Scattered Spider Hits Insurers, Chrome Patches a Live Zero-Day, and NSO Pays Up

Vulnerabilities

Chrome Zero-Day (CVE-2025-4664) Exploited in the Wild, Patch Now

Google rushed out a fix for a Chrome loader flaw that lets attackers leak cross-origin data through policy bypass, and it's already being used in attacks. If you run Chromium anywhere in your stack, push the update today, don't wait for your normal patch cycle.

Play Ransomware Group Exploiting Windows CLFS Zero-Day

Play is chaining a Windows Common Log File System privilege escalation bug with their usual ransomware playbook, and it's not fully patched everywhere yet. Worth auditing who still has unpatched Windows Server boxes exposed, especially anything facing RDP.

Ivanti EPMM RCE Chain Actively Exploited

Another Ivanti product, another remote code execution chain getting used in the wild against enterprise mobile management deployments. Ivanti's track record means anyone running their stack should treat every CVE from them as urgent by default, not wait-and-see.

News

Scattered Spider Shifts Targets to Insurance Companies

The same crew behind the MGM and Caesars hits is now running help-desk social engineering plays against insurance firms, going after the identity providers first. This is a reminder that your help desk verification process is a bigger attack surface than most of your firewall rules.

FBI Warns End-of-Life Routers Are Being Hijacked for Proxy Networks

Old SOHO routers that stopped getting updates are getting roped into residential proxy botnets used to mask other attacks, which is a quiet but persistent problem most orgs never think about. If you've got legacy network gear anywhere in a remote office, it's time to actually audit the EOL list.

Legal

Court Orders NSO Group to Pay Meta Over $167M for WhatsApp Hacking

A US jury hit NSO with major damages for deploying Pegasus against WhatsApp users, which is a rare case of a spyware vendor actually facing financial consequences. Doesn't fix the exploit broker business model, but it sets precedent other platforms will cite.

Tools

Nuclei Templates Repo Adds Batch of New Detection Rules

ProjectDiscovery keeps shipping fresh scanning templates for the latest CVEs faster than most vendors ship advisories, which makes it one of the few genuinely useful free tools for continuous exposure checks. If you're not running nuclei in CI against your own perimeter, you're behind.