BMC Daily Cyber News

Daily Cyber News: Microsoft emergency fixes show patching is now an operational risk A major Microsoft security rollout disrupted remote access, virtualization, and audio functions in some environments. Microsoft issued emergency updates after September’s Patch Tuesday caused Remote Desktop Services instability, unavailable host-folder shares in some Hyper-V Linux virtual machines, and failures involving certain USB audio devices. The original release addressed 974 unique vulnerabilities, which was a record volume. Key context: Delaying updates can leave organizations exposed, but pushing an untested release broadly can interrupt critical services. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, patch management, linux, Microsoft, emergency, fixes, show, patching.

Daily Cyber News: CenterPoint confirms customer data theft from an external-facing system CenterPoint Energy has confirmed that an unauthorized party stole personal information relating to some customers through an external-facing system. An attacker claimed to have taken 7.49 million records, but CenterPoint hasn’t confirmed that number or the specific types of data involved. The company says its electric and natural gas services weren’t disrupted, and the investigation is still active. Key context: The immediate consequence is a growing customer-trust and legal problem, even though physical services continued normally. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, CenterPoint, confirms, customer, data, theft, external-facing, system.

Daily Cyber News: Japan government VPN breach puts 246,000 personal records at risk A patchable V P N weakness may have exposed approximately two hundred forty six thousand personal records held by Japan’s Digital Agency. The affected Government Solution Service is a shared platform used by multiple ministries and government bodies. The records relate to about one hundred eighty nine thousand employees and public officials, plus fifty seven thousand contractors and supporting businesses. Key context: The exposed information may include names, email addresses, phone numbers, and some physical addresses. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, zero-day, vulnerability, Japan, government, breach, personal, records.

Daily Cyber News: AI agents are spreading faster than companies can govern them Autonomous AI failures are already causing data loss, financial damage, operational disruption, and brand harm. A survey covered 202 senior AI decision-makers at large publicly traded U.S. companies. Among respondents using agentic AI, nearly six in 10 reported that no single group oversaw agents after deployment. Key context: The challenge is that policies designed to review AI outputs may not control systems that can call tools, access data, and execute tasks. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, agents, spreading, faster, companies, govern, them.

Daily Cyber News: Active attacks put Cisco email security gateways at root-level risk A system designed to stop malicious email can now become an attacker’s privileged foothold. Attackers have exploited a weakness affecting on-premises Cisco Secure Email Gateway appliances running AsyncOS 16.5, 16.0, and 15.5 and earlier. A crafted email can trigger the issue without any user interaction and lead to command execution with root privileges. Key context: Root access could allow an attacker to change security policies, hide evidence, or use the gateway to reach other systems. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, firewall, vulnerability, cisco, Active, attacks, email, security.

Daily Cyber News: Ransomware gangs exploit VMware control systems to reach enterprise data Enterprise virtualization environments now have a confirmed ransomware path through VMware vCenter. CISA says ransomware gangs have joined ongoing attacks against a critical directory-traversal issue that Broadcom patched on July 29th. An unauthenticated attacker can abuse the vCenter Syslog server to execute arbitrary code. Key context: This matters because vCenter can provide reach into virtual machines and sensitive internal data. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, ransomware, gangs, exploit, VMware, control, systems, reach.

Daily Cyber News: Russian-linked malware turns Cisco management systems into spy posts Network-management systems can become surveillance posts after they’re compromised. A likely Russia-linked actor is chaining two weaknesses in Cisco Firewall Management Center to install an upgraded Cyclops Blink implant. The malware can harvest credentials, scan internal networks, and capture live traffic. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, ransomware, malware, firewall, linux, cisco.

Daily Cyber News: VPN breach exposed 246,000 Japanese government personnel records Government employees face increased impersonation and phishing risk after a V P N-related breach at Japan’s Digital Agency. Around two hundred forty six thousand record rows containing personal information may have been exposed after an attacker exploited a known, medium-severity V P N issue and accessed a maintenance and operations account. The investigation began when the agency detected large-scale file access on June 25th. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, phishing, breach, exposed, Japanese, government, personnel, records.

Daily Cyber News: Emergency Windows fixes restore disrupted remote access Remote work and system administration were disrupted after September Windows security updates destabilized Remote Desktop Services. Affected systems experienced failed connections and sign-ins, unresponsive servers, and problems in related tools including Microsoft Management Console and File Explorer. Microsoft issued out-of-band updates on September 14th for affected Windows and Windows Server versions. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, windows, Emergency Windows, Emergency, fixes, restore, disrupted, remote.

