Hackers above laptop displaying central shield with lock surrounded by warning icons, code, and threats

Daily Dose of Cybersecurity News - September 13, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

September 13, 2025 6:02 AM 5 min read

HybridPetya Ransomware Exploits CVE-2024-7344 to Bypass UEFI Secure Boot

High

What happened

A new ransomware variant named HybridPetya has been identified, capable of bypassing UEFI Secure Boot by exploiting the CVE-2024-7344 vulnerability. This malware installs a malicious application on the EFI System Partition, encrypts the Master File Table (MFT), and demands a ransom for decryption.

Who is affected

Organizations and individuals using Windows systems with outdated UEFI firmware that have not applied the January 2025 security updates are at risk.

Why it matters

HybridPetya's ability to bypass Secure Boot and encrypt critical system files poses a significant threat, potentially rendering systems inoperable and leading to data loss or operational disruptions.

How it could have been prevented

Applying the January 2025 security updates that address CVE-2024-7344 and maintaining regular offline backups of critical data can mitigate the risk posed by such ransomware.

Relevant professional terms

UEFI Secure Boot: A security standard designed to ensure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM).
EFI System Partition (ESP): A partition on a data storage device that is used by computers adhering to the UEFI specification for booting operating systems and other utilities.

Recommended reading: BleepingComputer

Source: bleepingcomputer.com

Critical RCE Vulnerability CVE-2025-5086 in DELMIA Apriso Exploited

Critical

What happened

A critical remote code execution (RCE) vulnerability, identified as CVE-2025-5086, has been actively exploited in DELMIA Apriso, a manufacturing operations management solution by Dassault Systèmes. The flaw arises from deserialization of untrusted data, allowing attackers to execute arbitrary code remotely.

Who is affected

Organizations utilizing DELMIA Apriso versions from Release 2020 through Release 2025 are impacted. This includes sectors such as automotive, aerospace, electronics, high-tech, and industrial machinery.

Why it matters

The exploitation of this vulnerability can lead to unauthorized access, data breaches, and potential disruption of critical manufacturing processes, posing significant operational and security risks.

How it could have been prevented

Regularly applying security patches and updates, conducting thorough code reviews to prevent deserialization vulnerabilities, and implementing robust input validation mechanisms.

Relevant professional terms

Remote Code Execution (RCE): A type of vulnerability that allows an attacker to execute arbitrary code on a target system remotely.
Deserialization: The process of converting serialized data back into its original object form. If untrusted data is deserialized, it can lead to security vulnerabilities.

Recommended reading: Dassault Systèmes Security Advisory

Source: bleepingcomputer.com

Samsung Patches Actively Exploited Zero-Day Vulnerability (CVE-2025-21043)

Critical

What happened

Samsung addressed a critical remote code execution vulnerability (CVE-2025-21043) in its Android devices, which was actively exploited in zero-day attacks. The flaw resides in the closed-source image parsing library libimagecodec.quram.so, developed by Quramsoft, and allows remote attackers to execute arbitrary code on affected devices.

Who is affected

Users of Samsung devices running Android 13 or later are impacted. The vulnerability was reported by security teams from Meta and WhatsApp on August 13, 2025.

Why it matters

This vulnerability enables remote code execution, potentially allowing attackers to gain full control over affected devices. Given its active exploitation in the wild, prompt patching is essential to prevent unauthorized access and potential data breaches.

How it could have been prevented

Regular security audits of third-party libraries and prompt application of security patches can mitigate such vulnerabilities. Additionally, implementing robust input validation and boundary checks within code can prevent out-of-bounds write issues.

Relevant professional terms

Zero-day vulnerability: A security flaw that is exploited by attackers before the software vendor becomes aware and issues a fix.
Remote code execution (RCE): A type of vulnerability that allows an attacker to run arbitrary code on a target system remotely.

