Nov 14, 2025 - This weekly report reviews recent high-profile breaches, emerging attack patterns, notable CVEs and exploits, and the top risks facing organizations. Practical recommendations are provided to strengthen defenses and improve resilience.

Current cyber security incidents


Over the past week, several large-scale breaches have come to light, highlighting persistent risks across sectors. A leading healthcare provider disclosed unauthorized access to patient records due to a compromised third-party vendor. Meanwhile, the ongoing impact of the MOVEit file transfer vulnerability continues to surface, with multiple regional governments confirming data exfiltration. Financial institutions have also reported an uptick in credential stuffing attacks, resulting in unauthorized logins and significant remediation costs.

In parallel, the automotive industry experienced a ransomware attack against a parts supplier, leading to production halts and supply chain disruptions. The victim company indicated that threat actors exploited exposed remote desktop services to deploy malware. In another incident, a global technology firm detected a sophisticated phishing campaign leveraging deepfake audio to dupe executives into authorizing fraudulent wire transfers, underscoring the evolution of social engineering tactics.

Current attack methods and trends


Adversaries are increasingly adopting multi-vector strategies that combine phishing, malware deployment, and zero-day exploitation. The use of credential stuffing remains prevalent, driven by the availability of large credential dumps on underground forums. Attackers automate login attempts against weakly protected accounts, then pivot within networks to escalate privileges. Additionally, corporate environments are under constant threat from supply-chain attacks, where software updates or third-party integrations serve as invasion channels for malware.

Ransomware operators continue to refine double-extortion techniques, exfiltrating sensitive data before encrypting systems and threatening public leaks. Notably, several ransomware groups are now offering managed extortion services to affiliates, streamlining attack orchestration. Attackers also exploit overlooked Internet-exposed services, such as legacy VPN gateways and unsecured databases, underscoring the need for robust exposure management and continuous monitoring.

Important CVEs and exploits (selection)


CVE-2024-26095 (F5 BIG-IP TMUI RCE) remains a critical issue following reports of active exploitation targeting unpatched devices. Successful attacks can yield full system compromise and facilitate lateral movement. Entities using BIG-IP appliances should apply vendor patches immediately.

CVE-2024-28205, a remote code execution flaw in a widely installed WordPress plugin, has been weaponized in automated scanning campaigns. Thousands of sites have been compromised to deliver cryptominers and web shells. Site administrators must update plugin versions or disable them if patches are unavailable.

In June, CVE-2024-36751 surfaced as a zero-day in Google Chrome, allowing attackers to bypass sandbox restrictions via a crafted JavaScript payload. Exploits were observed during targeted phishing attempts. Chrome users are urged to upgrade to the latest browser release without delay.

Greatest risks for companies


The most pressing risk remains inadequate patch management. Unpatched software provides a low-effort entry point for sophisticated adversaries. Organizations struggling with legacy systems and complex IT portfolios face heightened exposure. Another key concern is the human element: social engineering and business email compromise schemes are both more convincing and more frequent, making rigorous training and verification processes essential.

Supply-chain vulnerabilities pose systemic threats, as a compromise in one organization can cascade through interconnected networks. Companies relying on third-party services must enforce stringent security requirements and maintain visibility into vendor security postures. Finally, the acceleration of hybrid work models expands the attack surface, increasing the demand for secure remote access and zero-trust architectures.

Recommendations


Organizations should prioritize a risk-based patch management program that addresses high-severity vulnerabilities within days of vendor release. Implementing continuous asset discovery and vulnerability scanning will help identify exposures early. To counter evolving phishing and social engineering schemes, regular, scenario-driven simulations are vital, coupled with clear escalation protocols for suspected compromises. Supply-chain security can be strengthened through contractual security clauses, periodic audits of critical vendors, and adoption of software bill of materials (SBOM) standards. Finally, embracing a zero-trust framework—enforcing least-privilege access, micro-segmentation, and multi-factor authentication—will significantly reduce the impact of any single breach.