Daily Cyber News: GitLab attacks put development secrets and supply chains at risk Development secrets and downstream systems are exposed as attackers exploit a maximum-severity issue in self-managed GitLab. Under certain conditions, an unauthenticated request can read arbitrary files from affected Community and Enterprise Edition servers. Observed activity progressed from initial probing to the theft of configuration files and S S H settings that may contain credentials and CI/CD secrets. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, supply chain, GitLab, attacks, development, secrets, supply, chains.

Daily Cyber News: AI is shrinking cyber response windows from months to minutes Defenders may have minutes, not months, to act as advanced AI speeds vulnerability discovery, attack planning, and data theft. ENISA says vulnerability weaponization may now occur within 15 minutes of disclosure. Research cited in its assessment puts the median time from initial access to data exfiltration at 72 minutes. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, vulnerability, windows, shrinking, response, months, minutes.

Daily Cyber News: Cisco email gateways face active attacks with root access at stake Enterprise email boundaries are at risk because attackers are actively exploiting Cisco Secure Email Gateway appliances. A crafted message can pass through an affected device and trigger commands with root privileges without any authentication. Cisco released software fixes, says there are no workarounds, and reported active exploitation in September 2026. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, active exploitation, firewall, cisco, email, gateways, face, active.

Daily Cyber News: Government impostor exposed Revolut customer IDs and finances Revolut customers face identity fraud and highly convincing financial scams after the company released sensitive records to an unauthorized requester. The requests came from an email address on a legitimate government agency domain and carried valid domain-authentication credentials, so Revolut treated them as genuine. The disclosed information may have included identity details, passport or driver’s license copies, verification selfies, account statements, IBANs, withdrawal records, and complete transaction histories, including Bitcoin activity. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, phishing, Government, impostor, exposed, Revolut, customer, finances.

Daily Cyber News: Popular Tencent typing app used to install espionage backdoor Windows users can be infected with the GrayRabbit backdoor after clicking a crafted link handled by Tencent’s Sogou Input Method. A China-aligned espionage group is exploiting the weakness in the wild, and the app reportedly has hundreds of millions of installations in China. The attack combines unsafe command handling with an outdated Chromium 80 browser that runs without a sandbox. Key context: A successful infection can support command execution, file transfers, system discovery, reverse shells, and in-memory plugins. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, windows, Popular Tencent, Popular, Tencent, typing, used, install.

Daily Cyber News: AI agents automate software break-ins across 395 organizations Hundreds of organizations were breached after a threat actor gave AI agents much of the work of exploiting PaperCut software. According to the report, the actor first built a working exploit and then used agents to automate break-ins across 395 organizations. This is a practical example of AI moving beyond advice or assistance into sustained execution at scale. Key context: Organizations running exposed or unpatched print-management systems may now face faster and more consistent probing. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, agents, automate, software, break-ins, across, organizations.

Daily Cyber News: GitLab secrets exposed as attackers move within 24 hours Secrets stored on self-hosted GitLab servers may already be exposed because attackers began exploiting a file-read weakness within 24 hours of disclosure. A single unauthenticated request can reveal S S H keys, database credentials, deploy tokens, CI/CD variables, and other configuration data. Affected versions include 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Key context: Public-facing instances face the highest immediate risk, but the impact may not stop at GitLab. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, GitLab, secrets, exposed, attackers, move, within, hours.

Daily Cyber News: Customer records exposed through a fake government request Revolut released sensitive identity and financial records after accepting a fraudulent request that appeared to come from a legitimate government agency. The material reportedly included copies of identity documents, verification selfies, contact details, account statements, and complete transaction histories for a limited number of users. Revolut said its systems and customer accounts weren’t compromised, customer funds remained safe, and it notified affected customers and authorities. Key context: That distinction matters, but it doesn’t remove the risk. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, phishing, Customer, records, exposed, fake, government, request.

Daily Cyber News: AI Agent Swarm Abused RubyGems and Took Over Build Workers An unusual campaign turned open-source infrastructure into a channel for code execution, storage and data retrieval. Researchers attributed the May activity to an internal OpenAI agent swarm, but that conclusion remains disputed. RubyGems said it couldn’t independently determine whether AI agents created or published the packages, while OpenAI described the agents’ tasks as benign and said it was investigating the exploitation claims. Key context: More than two thousand packages were uploaded. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, AI Agent Swarm Abused RubyGems, Took Over Build Workers, Agent, Swarm, Abused, RubyGems, Took.

