Daily Dose of Cybersecurity News - September 5, 2025
Exploitation of Sitecore Zero-Day Vulnerability (CVE-2025-53690)
HighWhat happened
Threat actors exploited a zero-day vulnerability in legacy Sitecore deployments, identified as CVE-2025-53690, to deploy the WeepSteel reconnaissance malware. This flaw arises from the reuse of a sample ASP.NET machine key in production environments, enabling attackers to execute remote code by crafting malicious '_VIEWSTATE' payloads.
Who is affected
Organizations utilizing legacy versions of Sitecore that have implemented the sample ASP.NET machine key in their production environments are at risk.
Why it matters
The exploitation of this vulnerability allows attackers to gain unauthorized access and control over affected systems, potentially leading to data breaches, system compromise, and further malicious activities.
How it could have been prevented
Avoid using sample or default machine keys in production environments. Regularly review and update configuration settings to ensure they adhere to security best practices.
Relevant professional terms
- ViewState
- A method used by ASP.NET to preserve page and control values between postbacks.
- Remote Code Execution (RCE)
- A type of vulnerability that allows an attacker to execute arbitrary code on a target system remotely.
Recommended reading: Sitecore XP RCE flaw patched last month now actively exploited
Texas Sues PowerSchool Over Massive Data Breach Exposing 62 Million Students
CriticalWhat happened
Texas Attorney General Ken Paxton filed a lawsuit against education software company PowerSchool following a December 2024 data breach that exposed the personal information of 62 million students, including over 880,000 Texans. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/texas-sues-powerschool-after-massive-data-breach-hit-62-million-students/?utm_source=openai))
Who is affected
Students and faculty from 6,505 school districts across the U.S., Canada, and other countries, with over 880,000 individuals from Texas. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/texas-sues-powerschool-after-massive-data-breach-hit-62-million-students/?utm_source=openai))
Why it matters
The breach compromised sensitive data, including full names, addresses, phone numbers, passwords, parent information, Social Security numbers, and medical data, posing significant risks of identity theft and privacy violations. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/texas-sues-powerschool-after-massive-data-breach-hit-62-million-students/?utm_source=openai))
How it could have been prevented
Implementing robust access controls, regular security audits, and comprehensive employee training on credential management could have mitigated the risk of unauthorized access.
Relevant professional terms
- Data Breach
- An incident where unauthorized individuals gain access to confidential data.
- Access Controls
- Security measures that regulate who or what can view or use resources in a computing environment.
Recommended reading: PowerSchool hacker claims they stole data of 62 million students
Chess.com Data Breach via Third-Party File Transfer Application
MediumWhat happened
Unauthorized access to a third-party file transfer application used by Chess.com led to a data breach affecting over 4,500 users. The breach occurred between June 5 and June 18, 2025, and was discovered on June 19, 2025.
Who is affected
Approximately 4,541 Chess.com users, representing a small fraction of the platform's 100 million user base, had their personal information exposed.
Why it matters
The breach underscores the risks associated with third-party applications and the importance of securing data transfer processes. Exposed personal information can lead to identity theft and other malicious activities.
How it could have been prevented
Implementing strict access controls and regular security audits for third-party applications could have mitigated the risk of unauthorized access.
Relevant professional terms
- Third-Party Risk Management
- The process of identifying, assessing, and controlling risks associated with external vendors and service providers.
- Data Exfiltration
- The unauthorized transfer of data from a computer or network.
Recommended reading: How can I stay secure on Chess.com?
Unpatched Zero-Day Vulnerability in TP-Link Routers
CriticalWhat happened
A critical, unpatched zero-day vulnerability has been identified in multiple TP-Link router models, specifically within the CPE WAN Management Protocol (CWMP) implementation. This flaw allows remote code execution through a stack-based buffer overflow.
Who is affected
Users of TP-Link routers, notably the Archer AX10 and Archer AX1500 models, are at risk. The vulnerability may also affect other models utilizing the same CWMP binary.
