Central hacker figure surrounded by multiple laptops displaying locks with hexagonal shields and malware threats

Daily Dose of Cybersecurity News - September 5, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

September 5, 2025 6:03 AM 5 min read

Exploitation of Sitecore Zero-Day Vulnerability (CVE-2025-53690)

High

What happened

Threat actors exploited a zero-day vulnerability in legacy Sitecore deployments, identified as CVE-2025-53690, to deploy the WeepSteel reconnaissance malware. This flaw arises from the reuse of a sample ASP.NET machine key in production environments, enabling attackers to execute remote code by crafting malicious '_VIEWSTATE' payloads.

Who is affected

Organizations utilizing legacy versions of Sitecore that have implemented the sample ASP.NET machine key in their production environments are at risk.

Why it matters

The exploitation of this vulnerability allows attackers to gain unauthorized access and control over affected systems, potentially leading to data breaches, system compromise, and further malicious activities.

How it could have been prevented

Avoid using sample or default machine keys in production environments. Regularly review and update configuration settings to ensure they adhere to security best practices.

Relevant professional terms

ViewState: A method used by ASP.NET to preserve page and control values between postbacks.
Remote Code Execution (RCE): A type of vulnerability that allows an attacker to execute arbitrary code on a target system remotely.

Source: bleepingcomputer.com

Texas Sues PowerSchool Over Massive Data Breach Exposing 62 Million Students

Critical

What happened

Texas Attorney General Ken Paxton filed a lawsuit against education software company PowerSchool following a December 2024 data breach that exposed the personal information of 62 million students, including over 880,000 Texans. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/texas-sues-powerschool-after-massive-data-breach-hit-62-million-students/?utm_source=openai))

Who is affected

Students and faculty from 6,505 school districts across the U.S., Canada, and other countries, with over 880,000 individuals from Texas. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/texas-sues-powerschool-after-massive-data-breach-hit-62-million-students/?utm_source=openai))

Why it matters

The breach compromised sensitive data, including full names, addresses, phone numbers, passwords, parent information, Social Security numbers, and medical data, posing significant risks of identity theft and privacy violations. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/texas-sues-powerschool-after-massive-data-breach-hit-62-million-students/?utm_source=openai))

How it could have been prevented

Implementing robust access controls, regular security audits, and comprehensive employee training on credential management could have mitigated the risk of unauthorized access.

Relevant professional terms

Data Breach: An incident where unauthorized individuals gain access to confidential data.
Access Controls: Security measures that regulate who or what can view or use resources in a computing environment.

Source: bleepingcomputer.com

Chess.com Data Breach via Third-Party File Transfer Application

Medium

What happened

Unauthorized access to a third-party file transfer application used by Chess.com led to a data breach affecting over 4,500 users. The breach occurred between June 5 and June 18, 2025, and was discovered on June 19, 2025.

Who is affected

Approximately 4,541 Chess.com users, representing a small fraction of the platform's 100 million user base, had their personal information exposed.

Why it matters

The breach underscores the risks associated with third-party applications and the importance of securing data transfer processes. Exposed personal information can lead to identity theft and other malicious activities.

How it could have been prevented

Implementing strict access controls and regular security audits for third-party applications could have mitigated the risk of unauthorized access.

Relevant professional terms

Third-Party Risk Management: The process of identifying, assessing, and controlling risks associated with external vendors and service providers.
Data Exfiltration: The unauthorized transfer of data from a computer or network.

Recommended reading: How can I stay secure on Chess.com?

Source: bleepingcomputer.com

Unpatched Zero-Day Vulnerability in TP-Link Routers

Critical

What happened

A critical, unpatched zero-day vulnerability has been identified in multiple TP-Link router models, specifically within the CPE WAN Management Protocol (CWMP) implementation. This flaw allows remote code execution through a stack-based buffer overflow.

