⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More

The weekly recap highlights a cluster of high‑risk stories, including Oracle 0‑Day exploitation in the Oracle E‑Business Suite tracked as CVE‑2025‑61882 (CVSS 9.8), with threat actors tied to Cl0p exploiting vulnerabilities to steal data, and a note from Charles Carmakal, CTO of Mandiant at Google Cloud, that multiple flaws enabled data theft in August 2025 and that some were patched in Oracle’s July 2025 update as well as one patched this weekend.

It also covers a BitLocker bypass via the bitpixie vulnerability in Windows Boot Manager, where a downgrade attack can extract the VMK from memory to bypass encryption, recommending a pre‑boot PIN or the 2023 Microsoft patch CVE‑2023‑21563. The VMScape disclosure is noted as a Spectre‑based end‑to‑end exploit that leaks cryptographic keys via a malicious guest‑to‑host path, while the WhatsApp worm SORVEPOTEL is described as self‑propagating in Brazil, spreading via a compromised contact’s phishing ZIP attachment.

Rounding out the roundup are warnings of domain fronting abuse, a data‑leak site activity involving LAPSUS$, Scattered Spider and ShinyHunters, and a reminder that threat actors continue to weaponise mobile apps, cloud services, and AI‑driven tooling in ongoing campaigns.