Samsung patches actively exploited Android zero-day.

Summary

By the CyberWire staff

Samsung patches actively exploited Android zero-day.

Samsung has issued a patch for an actively exploited remote code execution flaw affecting its Android devices, BleepingComputer reports. The vulnerability (CVE-2025-21043) was reported by Meta and WhatsApp last month, and involves an out-of-bounds write in an image parsing library.

It's unclear if the attacks targeted only WhatsApp users or if other apps using the same library are vulnerable. Samsung users are urged to update their devices promptly.

Think your certificate security is covered? 47-day renewals will raise the stakes.

By March 2026, TLS certificate lifespans will be cut in half, meaning double today’s renewals. In 2029, certificates will expire every 47 days, demanding 8–12x the renewal volume. That’s exponential complexity, operational workload, and risk...unless you modernize your strategy. CyberArk — proven in identity security — is your partner in certificate security. We simplify lifecycle management with visibility, automation, and control at scale. Scan for vulnerabilities. Streamline operations. Scale security. Master the 47-day shift with CyberArk.

Phishing campaigns abuse AutoHotkey to deliver malware.

Researchers at Doppel warn of an increase in phishing campaigns abusing the Windows-based scripting language AutoHotkey (AHK) to deliver malware. The researchers note, "While it’s long been popular among power users and system admins for its simplicity and flexibility, threat actors began weaponizing AHK around 2019 to create lightweight malware droppers and info-stealers. These malicious scripts often masquerade as benign automation tools or support utilities."

In this case, the attackers "use a combination of fake support portals, Cloudflare CAPTCHA error pages, and clipboard hijacking to socially engineer victims into running malicious PowerShell code."

DMV Rising, D.C.’s Premier Conference for Cyber Execs.

The Washington, D.C. Maryland, and Virginia (DMV) region has established itself as a top-tier player in the global cyber industry. Join us on September 18, 2025 to celebrate the remarkable accomplishments of the DMV's cybersecurity community, connect with the brilliant minds shaping the future of the field, and experience firsthand why the DMV region is the beating heart of cyber innovation. Register now to secure your spot.

France warns of spyware campaign targeting Apple users.

France's Computer Emergency Response Team (CERT-FR) issued an advisory yesterday regarding a spyware campaign targeting Apple users, Infosecurity Magazine reports. The advisory says Apple notified targeted users last week informing them that "at least one of the devices linked to [their] iCloud account has been targeted and is potentially compromised." Affected users will receive the alert via an email from Apple and as a notification in their iCloud account.

CERT-FR hasn't provided details on the campaign, but notes that popular spyware tools are often abused to target "journalists, lawyers, activists, politicians, senior officials, members of management committees in strategic sectors, etc."

Notes.

Today's issue includes events affecting , and France the United States.

Attacks, Threats, and Vulnerabilities

Children hacking their own schools for 'fun', watchdog warns (BBC) The Information Commissioner's Office says schools face an "insider threat" from children as young as seven.

Microsoft fixes Exchange Online outage affecting users worldwide (BleepingComputer) Microsoft says that it has mitigated an Exchange Online outage affecting customers worldwide, which blocked their access to emails and calendars.

Marketplace

Halcyon Appoints Veteran Security Leader Tony Spinelli as Field CISO, Strengthening Enterprise Resilience Against Ransomware (Cision PR Newswire) /PRNewswire/ -- Halcyon, the leading anti-ransomware solution provider, today announced the appointment of Tony Spinelli as Vice President, Field Chief...

Legislation, Policy, and Regulation

California legislature passes bill forcing web browsers to let consumers automatically opt out of data sharing (The Record) Gov. Gavin Newsom vetoed an earlier version of the bill that also would have applied to mobile operating systems.

FTC to AI Companies: Tell Us How You Protect Teens and Kids Who Use AI Companions (CNET) As more teens turn to AI for companionship, the investigation comes as no surprise.

