June 2025 - RedSeal
CTEM

The Future of Exposure Management: From Vulnerability Counts to Business Context

/by

In cybersecurity, volume has become the enemy of clarity. Enterprises today face thousands—sometimes millions—of potential vulnerabilities across hybrid infrastructures. And while scanning and patching remain foundational practices, it’s clear that traditional vulnerability management doesn’t scale to today’s threat landscape. 

That’s where exposure management comes in. It’s not about checking off CVEs from a list. It’s about understanding which exposures, whether unpatched systems, misconfigured access, or forgotten assets, actually matter, based on context, reachability, and business impact. 

Why Exposure Management Needs to Evolve 

The modern attack surface is sprawling and dynamic. Cloud environments, third-party services, legacy infrastructure, and unmanaged assets introduce exposures that are difficult to track with legacy tools and periodic assessments. What’s needed is a shift from reactive scanning to continuous, risk-informed exposure reduction. 

A recent blog by the SANS Institute describes this shift as a necessary evolution: “Organizations must stop treating vulnerabilities as one-dimensional. The real risk lies in how threats can exploit those weaknesses through accessible paths to high-value assets.” (SANS) 

From Vulnerability Lists to Risk-Based Prioritization 

The next generation of exposure management tools must look beyond severity scores. A CVSS 9.8 vulnerability on an isolated, non-critical system is not as urgent as a CVSS 6.5 on a device directly reachable from the internet with lateral movement paths into sensitive areas. 

This is why reachability modeling, asset classification, and network context matter. As Carnegie Mellon’s CERT Division has noted, “Risk is not just about the presence of a flaw, it’s about the ability to exploit it within the operational environment.” (SEI CERT) 

The Role of Continuous Monitoring and Simulation 

One major trend in the future of exposure management is the move toward continuous visibility and simulation. Rather than waiting for quarterly scans or annual audits, organizations are embracing persistent exposure assessment as a daily discipline. 

Continuous Threat Exposure Management (CTEM), a model described by Gartner and supported by NIST guidelines, emphasizes a five-phase approach: scoping, discovery, prioritization, validation, and mobilization. CTEM is not a product. It’s a programmatic shift that aligns cyber risk visibility with business priorities. (NIST SP 800-137) 

Reducing Exposure Without Disrupting Operations 

Let’s be realistic: not everything can be patched. Legacy systems often run critical workloads and can’t tolerate downtime. Exposure management helps security teams navigate that reality by identifying alternative controls, like segmentation, policy updates, or virtual patching, based on which assets are actually exposed. 

As the Center for Internet Security (CIS) explains in their Controls v8, organizations must “continuously manage asset exposures and reduce attack paths, not just catalog vulnerabilities.” (CIS Controls v8) 

Final Thoughts 

The future of exposure management is about clarity over chaos. It’s about knowing what matters, what’s reachable, and what could impact the business, not chasing every alert with equal urgency. By combining continuous monitoring, contextual visibility, and strategic prioritization, exposure management becomes not just a security process but a business enabler. With the right strategy and RedSeal’s ability to support a continuous threat exposurement management (CTEM) process at every step, organizations make smarter, data-driven security decisions before attackers strike. Contact us today to learn more.

Cyber News Roundup for June 20, 2025

/by

Microsoft’s June 2025 security update giveth, and Microsoft’s June 2025 security update taketh away

Microsoft’s June 2025 security update has created a critical dilemma for IT admins: install a patch that breaks DHCP services or leave servers vulnerable to serious exploits. The update, released June 10, disrupts DHCP failover configurations on Windows Server 2016 through 2025, causing network outages. Microsoft confirms the bug but has yet to issue a fix—forcing some to uninstall the update, exposing systems to 66 vulnerabilities, including two zero-days. One is an actively exploited WebDAV flaw used by the Stealth Falcon group. The same update has also caused issues with Surface Hub devices and L2TP VPN connections. Experts warn this reflects a growing problem: rushed patches causing major system failures. Admins are effectively left testing mission-critical updates in production environments.

(WinBuzzer)

16 billion passwords exposed in record-breaking data breach, opening access to Facebook, Google, Apple, and any other service imaginable

According to research by Cybernews, more than 9.9 billion unique credential pairs have been found in databases collected from various infostealer malware operations. These logs contain not only usernames and passwords but also cookies, autofill data, and credit card information stolen from infected devices. Infostealers like RedLine, Raccoon, and Vidar quietly harvest this data from unsuspecting users’ browsers and software, often going unnoticed by endpoint security solutions. The leaked credentials have been aggregated over time and are now widely available on hacker forums and Telegram channels. Researchers warn that this treasure trove of data significantly increases the risk of credential stuffing, account takeover, and supply chain attacks unless organizations and users act quickly to reset passwords and enforce multi-factor authentication.

