At a glance.
- Thousands of Exchange servers remain vulnerable to high-severity flaw.
- WinRAR patches actively exploited zero-day.
- US extradites alleged ringleaders of major Ghanaian fraud organization.
Thousands of Exchange servers remain vulnerable to high-severity flaw.
BleepingComputer reports that, as of August 10th, more than 29,000 hybrid Microsoft Exchange servers remained vulnerable to a high-severity post-authentication vulnerability (CVE-2025-53786) that can allow threat actors to escalate privileges within compromised cloud environments.
The US Cybersecurity and Infrastructure Security Agency (CISA) last week ordered Federal civilian agencies to patch the flaw by 9:00 AM this morning. The agency stated, "Although exploitation of this vulnerability is only possible after an attacker establishes administrative access on the on-premises Exchange server, CISA is deeply concerned at the ease with which a threat actor could escalate privileges and gain significant control of a victim’s M365 Exchange Online environment."
WinRAR patches actively exploited zero-day.
WinRAR has received a patch for a vulnerability that was exploited as a zero-day by the Russia-aligned threat actor RomCom, SecurityWeek reports. Researchers at ESET discovered the flaw (CVE-2025-8088), which can allow an attacker to execute arbitrary code via maliciously crafted archive files. The attackers used spearphishing emails with phony job applications to target "financial, manufacturing, defense, and logistics companies in Europe and Canada."
RomCom is known for conducting cyberespionage alongside opportunistic criminal activity. ESET notes that this campaign "targeted sectors that align with the typical interests of Russian-aligned APT groups, suggesting a geopolitical motivation behind the operation."
US extradites alleged ringleaders of major Ghanaian fraud organization.
The US Justice Department has charged four Ghanaian nationals for their alleged roles in conducting romance scams and business email compromise (BEC) attacks that netted more than $100 million. Three of the defendants have been extradited to the US, while one remains at large. Two of the arrested individuals, Isaac Boateng and Inusah Ahmed, are considered chairmen of the criminal organization. The defendants face decades in prison if convicted.
