Team protecting laptop with shield and security network

October 17, 2025 - Daily Cybersecurity News

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

October 17, 2025 6:02 AM 5 min read

Sotheby's Data Breach Exposes Financial Information

High

What happened

Sotheby's, a leading international auction house, experienced a data breach where unauthorized actors accessed and exfiltrated sensitive customer information, including full names, Social Security numbers, and financial account details.

Who is affected

The breach impacts Sotheby's customers whose personal and financial information was stored in the company's systems. The exact number of affected individuals has not been disclosed.

Why it matters

The exposure of sensitive personal and financial data increases the risk of identity theft and financial fraud for affected individuals. Additionally, such breaches can damage the reputation of organizations handling high-value transactions and sensitive client information.

How it could have been prevented

Implementing robust cybersecurity measures, including regular system audits, timely patching of vulnerabilities, and advanced threat detection systems, could have mitigated the risk of unauthorized access. Employee training on recognizing and responding to security threats is also crucial.

Relevant professional terms

Data Breach: An incident where unauthorized individuals gain access to confidential data, leading to potential exposure or theft of sensitive information.
Identity Theft: The fraudulent acquisition and use of a person's private identifying information, usually for financial gain.

Recommended reading: BleepingComputer

Source: bleepingcomputer.com

Prosper Data Breach Exposes 17.6 Million Accounts

High

What happened

Hackers breached Prosper's systems, stealing personal information of over 17.6 million individuals, including Social Security numbers and other sensitive data.

Who is affected

Prosper customers and loan applicants, totaling over 17.6 million individuals.

Why it matters

The exposure of sensitive personal information increases the risk of identity theft and financial fraud for affected individuals, potentially leading to significant financial and reputational damage.

How it could have been prevented

Implementing robust access controls, regular security audits, and comprehensive data encryption could have mitigated the risk of unauthorized access and data exfiltration.

Relevant professional terms

Personally Identifiable Information (PII): Information that can be used to identify an individual, such as name, Social Security number, and date of birth.
Data Breach: An incident where unauthorized individuals gain access to confidential data.

Recommended reading: lgcybersec.co.uk

Source: bleepingcomputer.com

Exploitation of Cisco SNMP Vulnerability (CVE-2025-20352) Leading to Rootkit Deployment

Critical

What happened

Threat actors exploited a remote code execution vulnerability (CVE-2025-20352) in Cisco IOS and IOS XE software to deploy a Linux rootkit, achieving persistent access to affected devices.

Who is affected

Organizations using older Cisco networking devices, specifically Cisco 9400, 9300, and legacy 3750G series switches lacking endpoint detection and response solutions.

Why it matters

The exploitation allows attackers to gain root access, deploy rootkits, and maintain persistent control over critical network infrastructure, potentially leading to data breaches and network disruptions.

How it could have been prevented

Timely application of security patches provided by Cisco, disabling SNMP if not required, and implementing strict access controls to limit SNMP access to trusted management stations.

Relevant professional terms

Rootkit: Malicious software designed to gain unauthorized root or administrative access to a computer system while concealing its presence.
Simple Network Management Protocol (SNMP): A protocol used for network management, enabling monitoring and configuration of network devices.

Recommended reading: Cisco Security Advisory on SNMP Vulnerabilities

Source: bleepingcomputer.com

Microsoft Disrupts Rhysida Ransomware Attacks Targeting Teams Users

High

What happened

Microsoft revoked over 200 certificates used to sign malicious Microsoft Teams installers, effectively disrupting a series of Rhysida ransomware attacks orchestrated by the threat group Vanilla Tempest.

Who is affected

Organizations and individuals who downloaded and executed fake Microsoft Teams installers from malicious domains mimicking legitimate Microsoft Teams download sites.

Why it matters

The attackers used deceptive domains and malvertising to distribute malware, leading to potential data theft, unauthorized command execution, and deployment of additional malicious payloads on compromised systems.

