NVIDIA has released a critical DGX Spark firmware update addressing 14 vulnerabilities - including CVE-2025-33187 (CVSS 9.3), which enables malicious code execution and access to protected SoC regions.

Firmware flaws in AI workstations can impact model integrity, training data, and system stability.

Organizations using DGX Spark should patch immediately.

Source: https://cybersecuritynews.com/nvidia-dgx-spark-vulnerabilities/#google_vignette

What’s your view on firmware security in AI-focused hardware?
Follow us for more analysis.

#infosec #NVIDIA #DGXSpark #CVE #AIsecurity #firmwaresecurity #patchnow #securityupdate

🚨CVE-2021-26829: OpenPLC ScadaBR Cross-site Scripting Vulnerability

Vendor: OpenPLC
Product: ScadaBR
CWE: CWE-79
CVSS: 5.4

This vulnerability has been added to the CISA KEV Catalog.

https://darkwebinformer.com/cisa-kev-catalog/

#ActuLibre Une faille dans Symfony permet de contourner les règles d'accès - CVE-2025-64500, à lire sur https://security-sensei.fr/posts/20251117-faille-symfony-contournement-regles-acces/ #sécurité #web

Akira’s SonicWall Exploits Are Disrupting Large Enterprises
Source: https://www.databreachtoday.com/akiras-sonicwall-hacks-are-taking-down-large-enterprises-a-30145
The Akira ransomware group has found a path into large corporate networks by compromising SonicWall SSL VPN devices—hardware typically marketed to small- and medium-sized businesses. Once those firms are acquired by larger enterprises, these devices become high-value entry points for attackers.
Akira began exploiting CVE-2024-40766 between September and December 2024. The flaw was also leveraged by the Fog ransomware group during the same period.
A renewed wave of Akira activity surfaced this past summer, running from late July through at least September. According to Arctic Wolf, the volume and diversity of victims indicate opportunistic mass exploitation, rather than targeted attacks, with impacted organizations spanning multiple industries.

⚠️ HIGH severity: CVE-2025-58308 in Huawei HarmonyOS (5.0.1, 5.1.0, 6.0.0) exposes call module to local exploitation—no patch available. Abnormal feature behavior could lead to data leaks or DoS. Restrict access & monitor! https://radar.offseq.com/threat/cve-2025-58308-cwe-358-improperly-implemented-secu-281d6016 #OffSeq #Huawei #Vuln #SecOps

Popular Forge Library Receives Fix for Signature Verification Bypass Flaw
Source: https://www.bleepingcomputer.com/news/security/popular-forge-library-gets-fix-for-signature-verification-bypass-flaw/
A high-severity vulnerability in the node-forge package, a widely used JavaScript cryptography library, has been patched after researchers discovered a method to bypass digital signature verification.
Tracked as CVE-2025-12816, the flaw stems from weaknesses in the library’s ASN.1 validation logic. The issue allowed specially crafted, malformed data to pass signature checks despite being cryptographically invalid.
According to an advisory from Carnegie Mellon CERT-CC, the risk varies by implementation but may include:
Authentication bypass
Tampering with signed data
Misuse or manipulation of certificate-related functionality
CERT-CC noted that environments relying heavily on cryptographic verification could face particularly serious consequences.
The potential impact is amplified by the library’s widespread adoption, with nearly 26 million weekly downloads on the NPM registry.