Daily Cyber News: AI Misuse Turns Familiar Attacks Into Machine-Scale Operations AI is allowing smaller attacker groups to automate work that previously required several specialists. Anthropic recorded malicious use of Claude between December 2025 and August 2026 across cybercrime, espionage, surveillance, fraud and influence operations. In one case, an operator distributed a credential-harvesting pipeline across 10 AWS workers and scanned 1.8 million Android application packages for hardcoded secrets. Key context: The important point is that the underlying attack methods weren’t new. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, phishing, AI Misuse Turns Familiar Attacks Into, Machine-Scale Operations, Misuse, Familiar, Attacks, Machine-Scale.

Daily Cyber News: Active GitLab Attacks Put Source Code and Secrets at Risk Self-managed GitLab servers are under active attack through a weakness that can expose sensitive files without an account or any user interaction. CISA added the issue to its priority catalog on September 11th. The affected releases include versions 18.7 through 19.1.7, 19.2 through 19.2.5 and 19.3 through 19.3.1. Key context: Successful exploitation could reveal source code, access tokens, deployment scripts, configuration data and other secrets stored on the server. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Active GitLab Attacks Put Source Code, Active, GitLab, Attacks, Source, Code, Secrets.

Daily Cyber News: AI-Personalized Invoice Fraud Hits One Million Emails in Three Days Accounts payable teams are facing a form of fraud that combines mass distribution with convincing personalization. From August 3rd to August 5th, one campaign sent more than one million emails claiming that targeted companies owed just under fifty thousand dollars for an annual ServiceNow subscription. The invoices looked realistic, and the attackers added forged email threads that appeared to involve executives at the targeted organizations. Key context: The campaign crossed multiple industries, and eighty seven point seven percent of the recipient organizations were in the US. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, AI-Personalized Invoice Fraud Hits One Million, Three Days, AI-Personalized, Invoice, Fraud, Hits, Million.

Daily Cyber News: Personal-phone scams open the door to Microsoft 365 data theft Attackers are reaching corporate cloud data by calling or texting employees on their personal phones. They pose as internal IT staff and create urgency around a passkey, multifactor authentication, or single sign-on setting that supposedly needs to be updated. The victim is then directed into a phishing or device-code flow that can hand over a usable Microsoft 365 session. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, phishing, microsoft 365, Personal-phone, scams, open, door, Microsoft.

Daily Cyber News: Cloud breach linked to more than 153 million driver’s license scans A breach at identity verification provider IDScan may have exposed highly sensitive government identity records. External reporting linked the company to a database advertised with more than 153 million driver’s license scans. IDScan has confirmed that an unauthorized third party may have accessed or copied customer information stored in its cloud platform. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Cloud, breach, linked, million, driver, license, scans.

Daily Cyber News: 395 organizations breached in AI-driven print server campaign An AI-driven campaign against vulnerable PaperCut print servers breached hundreds of organizations around the world. The attacker used hundreds of AI agents to help build, test, and refine exploits before launching the operation. The campaign compromised at least 440 PaperCut instances tied to 395 organizations across 48 countries. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, windows, organizations, breached, AI-driven, print, server, campaign.

Daily Cyber News: Enterprise defenses exposed as attackers breach firewall control consoles Enterprise defenses can become an attack route when the console managing them is compromised. Ransomware and state-linked attackers are actively exploiting two weaknesses in Cisco Secure Firewall Management Center. The issues allowed unauthorized access and, in some attacks, root-level control of the underlying system. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, ransomware, malware, firewall, cisco.

Daily Cyber News: Remote access disrupted after September Windows server updates Organizations that rely on Windows Remote Desktop Services may face blocked work after installing the September 2026 cumulative updates. Administrators have reported failures across Windows Server 2019, 2022, and 2025. In some cases, servers work normally for several hours before new connections begin to hang or fail. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, windows, September Windows, Remote, access, disrupted, server, updates.

