Red Hot Cyber
Cybersecurity is about sharing. Recognize the risk, combat it, share your experiences, and encourage others to do better than you.
Search
Fortinet 320x100px
Banner Ransomfeed 970x120 1

Author: Redazione RHC

Zorin OS 18: The new beta version is now available

Zorin OS has released a beta version of its new release, Zorin OS 18. Currently, only the GNOME-based Core edition is available , without the proprietary library. According to Artem Zorin, a lightweight Xfce-based Lite version will arrive later, after the stable release. The system is based on Ubuntu 24.04 Noble Numbat , released almost a year and a half ago. However, the developers adhere to the ” release when it’s ready ” principle, rather than relying on a calendar. The previous version, 17.3, remains current and stable, although some users have been forced to downgrade from Noble to Jammy due to

Forget brains and notebooks! ChatGPT dominates classrooms.

ChatGPT usage has skyrocketed with the start of the new school year in the West, with token generation hitting record levels. According to OpenRouter , the popular chatbot OpenAI processed 78.3 billion tokens on September 18, the highest level since the summer crash. In June 2025, when most schools were on holiday, average daily usage dropped to 36.7 billion tokens. By comparison, in May 2025, when exams and finals were held, the average was close to 80 billion per day. OpenRouter statistics, which track the activity of 2.5 million users, show how patterns vary dramatically depending on the academic calendar. Although the

A US agency was hacked due to an unresolved patch. CISA: Conduct vulnerability assessments!

Experts at the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have reported a serious incident: hackers gained access to the network of a civilian federal agency by exploiting a critical vulnerability in the GeoServer server software. The issue affected an unpatched version of the platform , allowing attackers to remotely execute code and subsequently infiltrate the system. The critical vulnerability, designated CVE-2024-36401, was officially fixed on June 18, 2024, but many servers remained unpatched. About a month later, CISA added it to its public registry of actively exploited vulnerabilities. This was due to the public release of demonstration exploits published by several

Ransomware attack on European airports leaves Berlin in “emergency mode”

Berlin Airport (BER) remains in “emergency mode” for the fifth day after a major cyberattack on its supply chain. Der Spiegel reported the news in yesterday’s update. IT services provider Collins Aerospace, a subsidiary of the American company RTX, was the victim of a cyberattack last Friday. The hack paralyzed the electronic systems used to process passengers and baggage. According to an airport spokesperson, BER is still in “emergency mode” several days after the cyberattack on its IT system. The paralyzed passenger and baggage management system remains inactive. He noted that on Thursday, September 25, there were again several delays and three

Commodore 64: From the Legend of the ’80s to 2025! 10,000 New Consoles Sold

Commodore Corporation BV was recently acquired by fans and former employees. Now, the new Commodore brand has announced a significant milestone: the first Commodore 64 Ultimate computer in 30 years has surpassed 10,000 units sold. The company’s official X account posted sales figures and thanked the community for their support . As the published graph shows, sales began in earnest on July 12 of this year. Since August, the trend has been more consistent but stable. The timeline also shows the release dates of the “Let’s Buy Commodore” video trilogy, which has garnered hundreds of thousands of views (one episode surpassing 400,000).

Two critical bugs in Cisco ASA and FTD: score 9.9 and risk of remote code execution

Cisco has disclosed two critical vulnerabilities affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) firewalls, as well as other networking products. Both flaws allow arbitrary code execution and could lead to the complete compromise of affected devices. CVE-2025-20363 – Code Execution via Web Services The first vulnerability, identified as CVE-2025-20363 and with CVSS score 9.0 (critical) , affects the web services of: Cisco Secure Firewall ASA Software Feature Possible Vulnerable Configuration AnyConnect IKEv2 Remote Access (with client services) crypto ikev2 enable < interface name > client-services port < port_numbers > Mobile User Security (MUS) webvpn mus

Linux dances the samba… but hits a race condition. A critical flaw threatens the kernel.

Trend Research researcher Nicholas Zubrisky has reported a critical vulnerability in the ksmbd component of the Linux kernel that allows remote attackers to execute arbitrary code with maximum system privileges. The vulnerability, identified as CVE-2025-38561, affects all distributions that use the built-in ksmbd-based SMB server. The crash was related to the handling of the Preauth_HashValue field during SMB2 session creation. The developers made a thread synchronization error: the lack of a memory access lock created a race condition when multiple processes simultaneously modified the same object. This caused memory corruption and thread switching, paving the way for arbitrary code execution in kernel

They slept on networks for 393 days! Chinese state hackers and the BRICKSTORM backdoor

According to Google Threat Intelligence , the China-linked espionage group UNC5221 has carried out a series of successful intrusions into corporate networks since March of this year, exploiting previously unknown vulnerabilities in Ivanti products. The attacks involved the introduction of backdoors that allowed attackers to maintain access to victims’ infrastructure for an average of 393 days. Experts have attributed the actions to the UNC5221 group and other related Chinese cyberespionage groups. According to the report , UNC5221 began actively exploiting vulnerabilities in Ivanti devices as early as 2023. Google emphasizes that this group is not associated with Silk Typhoon (formerly Hafnium), suspected

Code as we knew it is dead! Artificial Intelligence writes the future.

Since 2013, the IEEE has published an annual interactive ranking of the most popular programming languages . However, traditional methods of measuring popularity may be losing their meaning today, due to changes in the way we program. In the latest IEEE Spectrum rankings, Python retains its first-place position. JavaScript has seen the biggest decline , falling from third to sixth place. Meanwhile, Python has also taken the lead in the separate ” Employment ” category, which only considers employer demand. However, SQL remains a key skill on developer resumes. The ranking methodology is based on a collection of open data: Google search

Cryptocurrencies, ransomware, and hamburgers: the fatal combo for Scattered Spider

The U.S. Department of Justice and British police have charged Talha Jubair, 19, a resident of East London, who investigators believe is a key member of Scattered Spider , a group responsible for a series of extortion attacks targeting major businesses and government agencies. According to the file, from May 2022 to September of this year, attackers carried out at least 120 intrusions, affecting 47 organizations in the United States, and the total amount of payments exceeded $115 million. A parallel case in London involves an attack on Transport for London in August 2024, in which 18-year-old Owen Flowers was involved along