Top stories.
- Patch Tuesday notes.
- Spiderman phishing kit impersonates European banks.
- Houston man charged for smuggling Nvidia chips to China.
Patch Tuesday notes.
Microsoft yesterday issued patches for 57 vulnerabilities, including three zero-days, SecurityWeek reports. One of the zero-days (CVE-2025-62221) is under active exploitation, while the other two were publicly disclosed before patches were released. The exploited zero-day is a use-after-free flaw in the Windows Cloud Files Mini Filter Driver, which has been assigned a CVSS score of 7.8.
Adobe issued fixes for nearly 140 vulnerabilities, most of which are cross-site scripting bugs affecting Experience Manager.
Fortinet fixed two critical authentication bypass flaws affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager.
Ivanti patched a critical vulnerability (CVE-2025-10573) in Ivanti Endpoint Manager that can allow a remote unauthenticated attacker to execute arbitrary JavaScript.
SAP addressed three critical flaws, including a code injection vulnerability (CVE-2025-42880) in Solution Manager with a CVSS score of 9.9.
SecurityWeek also has a roundup of patches released by ICS vendors, including Siemens, Rockwell Automation, Schneider Electric, and Phoenix Contact.
Spiderman phishing kit impersonates European banks.
Varonis has published a report on a new phishing kit called "Spiderman" that targets customers of European banks. The kit impersonates dozens of banks across Germany, Austria, Switzerland, Belgium, and Spain. The researchers explain, "While single-bank phishing kits are widely available for purchase, Spiderman consolidates multiple European financial brands into one kit for cross-country targeting at scale. It includes modules for banks such as Deutsche Bank, Commerzbank, ING (Germany & Belgium), CaixaBank, and several crypto wallet providers."
Houston man charged with smuggling Nvidia chips to China.
The US Justice Department says a Houston business owner, Alan Hao Hsu, attempted to smuggle $160 million worth of export-controlled Nvidia H100 and H200 Tensor Core GPUs to China. Justice stated, "Hsu and others falsified shipping paperwork, misclassifying the true nature of the goods and their recipients to conceal the ultimate destination of the GPUs. Hsu and Hao Global received more than $50 million in wire transfers that originated from the People’s Republic of China (PRC) to help fund the scheme. The GPUs were ultimately shipped to the PRC, Hong Kong, and other destinations in violation of U.S. export laws."
Hsu and his company, Hao Global LLC, both pleaded guilty to smuggling and unlawful export activities in October 2025. The Justice Department also charged two PRC nationals as part of the scheme, one of whom is the CEO of an IT services company based in Sterling, Virginia.