Welcome to your daily cybersecurity briefing.

🛡️ CERT-UA Alert: official update released – CERT-UA publishes an expanded update detailing malicious activity targeting educational and public-sector infrastructures, including new technical insights and reinforced hardening recommendations.

🧪 CERT-FR: new security advisory – CERT-FR issues a refreshed advisory regarding ongoing vulnerability analysis, highlighting potential operational risks affecting both Windows and Linux environments depending on configuration.

✈️ CERT-FR: additional security notice – A second CERT-FR advisory stresses the need for immediate mitigation actions due to the possibility of opportunistic exploitation associated with certain flaws with SYNOLOGY NAS.

🔐 NCSC: guidance for selecting an MSP – The NCSC releases updated recommendations to help organisations choose a trustworthy Managed Service Provider, with emphasis on baseline security controls, operational resilience and supply-chain risk management.

⚡ Don’t Think - Patch Now  and ask later.

📚 Sources:
🔗 CERT-UA – Official update
https://cert.gov.ua/article/6286219
🔗 CERT-FR – Advisory CERTFR-2025-AVI-1035 - SYNOLOGY
https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1035/
🔗 CERT-FR – Advisory CERTFR-2025-AVI-1036 - TANZU VMWare
https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1036/
🔗 NCSC – Choosing a Managed Service Provider
https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp

📞 Your feedback is welcome!
📧 Email: [email protected]
🌐 Website: https://www.radiocsirt.com
📰 Weekly Newsletter: https://radiocsirtintl.substack.com

#CyberSecurity #CERTFR #CERTUA #NCSC #MSP #SupplyChainSecurity #RadioCSIRT

Welcome to your daily cybersecurity podcast.

🛡️ Bulletproof hosting: new national guidance – The Australian Cyber Security Centre releases updated recommendations to mitigate risks posed by “bulletproof hosting” providers frequently used by cybercriminals to evade law-enforcement and defensive actions.

🧪 Wireshark vulnerabilities patched – CERT-FR publishes an advisory detailing several flaws in Wireshark, some of which may trigger denial-of-service conditions or application crashes when parsing specially crafted packets.

✈️ Iberia discloses customer data leak – The Spanish airline confirms a data breach originating from a compromised vendor, exposing personal information, identifiers, and travel-related details of customers.

🔐 Azure Bastion security flaw – A critical weakness affecting Azure Bastion may allow security bypass, potentially exposing cloud environments that lack proper isolation or configuration.

🛠️ Metasploit adds FortiWeb zero-day exploit – The Metasploit framework now includes an exploit for an unpatched zero-day vulnerability in FortiWeb, increasing the risk for organizations running unprotected Fortinet appliances.

⚡️ Don’t think — patch! 🚀

📚 Sources:
🔗 Guidance – Australian Cyber Security Centre
https://www.cyber.gov.au/about-us/view-all-content/news/new-guidance-for-mitigating-risks-from-bulletproof-hosting-providers

🔗 CERT-FR – Wireshark Vulnerabilities (CERTFR-2025-AVI-1026)
https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1026/

🔗 Iberia – Vendor Security Breach
https://www.bleepingcomputer.com/news/security/iberia-discloses-customer-data-leak-after-vendor-security-breach/

🔗 Azure Bastion Vulnerability
https://cybersecuritynews.com/azure-bastion-vulnerability/

🔗 Metasploit – FortiWeb Zero-day Exploit
https://cyberpress.org/metasploit-framework-updated-with-exploit-for-fortiweb-zero-day/

📞 Your feedback is welcome!
📧 Email: [email protected]
🌐 Website: https://www.radiocsirt.com
📰 Weekly Newsletter: https://radiocsirtintl.substack.com

#CyberSecurity #Wireshark #Azure #Iberia #Fortinet #Metasploit #CloudSecurity #BulletproofHosting #RadioCSIRT 🎧

Episode Description:
In this episode of RadioCSIRT, we examine how rising digital taxes are reshaping the cyber threat landscape. While taxation and cybersecurity may seem unrelated, the financial pressure created by digital taxes can significantly weaken organizational defenses — expanding the attack surface and creating opportunities for cybercriminals.

