Collecting Cyber-News from over 60 sources

Tag: update

Microsoft Patch Tuesday security updates for December 2025 fixed an actively exploited zero-day

Dec 10, 2025 11:32 AM

Tags: exploit, microsoft, office, powershell, update, vulnerability, windows, zero-day

Microsoft Patch Tuesday security updates for December 2025 address 57 vulnerabilities, including three critical flaws. Microsoft Patch Tuesday security updates for December 2025 addressed 57 vulnerabilities in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Exchange Server, Azure, Copilot, PowerShell, and Windows Defender. Three vulnerabilities are rated Critical, while the rest are…
Microsoft Fixes Three Zero-Days in Final Patch Tuesday of 2025

Dec 10, 2025 11:32 AM

Tags: cve, microsoft, update, zero-day

December’s Patch Tuesday sees the release of patches for over 50 CVEs including three zero-days First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/microsoft-three-zerodays-patch/
Gefährliche Sicherheitslücke: Hacker schleusen über Notepad++-Updater Malware ein

Dec 10, 2025 11:32 AM

Tags: bug, hacker, malware, update

Angreifer verbreiten über eine Sicherheitslücke im Updater von Notepad++ Malware. Der Entwickler warnt und rät zum Update – aber besser von Hand. First seen on golem.de Jump to article: www.golem.de/news/besser-manuell-patchen-hacker-nutzen-gefaehrliche-luecke-im-notepad-updater-aus-2512-203082.html
New Portuguese Law Shields Ethical Hackers from Prosecution

Dec 10, 2025 9:33 AM

Tags: cybercrime, hacker, law, update

Portugal updates its cybercrime law (Decree Law 125/2025) to grant ethical hackers a ‘safe harbour’ from prosecution. Learn the strict rules researchers must follow, including immediate disclosure to the CNCS, and how other nations are following this trend. First seen on hackread.com Jump to article: hackread.com/portugal-cybercrime-law-protects-ethical-hackers/
New Portuguese Law Shields Ethical Hackers from Prosecution

Dec 10, 2025 9:33 AM

Tags: cybercrime, hacker, law, update

Portugal updates its cybercrime law (Decree Law 125/2025) to grant ethical hackers a ‘safe harbour’ from prosecution. Learn the strict rules researchers must follow, including immediate disclosure to the CNCS, and how other nations are following this trend. First seen on hackread.com Jump to article: hackread.com/portugal-cybercrime-law-protects-ethical-hackers/
Zoom Rooms on Windows and macOS Exposed to Privilege Escalation and Data Leakage Flaws

Dec 10, 2025 5:33 AM

Tags: attack, cve, cyber, data, data-breach, flaw, macOS, software, unauthorized, update, vulnerability, windows

Zoom has released security patches addressing two critical vulnerabilities in Zoom Rooms deployments on both Windows and macOS. The vulnerabilities expose users to privilege escalation attacks and unauthorized software manipulation, prompting immediate update recommendations across enterprise environments. The first vulnerability, tracked as CVE-2025-67460, affects Zoom Rooms for Windows with a High severity rating. This flaw…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
Microsoft December 2025 Patch Tuesday Fixes 56 Vulnerabilities Fixed and 3 Zero-days

Dec 10, 2025 5:33 AM

Tags: cyber, exploit, flaw, microsoft, update, vulnerability, zero-day

Microsoft’s final Patch Tuesday of 2025 has been released, addressing 56 vulnerabilities across its product suite. The December update includes patches for three zero-day vulnerabilities, one of which is confirmed to be actively exploited in the wild. Among the resolved flaws, two are rated as >>Critical,>Important
Microsoft December 2025 Patch Tuesday Fixes 56 Vulnerabilities Fixed and 3 Zero-days

Dec 10, 2025 5:33 AM

Tags: cyber, exploit, flaw, microsoft, update, vulnerability, zero-day

Microsoft’s final Patch Tuesday of 2025 has been released, addressing 56 vulnerabilities across its product suite. The December update includes patches for three zero-day vulnerabilities, one of which is confirmed to be actively exploited in the wild. Among the resolved flaws, two are rated as >>Critical,>Important
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
Zoom Rooms on Windows and macOS Exposed to Privilege Escalation and Data Leakage Flaws

Dec 10, 2025 5:33 AM

Tags: attack, cve, cyber, data, data-breach, flaw, macOS, software, unauthorized, update, vulnerability, windows

