Cybersecurity

Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts 

Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts 

Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if successfully exploited, could allow attackers to take control of customer accounts.
The vulnerability, tracked as CVE-2025-54236 (aka SessionReaper), carries a CVSS score of 9.1 out of a maximum of 10.0. It has been described as an improper input validation flaw. Adobe said it’s not aware of

SAP Patches Critical NetWeaver (CVSS Up to 10.0) and Previously Exploited S/4HANA Flaws 

SAP Patches Critical NetWeaver (CVSS Up to 10.0) and Previously Exploited S/4HANA Flaws 

SAP on Tuesday released security updates to address multiple security flaws, including three critical vulnerabilities in SAP Netweaver that could result in code execution and the upload arbitrary files.
The vulnerabilities are listed below –

CVE-2025-42944 (CVSS score: 10.0) – A deserialization vulnerability in SAP NetWeaver that could allow an unauthenticated attacker to submit a malicious

Microsoft Patch Tuesday, September 2025 Edition 

Microsoft Patch Tuesday, September 2025 Edition 

Microsoft Corp. today issued security updates to fix more than 80 vulnerabilities in its Windows operating systems and software. There are no known “zero-day” or actively exploited vulnerabilities in this month’s bundle from Redmond, which nevertheless includes patches for 13 flaws that earned Microsoft’s most-dire “critical” label. Meanwhile, both Apple and Google recently released updates to fix zero-day bugs in their devices.

Axios Abuse and Salty 2FA Kits Fuel Advanced Microsoft 365 Phishing Attacks 

Axios Abuse and Salty 2FA Kits Fuel Advanced Microsoft 365 Phishing Attacks 

Threat actors are abusing HTTP client tools like Axios in conjunction with Microsoft’s Direct Send feature to form a “highly efficient attack pipeline” in recent phishing campaigns, according to new findings from ReliaQuest.
“Axios user agent activity surged 241% from June to August 2025, dwarfing the 85% growth of all other flagged user agents combined,” the cybersecurity company said in a

The AI Fix #67: Will Smith’s AI crowd scandal, and gullible agents fall for scams 

The AI Fix #67: Will Smith’s AI crowd scandal, and gullible agents fall for scams 

In episode 67 of The AI Fix, Graham talks to an AI with a fax machine, Bill Gates says there’s one job AI will never replace, criminals use Claude Code for cyberattacks, Mark reveals why GPT-5 was better than you think, and a bird brings new meaning to the words “cloud storage”.

Also, Graham reveals that web-browsing AI agents are as gullible and click-happy as your most credulous distant relative, and Mark explains why the crowd at a recent Will Smith gig included somebody who wasn’t there and a man whose hands look like feet.

All this and much more is discussed in the latest edition of “The AI Fix” podcast by Graham Cluley and Mark Stockley.

RatOn Android Malware Detected With NFC Relay and ATS Banking Fraud Capabilities 

RatOn Android Malware Detected With NFC Relay and ATS Banking Fraud Capabilities 

A new Android malware called RatOn evolved from a basic tool capable of conducting Near Field Communication (NFC) attacks to a sophisticated remote access trojan with Automated Transfer System (ATS) capabilities to conduct device fraud.
“RatOn merges traditional overlay attacks with automatic money transfers and NFC relay functionality – making it a uniquely powerful threat,” the Dutch mobile

From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks 

From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks 

Cybersecurity researchers have disclosed details of a phishing campaign that delivers a stealthy banking malware-turned-remote access trojan called MostereRAT.
The phishing attack incorporates a number of advanced evasion techniques to gain complete control over compromised systems, siphon sensitive data, and extend its functionality by serving secondary plugins, Fortinet FortiGuard Labs said.

TOR-Based Cryptojacking Attack Expands Through Misconfigured Docker APIs 

TOR-Based Cryptojacking Attack Expands Through Misconfigured Docker APIs 

Cybersecurity researchers have discovered a variant of a recently disclosed campaign that abuses the TOR network for cryptojacking attacks targeting exposed Docker APIs.
Akamai, which discovered the latest activity last month, said it’s designed to block other actors from accessing the Docker API from the internet.
The findings build on a prior report from Trend Micro in late June 2025, which

[Webinar] Shadow AI Agents Multiply Fast —  Learn How to Detect and Control Them 

[Webinar] Shadow AI Agents Multiply Fast — Learn How to Detect and Control Them 

⚠️ One click is all it takes.
An engineer spins up an “experimental” AI Agent to test a workflow. A business unit connects to automate reporting. A cloud platform quietly enables a new agent behind the scenes.
Individually, they look harmless. But together, they form an invisible swarm of Shadow AI Agents—operating outside security’s line of sight, tied to identities you don’t even know exist.

How Leading CISOs are Getting Budget Approval 

How Leading CISOs are Getting Budget Approval 

It’s budget season. Once again, security is being questioned, scrutinized, or deprioritized.
If you’re a CISO or security leader, you’ve likely found yourself explaining why your program matters, why a given tool or headcount is essential, and how the next breach is one blind spot away. But these arguments often fall short unless they’re framed in a way the board can understand and appreciate.

NEW CUSTOMERS CALL TODAY: 720.221.6804  |  EXISTING CUSTOMERS REQUIRING SUPPORT: 303.617.6442

X