This episode covers:
• Budget impacts and the reduction of security capabilities
• Growth of ransomware, phishing and legacy-system exploitation
• Supply-chain weak points amplified by economic pressure
• Case studies from the UK, Brazil and India
• Key lessons for CISOs, SOC teams and policymakers

A concise, fact-driven analysis designed for cybersecurity professionals who want to understand the economic forces influencing modern threat behavior.

Welcome to your daily cybersecurity podcast.

🚨 Active exploitation – Oracle Identity Manager: CISA warns that a remote code execution vulnerability in Oracle Identity Manager is being actively exploited, putting IAM infrastructures at immediate risk.

🛠️ SolarWinds Serv-U under fire: Two critical vulnerabilities impact Serv-U, potentially allowing attackers to fully compromise targeted servers.

📨 SonicWall issues emergency patches: The vendor releases fixes for two flaws in its Email Security appliances, including a code execution bug (CVE-2025-40604).

🚆 Massive data breach in Italy: The Italian railway operator Ferrovie dello Stato suffers a major data leak following an attack on contractor Almaviva.

📊 Critical CVSS 10 flaw: Grafana patches a SCIM vulnerability rated 10/10, which could allow total compromise if left unpatched.

🏢 ShinyHunters strikes again: Salesforce and Gainsight hit by a new data breach attributed to the group, with confirmed data exfiltration.

⚡️ Don’t think—patch! 🚀

📚 Sources:
🔗 Oracle – CISA warns Oracle Identity Manager RCE flaw is being actively exploited
https://www.bleepingcomputer.com/news/security/cisa-warns-oracle-identity-manager-rce-flaw-is-being-actively-exploited/
🔗 SolarWinds – Serv-U Critical Vulnerabilities
https://thecyberthrone.in/2025/11/22/solarwinds-serv-u-critical-vulnerabilities/
🔗 SonicWall – Patches for Email Security Appliances (CVE-2025-40604)
https://securityonline.info/sonicwall-patches-two-vulnerabilities-in-email-security-appliances-including-code-execution-flaw-cve-2025-40604/
🔗 Data Leak – Italian Railway Operator Hit via Almaviva Hack
https://securityaffairs.com/184907/data-breach/massive-data-leak-hits-italian-railway-operator-ferrovie-dello-stato-via-almaviva-hack.html
🔗 Grafana – SCIM CVSS 10.0 Vulnerability Patch
https://thehackernews.com/2025/11/grafana-patches-cvss-100-scim-flaw.html
🔗 Breach – ShinyHunters Targets Salesforce & Gainsight
https://www.theregister.com/2025/11/21/shinyhunters_salesforce_gainsight_breach/

📞 Share your feedback:
📧 [email protected]
🌐 www.radiocsirt.org
📰 radiocsirtintl.substack.com

Welcome to your daily podcast dedicated to cybersecurity.

🚨 Critical SharePoint Alert: Microsoft issues CVE-2025-59245, a severe privilege escalation flaw that demands immediate attention from administrators.
🎧 Espionage & Malware: Google exposes "BadAudio," the new tool from the APT24 group, while the ShadowPad backdoor resurfaces in fresh targeted campaigns.
☁️ Salesforce Clamps Down: The CRM giant is cutting off access to third-party apps after detecting suspicious activity, moving fast to protect customer data.
💼 Dark Web Job Market: Crime starts young. A new study reveals that the median age of cybercrime job seekers is now just 24 years old.

⚡️ Don't think, just patch! 🚀

📚 Sources:
🔗 Microsoft – SharePoint Elevation of Privilege (CVE-2025-59245) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59245
🔗 Espionage – Google exposes BadAudio & APT24 https://www.bleepingcomputer.com/news/security/google-exposes-badaudio-malware-used-in-apt24-espionage-campaigns/
🔗 Cloud Sec – Salesforce cuts off third-party access https://therecord.media/salesforce-cuts-off-access-to-third-party-unusual-activity
🔗 Dark Web – Job Market Analysis 2023-2025 https://securelist.com/dark-web-job-market-2023-2025/118057/
🔗 Malware – ShadowPad Overview https://cyberpress.org/shadowpad-malware/

📞 Share your feedback:
📧 Email: [email protected]
🌐Web Site: www.radiocsirt.org
📰Weekly Newsletter: radiocsirtintl.substack.com

Welcome to your daily podcast dedicated to cybersecurity.

