged to update immediately.\u200b<\/p>\n Read more: https:\/\/cybersecuritynews.com\/watchguard-firebox-vulnerabilities\/<\/a><\/p>\n Fortinet disclosed a critical improper cryptographic signature verification issue in FortiCloud SSO handling that allows unauthenticated attackers to forge SAML messages and gain admin access when FortiCloud login is enabled (often auto\u2011enabled during registration). A broad range of FortiOS, FortiProxy, FortiWeb, and FortiSwitchManager releases require urgent upgrades, with disabling FortiCloud SSO offered as an interim workaround for environments that cannot patch immediately.<\/p>\n Read more: https:\/\/cybersecuritynews.com\/critical-fortinet-vulnerability\/<\/a><\/p>\n A separate FortiSandbox issue allows attackers to exploit an OS command injection flaw to run arbitrary commands on affected appliances, threatening both sandbox integrity and adjacent monitored networks. Fortinet has issued fixed firmware versions and recommends immediate upgrades for any internet\u2011exposed or shared multi\u2011tenant sandbox deployments.<\/p>\n Read more: https:\/\/cybersecuritynews.com\/fortisandbox-os-command-injection-vulnerability\/<\/a><\/p>\n Research from OFFENSAI shows how IAM\u2019s 3\u20134 second consistency delay lets attackers keep or reestablish access even after defenders delete compromised access keys or apply deny policies, because stale state remains usable briefly across regions. Recommended mitigations include enforcing account\u2011level SCPs via AWS Organizations, favoring short\u2011lived STS and role\u2011based access over long\u2011term keys, and updating incident\u2011response playbooks to explicitly account for propagation delays.\u200b<\/p>\n Read more: https:\/\/cybersecuritynews.com\/aws-iam-eventual-consistency-exploited\/<\/a><\/p>\n A new \u201cConsentFix\u201d technique manipulates OAuth consent flows and existing app grants to silently escalate access to Microsoft accounts, allowing attackers to persist without traditional credential theft. Organizations should review enterprise app consents, enforce admin\u2011only consent for high\u2011risk scopes, and tighten conditional access and app governance policies.<\/p>\n Read more: https:\/\/cybersecuritynews.com\/consentfix-attack-hijack-microsoft-accounts\/<\/a><\/p>\n SAP\u2019s December Security Patch Day delivered 14 notes, including three critical issues such as a 9.9\u2011rated code injection in SAP Solution Manager and critical flaws in Commerce Cloud (Tomcat) and jConnect deserialization that can enable remote code execution and systemic compromise. Additional high and medium notes span Web Dispatcher, NetWeaver, Business Objects, SAPUI5, and Enterprise Search, with SAP urging rapid patching via the Support Portal and non\u2011production testing first.\u200b Microsoft\u2019s final 2025 Patch Tuesday fixes 56 vulnerabilities across Windows, Office, Exchange, Azure components, and developer tooling, including three zero\u2011days: two command\u2011injection RCEs in PowerShell and GitHub Copilot for JetBrains, and an actively exploited elevation\u2011of\u2011privilege bug in the Windows Cloud Files Mini Filter Driver. With 19 RCEs and 28 EoP issues, defenders should prioritize zero\u2011days and \u201cmore likely\u201d exploits, especially on internet\u2011facing services and high\u2011value endpoints heading into the holiday period.<\/p>\n Read more: https:\/\/cybersecuritynews.com\/microsoft-december-2025-patch-tuesday\/<\/a><\/p>\n CISA added CVE\u20112025\u201114174, an out\u2011of\u2011bounds memory access bug in Chromium\u2019s ANGLE graphics layer, to its Known Exploited Vulnerabilities catalog after in\u2011the\u2011wild abuse for remote code execution via malicious HTML content. Organizations must move Chrome to at least 131.0.6778.201, Edge to 131.0.3139.95, and ensure rapid updates across all Chromium\u2011based browsers before CISA\u2019s early\u2011January mitigation deadline. A separate Chrome 0\u2011day has been patched after active exploitation, allowing attackers to compromise users through crafted web content and potentially deploy spyware or ransomware. Enterprises should enforce browser auto\u2011update policies, monitor crash and anomaly telemetry, and validate that high\u2011risk user groups (admins, developers, execs) are on fixed builds.