Heads up, Digital Defenders.

Zero-days abound, and Microsoft’s paying $5 million to the next person who finds the next big one. Google and Adobe rushed out patches for active exploits, TikTok Shop users are being lured into malware traps via fake influencer ads, and Pandora joins the growing list of Salesforce breach victims.

Patch fast, get in the know, and stay ahead.

Here’s what you need to know:

Zero-Day Download

Microsoft Launches Largest Hacking Challenge in History With $5M Bounty for Zero Day Quest 2026

Microsoft is ramping up its cybersecurity push with Zero Day Quest 2026, offering up to $5 million in rewards for researchers who uncover critical vulnerabilities across Azure, Copilot, Dynamics 365, M365, and more.

Source: linkedin.com/showcase/microsoft-security-response-center

Qualifying findings could earn a 50% bounty bonus, with top contributors gaining access to training from Microsoft’s AI Red Team and security experts. The initiative is part of Microsoft’s Secure Future Initiative, emphasizing transparency and secure-by-design principles.

Security researchers eyeing the top rewards should act fast: submit high-impact findings early, focus on critical severity bugs, and prepare to demonstrate real-world exploitation potential.

Google Patch Targets Active Android Exploits in Qualcomm GPUs

Google's August 2025 Android security update fixes multiple high-impact vulnerabilities, including two Qualcomm GPU bugs—CVE-2025-21479 and CVE-2025-27038—actively exploited in the wild.

Both flaws have been tied to memory corruption risks in the Graphics component and have been flagged for limited, targeted abuse, likely by commercial spyware vendors.

The update, now part of CISA's KEV catalog, also addresses critical privilege escalation and remote code execution flaws across the Android Framework and System components.

Users are urged to install the latest patches to guard against ongoing threats.

Adobe Rushes Emergency Fixes for Critical AEM Forms Zero-Days Enabling Remote Code Execution

Adobe has issued urgent patches for two critical zero-day vulnerabilities in Adobe Experience Manager (AEM) Forms on JEE—CVE-2025-54253 and CVE-2025-54254—after researchers published a proof-of-concept exploit chain enabling unauthenticated remote code execution.

One flaw stems from a misconfigured developer setting in the /adminui module, while the other is a severe XML External Entity (XXE) bug that exposes local files. The flaws remained unpatched for over 90 days, prompting public disclosure.

Admins are strongly urged to apply the latest updates immediately to prevent exploitation in the wild.

Share this newsletter!

Pulse Check

Which app is the biggest privacy dumpster fire?

Yesterday's Pulse Check Results

Could your organization detect malicious activity over messaging apps?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Pandora Hit by Salesforce Data Theft, Customer Info Exposed in Ongoing Extortion Campaign

Global jewelry brand Pandora has confirmed a data breach after threat actors stole customer information from its Salesforce database as part of a broader wave of social engineering attacks.

Source: wikipedia.org

The breach exposed names, birthdates, and email addresses—but not passwords or financial data. Hackers reportedly gained access by tricking employees into approving malicious OAuth apps or leaking credentials, a tactic linked to the group ShinyHunters, which is now privately extorting affected companies. 

Companies are urged to harden Salesforce access and follow security best practices to prevent further compromise, while impacted users are advised to monitor their online accounts and credit reports closely.

Massive Malware Scam Mimics TikTok Shop to Hijack Users Worldwide

Cybersecurity firm CTM360 has issued a warning about a global campaign dubbed FraudOnTok targeting TikTok Shop users with a blend of phishing and malware.

Threat actors are deploying over 15,000 fake domains that mimic TikTok’s platform, tricking users via AI-generated influencer videos and Meta ads into downloading trojanized apps or handing over credentials. The bogus sites distribute SparkKitty malware capable of stealing data from both Android and iOS devices, and even push fake crypto storefronts to drain user funds.

To stay safe, avoid clicking on suspicious ads, verify URLs carefully, and only download apps directly from official app stores.

Security Tip of the Day

Don’t Let Zero-day Threats Catch You Off Guard

Zero-day attacks are a hacker’s ultimate wild card for exploiting brand-new vulnerabilities before developers even know they exist, leaving organizations vulnerable and giving attackers the critical advantage of surprise and exclusive knowledge.

Source: freepik.com

By definition, zero-days are unknown threats, making them hard for traditional antivirus and firewalls to detect, and giving attackers a dangerous edge. But that doesn’t mean you’re defenseless; with the right precautions, you can significantly reduce the risk of a zero-day turning into a full-blown security breach.

Tips to defend against zero-day attacks:

Remember: Even when patches finally arrive, the race isn’t over; attackers continue to exploit gaps in unpatched or outdated systems. Staying ahead of a rapidly evolving, invisible enemy demands constant vigilance and proactive, multi-layered defenses—especially when fixes aren’t yet available.

Meet Our Writer:

Leon Yen

Leon Yen is a cybersecurity expert and seasoned tech journalist with over a decade of experience, including founding a cyber risk startup and leading industry-focused research and reporting.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.