AI Voice Cloning Exploit and Wi-Fi Vulnerabilities Highlight Cybersecurity Risks

This week’s cybersecurity bulletin highlights several critical threats, including a high-severity vulnerability in Redis (CVE-2025-62507) that allows unauthenticated remote code execution through a stack buffer overflow. JFrog’s analysis revealed that the flaw affects 2,924 servers running Redis 8.2 with the XACKDEL command, which lacks proper input validation. The vulnerability was addressed in version 8.3.2.

Another significant threat involves the emergence of signed malware, specifically BaoLoader, which uses legitimate business registrations to obtain valid code-signing certificates. This allows the malware to evade detection by appearing trustworthy to users and security tools. The malware can execute malicious JavaScript for reconnaissance and backdoor access, complicating detection efforts.

Phishing attacks have also evolved, with emails disguised as holiday invitations or invoices being used to deliver Remote Monitoring and Management (RMM) tools like LogMeIn Resolve and ScreenConnect. These tools can enable attackers to gain persistent access to compromised systems.

In a notable arrest, Dutch authorities apprehended a suspect linked to the AVCheck counter-antivirus service, which helped cybercriminals evade detection by antivirus programs. This highlights the ongoing battle between law enforcement and cybercriminals.

Additionally, vulnerabilities in AI libraries from Apple, NVIDIA, and Salesforce have been disclosed, allowing remote code execution when malicious metadata is loaded. These vulnerabilities were tracked as CVE-2025-23304 and CVE-2026-22584 and have been addressed by the respective companies.

Another alarming development is the discovery of a high-severity flaw in Broadcom Wi-Fi chipset software, which can take wireless networks offline with a single malicious frame. This vulnerability affects 5GHz networks and bypasses WPA2 and WPA3 protections, necessitating immediate action from affected organizations.

Finally, a ransomware strain called CrazyHunter has targeted Taiwanese hospitals, exploiting weaknesses in Active Directory infrastructure. This incident underscores the importance of robust security practices in healthcare environments.

1. Redis (CVE-2025-62507) – A high-severity vulnerability allowing unauthenticated remote code execution, affecting 2,924 servers.
2. BaoLoader – A signed malware that uses legitimate certificates to evade detection and gain unauthorized access.
3. LogMeIn Resolve – An RMM tool used in phishing campaigns to deliver remote access capabilities.
4. AVCheck – A counter-antivirus service linked to a suspect arrested by Dutch authorities.
5. AI libraries (CVE-2025-23304, CVE-2026-22584) – Vulnerabilities in AI libraries from Apple, NVIDIA, and Salesforce allowing remote code execution.
6. Broadcom Wi-Fi chipset – A flaw that can take 5GHz networks offline with a single malicious frame.
7. CrazyHunter – A ransomware strain targeting Taiwanese hospitals by exploiting Active Directory weaknesses.