The week’s headlines hit where it hurts, Digital Defenders. |
From Chrome’s zero-day to a revived cybercrime forum and poisoned DNS caches, attackers are aiming at the internet’s foundation. A few missed patches — or the wrong plugin — could open the door wide. Ready to see what’s under attack this week? |
|
|
Here’s what you need to know: |
|
|
New Dell Bugs Open Enterprise Data to Attack |
Multiple flaws in Dell Storage Manager (DSM) allow remote attackers to bypass authentication and seize control of enterprise storage systems.
Affecting DSM versions up to 20.1.21, the critical CVE-2025-43995 enables unauthenticated remote compromise via exposed APIs, while CVE-2025-43994 and CVE-2025-46425 risk data leaks and unauthorized access.
|
Dell has not yet reported any exploitation in the wild.
Update to version 2020 R1.22 or later, restrict DSM access, enable MFA, and maintain continuous monitoring and segmentation to minimize exposure. |
Chrome Zero-Day Fuels ForumTroll Spy Campaign |
A Chrome zero-day vulnerability has been exploited by the group Mem3nt0 Mori in espionage attacks against organizations in Russia and Belarus.
CVE-2025-2783, affecting Chrome versions before 134.0.6998.177, lets attackers bypass sandboxing and deliver spyware. This is an ongoing attack. Ensure Chrome is patched to the latest version, deploy browser isolation, and monitor for suspicious network traffic — especially to Fastly[.]net domains — to detect potential compromise. |
Poisoned DNS: BIND 9 Vulnerability Exposes Thousands |
A newly disclosed vulnerability in BIND 9 could let attackers poison DNS caches and redirect users to malicious sites.
Affecting thousands of instances worldwide, CVE-2025-40778 lets attackers inject forged DNS data remotely due to BIND’s lax handling of unsolicited records.
A proof-of-concept (PoC) has been published on GitHub, but Censys researchers reported that no known exploitation has occurred in the wild. Patch to BIND versions 9.18.41, 9.20.15, or 9.21.14 immediately, restrict recursion to trusted networks, and enable DNSSEC validation to authenticate responses and prevent cache manipulation. |
|
|
How confident are you in your org’s DNS defenses? |
|
|
Yesterday's Pulse Check Results |
Would you spot a malware trap hidden in a “free” YouTube download? |
|
|
Security Tools You Can Use |
|
|
Mass WordPress Attacks Exploit Plugin Flaws |
Threat actors are actively exploiting critical flaws in the GutenKit and Hunk Companion WordPress plugins, compromising thousands of sites globally.
The vulnerabilities allow unauthenticated attackers to install malicious plugins via the REST API. Wordfence Firewall has blocked over 8.7 million attacks in the past year. |
Source: Deng Xiang/Unsplash
|
The attacks are deploying obfuscated backdoors and webshells disguised as legitimate plugins. This is an ongoing attack in the wild. Update GutenKit to version 2.1.1 and Hunk Companion to 1.9.0, review plugin directories for unauthorized files, and restrict REST API access to authenticated users only. |
BreachForums Reemerges Online After FBI Takedown |
The infamous cybercrime hub BreachForums has reappeared online — this time on a clearnet domain accessible without Tor.
Announced on Oct. 20, 2025, by moderator “koko,” the forum’s relaunch promises rebuilt infrastructure, a new escrow system, and a safe community. Its return, however, renews the ongoing battle between law enforcement and cybercriminals.
As the successor to RaidForums, BreachForums has long traded in stolen data and exploits tied to groups like ShinyHunters. While some users cheer its revival, others suspect it’s a law enforcement honeypot.
Security teams should strengthen dark web monitoring, track leaked corporate credentials, and enforce MFA and credential hygiene policies to limit exposure from data dumps. |
|
|
Iru is the AI-native security & IT platform used by the world’s fastest-growing companies to secure their users, apps, and devices. Built for the AI era, Iru unifies identity & access, endpoint security & management, and compliance automation—collapsing the stack and giving IT & Security time and control back. |
|
|
When’s the Last Time You Checked Your DNS Defenses? |
DNS is the backbone of internet communication — and one of the most exploited attack surfaces. Attackers exploit DNS flaws — from cache poisoning to domain hijacking—to redirect users and breach networks. Strengthening DNS security is vital as new exploits increasingly target exposed or misconfigured resolvers. |
How to lock down your DNS defenses: |
-
Harden DNS infrastructure: Enable DNSSEC, restrict recursion to trusted networks, and apply regular patches to eliminate exploitable weaknesses.
- Secure DNS communications: Use encrypted protocols like DoH or DoT to prevent interception, tampering, and data exposure during DNS resolution.
-
Enhance visibility and control: Monitor DNS traffic for anomalies and implement split-horizon configurations to protect internal network details.
|
Proactive DNS security hardens a core network service — validating queries, encrypting traffic, and limiting access to protect against redirection attacks and build cyber resilience. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