✈️ Industrial espionage by UNC1549: Iranian hackers deploy DEEPROOT and TWOSTROKE backdoors against aerospace and defense sectors, exploiting VDI access and the supply chain.

🤖 Gmail trains its AI with your data: Google enables email and attachment analysis for its Gemini model by default, requiring a complex manual opt-out to preserve privacy.

🍎 New macOS "DigitStealer": A fileless malware specifically targeting Apple Silicon chips to exfiltrate credentials and crypto wallets while bypassing standard detections.

🛡️ Massive scan of GlobalProtect VPNs: A coordinated campaign of 2.3 million scan sessions targets Palo Alto Networks portals, foreshadowing imminent vulnerability exploitation.

⚡️ Don't think, just patch! 🚀

📚 Sources:

🔗 UNC1549 – Iranian hackers use DEEPROOT and TWOSTROKE https://thehackernews.com/2025/11/iranian-hackers-use-deeproot-and.html

🔗 Privacy – Gmail is reading your emails to train its AI https://www.malwarebytes.com/blog/news/2025/11/gmail-is-reading-your-emails-and-attachments-to-train-its-ai-unless-you-turn-it-off

🔗 Malware – Mac users warned about new DigitStealer https://www.malwarebytes.com/blog/news/2025/11/mac-users-warned-about-new-digitstealer-information-stealer

🔗 Infrastructures – GlobalProtect VPN portals probed with 2.3 million scan sessions https://www.bleepingcomputer.com/news/security/globalprotect-vpn-portals-probed-with-23-million-scan-sessions/

📞 Share your feedback:
📧 [email protected]
🌐 www.radiocsirt.org
📰 radiocsirtintl.substack.com

Welcome to your daily cybersecurity podcast.

🛰️ Europol dismantles multiple digital piracy services after investigators traced more than EUR 47 million in crypto assets linked to illegal IPTV, streaming, and content-distribution platforms;
🛡️ CISA adds a newly identified and actively exploited vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply patches under strict timelines;
⚠️ PlushDaemon supply-chain attacks: threat actors are hijacking legitimate software update mechanisms to deliver malicious payloads and compromise environments through trusted distribution channels;
📹 Large-scale CCTV compromise: thousands of connected surveillance cameras hijacked for coordinated cybercriminal operations, including unauthorized internal access, reconnaissance, and further attack staging;
🎭 New Browser-in-the-Browser phishing kit: an advanced toolset capable of cloning authentication portals—including MFA flows—to bypass modern protections and steal credentials and session tokens;
🏢 Eurofiber breach confirmed: attackers exfiltrated sensitive customer data and attempted extortion following the November 13 intrusion, with stolen information allegedly shared or offered for sale;
🛰️ EdgeStepper implant: a stealthy network-level malware capable of rerouting DNS traffic through compromised routers and intermediary devices, enabling manipulation, interception, and redirection of network flows.

⚡️ Don’t think—patch! 🚀

📚 Sources:

🔗 Europol – Crypto traced to dismantle digital piracy operations https://www.europol.europa.eu/media-press/newsroom/news/eur-47-million-in-crypto-traced-to-disrupt-digital-piracy-services

🔗 CISA – New KEV entry added https://www.cisa.gov/news-events/alerts/2025/11/18/cisa-adds-one-known-exploited-vulnerability-catalog

🔗 PlushDaemon supply-chain attacks https://www.bleepingcomputer.com/news/security/plushdaemon-hackers-hijack-software-updates-in-supply-chain-attacks/

🔗 CCTV system compromise
https://thecyberexpress.com/cybercrime-cctv-hack/

🔗 Browser-in-the-Browser phishing kit
https://cyberpress.org/bitb-phishing-kit/

🔗 Eurofiber breach & extortion attempt
https://securityaffairs.com/184822/data-breach/eurofiber-confirms-november-13-hack-data-theft-and-extortion-attempt.html

🔗 EdgeStepper implant
https://thehackernews.com/2025/11/edgestepper-implant-reroutes-dns.html

📞 Share your feedback:
📧 [email protected]
🌐 www.radiocsirt.org
📰 radiocsirtintl.substack.com

#CyberSecurity #Europol #CISA #SupplyChain #PlushDaemon #CCTV #Phishing #Eurofiber #EdgeStepper #RadioCSIRT 🎧

 Welcome to your daily cybersecurity podcast.