(CyberNews)

Cisco, Atlassian fix high-severity vulnerabilities

Cisco’s release is related to firmware updates for Meraki devices. The vulnerability in question affects the AnyConnect VPN server and could allow attackers to make these products restart, leading to a DoS condition. This vulnerability has a CVE number and CVSS score of 8.6. The bug can be exploited remotely. Atlassian “announced patches for five vulnerabilities in third-party dependencies in Bamboo, Bitbucket, Confluence, Crowd, and Jira.” These also have CVE numbers which are listed in the show notes for this episode.

CVE-2025-22228 (an improper authorization in Spring), CVE-2025-24970 (a DoS flaw in the Netty framework), CVE-2024-38816 (a path traversal related to the WebMvc.fn and WebFlux.fn web frameworks), CVE-2024-57699 (a DoS bug in Netplex Json-smart), and CVE-2025-31650 (DoS in Apache Tomcat).”

(Security Week)

Telecom company Viasat attacked by Salt Typhoon

The satellite communications company Viasat has announced it has become the latest telecom industry victim of China’s Salt Typhoon cyber-espionage group. Viasat provides satellite broadband services to “governments worldwide and aviation, military, energy, maritime, and enterprise customers.” It has 189,000 broadband subscribers in the U.S. As reported by Bloomberg, “the company discovered the Salt Typhoon breach earlier this year and has been working with federal authorities to investigate the attack.”

(BleepingComputer)

Krispy Kreme discusses November breach impact

The donut company has now released information on the cyberattack that it suffered last November. Its filing with Maine’s Attorney General shows that cybercriminals accessed data belonging to more than 160,000 people. Along with standard PII, the haul also included financial account information including credit or debit card information along with access information, as well as: email addresses and passwords. biometric data, USCIS or Alien Registration Numbers, U.S. military ID numbers, medical or health information and health insurance information. Some experts question the company’s need to collect this much data as well as the quality of their pre-breach security.

(The Register)

North Korea’s tricky ClickFake deepfake scam

A cautionary tale from the crypto world, but equally applicable to regular businesses and organizations. Security firm Huntress reports on a deepfake/social engineering scam in which an employee of a cryptocurrency foundation was invited to talk with a collection of executives of an external company, via Zoom. The short version of this story: upon accepting the Calendly invite, the employee “joined a group Zoom meeting that included several deepfakes of known members of the senior leadership of their company, along with other external contacts.” The employee found that his microphone was not being heard on the call, at which point the deepfake personas sent him a Zoom extension which had been altered to stealthily download a next-stage payload from a remote server. This is now being referred to as a ClickFake interview since it has a similar “I can fix it” vibe as the better-known ClickFix campaigns. The longer version of this story is available through the show notes to this episode.

(The Hacker News)

Linux distros vulnerable to LPE vulnerabilities

Researchers at the Qualys Threat Research Unit discovered two new local privilege escalation (LPE) vulnerabilities impacting many prominent Linux distributions. One flaw in the Pluggable Authentication Modules framework on SUSE Linux 15 allows attackers to obtain “allow_active” user privileges. The other s the udisks daemon, a default storage management service on most distributions, that allows the same privilege escalation through a flaw in libblockdev. While these can be chained easily to attack SUSE systems, the researchers also created POCs to obtain root privileges on Ubuntu, Debian, and Fedora. Patches for both are available now.

(Bleeping Computer

Operation Fluffy Narwhal thinks it’s time to rethink adversary naming

And finally, when a Russian military unit hacks an election, but we call them “Fancy Bear,” it’s no wonder folks think cybersecurity is some elaborate comic book. In a sharply wry op-ed for Just Security, Jen Easterly and Ciaran Martin argue it’s time to stop branding our cyber adversaries like Pokémon and start naming them for what they are: nation-states and criminals. Microsoft and CrowdStrike’s recent alliance to align threat actor names is a welcome baby step. But Easterly and Martin say it’s not enough. Until the cybersecurity world adopts a single, clear, vendor-neutral naming system, we’ll keep confusing defenders and glamorizing adversaries. The idea that naming can’t be standardized is, they argue, nonsense—we do it in medicine, defense, and even for missiles. So why not malware? It’s time to ditch the marketing mascots. Let’s trade “Charming Kitten” for “Iranian espionage” and call the cyber criminals what they are—without the flair.