Who is affected

Users of TP-Link routers, notably the Archer AX10 and Archer AX1500 models, are at risk. The vulnerability may also affect other models utilizing the same CWMP binary.

Why it matters

Exploitation of this vulnerability could grant attackers control over affected routers, enabling them to reroute DNS queries, intercept or manipulate unencrypted traffic, and inject malicious payloads into web sessions. This poses significant security risks to both individual users and organizations.

How it could have been prevented

Regular security audits and timely patching of firmware vulnerabilities could have mitigated this risk. Users are advised to change default administrative passwords, disable CWMP if not required, and apply the latest firmware updates as they become available.

Relevant professional terms

Zero-day vulnerability: A security flaw that is unknown to the vendor and lacks a patch, making it exploitable by attackers.
Buffer overflow: A condition where a program writes more data to a buffer than it can hold, potentially allowing attackers to execute arbitrary code.

Source: bleepingcomputer.com

Emerging Browser-Based Attack Techniques in 2025

High

What happened

Cybersecurity experts have identified six emerging browser-based attack techniques that are leading causes of data breaches in 2025. These methods exploit vulnerabilities within web browsers to compromise business applications and sensitive data.

Who is affected

Organizations utilizing web browsers for accessing business-critical applications are at risk, particularly those without robust browser security measures.

Why it matters

As browsers become central to business operations, they have become prime targets for cyberattacks. Understanding these attack vectors is crucial for implementing effective defenses and mitigating potential data breaches.

How it could have been prevented

Implementing comprehensive browser security solutions, regularly updating and patching browsers, and educating employees on safe browsing practices can mitigate these risks.

Relevant professional terms

Browser-Based Attack: A cyberattack that exploits vulnerabilities within a web browser to compromise data or systems.
Data Breach: An incident where unauthorized individuals gain access to confidential data.

Source: bleepingcomputer.com

Bridgestone Cyberattack Disrupts North American Manufacturing

Medium

What happened

Bridgestone Americas experienced a cyberattack that disrupted operations at several manufacturing facilities in North America. The company responded swiftly to contain the incident and is conducting an ongoing investigation.

Who is affected

Bridgestone Americas' manufacturing facilities in Aiken County, South Carolina, and Joliette, Quebec, were impacted. Employees at these locations faced operational disruptions.

Why it matters

The attack highlights the vulnerability of critical manufacturing infrastructure to cyber threats, potentially leading to production halts and supply chain disruptions. Prompt containment efforts are crucial to mitigate such risks.

How it could have been prevented

Implementing robust network segmentation and continuous monitoring could have detected and isolated the threat earlier. Regular cybersecurity training for employees can also reduce the risk of such incidents.

Relevant professional terms

Network Segmentation: Dividing a computer network into smaller parts to improve security and performance.
Incident Containment: Actions taken to limit the impact of a security breach and prevent further damage.

Recommended reading: CISA Stop Ransomware

Source: bleepingcomputer.com

Critical Sitecore Zero-Day Vulnerability (CVE-2025-53690) Exploited in ViewState Attacks

Critical

What happened

Attackers exploited a zero-day vulnerability (CVE-2025-53690) in Sitecore products by leveraging exposed ASP.NET machine keys to perform ViewState deserialization attacks, leading to remote code execution.

Who is affected

Organizations using Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud, particularly those deployed with sample machine keys from pre-2017 documentation.

Why it matters

Exploitation of this vulnerability allows attackers to execute arbitrary code on affected servers, potentially leading to data breaches, system compromise, and further network infiltration.

How it could have been prevented

- Generate unique, secure machine keys for each deployment instead of using sample keys from documentation. - Regularly rotate and encrypt machine keys to enhance security.

Relevant professional terms

ViewState: An ASP.NET feature that maintains the state of web pages between user interactions by storing data in a hidden field.
Deserialization Attack: A type of attack where malicious data is processed by an application, leading to unintended code execution.

Recommended reading: BleepingComputer

Source: darkreading.com