Kirsten Doyle

A newly disclosed vulnerability in SAP S/4HANA has been rated critical, with security researchers warning that exploitation is already underway. The flaw, tracked as CVE-2025-42957, carries a CVSS score of 9.9 and affects S/4HANA systems running S4CORE versions 102 through 108, both in private cloud and on-premise deployments. According to the official CVE record published by SAP SE, the issue stems from a function module exposed via Remote Function Call (RFC) that allows attackers with low-level user privileges to inject arbitrary ABAP code, bypassing authorization checks. In effect, it functions as a backdoor, exposing the confidentiality, integrity, and availability of…

Qantas has cut short-term bonuses for its top executives by 15% in response to a customer data breach, even as the airline reported a strong year of profits. CEO Vanessa Hudson saw her bonus reduced by about AUD 250,000 under the 2025 remuneration decisions, with the airline saying the adjustment reflected shared accountability across the leadership team. Despite the cut, Hudson’s total pay package rose to roughly AUD 6.3 million for the year, up from AUD 4.4 million in 2024, due to increases in base salary and other components. The bonus reductions follow a cyber incident in late June 2025,…

Bad actors are exploiting Grok AI to push malware through promoted ads on X, in a scheme researchers are calling “Grokking.”  The method, uncovered by Guardio Labs researcher Nati Tal, takes advantage of how Grok parses hidden fields in ads. Malvertisers post videos with adult content baits, but avoid direct links in the main body to bypass filters. Instead, the link is buried in the small “From:” metadata field under the video card, a spot the platform doesn’t scan for malicious content. Once the ad is live, the actors reply to their own post with a simple question for Grok:…

In July 2025, Darktrace researchers detected an attempted cryptojacking incident on a retail and e-commerce network.   A desktop device initiated an HTTP connection to a rare endpoint, 45.141.87[.]195 over port 8000. Embedded in the request was a PowerShell script, infect.ps1. The script’s behavior flagged an immediate anomaly: a new PowerShell user agent making an unusual outbound connection. Analysis revealed the script dropped an obfuscated AutoIt loader. The loader injected NBMiner into a legitimate Windows process, charmap.exe. The attack chain began with three encoded data blobs in the PowerShell script. The first blob, XOR’d with 97, produced an AutoIt executable stored…

The European General Court has backed the EU-U.S. Data Privacy Framework (DPF). The ruling clears legal uncertainty for organisations moving data across the Atlantic. It upholds the European Commission’s adequacy decision, and confirms that the framework protects personal data while still enabling cross-border digital activity. ITI and its members welcomed the decision. It provides clarity for entities of all sizes, from the largest multinationals to their SME counterparts. It also sees that personal data is protected under Europe’s strong privacy standards. “This ruling sends a clear signal: the Data Privacy Framework stands on solid legal and rights-based foundations,” said ITI…

WhatsApp has disclosed a zero-day flaw that was used in precision attacks against Apple users. The bug, tracked as CVE-2025-55177 with a CVSS score of 8.0, involved incomplete authorization of linked device sync messages. In practice, that meant an attacker could trick a device into processing content from arbitrary URLs. The issue affected WhatsApp for iOS before version 2.25.21.73, WhatsApp Business for iOS before 2.25.21.78, and WhatsApp for Mac before 2.25.21.78.  According to WhatsApp’s advisory, the flaw appears to have been paired with another Apple vulnerability, CVE-2025-43300, in a sophisticated campaign aimed at select targets. Apple patched CVE-2025-43300 on August…

Jaguar Land Rover (JLR) has fallen victim to a cyber-attack. In a statement JLR said: “JLR has been impacted by a cyber incident. We took immediate action to mitigate its impact by proactively shutting down our systems. We are now working at pace to restart our global applications in a controlled manner.” The company, owned by India’s Tata Motors, said at this time there is no evidence any customer data has been stolen but its retail and production activities have been severely disrupted.  It said it moved fast to contain the breach and is working to bring systems back online. …

The European Union said Monday that Russia was suspected of jamming the GPS system of a plane carrying European Commission President Ursula von der Leyen to Bulgaria on Sunday. “We can indeed confirm that there was GPS jamming, but the plane landed safely in Bulgaria,” a European Commission spokesperson told reporters. “We have received information from the Bulgarian authorities that they suspect that this was due to blatant interference by Russia.”  The spokesperson said Europe was used to such moves. “We are of course aware and used to the threats and intimidations that are a regular component of Russia’s hostile…

Zscaler has disclosed a security incident tied to Salesloft Drift, a marketing automation service used by many Salesforce customers. The company has confirmed that attackers stole OAuth tokens connected to Drift, which opened a door to certain Salesforce data. Zscaler was among the organizations affected.  Zsclaler stressed that its own products, services, and core infrastructure were not touched and that the breach was confined to Salesforce. What was exposed? Mostly business contact details: names, emails, job titles, phone numbers, and regional information. Some Salesforce-related content was also accessed, including licensing and commercial details, as well as plain text from certain…

Check Point Research has uncovered a new campaign tied to the Silver Fox APT group. The operation relies on signed but vulnerable Windows drivers to slip through security defenses and deliver ValleyRAT, a modular backdoor.  Two drivers are key to this operation, both built on the Zemana Anti-Malware SDK. One is old and already flagged and blocked on most systems, while the other is new, still trusted, and signed by Microsoft. That signature means it loads without question, even on fully updated Windows 10 and 11 machines. Both drivers share the same ability: they can terminate protected processes, the very…