Zoom has released security patches addressing two critical vulnerabilities in Zoom Rooms deployments on both Windows and macOS. The vulnerabilities expose users to privilege escalation attacks and unauthorized software manipulation, prompting immediate update recommendations across enterprise environments. The first vulnerability, tracked as CVE-2025-67460, affects Zoom Rooms for Windows with a High severity rating. This flaw…
Zoom Rooms on Windows and macOS Exposed to Privilege Escalation and Data Leakage Flaws

Dec 10, 2025 5:33 AM

Tags: attack, cve, cyber, data, data-breach, flaw, macOS, software, unauthorized, update, vulnerability, windows

Zoom has released security patches addressing two critical vulnerabilities in Zoom Rooms deployments on both Windows and macOS. The vulnerabilities expose users to privilege escalation attacks and unauthorized software manipulation, prompting immediate update recommendations across enterprise environments. The first vulnerability, tracked as CVE-2025-67460, affects Zoom Rooms for Windows with a High severity rating. This flaw…
Zoom Rooms on Windows and macOS Exposed to Privilege Escalation and Data Leakage Flaws

Dec 10, 2025 5:33 AM

Tags: attack, cve, cyber, data, data-breach, flaw, macOS, software, unauthorized, update, vulnerability, windows

Zoom has released security patches addressing two critical vulnerabilities in Zoom Rooms deployments on both Windows and macOS. The vulnerabilities expose users to privilege escalation attacks and unauthorized software manipulation, prompting immediate update recommendations across enterprise environments. The first vulnerability, tracked as CVE-2025-67460, affects Zoom Rooms for Windows with a High severity rating. This flaw…
Microsoft Patch Tuesday for December 2025, Snort rules and prominent vulnerabilities

Dec 10, 2025 1:32 AM

Tags: exploit, microsoft, update, vulnerability

The Patch Tuesday for December of 2025 includes 57 vulnerabilities, including two that Microsoft marked as “critical.” The remaining vulnerabilities listed are classified as “important.” Microsoft assessed that exploitation of the two “critical” vulnerabilities is “less likely.” First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/microsoft-patch-tuesday-december-2025/
Microsoft reports 7.8-rated zero day, plus 56 more in December Patch Tuesday

Dec 10, 2025 1:32 AM

Tags: attack, fortinet, ivanti, microsoft, update, zero-day

Plus critical critical Notepad++, Ivanti, and Fortinet updates, and one of these patches an under-attack security hole First seen on theregister.com Jump to article: www.theregister.com/2025/12/09/december_2025_patch_tuesday/
Microsoft Patch Tuesday for December 2025, Snort rules and prominent vulnerabilities

Dec 10, 2025 1:32 AM

Tags: exploit, microsoft, update, vulnerability

The Patch Tuesday for December of 2025 includes 57 vulnerabilities, including two that Microsoft marked as “critical.” The remaining vulnerabilities listed are classified as “important.” Microsoft assessed that exploitation of the two “critical” vulnerabilities is “less likely.” First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/microsoft-patch-tuesday-december-2025/
Patchday: Windows Server-Updates (9. Dezember 2025)

Dec 10, 2025 12:32 AM

Tags: update, windows

Zum 9. Dezember 2025 (zweiter Dienstag im Monat, Patchday bei Microsoft) wurden verschiedene kumulative Updates für die unterstützten Versionen von Windows Server freigegeben. Nachfolgend habe ich die bereitgestellten Updates samt einigen Details für diese Windows Server-Versionen (von Windows Server 2012 … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/12/10/patchday-windows-server-updates-9-dez/
Patchday: Windows 10/11 Updates (9. Dezember 2025)

Dec 10, 2025 12:32 AM

Tags: microsoft, update, vulnerability, windows

Am 9. Dezember 2025 (zweiter Dienstag im Monat, Patchday bei Microsoft) hat Microsoft kumulative Updates für die noch unterstützten Client-Betriebssystem-Versionen von Windows 10 (mit ESU-Lizenz) und Windows 11 veröffentlicht. Hier einige Details zu diesen Updates, die Schwachstellen sowie Probleme beheben … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/12/10/patchday-windows-10-11-updates-9-dezember-2025/
SAP fixes three critical vulnerabilities across multiple products

Dec 10, 2025 12:32 AM

Tags: sap, update, vulnerability

SAP has released its December security updates addressing 14 vulnerabilities across a range of products, including three critical-severity flaws. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sap-fixes-three-critical-vulnerabilities-across-multiple-products/
Microsoft Fixes Exploited Zero Day in Light Patch Tuesday