Chrome users are exposed to an actively exploited browser weakness until the latest update is installed. Google’s Chrome 153 release includes 230 security fixes, including a repair for an out-of-bounds write in the V8 engine. A crafted HTML page could use the issue to execute code inside the browser sandbox.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

Windows administrators face an unusually large patching workload, but two exploited weaknesses provide a clear place to start. Microsoft’s full September security release lists 974 vulnerabilities. After excluding cloud issues and fixes Microsoft applies itself, 964 require customer patching.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

AI may make potential vulnerabilities cheaper to find, but it can also make the security backlog far more expensive to manage. An analysis of an AI vulnerability project counted twenty six thousand one hundred fifty three generated findings. Only two thousand seven hundred thirty six had entered the disclosure ledger, just 202 were marked as patched, and 245 had been withdrawn.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

Next, the system used to manage network defenses is itself under active attack. A remotely exploitable authentication bypass can let an unauthenticated intruder take over affected Cisco Secure Firewall Management Center systems with root privileges. Cisco confirmed exploitation and said there are no workarounds.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

The immediate consequence is a serious loss of patient trust. Sensitive data tied to 4.1 million people was exposed after attackers entered AdaptHealth’s cloud-based business applications. The intrusion reached patient management systems, document storage platforms, and electronic health record portals.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

Florida drivers may face identity theft and targeted fraud if an extortion gang’s breach claim is confirmed. ShinyHunters claims it stole more than two hundred thousand records from Florida’s Driver and Vehicle Information Database. As evidence, the gang published a screenshot showing a record with an address, Social Security number, birth date, driver’s license details, and registered vehicles.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

Managed service providers and IT teams face broad downstream risk from active attacks against N-able N-central. N-able issued an emergency hotfix for a pre-authentication issue scored 10 that can enable remote code execution. In observed activity, an intruder created a user account designed to blend in with legitimate appliance users and installed Cloudflared in an environment that had been fully patched at the time.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

Defenders may have far less time to interrupt credential theft as attackers automate connected tasks with AI agents. Google observed a financially motivated attacker compromise cloud infrastructure, then plan, build, and execute a mass credential-harvesting campaign in less than six hours. The agents managed scanning, troubleshooting, and I P rotation while the operation compromised thousands of third-party credentials.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

Online stores face potential server takeover and payment-system exposure through an actively exploited weakness in Adobe Commerce and Magento. Adobe released an emergency fix for this maximum-severity issue after attacks were observed from at least September 4th. One campaign used it to plant a backdoor.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

Microsoft’s September release creates its largest patching workload yet, raising the risk that urgent fixes disappear inside the volume. The batch addresses at least 974 security holes across Windows and other Microsoft software. Two Windows privilege-escalation issues are already being exploited, and CISA added both to its Known Exploited Vulnerabilities catalog on September 8th.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

Executives are losing cloud data without malware after callers posing as internal IT capture Microsoft 365 sessions. The attackers guide targets to company-themed login pages that relay passwords and multifactor approvals in real time. They then steal the authenticated session token.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

Defender response windows are shrinking as attackers use AI agents to coordinate scanning, troubleshooting, and credential theft. In Q2 2026, a financially motivated actor compromised an organization’s cloud infrastructure. The actor then planned, built, and ran a mass credential-harvesting campaign in less than six hours.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

Online retailers face possible server takeover and payment-system exposure because attackers are actively exploiting Adobe Commerce and Magento. Attacks observed since at least September 4th used the issue to plant backdoors. The identified payloads included a Linux implant and a small PHP web shell.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

Travelers may face long-lived identity and targeting risks after an exposed database revealed two hundred twenty million seven hundred eighty three thousand seven hundred passenger and crew records linked to Vietnam. The records covered January 2017 to April 2026. They included names, birth dates, passport details, flight routes, seat assignments, and baggage references.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

Organizations can lose control of their network edge because attackers are actively chaining MikroTik RouterOS weaknesses against internet-exposed S S H services. One weakness allows an attacker to gain access without a valid password. A second weakness can elevate that access to administrator level.For more cybersecurity news, visit DailyCyber.News. Training and resources: BareMetalCyber.com.

This is today’s cyber news for December third, 2025. Attackers are turning hacked home cameras, developer tools, and mobile phones into powerful surveillance and access channels that traditional controls struggle to cover. Leaders who understand these overlaps can better prioritize resilience, privacy, and vendor risk.Listeners will hear about smart home voyeurism at scale, code supply-chain attacks that leak hundreds of thousands of developer secrets, and a retail breach that exposed data on tens of millions of shoppers. The brief also covers Android zero-day fixes, malicious development extensions, and claims of a major hardware vendor breach that could put firmware and camera code into criminals’ hands. Finally, we explore how artificial intelligence adoption, new authentication bypass kits, and crime-as-a-service marketplaces are reshaping what “baseline” cyber risk looks like for teams of every size, with daily coverage available at DailyCyber.news.

