Do Son Rockwell patched a flaw (CVE-2025-9067) in FactoryTalk Linx allowing SYSTEM privilege escalation via MSI repair hijacking. Other flaws risk file deletion and DoS in ICS environments.
cybernewswire
Torrance, United States, 14th October 2025, CyberNewsWire
SAP's October 2025 Security Patch Day addressed 13 new notes, including two critical 10.0 flaws in NetWeaver AS Java and Print Service, posing an RCE threat.
Luxembourg, Luxembourg, 14th October 2025, CyberNewsWire
Google consolidated ads into a "Sponsored Results" section that requires users to scroll over the entire block before they can manually hide the ads, boosting ad visibility globally.
Microsoft announced MAI-Image-1, its first in-house AI image generation model, now in testing for Copilot and Bing Image Creator, signaling a major push for technological self-reliance.
Ivanti disclosed 13 EPM flaws, including a High-severity RCE (CVE-2025-9713) and 11 Medium SQL Injection bugs. Fixes are scheduled for Nov 2025 and Q1 2026.
Apple faces a second class-action lawsuit claiming its AI models were trained using pirated books from "shadow libraries." The suit cites Anthropic's recent $1.5B copyright settlement.
Early OneDrive testers found Microsoft's new AI facial recognition feature can only be disabled three times per year. The feature is opt-out by default for preview users.
Google is integrating its Nano Banana AI image editor across Search, NotebookLM, and Photos. The feature will enhance video overviews and enable AI image editing via conversational prompts.
Microsoft updated Edge’s IE Mode policy after a Chakra zero-day was exploited via phishing. Users must now manually enable and whitelist domains to prevent remote device compromise.
OpenAI partnered with Broadcom to design and deploy custom AI accelerator chips for 10 gigawatts of infrastructure by 2029, strategically reducing its reliance on external suppliers like NVIDIA.
Google Chrome will now automatically revoke notification permissions from inactive websites (those with low click-through rates) to significantly reduce user interruptions and spam.
Apple introduced native threat notifications in iOS 26.1 Beta 3, allowing immediate Lockdown Mode alerts to appear directly in the Notification Center when mercenary spyware attacks are detected.
CERT/CC warns that Clevo’s UEFI firmware updates accidentally exposed Intel Boot Guard private keys (CVE-2025-11577), risking pre-boot firmware integrity on multiple OEM laptops.
A Critical (CVSS 9.1) flaw (CVE-2025-37729) in Elastic Cloud Enterprise allows authenticated Admin RCE. Attackers exploit Jinjava template injection to exfiltrate data and execute commands.
ETH Zurich exposed RMPocalypse, a deterministic flaw in AMD SEV-SNP that bypasses memory integrity during initialization, allowing a malicious hypervisor to compromise Confidential VMs (Zen 3/4/5) with 100% success.
Seqrite discovered a campaign using SVG smuggling and a fake Colombian court lure to deploy AsyncRAT. The SVG executes JS to stage a malicious HTA file, evading detection.
Malicious packages across npm, PyPI, and RubyGems are exploiting Discord webhooks as stealthy, resilient C2 endpoints to exfiltrate developer config files and sensitive host data.
A consortium of LAPSUS$/ShinyHunters hackers launched an EaaS campaign, claiming 1 billion records stolen from 39 Salesforce customers, and demanded a ransom before an October 10 deadline.
McAfee uncovered the Astaroth banking Trojan using GitHub for C2 backup, hiding encrypted configuration data via steganography in images to target Brazilian financial and crypto users.