<\/p>\n Read more: https:\/\/cybersecuritynews.com\/chrome-0-day-vulnerability-2\/<\/a><\/p>\n Apple shipped emergency fixes for multiple zero\u2011days across iOS, iPadOS, macOS, and Safari that attackers were already leveraging for code execution and potential spyware deployment. Admins should prioritize mobile device management enforcement of the latest releases, especially for high\u2011risk travelers and BYOD fleets.<\/p>\n Read more: https:\/\/cybersecuritynews.com\/apple-0-day-vulnerabilities-exploited-2\/<\/a><\/p>\n The \u201cGeminiJack\u201d issue in Google Gemini Enterprise (and earlier Vertex AI Search) exploited prompt\u2011injection in shared Docs, Calendar events, and emails to trick Gemini\u2019s RAG pipeline into querying sensitive Workspace data and exfiltrating results via hidden image requests, all without user interaction. Google has separated services and hardened instruction handling, but the case underscores the need to restrict AI data sources, monitor RAG behavior, and treat AI assistants as privileged data processors in threat models.<\/p>\n Read more: https:\/\/cybersecuritynews.com\/gemini-zero-click-vulnerability\/<\/a><\/p>\n Vulnerabilities disclosed in SoapWn.NET, a .NET SOAP testing framework, can be abused to run arbitrary code or manipulate test configurations when opening crafted project files or responses. Development and QA teams should patch to the latest release, avoid loading untrusted test artifacts, and consider sandboxing tooling used to inspect attacker\u2011controlled inputs.<\/p>\n Read more: https:\/\/cybersecuritynews.com\/soapwn-net-vulnerabilities\/<\/a><\/p>\n Threat actors are exploiting a Notepad++ flaw to deliver malicious payloads, using weaponized plugins or crafted files to execute code on developer and IT endpoints. Updating to fixed builds and restricting plugin sources are essential, along with treating developer utilities as high\u2011risk targets in endpoint protection policies.<\/p>\n Read more: https:\/\/cybersecuritynews.com\/notepad-vulnerability-exploited\/<\/a><\/p>\n Hundreds of Porsche owners in Russia found their internal combustion models suddenly undrivable after a malfunction in the factory-installed alarm and telematics stack blocked satellite connectivity and engine start. The issue affects multiple ICE lines\u2014from sports models to SUVs\u2014and requires towing to authorized centers, where technicians manually reset immobilized alarm units without a definitive permanent fix yet. With no reported impact on hybrids or EVs and growing speculation around firmware bugs, supply chain tampering, or even remote kill-switch logic, the incident underscores how tightly vehicle safety now depends on opaque backend ecosystems and OTA logic.\u200b<\/p>\n Read more: https:\/\/cybersecuritynews.com\/porsche-cars-immobilized\/<\/a><\/p>\n Researchers detailed a critical privacy weakness dubbed \u201cCareless Whisper\u201d that lets attackers probe WhatsApp and Signal users using only a phone number and stealth delivery receipts. By sending invisible reactions, invalid deletions, or timed-out edits, adversaries can measure round-trip delays from each device to infer screen state, usage patterns, and multi-device presence with sub-second granularity\u2014without triggering notifications or needing prior conversations. High-rate probing, including oversized reactions that generate sustained traffic, can also inflate data usage and drain batteries, while the lack of effective rate limiting or receipt filtering for unknown contacts leaves billions of users exposed until platforms redesign their messaging metadata flows.\u200b<\/p>\n Read more: https:\/\/cybersecuritynews.com\/hackers-leverage-delivery-receipts\/<\/a><\/p>\n A significant outage in Microsoft Copilot affected users across the UK and parts of Europe, leaving many unable to authenticate to Copilot endpoints or experiencing severely degraded AI features across Edge and Microsoft 365 experiences. The disruption, tracked under a cloud incident ID, blocked or slowed AI-assisted workflows such as content drafting, data summarization, and in-app copilots, demonstrating how quickly productivity pipelines stall when centralized AI inference services fail. For security and IT leaders, the event reinforces the need for contingency planning around AI dependencies, including fallbacks for critical business processes and explicit incident playbooks for SaaS-level AI outages.