Litigation, Investigation, and Law Enforcement

Hacker convicted of extorting 20,000 psychotherapy victims walks free during appeal (The Record) A Finnish judge set free Aleksanteri "Julius" Kivimäki, convicted of extorting victims of the Vastaamo psychotherapy center's data breach, as his appeal in the case continues.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

TRUSTECH 2025 (Paris, France, Dec 2 - 4, 2025) This international event is the go-to place for all things payments, digital identity, cybersecurity, and fintech. With over 200 exhibitors, 100+ speakers, innovation awards, networking opportunities, and exclusive content, it’s the perfect place to discover what’s next in trusted technologies.

SpaceCom | Space Congress: The Global Conference & Expo for the Commercial Space Industry (Orlando, Florida, USA, Jan 28 - 30, 2026) SpaceCom | Space Congress is where the business of space gets done. As the flagship event of Commercial Space Week—co-located with the Space Mobility Conference and the GSA Spaceport Summit—this event unites aerospace, defense, and commercial leaders for three days of deal-making, partnership building, and technology discovery on the expo floor, in the conference program, and through curated networking that drives real results.

RSAC 2026 (San Francisco, California, USA, Mar 23 - 26, 2026) Ideas become breakthroughs when shared. Challenges become opportunities when tackled together. That’s the Power of Community—a key focus for RSAC™ 2026 Conference. Real change happens when cybersecurity professionals unite.

Space Symposium 2026 (Colorado Springs, Colorado, USA, Apr 13 - 16, 2026) Space Symposium is the premier event uniting global space professionals from all sectors, providing a unique platform to explore critical space issues, foster dialogue, and drive innovation across the space industry.

ASCEND 2026 (Washington, DC, USA, May 19 - 21, 2026) ASCEND connects the civil, commercial, and national security space sectors, along with adjacent industries, to embrace the opportunities and address the challenges that come with increased activity in space. Building our sustainable off-world future requires long-term thinking. Strategic planning, innovation, scientific exploration, and effective regulations and standards will help us preserve space for future generations. ASCEND will enable the technical exchanges, debates, and collaboration that will help forge a sustainable off-world future for all.

Events

DMV Rising '25 (Washington, DC, USA, Sep 18, 2025) Join us on September 18, 2025 to celebrate the remarkable accomplishments of the DMV's cybersecurity community, connect with the brilliant minds shaping the future of the field, and experience firsthand why the DMV region is the beating heart of cyber innovation. Register now to secure your spot.

HackAICon 2025 (Lisbon, Portugal, Sep 25, 2025) The first conference dedicated to combining AI and Ethical Hacking. We're bringing together OffSec pros, hackers, and leading researchers to find practical ways of using AI to secure the internet. Learn about the latest AI Hacking cosmic trends and connect with fellow professionals in engaging conversations. We banned sales pitches from the event - just knowledge sharing, leadership and technical insights.

Open Source Security Summit 2025 (Virtual, Sep 25, 2025) The sixth annual Open Source Security Summit brings together business leaders, industry visionaries, and technology users to chart a path forward and highlight the future of open source security solutions at this free virtual event. Register now to explore advancements in open source security and how using open source tools can build trust with customers and consumers.

Don’t miss Jen Easterly, former CISA Director, headlining HIP Conf 25 (Charleston, SC, USA, Oct 7 - 9, 2025) Jen Easterly, former CISA Director, keynotes HIP Conf 2025. A globally recognized cybersecurity leader, Easterly brings unmatched insight into hybrid identity security and resilience. Register now for this must-attend event.

Uniting Women in Cyber 2025 (Crystal City, Virginia, USA, Oct 9, 2025) UWIC is the premier event for cybersecurity leaders, professionals, and aspiring practitioners. Connect with a vibrant community focused on emerging global trends, technological advancements, and workforce development. Attend UWIC 2025 to learn, share ideas, and expand your professional network!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry's largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust N2K CyberWire to get the message out. Learn more.

Daily Briefing for 09.12.25

Top stories.

Samsung patches actively exploited Android zero-day.

Phishing campaigns abuse AutoHotkey to deliver malware.

France warns of spyware campaign targeting Apple users.

Notes.

Attacks, Threats, and Vulnerabilities

Marketplace

Legislation, Policy, and Regulation

Litigation, Investigation, and Law Enforcement

Newly Noted Events

Events