No calm skies today, Digital Defenders. |
Car buyers. Travelers. Office workers. Anyone online. The recent wave of attacks proves the blast radius is widening. |
|
| Here’s what you need to know: |
|
|
18M Records Stolen in Stellantis Supply Chain Hack |
Stellantis, maker of Jeep, FIAT, and Citroën, confirmed a breach exposing North American customer contact data via a Salesforce-linked third-party.
ShinyHunters claimed that 18 million records were taken via stolen OAuth tokens, highlighting how supply chain attacks can impact even major automakers—increasing phishing risks against Stellantis customers. Stellantis is still investigating the attack. |
This attack shows that organizations must audit vendors, revoke unused OAuth tokens, and enforce MFA across SaaS to reduce risk. |
Google Rushes Patch for High-Severity Chrome Bugs |
Google released an urgent Chrome update patching three flaws that could let attackers steal data or crash browsers via malicious sites.
CVE-2025-10890 leaks data via side channels. Meanwhile, CVE-2025-10891 and CVE-2025-10892 are integer overflows enabling DoS or possible code execution. Google warns they pose real-world risk to organizations. There are no reports of exploitation in the wild yet.
Update Chrome, enforce isolation, enable exploit protection, restrict extensions, monitor logs, and leverage threat intel to spot emerging exploit chains. |
Proofpoint Arms Enterprises Against AI Agent Exploits |
Proofpoint unveiled four tools to secure AI assistants, govern agents, and protect data from threats exploiting AI workflows and unsanctioned tools.
Proofpoint added AI exploit detection, unified DLP/DSPM, a Secure Agent Gateway, and Satori automation agents—making it one of the first to tackle “agentic workspace” risks at scale. The new tools will be available over the next few months.
As AI tool adoption increases across organizations, it’s important to map where AI tools are already in use—sanctioned or not—and enforce policy controls to govern data flows before adoption scales beyond visibility. |
|
|
If attackers exfiltrated sensitive files from your enterprise today, how good are your defenses? |
|
|
Yesterday's Pulse Check Results |
What’s your biggest concern with open source? |
|
|
Security Tools You Can Use |
-
NordLayer helps secure your workforce with a compliance-ready VPN that simplifies remote access and delivers enterprise-grade protection.
-
You can build a strong security foundation by combining MDM, encryption, antivirus, and backup tools in one comprehensive suite.
-
Sticky Password Premium lets you lock down your digital life with a lifetime password manager and dark web monitoring—now 87% off for a limited time.
|
|
|
Critical Salesforce Installer Bug Enables Host Takeover |
A vulnerability in the Salesforce CLI installer (CVE-2025-9844) lets attackers hijack file paths to run malicious code and gain SYSTEM privileges on Windows versions before 2.106.6.
Salesforce says the flaw stems from loading executables before integrity checks, letting crafted files escalate privileges. |
While limited to installs from untrusted mirrors, the risk is severe—full host takeover via registry edits, rogue services, and reverse shells. Salesforce has released a patch. Upgrade to the latest patch, remove unverified builds, enforce trusted sources, and use MDAC to block unsigned executables for added protection. |
Airport Chaos as Ransomware Halts Passenger Check-In |
A ransomware attack against Collins Aerospace’s Muse platform forced airports across Europe, including Heathrow, Brussels, and Berlin, to switch to manual check-in. The issue caused widespread delays and cancellations.
Linked to HardBit ransomware, the attack encrypted Domain Controllers, crippling kiosks, gates, and baggage systems. ENISA and NCSC warn ransomware groups are escalating assaults on aviation, where downtime threatens safety and economies.
Collins Aerospace continues its recovery efforts and UK authorities have arrested a suspect in the case. To reduce risk from similar attacks, deploy phishing-resistant defenses, enforce least privilege, monitor for registry or GPO anomalies, and segment IT and ICS networks. |
|
|
What’s Lurking Behind That Click? |
From malicious ads to drive-by downloads, unsafe browsing remains a leading cause of data breaches and malware infections. Attackers continually refine tactics, making strong web hygiene and layered defenses essential for both end users and enterprises. |
Here's how you can stay protected: |
-
Use HTTPS and Browser Isolation: Encrypt traffic and sandbox risky sites to stop threats at the source.
- Block Malicious Ads and Scripts: Cut off attacks by limiting unauthorized code execution.
- Update and Harden Browsers: Apply patches quickly and restrict extensions to reduce exploitable gaps.
-
Stay Phishing-Aware: Train users to spot suspicious links and fake domains.
- Use a Trusted VPN: Encrypt browsing traffic on public or insecure networks to protect data from interception.
|
Smart browsing habits protect both users and enterprises. Pairing strong controls with daily vigilance helps reduce your overall risk. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
