Put your shields up, Digital Defenders.

Today brings Magento stores falling to mass exploits, Russian malware chaining through fresh payloads, and Iranian phishers hijacking inboxes worldwide — just as the UN readies a cybercrime treaty stirring fears of surveillance.

Here’s what you need to know:

Zero-Day Download

Magento Sites Under Siege as Hackers Exploit Adobe Commerce Flaw

More than 250 Magento and Adobe Commerce stores were attacked within 24 hours of hackers beginning to exploit a critical vulnerability (CVE-2025-54236) known as SessionReaper. 

The flaw, rated 9.1 on the CVSS scale, allows attackers to hijack customer accounts through the Commerce REST API. 

Source: Rubaitul Azad/Unsplash

Although Adobe issued a patch last month, Sansec reports that about 62% of Magento stores remain unpatched, putting thousands of online retailers at risk of remote code execution and PHP webshell installation. 

Website admins should apply Adobe’s security patch right away and check endpoints for any suspicious or unauthorized file activity.

Microsoft’s Emergency Patch Revives Windows 11 Recovery Tools

A recent Microsoft security update accidentally broke one of Windows 11’s most critical features: recovery mode. 

The Oct.14 patch (KB5066835) disabled USB keyboards and mice within the Windows Recovery Environment (WinRE). This left millions unable to repair systems when issues arose.

Microsoft issued two emergency patches: KB5070773 and KB5070762 to replace corrupted USB stack components and restore functionality. 

Verify the installation of the Oct. 20 emergency updates and test WinRE access to confirm USB functionality before the next rollout.

Russian Hackers Unleash New “ROBOT” Malware Chain

Russian state-sponsored hackers have rapidly deployed a new malware series dubbed “ROBOT,” only days after their previous toolset, LOSTKEYS, was exposed. Google’s Threat Intelligence Group (GTIG) linked the campaign to COLDRIVER, also known as Star Blizzard. 

The new infection chain begins with a fake CAPTCHA lure that installs a malicious DLL called NOROBOT, which then downloads follow-up payloads, such as MAYBEROBOT — a stealthy PowerShell backdoor designed for persistence and data theft.

Security teams should monitor rundll32 and PowerShell activity for unusual behavior and block suspicious DLL downloads that imitate verification pages.

Share this newsletter!

Pulse Check

After experiencing a bad patch, how much do you trust future system updates?

Yesterday's Pulse Check Results

AI Threat Check: How ready is your team for AI-powered attacks? 

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

MuddyWater Exploits Compromised Mailboxes in Global Phishing Campaign

Researchers have uncovered a sophisticated phishing operation attributed to the Iran-linked group MuddyWater, which used hijacked email accounts to distribute malware worldwide. 

Source: Giphy

By sending malicious Microsoft Word attachments from trusted inboxes, the attackers lured victims into enabling macros that installed Phoenix v4 — a backdoor with persistence, registry tampering, and a credential stealer disguised as a calculator app.

Experts warn that the operation highlights how state-backed threat actors exploit trusted communication channels to bypass defenses.

Disable Office macros by default, monitor for abnormal registry changes, and educate users about phishing campaigns and emails.

UN Cybercrime Pact Spurs Debate Over Security and Surveillance

The United Nations is preparing to sign its first global cybercrime treaty in Hanoi, a deal meant to tighten cooperation against cyberattacks that cost the global economy trillions of dollars each year.

While hailed as a breakthrough, critics warn that the agreement’s vague language could empower authoritarian regimes to stifle dissent or prosecute ethical hackers under the guise of “cybercrime.” 

Tech firms like Meta and Microsoft have called it a potential “surveillance treaty,” and human rights groups question Vietnam’s role as host, given its record on online expression.

Security Tip of the Day

Don’t Delay — Patch Today

Cybercriminals are exploiting new vulnerabilities faster than ever — sometimes within hours of public disclosure. 

Delayed patching can lead to data theft, downtime, and costly breaches. Staying current with updates is one of the simplest, most effective defenses available.

Source: Clint Patterson/Unsplash

How to stay ahead of threat actors:

Attackers thrive on delay. Automating, prioritizing, and verifying your patch cycle helps keep your systems secure and your team ahead of the next zero-day.

Meet Our Writer:

Luis Millares

Senior Staff Writer at TechnologyAdvice

Luis Millares is a seasoned tech writer with broad experience reviewing consumer gadgets and enterprise software, offering clear, reliable insights across the latest in technology. 

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.