🛰️ Australia’s Cyber Arrow Exercise: a large-scale national drill uniting government, industry and critical-infrastructure operators in the energy, communications and finance sectors, focusing on detection capabilities, digital forensics and major incident response readiness.

🛡️ Multiple Vulnerabilities in NetApp Products: several flaws impacting Brocade SANnav and HCI Compute Node Bootstrap OS, enabling remote denial of service, data confidentiality breaches and integrity compromise.

⚠️ Critical Mozilla Thunderbird Vulnerabilities: issues affecting versions prior to 140.5 and 145, allowing remote arbitrary code execution, security-policy bypass and other unspecified behaviors.

🏢 Mattermost Server Vulnerabilities: several versions in the 10.11.x, 10.12.x and 11.0.x branches exposed to a security issue undisclosed by the vendor.

🔍 Coinbase Breach Timeline Disputed: a researcher says he reported an attempted fraud on January 7 using detailed stolen personal data, challenging Coinbase’s official disclosure timeline published in May.

🌩️ Record 15.72 Tbps DDoS Attack Mitigated: Microsoft automatically blocked an AISURU-driven massive assault launched from hundreds of thousands of compromised IoT devices and targeting a public IP address in Australia.

🧩 Google Patches Actively Exploited Chrome Zero-Day: a V8 type-confusion bug tracked as CVE-2025-13223 and exploited in the wild, fixed alongside another similar engine vulnerability in the latest Chrome update.

💥 Critical W3 Total Cache Vulnerability: an unauthenticated command-injection flaw tracked as CVE-2025-9501, allowing remote code execution through malicious WordPress comments on more than one million vulnerable sites.

📧 Thunderbird 145 Updates: new Microsoft Exchange support via EWS, improved syncing and performance, DNS-over-HTTPS, enhanced manual configuration and numerous functional and UI fixes.

⚡️ Don’t think — patch! 🚀

📚 Sources:
🔗 Cyber Arrow Exercise – Australian Cyber Security Centre
https://www.cyber.gov.au/view-all-content/news/exercise-cyber-arrow

🔗 NetApp Vulnerabilities – CERTFR-2025-AVI-1015
https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1015/

🔗 Mozilla Thunderbird Vulnerabilities – CERTFR-2025-AVI-1016
https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1016/

🔗 Mattermost Vulnerabilities – CERTFR-2025-AVI-1017
https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-1017/

🔗 Coinbase Breach Timeline – The Register
https://www.theregister.com/2025/11/17/coinbase_breach_timeline/

🔗 AISURU DDoS Attack – The Hacker News
https://thehackernews.com/2025/11/microsoft-mitigates-record-572-tbps.html

🔗 Chrome V8 Zero-Day – The Hacker News
https://thehackernews.com/2025/11/google-issues-security-fix-for-actively.html

🔗 W3 Total Cache Command Injection – CyberPress
https://cyberpress.org/w3-total-cache-command-injection-flaw/

🔗 Thunderbird 145 – OMG!Ubuntu
https://www.omgubuntu.co.uk/2025/11/thunderbird-145-microsoft-exchange-support-ews

📞 Share your feedback:
📧 [email protected]
🌐 www.radiocsirt.org
📰 radiocsirtintl.substack.com

#CyberSecurity #CyberThreats #DDoS #ZeroDay #Chrome #WordPress #NetApp #Thunderbird #Mattermost #Coinbase #RadioCSIRT  #Raclette 🎙️

Welcome to your daily cybersecurity podcast.

🛰️ RoningLoader analysis: new research unveils the stealthy capabilities of RoningLoader, a modular malware loader designed for evasion, payload staging, and long-term persistence across compromised environments.

🛑 Gh0st RAT impersonation campaigns: recent investigations reveal large-scale social-engineering operations delivering Gh0st RAT through impersonated organizations, using spoofed identities and fraudulent communication channels to compromise victims.

🎭 Online radicalisation via gaming platforms: Europol and partner nations report coordinated action against extremist groups exploiting gaming ecosystems for recruitment, covert communication, and distribution of illicit content.

🏢 IBM AIX/VIOS – Critical vulnerability: a newly disclosed high-severity flaw impacts IBM AIX and VIOS systems, enabling attackers to exploit privilege-escalation vectors. Patch guidance has been issued and should be applied promptly.

