At a glance.
- Patch Tuesday notes.
- Iranian ransomware gang offers bonuses for hitting US and Israeli targets.
- Threat actor targets diplomats with Marco Rubio deepfakes.
Patch Tuesday notes.
Microsoft yesterday issued fixes for 130 flaws, including ten with a severity score of "Critical." The most serious of these is an RCE vulnerability affecting the SPNEGO Extended Negotiation (NEGOEX) Security Mechanism (CVE-2025-47981). The company also fixed four critical RCE flaws affecting Office (CVE-2025-49695, CVE-2025-49696, CVE-2025-49697, CVE-2025-49702). The Register notes that this is Microsoft's first Patch Tuesday of 2025 with no actively exploited flaws.
Adobe has released patches for 58 vulnerabilities across multiple products, including three critical flaws affecting Adobe Connect, ColdFusion, and Adobe Experience Manager (AEM) Forms on JEE, SecurityWeek reports. Adobe urges users to prioritize patching the AEM Forms flaw (CVE-2025-49533), which has been assigned a CVSS score of 9.8 and can lead to arbitrary code execution.
SAP has issued new or updated security notes for 31 vulnerabilities, including five critical flaws. Notably, CVE-2025-30012 was upgraded to a severity score of 10 after it was found that unauthenticated attackers could exploit the flaw to execute arbitrary commands with administrative privileges.
Iranian ransomware gang offers bonuses for hitting US and Israeli targets.
The Iranian ransomware-as-a-service operation Pay2Key.I2P is offering 10% bonuses to affiliates who target US and Israeli entities, according to researchers at Morphisec. Affiliates will receive an 80% profit share (up from 70%) for targeting countries opposed to Iran. The researchers note that Pay2Key has links to the Tehran-sponsored cyberespionage group Fox Kitten and is closely tied to the Mimic ransomware operation. Pay2Key has collected over $4 million in ransom payments since the group surfaced in February 2025.
Threat actor targets diplomats with Marco Rubio deepfakes.
An unknown individual used voice deepfakes to impersonate US Secretary of State Marco Rubio in social engineering attacks targeting "at least five non-Department individuals, including three foreign ministers, a U.S. governor, and a U.S. member of Congress," according to a State Department cable obtained by the Washington Post. The threat actor was likely attempting to gain access to sensitive information or accounts.
SecurityWeek cites a US official as saying the social engineering attempts were "not very sophisticated," but the State Department is warning diplomats to be on the lookout for similar tactics.
