Large team at multiple laptops with central shield displaying keyhole surrounded by malware and warnings

Daily Dose of Cybersecurity News - September 10, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

September 10, 2025 6:02 AM 5 min read

Microsoft's September 2025 Patch Tuesday Addresses Over 80 Vulnerabilities

High

What happened

Microsoft released security updates addressing over 80 vulnerabilities in Windows operating systems and related software, including 13 critical flaws.

Who is affected

Users and administrators of Windows operating systems and software are impacted.

Why it matters

The updates address critical vulnerabilities that could allow attackers to gain remote access or escalate privileges, posing significant security risks.

How it could have been prevented

Regularly applying security patches and updates, conducting vulnerability assessments, and implementing robust network security measures.

Relevant professional terms

Remote Code Execution (RCE): A vulnerability that allows an attacker to execute arbitrary code on a target system remotely.
Privilege Escalation: A security flaw that enables an attacker to gain higher access rights than initially granted.

Source: krebsonsecurity.com

U.S. Sanctions Southeast Asian Cyber Scam Networks

Critical

What happened

The U.S. Department of the Treasury has imposed sanctions on multiple cyber scam networks operating in Southeast Asia, particularly in Burma and Cambodia, responsible for defrauding Americans of over $10 billion in 2024.

Who is affected

American individuals and businesses who fell victim to these sophisticated online scams, as well as the sanctioned entities and individuals in Southeast Asia.

Why it matters

The significant financial losses underscore the growing threat of international cyber scams. The use of forced labor and human trafficking in these operations highlights severe human rights violations.

How it could have been prevented

- Implementing robust cybersecurity measures and public awareness campaigns to educate individuals about recognizing and avoiding online scams. - Strengthening international cooperation to identify and dismantle such criminal networks.

Relevant professional terms

Sanctions: Official penalties imposed by one country on another to deter certain behaviors or policies.
Human Trafficking: The illegal trade of humans for the purposes of forced labor, sexual slavery, or commercial sexual exploitation.

Source: bleepingcomputer.com

Hackers Exploit Exposed Docker APIs Using Tor Network

High

What happened

Attackers are exploiting exposed Docker APIs to deploy malicious containers that utilize the Tor network for anonymity. These containers install tools like curl and Tor, establish persistent SSH access, and download additional payloads from hidden services.

Who is affected

Organizations with misconfigured Docker API endpoints exposed to the internet are at risk of unauthorized access and potential system compromise.

Why it matters

This attack vector allows threat actors to gain control over Docker hosts, potentially leading to data breaches, service disruptions, and the establishment of botnets. The use of the Tor network complicates attribution and mitigation efforts.

How it could have been prevented

- Restrict access to Docker APIs by configuring firewalls to allow connections only from trusted networks. - Implement authentication mechanisms for Docker API endpoints to prevent unauthorized access.

Relevant professional terms

Docker API: An interface that allows users to interact with the Docker daemon programmatically, enabling the management of containers and images.
Tor Network: A decentralized network that anonymizes internet traffic by routing it through multiple servers, concealing the user's location and usage.

Recommended reading: Compromised Docker Hosts Use Shodan to Infect More Victims

Source: bleepingcomputer.com

Windows 11 KB5065426 & KB5065431 Cumulative Updates Released

High

What happened

Microsoft has released the KB5065426 and KB5065431 cumulative updates for Windows 11 versions 24H2 and 23H2, respectively, addressing security vulnerabilities and various issues.

Who is affected

Users of Windows 11 versions 24H2 and 23H2 are affected by these updates.

Why it matters

These updates are mandatory as they contain the September 2025 Patch Tuesday security patches for vulnerabilities discovered in previous months, ensuring system security and stability.

How it could have been prevented

Regularly applying Windows updates and patches as they are released helps prevent security vulnerabilities and system issues.

Relevant professional terms

Cumulative Update: A package that includes all previously released fixes and improvements for a software product.
Patch Tuesday: The second Tuesday of each month when Microsoft releases security patches for its software products.

Recommended reading: support.microsoft.com

Source: bleepingcomputer.com

US Charges Administrator of LockerGoga, MegaCortex, and Nefilim Ransomware Operations

High

What happened

The U.S. Department of Justice has charged Ukrainian national Volodymyr Viktorovich Tymoshchuk for his role as the administrator of the LockerGoga, MegaCortex, and Nefilim ransomware operations. Operating under aliases such as "deadforz," "Boba," "msfv," and "farnetwork," Tymoshchuk was involved in ransomware attacks that compromised hundreds of companies, causing millions of dollars in damages.

Who is affected

Over 250 companies in the United States and numerous others worldwide were targeted between July 2019 and October 2021. These attacks impacted various sectors, leading to significant operational disruptions and financial losses.

Why it matters

This case underscores the persistent threat posed by sophisticated ransomware operations and highlights the importance of international cooperation in combating cybercrime. The charges against Tymoshchuk serve as a warning to cybercriminals about the potential consequences of their actions.

How it could have been prevented

Implementing robust cybersecurity measures, including regular system updates, employee training on phishing attacks, and comprehensive incident response plans, could mitigate the risk of such ransomware attacks.

Relevant professional terms

Ransomware: Malicious software designed to block access to a computer system until a sum of money is paid.
Administrator: An individual responsible for managing and overseeing the operations of a system or network.

Recommended reading: Ukrainian extradited to US for Nefilim ransomware attacks

Source: bleepingcomputer.com

Critical 'SessionReaper' Vulnerability (CVE-2025-54236) Patched in Adobe Commerce and Magento Open Source

Critical

What happened

Adobe released a security update addressing a critical vulnerability, CVE-2025-54236, known as 'SessionReaper,' in its Commerce and Magento Open Source platforms. This flaw allows unauthenticated attackers to hijack customer sessions via the Commerce REST API.

Who is affected

Users and administrators of Adobe Commerce and Magento Open Source platforms are impacted by this vulnerability.

Why it matters

Exploitation of this vulnerability could lead to unauthorized access to customer accounts, compromising sensitive information and potentially resulting in financial loss and reputational damage for affected organizations.

How it could have been prevented

Regularly updating and patching software, implementing robust authentication mechanisms, and conducting thorough security audits could mitigate such vulnerabilities.

Relevant professional terms

REST API: A set of web services that allow interaction with web-based applications through stateless operations.
Session Hijacking: An attack where a malicious actor takes over a valid user session to gain unauthorized access to information or services.

Recommended reading: Adobe Security Bulletin APSB25-54

Source: bleepingcomputer.com

SAP NetWeaver Critical Vulnerability (CVE-2025-42944) Patched

Critical

What happened

SAP released patches addressing 21 vulnerabilities, including a critical insecure deserialization flaw (CVE-2025-42944) in NetWeaver's RMI-P4 module, which could allow unauthenticated attackers to execute arbitrary OS commands.

Who is affected

Organizations using SAP NetWeaver, particularly those with the RMI-P4 module exposed to untrusted networks.

Why it matters

Exploitation of this vulnerability could lead to full system compromise, granting attackers unauthorized access to sensitive data and critical business processes.

How it could have been prevented

Regularly applying security patches, conducting thorough network exposure assessments, and ensuring that internal services like RMI-P4 are not accessible from untrusted networks.

Relevant professional terms

Insecure Deserialization: A security flaw where untrusted data is deserialized, potentially leading to arbitrary code execution.
Remote Method Invocation (RMI): A Java API that allows objects to invoke methods on objects located remotely, facilitating distributed computing.

Recommended reading: SAP Security Notes

Source: bleepingcomputer.com