Recommended reading: Samsung Mobile Security Updates

Source: bleepingcomputer.com

French Advisory Highlights Apple Spyware Activity

High

What happened

France's national cybersecurity agency, CERT-FR, reported that Apple has sent notifications to individuals targeted by sophisticated spyware attacks, indicating potential device compromises.

Who is affected

Apple device users who received threat notifications from Apple, suggesting their devices may have been compromised by spyware.

Why it matters

The use of advanced spyware like Pegasus and Predator poses significant security risks, as these tools can infiltrate devices without user interaction, leading to unauthorized data access and surveillance.

How it could have been prevented

Regularly updating devices to the latest software versions and enabling security features like Lockdown Mode can mitigate the risk of spyware infections.

Relevant professional terms

Zero-day vulnerability: A software flaw unknown to the vendor, leaving systems vulnerable to attacks until a fix is developed.
Lockdown Mode: A security feature in Apple devices designed to protect against highly sophisticated cyberattacks by restricting certain functionalities.

Recommended reading: darkreading.com

Source: darkreading.com

Critical Vulnerability CVE-2025-5086 Exploited in DELMIA Apriso Software

Critical

What happened

A critical vulnerability (CVE-2025-5086) in DELMIA Apriso software is being actively exploited, allowing attackers to execute remote code.

Who is affected

Organizations using DELMIA Apriso versions 2020 through 2025 across industries such as aerospace, defense, automotive, high-tech, and industrial equipment.

Why it matters

The exploitation of this vulnerability can lead to unauthorized control over manufacturing processes, posing significant operational and security risks.

How it could have been prevented

Regularly updating software to the latest versions and applying security patches promptly upon release.

Relevant professional terms

Deserialization of untrusted data: A security flaw where malicious data is processed, leading to potential code execution.
Remote Code Execution (RCE): An attack that allows an adversary to run arbitrary code on a target system remotely.

Recommended reading: CISA Known Exploited Vulnerabilities Catalog

Source: securityweek.com

VMScape: New Spectre-BTI Attack Compromises Cloud Virtualization Isolation (CVE-2025-40300)

High

What happened

Researchers from ETH Zurich have developed VMScape, a Spectre branch target injection (Spectre-BTI) attack that breaches virtualization isolation, allowing malicious guest users to leak sensitive information from the hypervisor without code modifications.

Who is affected

Organizations utilizing AMD Zen CPUs and older Intel CPUs in virtualized cloud environments are vulnerable to this attack.

Why it matters

This vulnerability undermines the fundamental security of cloud-based virtual machines, potentially exposing sensitive data such as cryptographic keys, thereby posing significant risks to data confidentiality and integrity.

How it could have been prevented

Implementing Indirect Branch Prediction Barrier (IBPB) on each VM exit before entering the hypervisor's user-space can mitigate the attack. Regularly updating systems with the latest security patches is also essential.

Relevant professional terms

Hypervisor: Software that creates and manages virtual machines by allocating resources from the host hardware.
Branch Predictor: A CPU component that attempts to guess the direction of branch instructions to improve processing efficiency.

Recommended reading: comsec.ethz.ch

Source: securityweek.com

KioSoft's Delayed Response to CVE-2025-8699 Vulnerability in NFC Payment Cards

High

What happened

SEC Consult identified a vulnerability (CVE-2025-8699) in KioSoft's NFC-based stored-value cards, allowing unauthorized balance top-ups due to local storage of balance information.

Who is affected

Users and operators of KioSoft's self-service payment machines utilizing MiFare Classic NFC card technology.

Why it matters

The vulnerability enables attackers to fraudulently increase card balances, leading to potential financial losses and undermining trust in the payment system's security.

How it could have been prevented

Implementing secure, server-side storage for balance information and utilizing more secure NFC card technologies could have mitigated this vulnerability.

Relevant professional terms

MiFare Classic NFC: A type of Near Field Communication card known for its security vulnerabilities.
Stored-Value Card: A payment card with a monetary value stored directly on the card itself.

Recommended reading: SecurityWeek

Source: securityweek.com