🧨 1. Microsoft SharePoint Exploited: 400+ Orgs Breached
APT Group: Warlock (Black Basta lineage)
- CVE exploited: Unpatched SharePoint RCE (TBD)
- Victims include: U.S. Nuclear Agency, Government Orgs
- TTPs: Lateral movement, persistence post-patching
- ⚠️ High persistence risk even after patching
🕳️ 2. Windows CLFS Zero-Day — CVE‑2025‑29824
Used by Storm‑2460 to drop PipeMagic ransomware
- Affected component: CLFS.sys (Kernel)
- Impact: Privilege Escalation → Full ransomware deployment
- Regions hit: 🇺🇸 🇪🇸 🇸🇦 🇻🇪
- Patch Available: URGENT update required
💉 3. Critical FortiWeb SQL Injection (CVE‑2025‑25257)
Unauthenticated SQL Injection flaw
- Allows: Full control over WAF appliances
- Exploit POC now public
- Attackers exploiting vulnerable FortiWeb instances globally
- Vendor advisory: Fortinet Security Center
🔓 4. AI Tool Infrastructure Zero-Day
Privacy threat in popular coding assistant backend
- Allows: Harvesting of user emails
- Phishing risk: High
- Impact: AI developers, open-source projects
- Remediation: Limit LLM API access & monitor outgoing traffic
🧬 5. WormGPT Clones Generate Polymorphic Malware
Malware re-coded on demand in: Python, PowerShell, Bash
- Adapts to evade: YARA, EDR, Sandboxes
- Delivery: Phishing, loaders, GitHub links
- Used by: APT, ransomware crews, and darknet services
🔐 6. SAP Zero-Day (CVE‑2025‑31324) in Visual Composer
CVSS: 10.0 — Critical
- Allows: Unauthenticated file upload → Full system compromise
- Exploited in the wild
- CISA has listed it as Known Exploited Vulnerability (KEV)
🧠 7. Google Chrome Zero-Days: CVE‑2025‑6554 & 6558
Exploited in the wild targeting Chromium-based browsers
- Patch released urgently
- Affects: Chrome, Edge, Brave, Opera
- Delivery vectors: Malvertising, infected extensions
📡 8. Telecom Orange Hacked – Data Exposure Suspected
- Incident ongoing
- Early reports: Data breach, internal disruption
- Details expected from CERT-FR
- Attack type: Likely supply-chain compromise
🧠 Analysis
We’re seeing a steep spike in zero-days targeting:
- Collaboration platforms (SharePoint, SAP)
- Critical infrastructure (Telecom, Gov)
- Browser attack surfaces
- AI development environments
💬 “Modern cyberattacks don’t just break in—they blend in.” — CyberDudeBivash
🛡️ Recommendations
- ✅ Patch all major software: Chrome, SharePoint, FortiWeb, Windows
- ✅ Harden AI environments (monitor LLM API & plugins)
- ✅ Implement memory-based EDRs with AI-malware detection
- ✅ Train SOC teams on polymorphic AI-generated malware
📣 Share & Spread Awareness
🔗 Full Blog → cyberdudebivash.com
🔗 Google Blog → cyberbivash.blogspot.com
🔗 LinkedIn → @CyberDudeBivash