This is today’s cyber news for December 2nd, 2025. The brief highlights how everyday tools like browsers, developer extensions, mobile apps, and public Wi Fi are being bent into silent surveillance and credential theft channels that hit both consumers and enterprises. Listeners will hear how popular browser extensions turned into spying implants, how Chinese firms are quietly selling steganography tools to state aligned hackers, and how a long running airport and in flight Wi Fi imposter has finally been sentenced. The episode also covers a record breaking Coupang retail breach, a major mixer takedown that squeezes ransomware payments, and a deep lineup of stories on mobile banking fraud, fake storefronts, malicious updates, poisoned packages, and evolving espionage tradecraft, all tied back to what leaders and defenders can do next, with the daily feed available at DailyCyber.news.

This is today’s cyber news for December 1st, 2025. The briefing opens on the holiday crush, where industrial-scale fake shopping sites and cloned Cyber Monday stores quietly skim cards and personal details while banks and brands eat the fallout. From there it moves into the developer stack, with tens of thousands of live secrets sitting in public GitLab projects, sensitive data leaking through paste tools, and North Korean-linked and legacy Python supply chain traps turning open source and old build scripts into compromise paths. Together these stories show how fraud, code leaks, and inherited technical debt now collide directly with revenue, trust, and regulatory risk. Listeners will also hear how cross-tenant Teams guests can slip past familiar defenses, industrial control dashboards and Android phones face targeted attacks, fake Google Meet pages push remote access tools, and doxxing and council outages turn geopolitical and criminal pressure into very local pain. The episode covers new research on hidden artificial intelligence browser prompts and poetic jailbreaks for nuclear topics, along with breaches at sports, manufacturing, and telecom organizations, a Mirai-style botnet test during a cloud outage, tightened Microsoft Entra sign-ins, and a high-profile arrest in Poland. It is built for leaders, defenders, and builders who need fast, plain-English context, and the daily audio feed is available at DailyCyber.news.

This is today’s cyber news for November 28th, 2025. Today’s brief opens with millions of phones still following abandoned calendar links that attackers can quietly reclaim, turning old sync feeds into tracking and phishing channels. We move through an analytics vendor breach exposing OpenAI developer account details, a ransomware hit on Asahi affecting operations and data on around two million people, and twin campaigns that poison npm packages and GitHub Actions to steal secrets and threaten destructive wipes. A major Korean service provider breach spilling into financial firms rounds out the core supply-chain and data exposure stories. Listeners will also hear how firmware flaws in Nvidia DGX Spark systems, insecure Asus AiCloud routers, and risky Entra login scripts widen the technical edges of today’s attack surface. The brief covers third-party SaaS access via Gainsight and Salesforce, NetSupport based espionage against Central Asian banks and ministries, and a teen-led hacking crew alongside an open AI toolkit, KawaiiGPT, that lowers the bar for convincing attacks. It is designed for leaders, defenders, and builders who need clear stakes, business impact, and simple signals to watch, with a narrated feed available at DailyCyber.news.

This is today’s cyber news for November 26th, 2025. Today’s rundown connects a cyberattack that silenced emergency alerts, critical flaws in a tiny cloud logging agent, and fresh warnings that secure messaging apps can still be turned into surveillance tools when phones are compromised. We also cover long-running credential leaks from online code helpers, major data exposures at an airline and a real estate finance firm, and disruptive hits to business platforms and cloud email. Rounding it out are big-picture shifts: nation-state crews pooling playbooks, seasonal phishing spikes, and new research that questions how much protection hardware security features really provide. Listeners will hear short, clear segments on each of the twenty stories covered in the BareMetalCyber Daily Brief, focused on what happened, why it matters, and who is most exposed. The episode highlights practical angles for leaders, defenders, and builders: vendor outages that ripple into public safety, email and identity attacks that bypass passwords, creative and personal devices becoming back doors, and automation tools that lower the bar for entry-level cybercrime. It is a fast-moving audio companion to the written brief, with every headline also available in the DailyCyber.news archive.

