Clop Ransomware Breaches Washington Post; Critical Flaws Found in Docker, QNAP, and AI Models
Summary
This cybersecurity brief for November 9, 2025, covers a series of high-impact events. The Clop ransomware group has been confirmed as the perpetrator behind a major breach at The Washington Post, exploiting Oracle E-Business Suite vulnerabilities in a campaign affecting over 100 organizations. Concurrently, Microsoft revealed a novel 'Whisper Leak' side-channel attack capable of inferring AI chat topics from encrypted traffic. Critical vulnerabilities have also emerged, with the GlassWorm malware resurfacing in the VSCode marketplace, QNAP patching seven zero-days from Pwn2Own, and newly disclosed flaws in the runC container runtime threatening Docker and Kubernetes environments. These incidents highlight escalating threats across enterprise software, AI platforms, and cloud infrastructure.
Today New Articles
Washington Post Breached by Clop Ransomware via Oracle Flaws
The Washington Post has officially confirmed it was a victim of a large-scale cyberattack orchestrated by the Clop ransomware group. The threat actors exploited vulnerabilities in Oracle's E-Business Suite, compromising over 100 organizations globally. The cam...
Microsoft 'Whisper Leak' Attack Can Spy on Encrypted AI Chats
Microsoft researchers have discovered a novel side-channel attack method named 'Whisper Leak' that undermines the privacy of encrypted AI chatbot conversations. By analyzing the size and timing of encrypted data packets from streaming Large Language Models (LL...
Chinese-Made Electric Buses in Europe & Australia Pose Remote Shutdown Risk
Cybersecurity tests conducted in Norway on November 7, 2025, have uncovered a significant security risk in Chinese-manufactured Yutong electric buses, which are widely used across Europe and Australia. The 'Lion Cage' experiment demonstrated that the buses' co...
Philippines Lawmakers Push for National Cybersecurity Fund
In the Philippines, Representatives Migz and Luigi Villafuerte have introduced a proposal to create a 'Cybersecurity Risk Management and Mitigation Fund' (CRMMF). This dedicated national fund would provide the government with the necessary resources to prevent...
Critical Container Escape Flaws in runC Threaten Docker & Kubernetes
A security alert issued on November 9, 2025, warns of three new critical vulnerabilities in runC, the low-level container runtime used by Docker, Kubernetes, and other major container platforms. The flaws could allow a malicious actor to execute a 'container e...
Article Updates
Over 75% of Orgs Can't Keep Pace with AI-Powered Attacks, Survey Finds
Update:A new Accenture report, 'State of Cybersecurity Resilience 2025,' reinforces findings that organizations are critically unprepared for AI-driven cyber threats. Surveying over 2,200 executives, it found 90% of firms are not equipped, with 63% in an 'Exposed Zon...
Pwn2Own Day 1: Hackers Net $522K for 34 Zero-Days in SOHO Devices
Update:QNAP has issued critical security updates addressing seven zero-day vulnerabilities, including CVEs like CVE-2025-62847, that were demonstrated at Pwn2Own Ireland 2025. These flaws, ranging from buffer overflows to path traversals, allow unauthenticated remote...