\u200b<\/p>\n Read more: https:\/\/cybersecuritynews.com\/microsoft-copilot-disruption-in-the-uk\/<\/a><\/p>\n Google announced a sweeping AI upgrade for Chrome that embeds Gemini-powered capabilities directly into the browser, including in-page assistance, summarization, and smarter security protections. On the security front, enhanced Safe Browsing logic uses on-device AI to better flag scam pages and fake alerts, while new privacy models aim to reduce tracking and unwanted notification prompts at scale. At the same time, deeper AI integration increases Chrome\u2019s attack surface, requiring defenders to watch for abuse of AI-driven content generation, prompt injection scenarios, and potential misconfigurations in new security and privacy controls.\u200b<\/p>\n Read more: https:\/\/cybersecuritynews.com\/google-new-ai-features\/<\/a><\/p>\n GitHub users around the world reported intermittent outages, seeing unicorn error pages and \u201cNo server is currently available to service your request\u201d while attempting to access repositories, perform Git operations, or log in. The disruption, tied to increased backend request failures impacting core services and automation pipelines, caused delays for both open-source projects and enterprise CI\/CD workflows that depend on GitHub Actions and webhooks. While initial indicators point to infrastructure and capacity issues rather than a cyberattack, the incident again highlights how central code-hosting platforms have become to vulnerability management, incident response, and daily development.\u200b<\/p>\n Read more: https:\/\/cybersecuritynews.com\/github-down\/<\/a><\/p>\n MITRE published the 2025 CWE Top 25 Most Dangerous Software Weaknesses, analyzing tens of thousands of CVEs to identify the most frequently exploited root causes. Cross-site scripting and SQL injection remain near the top of the list, but the ranking also shows a surge in authorization weaknesses such as missing authorization and incorrect access control, along with persistent memory errors like out-of-bounds writes, use-after-free, and classic buffer overflows. For defenders and engineering leaders, the list offers a practical roadmap for secure-by-design initiatives, suggesting a stronger emphasis on memory-safe languages, robust input validation, and systematic authorization checks in cloud and microservices architectures.\u200b<\/p>\n Read more: https:\/\/cybersecuritynews.com\/mitre-releases-top-25-most-dangerous-software\/<\/a><\/p>\n The Kali Linux team released version 2025.4, the final rolling update of the year, bringing kernel 6.16, refreshed GNOME, KDE, and Xfce environments, and a fully Wayland-focused desktop experience\u2014even in virtual machines. Offensive tooling receives a boost with several new packages, while NetHunter gains tighter integration with Wifipumpkin3 to support advanced wireless attacks such as Evil Twin setups, captive portal phishing, and traffic interception from mobile devices. For penetration testers, the release improves day-to-day usability and broadens assessment coverage, making it a timely upgrade ahead of 2026 engagement cycles.\u200b<\/p>\n Read more: https:\/\/cybersecuritynews.com\/kali-linux-2025-4\/<\/a><\/p>\n Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n The post Cybersecurity News Weekly Newsletter \u2013 Windows, Chrome, and Apple 0-days, Kali Linux 2025.4, and MITRE Top 25<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n\u200bThreats<\/strong><\/h2>\n
Malicious Go UUID Packages Target Developers<\/strong><\/h3>\n
github.com\/bpoorman\/uuid<\/code> and github.com\/bpoorman\/uid<\/code> to impersonate Google\u2019s and pborman\u2019s UUID libraries while silently exfiltrating sensitive data passed into a backdoored Valid<\/code> helper function. Collected data is encrypted and uploaded to dpaste.com using a hardcoded API token, and the malicious packages have been available since 2021, highlighting the need for strict dependency verification in Go projects and regular audits of go.mod<\/code> imports.<\/p>\nVS Code & AI IDE Extensions as Backdoors<\/strong><\/h3>\n
Anatsa Banking Trojan Hidden in Google Play Document Reader<\/strong><\/h3>\n
GhostPenguin: Zero\u2011Detection Linux Backdoor<\/strong><\/h3>\n
Ransomware Surge Against Hyper\u2011V & ESXi<\/strong><\/h3>\n
AI Conversations Weaponized to Deliver AMOS<\/strong><\/h3>\n