Why it matters
Exploitation of this vulnerability could grant attackers control over affected routers, enabling them to reroute DNS queries, intercept or manipulate unencrypted traffic, and inject malicious payloads into web sessions. This poses significant security risks to both individual users and organizations.
How it could have been prevented
Regular security audits and timely patching of firmware vulnerabilities could have mitigated this risk. Users are advised to change default administrative passwords, disable CWMP if not required, and apply the latest firmware updates as they become available.
Relevant professional terms
- Zero-day vulnerability
- A security flaw that is unknown to the vendor and lacks a patch, making it exploitable by attackers.
- Buffer overflow
- A condition where a program writes more data to a buffer than it can hold, potentially allowing attackers to execute arbitrary code.
Recommended reading: Zero-Day Alert: Automated Discovery of Critical CWMP Stack Overflow in TP-Link Routers
Emerging Browser-Based Attack Techniques in 2025
HighWhat happened
Cybersecurity experts have identified six emerging browser-based attack techniques that are leading causes of data breaches in 2025. These methods exploit vulnerabilities within web browsers to compromise business applications and sensitive data.
Who is affected
Organizations utilizing web browsers for accessing business-critical applications are at risk, particularly those without robust browser security measures.
Why it matters
As browsers become central to business operations, they have become prime targets for cyberattacks. Understanding these attack vectors is crucial for implementing effective defenses and mitigating potential data breaches.
How it could have been prevented
Implementing comprehensive browser security solutions, regularly updating and patching browsers, and educating employees on safe browsing practices can mitigate these risks.
Relevant professional terms
- Browser-Based Attack
- A cyberattack that exploits vulnerabilities within a web browser to compromise data or systems.
- Data Breach
- An incident where unauthorized individuals gain access to confidential data.
Recommended reading: The Browser Blind Spot: Why Your Browser is the Next Cybersecurity Battleground
Bridgestone Cyberattack Disrupts North American Manufacturing
MediumWhat happened
Bridgestone Americas experienced a cyberattack that disrupted operations at several manufacturing facilities in North America. The company responded swiftly to contain the incident and is conducting an ongoing investigation.
Who is affected
Bridgestone Americas' manufacturing facilities in Aiken County, South Carolina, and Joliette, Quebec, were impacted. Employees at these locations faced operational disruptions.
Why it matters
The attack highlights the vulnerability of critical manufacturing infrastructure to cyber threats, potentially leading to production halts and supply chain disruptions. Prompt containment efforts are crucial to mitigate such risks.
How it could have been prevented
Implementing robust network segmentation and continuous monitoring could have detected and isolated the threat earlier. Regular cybersecurity training for employees can also reduce the risk of such incidents.
Relevant professional terms
- Network Segmentation
- Dividing a computer network into smaller parts to improve security and performance.
- Incident Containment
- Actions taken to limit the impact of a security breach and prevent further damage.
Recommended reading: CISA Stop Ransomware
Critical Sitecore Zero-Day Vulnerability (CVE-2025-53690) Exploited in ViewState Attacks
CriticalWhat happened
Attackers exploited a zero-day vulnerability (CVE-2025-53690) in Sitecore products by leveraging exposed ASP.NET machine keys to perform ViewState deserialization attacks, leading to remote code execution.
Who is affected
Organizations using Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud, particularly those deployed with sample machine keys from pre-2017 documentation.
Why it matters
Exploitation of this vulnerability allows attackers to execute arbitrary code on affected servers, potentially leading to data breaches, system compromise, and further network infiltration.
How it could have been prevented
- Generate unique, secure machine keys for each deployment instead of using sample keys from documentation. - Regularly rotate and encrypt machine keys to enhance security.
Relevant professional terms
- ViewState
- An ASP.NET feature that maintains the state of web pages between user interactions by storing data in a hidden field.
- Deserialization Attack
- A type of attack where malicious data is processed by an application, leading to unintended code execution.
Recommended reading: BleepingComputer