This Weeks Headlines

• Microsoft Patches Actively Exploited Power Pages Privilege Escalation Vulnerability
• UK Government Orders Apple to Provide Access to Encrypted User Data
• Critical Vulnerabilities Discovered in Unifi Protect Cameras and Management Interface
• Content Credentials Initiative Gains Momentum in Combating Digital Disinformation
• Storm-2372 Cybercriminals Exploit Device Codes in Phishing Attacks via Microsoft Teams and WhatsApp
• Oireachtas Committee to Assess Ireland’s Cybersecurity Preparedness Amid Escalating Digital Threats

Microsoft Patches Actively Exploited Power Pages Privilege Escalation Vulnerability

Microsoft has released security updates addressing two critical vulnerabilities affecting Bing and Power Pages, including one actively exploited in the wild.

The first, CVE-2025-21355, is a remote code execution flaw in Microsoft Bing that allows unauthorised attackers to execute code over a network.

The second, CVE-2025-24989, is an elevation of privilege vulnerability in Microsoft Power Pages, a low-code platform for building secure business websites. This flaw permits attackers to bypass user registration controls and elevate privileges.

Microsoft has mitigated the issue and notified affected customers with guidance on reviewing and securing their sites.

UK Government Orders Apple to Provide Access to Encrypted User Data

The UK government has reportedly issued a Technical Capability Notice (TCN) to Apple, compelling the company to grant access to users’ encrypted data stored in iCloud. This order, made under the Investigatory Powers Act 2016, requires Apple to create a backdoor for law enforcement agencies to access encrypted information, potentially affecting users worldwide.

Critics argue that such a move could undermine user privacy and set a precedent for other governments to demand similar access.

Apple has previously expressed concerns over such mandates, stating they could force the company to withdraw critical security features from the UK market. The Home Office has declined to confirm or deny the existence of the order.

Critical Vulnerabilities Discovered in Unifi Protect Cameras and Management Interface

Ubiquiti has identified five security vulnerabilities in its Unifi Protect product line, affecting both surveillance cameras and their management interface. These flaws could allow attackers with local network access to alter device settings or execute arbitrary commands.

The most severe, CVD-2025-23116 (CVSS 9.6), enables authentication bypass in the Unifi Protect Application, granting remote control over cameras. Another critical issue, CVE-2025-23115 (CVSS 9.0), is a “Use After Free” vulnerability that permits code injection into a camera without prior authentication.

Ubiquiti has released updates to address these vulnerabilities. Users are strongly advised to update their systems promptly to mitigate potential security risks.

Content Credentials Initiative Gains Momentum in Combating Digital Disinformation

The Content Authenticity Initiative (CAI), established in 2019 by Adobe, The New York Times, and Twitter, has made significant strides in addressing digital disinformation through its open technology known as Content Credentials. This system enables creators and publishers to attach verifiable metadata to digital content, detailing its origin and any modifications.

Recently, the British Broadcasting Corporation (BBC) utilised Content Credentials to authenticate a TikTok video depicting a Haitian prison raid, confirming the video’s location while identifying added audio of gunfire.

The Coalition for Content Provenance and Authenticity (C2PA), comprising over 500 media, software, and hardware companies, continues to develop this standard, aiming to enhance media transparency and trustworthiness.

Storm-2372 Cybercriminals Exploit Device Codes in Phishing Attacks via Microsoft Teams and WhatsApp

A Russian cybercriminal group, identified as Storm-2372, has been conducting a sophisticated phishing campaign since August 2024, targeting organisations across Europe, North America, Africa, and the Middle East. The group focuses on sectors such as government, IT, defense, telecommunications, healthcare, and energy.

Their method involves sending deceptive messages through platforms like WhatsApp, Signal, or Microsoft Teams, impersonating prominent individuals to gain the victim’s trust.

Victims receive spoofed Microsoft Teams meeting invites leading them to legitimate Microsoft login pages, where they are prompted to enter device verification codes. Once the code is entered, attackers gain unauthorised access to the victim’s account without needing passwords or multi-factor authentication codes.

Microsoft emphasises that this tactic exploits standard device code authentication methods and is not due to a flaw in their system. Users are advised to be vigilant about unexpected authentication requests and to block device code flows where not required.

Oireachtas Committee to Assess Ireland’s Cybersecurity Preparedness Amid Escalating Digital Threats

In response to growing concerns over Ireland’s vulnerability to cyberattacks, the Oireachtas will be establishing a dedicated committee to evaluate the nation’s cybersecurity readiness. This initiative aims to ensure that Ireland is adequately prepared to defend against potential digital threats, especially in the context of rapid advancements in AI and recent incidents highlighting security gaps. The committee’s formation is part of the government’s broader strategy to enhance national cyber defenses and align with evolving technological landscapes.

The establishment of this committee follows the publication of the National Cyber Security Bill 2024, which seeks to strengthen the legal framework governing Ireland’s cyber infrastructure. The bill proposes the designation of national competent authorities to oversee cybersecurity measures across various sectors, with the National Cyber Security Centre (NCSC) playing a pivotal role in managing large-scale cyber incidents.

Recent events, such as the exposure of a Russian agent infiltrating Ireland’s Defense Forces, have underscored the urgency for robust cybersecurity measures. This incident revealed significant vulnerabilities within national security protocols, prompting calls for a comprehensive review and enhancement of Ireland’s cyber defense strategies.

The newly formed Oireachtas committee will be expected to conduct a thorough assessment of existing cybersecurity policies, identify potential weaknesses, and recommend actionable steps to fortify Ireland’s digital resilience against both current and emerging threats.

If you’re ready to learn how we can help protect your business from cyber threats, contact us using the form below 👇.