Latest CyberSec News by @thecyberpicker

Microsoft says that Storm-1175, a China-based financially motivated cybercriminal group known for deploying Medusa ransomware payloads, has been deploying n-day and zero-day exploits in high-velocity attacks.

Posts about macOS malware, exploits, and tools

DPRK-linked actors use GitHub C2 and LNK phishing in South Korea, enabling persistent PowerShell control and data exfiltration.

The Drift Protocol says that the $280+ million hack it suffered last week was the result of a long-term, carefully planned operation that included building "a functioning operational presence inside the Drift ecosystem."

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to secure FortiClient Enterprise Management Server (EMS) instances against an actively exploited vulnerability by Friday.

Posts about macOS malware, exploits, and tools

German police BKA identified two key REvil ransomware members, linking them to over 130 attacks in Germany.

Fortinet released an emergency hotfix after security researchers discovered the vulnerability being exploited as a zero-day.

The telehealth provider said hackers gained access to a third-party customer service platform, but medical records remained secure.

ANY.RUN cuts MTTR by 21 minutes per case, reducing escalations and breach exposure in multi-OS attacks.

Phishing surge, LinkedIn tracking claims, spyware use, and rising stealers expose growing abuse of trusted systems.

Infostealers are harvesting credentials and session cookies at scale, bypassing traditional defenses. Lunar explains why simple breach monitoring alone can't keep up with modern credential-based attacks.

Over 14,000 F5 BIG-IP APM instances remain exposed online, as attackers actively exploit a critical remote code execution flaw CVE-2025-53521.

is-localhost-ip 2.0.0 - SSRF.. local exploit for Multiple platform

Windows Kernel - Elevation of Privilege. CVE-2025-62215  . local exploit for Windows platform

Desktop Window Manager Core Library 10.0.10240.0 - Privilege Escalation. CVE-2025-59254 . local exploit for Windows platform

ASP.net 8.0.10 - Bypass. CVE-2025-55315 . webapps exploit for Multiple platform

Zhiyuan OA - arbitrary file upload leading. CVE-2025-34040 . webapps exploit for Multiple platform

Grafana 11.6.0 - SSRF. CVE-2025-4123 . webapps exploit for Multiple platform

RiteCMS 3.1.0 - Authenticated Remote Code Execution.. webapps exploit for Multiple platform

WBCE CMS 1.6.4 - Remote Code Execution.. webapps exploit for Multiple platform

WordPress Madara - Local File Inclusion. CVE-2025-4524 . webapps exploit for Multiple platform

Fortinet FortiWeb v8.0.1 - Auth Bypass. CVE-2025-64446 . webapps exploit for Multiple platform

This week in cybersecurity from the editors at Cybercrime Magazine

Guidance for CSA members on deploying post-quantum crypto in cloud-native zero-trust architectures, with priorities, timelines, and governance.

LiteLLM 1.82.7–1.82.8 supply chain attack exposed 33,185 secrets across 6,943 machines, leaving 3,760 valid credentials active.

Google says that it will fully transition to post-quantum cryptography by 2029. I think this is a good move, not because I think we will have a useful quantum computer anywhere near that year, but because crypto-agility is always a good thing. Slashdot thread.