Dec 10, 2025 12:32 AM

Tags: exploit, flaw, microsoft, update, zero-day

Proof-of-concept exploit code is publicly available for two other flaws in this month’s Patch Tuesday. In total, the company issued patches for more than 1,150 flaws this year. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/microsoft-fixes-exploited-zero-day-light-patch-tuesday
Microsoft patched over 1,100 CVEs in 2025

Dec 9, 2025 11:32 PM

Tags: cve, microsoft, update

The final Patch Tuesday update of the year brings 56 new CVEs, bringing the year-end total to over 1,100. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366636275/Microsoft-patched-over-1100-CVEs-in-2025
Microsoft Security Update Summary (9. Dezember 2025)

Dec 9, 2025 11:32 PM

Tags: microsoft, office, update, vulnerability, windows, zero-day

Microsoft hat am 9. Dezember 2025 Sicherheitsupdates für Windows-Clients und -Server, für Office sowie für weitere Produkte veröffentlicht. Die Sicherheitsupdates beseitigen 56 Schwachstellen (CVEs), eine davon wurde als 0-day klassifiziert und wird ausgenutzt. Nachfolgend findet sich ein kompakter … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/12/09/microsoft-security-update-summary-9-dezember-2025/
Microsoft’s last Patch Tuesday of 2025 addresses 57 defects, including one zero-day

Dec 9, 2025 10:33 PM

Tags: microsoft, update, zero-day

Microsoft closed out the year with 1,139 total defects patched, making it the second-largest year in volume behind 2020, according to Trend Micro. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-patch-tuesday-december-2025/
Microsoft releases Windows 10 KB5071546 extended security update

Dec 9, 2025 9:33 PM

Tags: microsoft, update, vulnerability, windows, zero-day

Microsoft has released the KB5071546 extended security update to resolve 57 security vulnerabilities, including three zero-day flaws. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5071546-extended-security-update/
Microsoft December 2025 Patch Tuesday fixes 3 zero-days, 57 flaws

Dec 9, 2025 8:33 PM

Tags: exploit, flaw, microsoft, update, zero-day

Microsoft’s December 2025 Patch Tuesday fixes 57 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-december-2025-patch-tuesday-fixes-3-zero-days-57-flaws/
Fortinet warns of critical FortiCloud SSO login auth bypass flaws

Dec 9, 2025 8:33 PM

Tags: flaw, fortinet, login, update, vulnerability

Fortinet has released security updates to address two critical vulnerabilities in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager that could allow attackers to bypass FortiCloud SSO authentication. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-forticloud-sso-login-auth-bypass-flaws/
Windows 11 KB5072033 & KB5071417 cumulative updates released

Dec 9, 2025 8:33 PM

Tags: microsoft, update, vulnerability, windows

Microsoft has released Windows 11 KB5072033 and KB5071417 cumulative updates for versions 25H2/24H2 and 23H2 to fix security vulnerabilities, bugs, and add new features. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-11-kb5072033-and-kb5071417-cumulative-updates-released/
Racks, sprawl and the myth of redundancy: Why your failover isn’t as safe as you think

Dec 9, 2025 6:32 PM

Tags: access, automation, backup, breach, cloud, control, data, data-breach, defense, detection, dns, encryption, firmware, flaw, infrastructure, intelligence, Internet, metric, mobile, network, resilience, software, strategy, supply-chain, tool, update, vulnerability, zero-day

Cloud complexity and policy traps: Networks, however, no longer stay confined to racks. They live in routing tables, BGP sessions, cloud control planes and software-defined overlays. Many organizations rush to multi-region cloud setups, believing geographic distance alone guarantees resilience. It does not. Last year, I oversaw a global e-commerce platform with active-passive failover across two…
Racks, sprawl and the myth of redundancy: Why your failover isn’t as safe as you think

Dec 9, 2025 6:32 PM

Tags: access, automation, backup, breach, cloud, control, data, data-breach, defense, detection, dns, encryption, firmware, flaw, infrastructure, intelligence, Internet, metric, mobile, network, resilience, software, strategy, supply-chain, tool, update, vulnerability, zero-day

Cloud complexity and policy traps: Networks, however, no longer stay confined to racks. They live in routing tables, BGP sessions, cloud control planes and software-defined overlays. Many organizations rush to multi-region cloud setups, believing geographic distance alone guarantees resilience. It does not. Last year, I oversaw a global e-commerce platform with active-passive failover across two…