🐧 Rondodox botnet expansion: threat actors are actively weaponizing an unpatched XWiki RCE vulnerability, expanding the Rondodox botnet with automated exploitation routines targeting internet-facing systems.

📱 Rust adoption improves Android memory-safety posture: new assessments highlight significant reductions in memory-corruption issues within Android components rewritten in Rust, reinforcing the long-term shift toward safer systems languages.

🛍️ Holiday cyber scams warning: national security agencies urge increased vigilance amid a rise in fraudulent shopping campaigns, fake storefronts, phishing operations, and payment-data harvesting schemes targeting consumers ahead of seasonal sales.

⚡️ Don’t think — patch! 🚀

📚 Sources:
🔗 RoningLoader – Elastic Security Labs: https://www.elastic.co/security-labs/roningloader
🔗 Gh0st RAT Impersonation Campaigns – Unit42: https://unit42.paloaltonetworks.com/impersonation-campaigns-deliver-gh0st-rat/
🔗 Online Radicalisation on Gaming Platforms – Europol: https://www.europol.europa.eu/media-press/newsroom/news/europol-and-partner-countries-combat-online-radicalisation-gaming-platforms
🔗 IBM AIX/VIOS CVE-2025-36250: https://cyberveille.esante.gouv.fr/alertes/ibm-aixvios-cve-2025-36250-2025-11-14
🔗 Rondodox Botnet Expands via XWiki RCE – Security Affairs: https://securityaffairs.com/184702/malware/rondodox-expands-botnet-by-exploiting-xwiki-rce-bug-left-unpatched-since-february-2025.html
🔗 Rust Adoption & Android Memory Safety – The Hacker News: https://thehackernews.com/2025/11/rust-adoption-drives-android-memory.html
🔗 Holiday Shopping Cyber-Scams – NCSC: https://www.ncsc.gov.uk/news/stay-alert-to-holiday-shopping-cyber-scams

📞 Share your feedback:
📧 [email protected]
🌐 www.radiocsirt.org
📰 radiocsirtintl.substack.com

#CyberSecurity #Malware #Gh0stRAT #Europol #IBM #Rondodox #Rust #Android #NCSC #RadioCSIRT 🎧

Welcome to your daily cybersecurity podcast.

🛰️ DNS4EU: the European Union continues to advance its sovereign DNS resolver project, designed to reduce dependency on non-EU services. The initiative aims to deliver a secure, privacy-respecting, and resilient DNS infrastructure operated entirely within Europe, with integrated filtering and threat-detection capabilities.

🛑 Ransomware – Q3 2025 Overview: recent analysis reveals continued growth in ransomware activity, driven by the increasing professionalization of threat groups, industrialized phishing operations, and expanding affiliate networks targeting SMEs, critical infrastructure, and interconnected suppliers.

🎭 North Korean IT worker schemes: several U.S. nationals have pleaded guilty to acting as intermediaries for North Korean operatives posing as legitimate IT professionals to secure employment in sensitive American companies, bypassing sanctions and screening controls.

🏢 Cisco Catalyst Center: a newly disclosed critical vulnerability impacts the platform, enabling attackers to obtain privileged access within administrative environments. A security update is available and should be applied without delay in infrastructures dependent on Catalyst Center.

🐧 Debian: the Debian Project has released new security updates affecting core components and widely deployed packages, with significant implications for server environments and systems relying on sensitive libraries and services.

⚡️ Don’t think — patch! 🚀

📚 Sources:

🔗 DNS4EU: https://blog.marcfredericgomez.fr/dns4eu-vers-un-dns-europeen-souverain-securise-et-respectueux-de-la-vie-privee/
🔗 Check Point – State of Ransomware Q3 2025: https://research.checkpoint.com/2025/the-state-of-ransomware-q3-2025/
🔗 North Korean IT Workers – The Record: https://therecord.media/multiple-us-nationals-guilty-pleas-north-korean-it-worker-scams
🔗 Cisco Catalyst Center: https://cybersecuritynews.com/cisco-catalyst-center-vulnerability/
🔗 Debian – Security Updates: https://www.debian.org/News/2025/20251115

📞 Share your feedback:
📧 [email protected]
🌐 www.radiocsirt.org
📰 radiocsirtintl.substack.com

#CyberSecurity #DNS4EU #Ransomware #NorthKorea #Cisco #Debian #RadioCSIRT 🎧🔥