Windows SMB Flaw Exploited, OAuth Apps Hijacked
▼ Summary
– Most AI privacy research focuses on data memorization, but the biggest risks come from how LLMs collect, process, and infer information during regular use.
– Cyber risk has expanded beyond IT to include IoT, OT, and supply chain ecosystems, multiplying the attack surface as organizations connect these assets.
– Multiple critical vulnerabilities are being actively exploited, including in Microsoft WSUS, Lanscope Endpoint Manager, and Adobe Commerce, requiring urgent updates.
– Attackers are using new techniques like abusing OAuth apps, targeting gift card systems, and distributing malware through compromised websites like Xubuntu’s.
– AI is a double-edged sword in cybersecurity, helping law enforcement trace attacks while also being used by criminals to conceal them and introducing vulnerabilities in AI-generated code.
Navigating the complex landscape of digital security requires staying informed about emerging threats and evolving defense strategies. Recent developments highlight a surge in sophisticated cyberattacks targeting everything from enterprise infrastructure to consumer applications. A critical Windows SMB flaw (CVE-2025-33073) is now under active exploitation, posing a significant risk to organizations relying on this protocol for network file sharing. Simultaneously, security researchers have observed a disturbing trend where attackers are hijacking trusted OAuth applications to create persistent backdoors in cloud environments, bypassing traditional security measures.
The scope of digital risk continues to expand beyond traditional IT systems. As organizations increasingly connect operational technology, Internet of Things devices, and supply chain partners through cloud and networked systems, the potential attack surface multiplies dramatically. This interconnected reality means that vulnerabilities in one area can quickly cascade across entire ecosystems.
Microsoft has responded urgently to another serious threat, releasing an out-of-band security update to address CVE-2025-59287, a remote code execution vulnerability in Windows Server Update Services that attackers are already exploiting. The company has also modified how Windows File Explorer handles internet-downloaded files to prevent malicious previews from executing code.
Multiple other critical vulnerabilities are seeing active exploitation. CVE-2025-61932, affecting Lanscope Endpoint Manager, has been exploited as a zero-day since April. Meanwhile, attackers are targeting CVE-2025-54236, a critical vulnerability in Adobe Commerce and Magento Open Source that could compromise e-commerce platforms. Even the official Xubuntu website was compromised recently to distribute Windows malware instead of the legitimate Linux distribution.
The threat landscape extends beyond software vulnerabilities. Check Point researchers uncovered a massive malware distribution network operating through YouTube, while Proofpoint documented attackers abusing internal OAuth applications to maintain access to cloud environments. Suspected Morocco-based attackers have been targeting global retailers’ gift card systems using cloud-only techniques, and China-linked Salt Typhoon hackers continue their campaign against telecommunications companies.
Industrial systems face their own challenges, with Moxa addressing five vulnerabilities in its industrial network security appliances and routers, including CVE-2025-6950, which features hard-coded credentials that could lead to complete system compromise.
North Korea’s Lazarus Group remains active, with ESET researchers uncovering a new wave of Operation DreamJob targeting European defense contractors involved in drone and UAV development. The campaign uses fake job advertisements to infiltrate organizations, highlighting Pyongyang’s interest in expanding its drone capabilities.
Artificial intelligence presents both solutions and new security considerations. While Texas Tech researchers are developing smart helmet technology that uses jaw and cheek movements to combat audio deepfakes, the University of Cagliari is studying AI’s dual role in both solving and concealing cybercrimes. Aikido Security reports that AI-generated code is introducing new vulnerabilities, forcing human developers to clean up the mess.
Privacy research may be focusing on the wrong problems, according to Carnegie Mellon and Northeastern University researchers. They argue that while most studies target data memorization in large language models, the bigger risks come from how these systems collect, process, and infer information during regular operation.
Accessibility remains a concern in security tools. A study from CISPA Helmholtz Center for Information Security and DePaul University found that password managers with poor accessibility features can lead blind and low-vision users to develop risky habits like password reuse.
The human element of cybersecurity continues to evolve. Military veterans are finding natural transitions into security roles, bringing valuable experience in teamwork and mission-focused work. However, hiring remains challenging, with many organizations struggling to find qualified candidates despite the growing need for security expertise.
As technology advances, even end-of-life considerations are becoming more complex. The OpenID Foundation is developing guidelines for digital estate planning to help ensure loved ones can legally access online accounts after death or incapacity.
Looking ahead, Gartner has identified the technologies likely to transform 2026, emphasizing that AI, connectivity, and digital trust will shape how companies compete and operate. European IT professionals are particularly concerned, with 51% expecting AI-driven threats and deepfakes to be major worries in the coming year.
Tools continue to evolve alongside threats. Wireshark 4.6.0 brings significant updates for packet analysis and decryption, while OpenFGA offers an open-source authorization engine for implementing fine-grained access control. NodePass provides a lightweight TCP/UDP tunneling solution for managing complex network environments.
The fundamental challenge remains balancing innovation with security. As Microsoft’s 2025 report indicates, adversaries are using AI to sharpen attacks and automate operations, blurring the lines between cybercrime, espionage, and disruption. Organizations must adapt their defenses accordingly, recognizing that the next major incident may originate from somewhere entirely unexpected in their supply chain.
(Source: HelpNet Security)