dscl<\/code> and sudo -S<\/code> to validate and reuse user credentials, and sets up persistence via LaunchDaemons, exploiting user trust in AI platforms rather than exploiting OS vulnerabilities.<\/p>\nLifecycle of Data Stolen in Phishing Attacks<\/strong><\/h3>\n
Cyberattack<\/strong><\/h2>\n
React2Shell RCE Actively Exploited in the Wild (CVE-2025-55182)<\/strong><\/h3>\n
AmsiUtils.amsiInitFailed<\/code> to true.\u200b
Defenders should urgently patch affected React\/Next.js stacks, block known campaign IPs where possible, and monitor for repeated PowerShell arithmetic execution and AMSI-bypass indicators on Windows endpoints.\u200b<\/p>\nOceanLotus Targets China\u2019s Xinchuang Ecosystem via Supply Chain Attacks<\/strong><\/h3>\n
.desktop<\/code> files, WPS PDF lures, and JAR archives, then chains brute\u2011forcing of internal security servers with suspected zero\u2011days to push malicious update scripts.\u200b
An N\u2011day bug in Atril (CVE-2023-52076) is weaponized via crafted EPUBs to achieve path traversal and arbitrary file write, dropping an autostart .desktop<\/code> loader and encrypted payload that decrypts to a Python downloader on login.\u200b<\/p>\nSpiderman Phishing Kit Supercharges European Banking Fraud<\/strong><\/h3>\n
Spiderman further evades takedowns using granular geo\/device filtering and anti\u2011analysis rules and extends fraud into crypto by harvesting wallet seed phrases for platforms like Ledger, MetaMask, and Exodus.\u200b<\/p>\nChatGPT-Themed Lures Deliver AMOS InfoStealer to macOS<\/strong><\/h3>\n
Once deployed, AMOS harvests browser data, credentials, cookies, and other secrets from Mac endpoints, enabling account takeover and lateral movement against both consumer and enterprise environments.\u200b<\/p>\nCisco\u2011Trained Chinese Hackers Turn Tools Against Cisco Devices<\/strong><\/h3>\n
ValleyRAT Builder Leak Fuels Stealthy Windows 11 Rootkit Campaigns<\/strong><\/h3>\n
The malware chains first\u2011stage beaconing modules with a driver plugin that stealthily installs a signed rootkit, injects user\u2011mode shellcode, and forcibly removes AV\/EDR drivers from vendors like Qihoo 360, Huorong, Tencent, and Kingsoft to create a blind spot.<\/p>\nCyberVolk\u2019s VolkLocker Hits Linux and Windows with RaaS Model<\/strong><\/h3>\n
VolkLocker uses a registry\u2011based \u201cms-settings\u201d UAC bypass for stealthy privilege escalation, then performs extensive environment checks to avoid sandboxes and focus on production systems, while encouraging affiliates to apply UPX packing for additional evasion.<\/p>\nVulnerability<\/strong><\/h2>\n
WatchGuard Firebox: 10 flaws enabling code execution<\/strong><\/h3>\n
Fortinet SSO bypass across FortiOS, FortiWeb, and FortiProxy<\/strong><\/h3>\n
FortiSandbox OS command injection<\/strong><\/h3>\n
AWS IAM eventual consistency is abused for stealthy persistence<\/strong><\/h3>\n
\u201cConsentFix\u201d attack hijacks Microsoft accounts via OAuth consent abuse<\/strong><\/h3>\n
SAP December Patch Day: 3 critical code\u2011execution paths<\/strong><\/h3>\n
Read more: https:\/\/cybersecuritynews.com\/sap-security-patch-day-december\/<\/a><\/p>\nMicrosoft Patch Tuesday: 56 CVEs, 3 zero\u2011days<\/strong><\/h3>\n
Chromium ANGLE zero\u2011day added to CISA KEV<\/strong><\/h3>\n
Read more: https:\/\/cybersecuritynews.com\/chromium-0-day-vulnerability-exploited\/<\/a><\/p>\nGoogle Chrome 0\u2011day targeting mainstream users<\/strong><\/h3>\n
Apple zero\u2011days exploited in the wild<\/strong><\/h3>\n
GeminiJack: Zero\u2011click data exfiltration via Gemini Enterprise<\/strong><\/h3>\n
SoapWn.NET vulnerabilities in SOAP testing tooling<\/strong><\/h3>\n
Notepad++ vulnerability exploited for lure delivery<\/strong><\/h3>\n
Other News<\/strong><\/h2>\n
Porsche Cars Immobilized by Satellite Security Glitch<\/strong><\/h3>\n
\u201cCareless Whisper\u201d: Silent Delivery Receipts Expose WhatsApp & Signal Activity<\/strong><\/h3>\n
Microsoft Copilot Disruption Hits UK Users<\/strong><\/h3>\n
Google Pushes New Gemini-Powered AI Features in Chrome<\/strong><\/h3>\n
GitHub Outage Disrupts Developers with \u201cNo Server Available\u201d Errors<\/strong><\/h3>\n
MITRE\u2019s 2025 CWE Top 25: Memory Safety & Authorization Flaws Dominate<\/strong><\/h3>\n
Kali Linux 2025.4: New Tools, Wayland, and NetHunter Enhancements<\/strong><\/h3>\n