Jul 31, 2025

Alert status: blinking red, Digital Defenders.

Today’s cyber news roundup is stacked: Apple patches a live exploit, Google tightens Chrome session security, and hackers hit everything from Linux servers to Fermilab’s SharePoint.

Stay sharp—threats are moving fast, and weak defenses won’t cut it.

Here’s what you need to know:

Zero-Day Download

Zero-Day in the Wild: Apple Rushes to Patch Safari Exploit

Apple has issued security updates across its platforms to fix a high-severity zero-day vulnerability (CVE-2025-6558) actively exploited in the wild.

Source: apple.com

The flaw, tied to improper input validation in browser GPU components, could allow attackers to escape the sandbox using malicious HTML. Apple confirmed the bug affects WebKit, the engine behind Safari, and could cause unexpected crashes when processing crafted web content.

If you’re an iOS, iPadOS, macOS, tvOS, watchOS, or visionOS user, update to the latest versions for protection.

Hackers Breach Linux Systems via SAP Flaw to Deploy Stealthy Auto-Color Malware

Hackers exploited a critical SAP NetWeaver vulnerability (CVE-2025-31324) to infiltrate a US chemicals company and deploy Auto-Color, a stealthy Linux backdoor with remote access capabilities.

The vulnerability, patched in April 2025, allowed unauthenticated file uploads and remote code execution. Over a three-day period, attackers downloaded suspicious files and connected to known Auto-Color command servers.

Be sure to apply security patches for SAP systems, monitor network traffic for unusual activity, and implement endpoint detection on Linux servers.

Google Rolls Out Device-Bound Sessions in Chrome to Thwart Cookie Theft Attacks

Google has launched an open beta for Device Bound Session Credentials (DBSC), a security feature that ties session cookies to the original device used for login, blocking attackers from hijacking accounts using stolen cookies.

Initially introduced in April 2024, DBSC is now available in Chrome on Windows. It enhances post-login protection by ensuring session integrity. Google also announced the general availability of passkeys to over 11 million Workspace users and introduced expanded admin controls.

Interested in trying out DBSC? Visit the Chrome for Developers blog for more information.

Share this newsletter!

Pulse Check

What triggers your patching process?

🧨 Active exploit: If it’s in the wild, I’m on it.

📊 Severity rating: CVSS 9+ gets attention.

📅 Whatever’s scheduled: I follow the maintenance calendar.

Yesterday's Pulse Check Results

Do you trust apps to securely store your personal photos?

Security Tools You Can Use

Keep your passwords and other sensitive credentials safe from prying eyes with Keeper Security’s zero-trust password manager.
Get started with DNS and DHCP rules quickly with this ready-to-use DNS and DHCP Usage Policy, designed to streamline your IT management efforts.

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Second Breach Spills 1.1M DMs from Tea App, Forces Messaging Shutdown

Dating app Tea has disabled its direct messaging feature following a second data breach that exposed over 1.1 million private messages, including highly sensitive conversations and shared phone numbers.

Source: apps.apple.com

This comes just days after a previous breach leaked 72,000 user images—selfies, photo IDs, and message attachments—which were reportedly circulated on 4chan. Despite Tea’s initial claim that only early users were affected, new evidence shows exposed data spans from early 2023 to the present.

The app has already been taken offline. However, users should monitor their other online accounts for suspicious behavior.

Hackers Target US Fermilab in Ongoing SharePoint Exploit Campaign

Fermilab, a key US Department of Energy research lab, was hit in a cyberattack exploiting a known vulnerability in Microsoft’s SharePoint software, Bloomberg reports.

The attack was part of a broader global espionage campaign, though officials say it was swiftly contained with no classified data compromised. The incident follows a wave of intrusions linked to an incomplete Microsoft patch released last month.

Fermilab’s systems have since been restored, but the event underscores ongoing risks tied to the unresolved SharePoint flaw that has also impacted other critical DOE infrastructure.

FROM OUR PARTNERS:

Black Hat USA attendees: Do you know your blindspots? Attackers do. And even the most secure environments have them. Join Marcus Hutchins—the cybersecurity legend who stopped WannaCry—for this high-stakes, hands-on, 90-minute cyber crisis simulation. Expose gaps. Shatter assumptions.

Request a seat at the table

Security Tip of the Day

How to Prevent Password Spraying Attacks

Password spraying is a low-effort, high-impact tactic: attackers try a few common passwords across tons of accounts. If you’re still using weak creds or relying on basic auth, you’re a target.

Source: owasp.org

Here are some defense tips to stop password spraying:

Turn on MFA: Stops most spray attacks cold.
Disable basic auth: Especially in Microsoft 365.
Enforce strong passwords: Long, unique, passphrase-style.
Monitor logins: Look for slow, repeated failures across many accounts

Don’t pray the spray misses you. Harden your creds, upgrade your defenses, and stop weak passwords from opening the front door.

Meet Our Writers:

Leon Yen

Leon Yen is a cybersecurity expert and seasoned tech journalist with over a decade of experience, including founding a cyber risk startup and leading industry-focused research and reporting.

Protect your team with premium policies, guides, and more

Cybersecurity Insider subscribers can now get 20% off an annual subscription to TechRepublic Premium and unlock unlimited access to hundreds of customizable policy templates, step-by-step checklists, and expert-written guides. Replace days of research and drafting with proven, plug-and-play resources that help your team harden defenses and stay audit-ready — fast. Use the code CSI20 at checkout.

Subscribe Now!

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.