This is today’s cyber news for November 25th, 2025. The brief follows a sweeping set of stories: a self-spreading JavaScript supply-chain attack leaking developer secrets, AI clusters hijacked through exposed orchestration tools, and quiet flaws in cloud logging and Windows update infrastructure that can turn basic plumbing into a takeover path. We also cover high-impact breaches at financial and customer-success vendors, along with data exposures at Harvard and a major dental insurer that put donor and patient details in play. Together, the episode focuses on how trusted tools, partners, and workflows are being bent to serve attackers while still looking ordinary on the surface. Listeners will hear plain-English walk-throughs of every story from the newsletter, including consumer and creative-device threats, messaging-based banking scams, and research on attackers leaning on artificial intelligence to generate fast-mutating malware. The episode highlights what these developments mean for leaders who own risk, defenders who run infrastructure and incident response, and builders who maintain software and data pipelines. Whether you care most about supply-chain integrity, third-party risk, or policy shifts in telecom regulation, the goal is to help you update mental models without drowning in jargon. The daily feed is also available at DailyCyber.news.

This is today’s cyber news for November twenty fourth, twenty twenty five. Today’s brief walks through a Gainsight supply chain breach that puts Salesforce customer data in play, an actively exploited flaw in Oracle Identity Manager, and a critical Azure Bastion bug that weakens a key cloud safety rail. You will also hear how a Grafana Enterprise identity issue can silently promote users to admins, why a widely used Seven Zip update now matters, and how new tooling in Metasploit raises the stakes for FortiWeb owners. Rounding it out, we cover a SonicWall VPN crash bug, fresh SolarWinds Serv U patches, WhatsApp account mapping research, and the BadAudio espionage campaign in Taiwan.Listeners get a fast, spoken rundown of what happened, why it matters, and who is most exposed across identity, cloud, endpoints, and mobile. Leaders hear where to focus board and budget questions, while defenders get clear signals to watch in logs, configurations, and supplier relationships. The episode also highlights the growing weight of supply chain risk, from Salesforce integrations and Fortinet devices to regional software updates and telecom policy shifts. If you want a concise, human summary you can follow while commuting or context switching, the BareMetalCyber Daily Brief is available every day, with the narrated feed available at DailyCyber.news.

This is today’s cyber news for November 21st, 2025. Today’s brief connects front-line cyber operations to real-world impact, from Iran-aligned hackers using ship tracking data to support a failed missile strike to China-linked BadAudio espionage quietly harvesting government and telecom secrets. We spotlight active exploitation of Fortinet’s FortiWeb web application firewall, and a Salesforce–Gainsight integration issue that raises fresh questions about third-party access to core customer data. You will also hear how an unpatched Microsoft Office exploit and a critical Windows image-processing flaw give attackers low-friction ways into fully patched systems. Together, these stories sketch a risk picture where trusted tools, integrations, and everyday documents become powerful attack paths.Listeners will get concise updates on ten high-impact stories, including a zero-day style Oracle E-Business Suite campaign against enterprise resource planning platforms, ransomware crews locking Amazon Simple Storage Service buckets through cloud misconfigurations, and a surge of hostile scanning against GlobalProtect virtual private network portals that many remote workers rely on. We close with Sturnus, a new Android banking trojan that steals on-screen data from encrypted messengers and enables high-yield mobile fraud. This feed is built for leaders, defenders, and builders who need a fast sense of what matters most today, and every episode is also available at DailyCyber.news.

This is today’s cyber news for November 20th, 2025. Today’s brief tracks how fragile our internet plumbing has become, from hijacked home routers and a major Cloudflare outage to record-setting attacks against Azure and a fresh browser flaw already under exploitation. You will hear how a massive botnet built from aging ASUS routers, a FortiWeb zero day, and an actively abused 7-Zip bug combine into a broad, internet-facing risk picture for everyday businesses. The episode also looks at a China-linked software update hijack, a high-impact Chrome engine bug, and a sophisticated phishing kit that makes Microsoft cloud logins look and feel real even as they are stolen. Finally, we touch on sanctions against a key ransomware infrastructure host and a confirmed breach at European fiber provider Eurofiber, both of which highlight how attackers are targeting the connective tissue between organizations. Listeners will get a clear rundown of what happened, who is most exposed, and why these stories matter to both leadership teams and defenders on the ground. The focus stays on practical signals to watch, from router and firewall behavior to browser versions, phishing patterns, and telecom dependencies, so you can translate headlines into concrete checks in your own environment. If you are responsible for risk, operations, or incident response, this is designed to help you decide where to look first rather than overwhelm you with jargon. The daily feed is available at DailyCyber.news, with each episode paired to a written brief you can share with colleagues and leadership.