Live Zero-Days, Precedent-Setting Spyware Damages, and Sector-Specific Social Engineering

News

Google Patches Third Actively Exploited Chrome Zero-Day This Month (CVE-2025-4664)

Chrome's already patched another actively exploited zero-day, making it the third this month. If you aren't automating patch deployment for your fleet, you're falling behind.

Play Ransomware Gang Exploits Windows Zero-Day in Active Campaign

Play ransomware is weaponizing a Windows zero-day to bypass security. This is a live example of how fast threat actors move from technical bug to business risk.

NSO Group Ordered to Pay Meta $167M in WhatsApp Hacking Case

A federal court has finally ordered NSO Group to pay significant damages for the WhatsApp exploit. This sets a major legal precedent, putting commercial spyware vendors on notice about their liability.

Hackers Target U.S. Insurance Companies in Fresh Scattered Spider Attacks

Scattered Spider is aggressively targeting US insurance firms, using social engineering to bypass security controls. This underscores that for high-value data like PII, your weakest link is your people, not just your code.

Ivanti Patches Critical RCE Vulnerability in Endpoint Manager Mobile

Ivanti just patched a critical RCE bug in Endpoint Manager Mobile. If you're running this, patching needs to be today's top priority; these are high-value targets for initial access brokers.

Tools

ProjectDiscovery Merges New Nuclei Templates for Latest Vulns

New vulnerability detection templates have been added to the Nuclei project. This is exactly what you want in your continuous security pipeline to catch critical flaws in web apps automatically.