How it could have been prevented

- Verifying the authenticity of software download sources before installation.- Implementing robust endpoint protection to detect and block malicious software.

Relevant professional terms

Malvertising: The use of online advertising to spread malware by embedding malicious code within ads.
Code Signing Certificate: A digital certificate used to sign software, verifying the publisher's identity and ensuring the code has not been altered.

Recommended reading: Microsoft Security Blog

Source: bleepingcomputer.com

Gladinet Releases Patch for Actively Exploited Zero-Day Vulnerability (CVE-2025-11371)

High

What happened

Gladinet has released a security update for its CentreStack file-sharing platform to address a local file inclusion (LFI) vulnerability, identified as CVE-2025-11371, which has been actively exploited since late September. Attackers utilized this flaw to read the Web.config file, extract the machine key, and exploit a previously patched deserialization vulnerability (CVE-2025-30406) to achieve remote code execution.

Who is affected

Organizations using Gladinet's CentreStack platform are affected, particularly those with internet-facing deployments.

Why it matters

The exploitation of this vulnerability allows unauthorized access to sensitive configuration files, leading to potential remote code execution. This poses a significant risk to data integrity and system security, especially for organizations relying on CentreStack for file-sharing services.

How it could have been prevented

Regularly updating software to the latest versions and applying security patches promptly can mitigate such vulnerabilities. Additionally, implementing strict access controls and monitoring for unusual activity can help detect and prevent exploitation attempts.

Relevant professional terms

Local File Inclusion (LFI): A vulnerability that allows attackers to include files on a server through the web browser, potentially leading to information disclosure or code execution.
Deserialization Vulnerability: A security flaw that occurs when untrusted data is used to abuse the logic of an application, leading to remote code execution or other malicious outcomes.

Recommended reading: Huntress Technical Details on CVE-2025-11371

Source: bleepingcomputer.com

Critical Adobe Experience Manager Vulnerability (CVE-2025-54253) Actively Exploited

Critical

What happened

Attackers are actively exploiting a critical vulnerability (CVE-2025-54253) in Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23 and earlier, allowing unauthenticated remote code execution.

Who is affected

Organizations using Adobe Experience Manager Forms on JEE versions 6.5.23 and earlier.

Why it matters

Exploitation of this vulnerability can lead to unauthorized access, data breaches, and potential system compromise, posing significant risks to affected organizations.

How it could have been prevented

Timely application of security patches released by Adobe and restricting internet access to AEM Forms when deployed as a standalone application.

Relevant professional terms

Remote Code Execution (RCE): The ability of an attacker to execute arbitrary code on a target system remotely.
Authentication Bypass: A security flaw that allows an attacker to gain access to a system without proper credentials.

Recommended reading: Adobe Security Bulletin APSB25-42

Source: bleepingcomputer.com

North Korean Hackers Employ 'EtherHiding' to Conceal Malware on Blockchain

High

What happened

North Korean state-sponsored hackers, identified as UNC5342, have adopted the 'EtherHiding' technique to embed and deliver malware through smart contracts on public blockchains, facilitating cryptocurrency theft.

Who is affected

Software and web developers targeted through fake job interviews orchestrated by entities like BlockNovas LLC, Angeloper Agency, and SoftGlide LLC.

Why it matters

This marks the first known instance of a nation-state actor utilizing blockchain technology to host and distribute malware, presenting new challenges in tracking and mitigating such threats due to the decentralized and immutable nature of blockchains.

How it could have been prevented

Implementing strict download restrictions for executable files, enforcing robust web access and script execution policies, and conducting thorough verification of job offers and associated entities.

Relevant professional terms

EtherHiding: A technique where malicious code is embedded within smart contracts on public blockchains, allowing attackers to host and deliver malware in a decentralized and resilient manner.
Smart Contract: Self-executing contracts with the terms of the agreement directly written into code, running on blockchain networks to automatically enforce and execute agreements without intermediaries.

Recommended reading: Google Cloud Blog: DPRK Adopts EtherHiding

Source: bleepingcomputer.com