(Just Security)

North Korea’s Kimsuky targets academic institutions using password-protected research documents

A new malware campaign by North Korea-linked Kimsuky is targeting academic institutions using password-protected research documents to deliver multi-stage malware. Disguised as review requests from professors, phishing emails contain Hangul Word Processor (HWP) files with malicious OLE objects. These bypass security tools and trick recipients into opening them, launching a sophisticated infection chain. Upon activation, the malware installs six files, performs system reconnaissance, and establishes remote access using AnyDesk. The campaign exploits academic trust and collaboration, making detection harder and expanding risks to connected government and private networks. The malware uses obfuscation techniques and disguises malicious actions under the appearance of legitimate documents. Analysts warn this campaign marks an evolution in social engineering, blending technical precision with realistic academic bait, and urge institutions to remain vigilant.

(Cyber Security News)

Organizations warned of vulnerability exploited against discontinued TP-Link routers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that attackers are exploiting a critical command injection flaw, affecting multiple discontinued TP-Link router models. Agencies must remove affected devices by July 7. CISA also flagged active exploitation of Apple products, a media-processing flaw used in targeted attacks—patched in February with iOS 18.3.1 and macOS 15.3.1.

(SecurityWeek)

Silver Fox APT targets Taiwan with complex Gh0stCringe and HoldingHands RAT malware

Researchers at Fortinet warn of a phishing campaign by China-linked group Silver Fox APT targeting Taiwan with two Gh0st RAT variants: Gh0stCringe and HoldingHands. Delivered via fake emails posing as government or business communications, the malware uses PDF and ZIP attachments to deploy shellcode through DLL sideloading, enabling remote access, data theft, and additional payload downloads. The attackers use sophisticated anti-VM and privilege escalation techniques, continuously refining their tools and methods across recent campaigns, including the earlier Winos 4.0 attacks.

(The Hacker News)

Google warns of Scattered Spider attacks targeting IT support teams at U.S. insurance firms

Google’s Threat Intelligence Group says the cybercrime gang Scattered Spider (aka UNC3944) is now actively targeting IT support teams at major U.S. insurance firms. Known for social engineering tactics, the group impersonates employees, bypasses MFA, and exploits help desks—often gaining broad access via MSPs and contractors. Google and Mandiant warn the group is likely seeking high-value enterprise targets. Experts recommend tightening identity controls, restricting access, and training support staff to verify identities before account changes.

(The Hacker News)

Attackers can disable Secure Boot on many Windows devices by exploiting a firmware flaw

Researchers at Binarly uncovered a vulnerability (CVE-2025-3052) that allows attackers to disable Secure Boot on many Windows devices by exploiting a flaw in UEFI firmware. The flaw, found in a module by a rugged display vendor, allows arbitrary memory writes via the IhisiParamBuffer variable, stored in non-volatile RAM. This could let attackers overwrite Secure Boot variables without detection, even though the OS still appears protected. While the exploit requires admin and physical access, the risk is significant due to UEFI’s pre-OS role. Some UEFI distributions are immune, but most systems remain vulnerable. The flaw has likely circulated since October 2022. Microsoft has patched the issue and revoked certificates for 14 affected modules in its June 2025 Patch Tuesday update.

(Gov Infosecurity)

Beware the SMS 2FA middleman

An anonymous whistleblower provided Bloomberg Businessweek and Lighthouse Reports with autogenerated login codes related to roughly 1 million SMS messages with two-factor authentication codes sent in June 2023. All these messages passed through the Swiss company Fink Telecom Services, which cybersecurity researchers have previously found worked with government and private surveillance contracts to track user locations and spy on phones. Fink Telecom is one of the many intermediaries that process SMS factors for other platforms. Fink CEO Andreas Fink told Bloomberg that legal restrictions prevent them from seeing message content and that it no longer works in surveillance. Fink generally operates as a subcontractor for other SMS processors, so the platforms sending the codes have no direct business relationship or oversight of them.

(Bloomberg)

Wiz’s acquisition faces antitrust scrutiny

Bloomberg’s sources say the US Department of Justice opened an antitrust investigation into Google’s planned $32 billion acquisition of Wiz. That deal was announced in March. The investigation is in the early stages and could stretch on for months. A block on the deal wouldn’t just deny Google adding a strong cloud security portfolio, as a $3.2 billion breakup fee is attached. The DOJ also investigated Google’s 2022 acquisition of Mandiant, but eventually cleared the deal.

(Security Week)

NIST publishes new ZTA guidance

This new guidance is meant to serve as a foundational starting point for organizations building their own zero-trust architecture, although it cautions that all of these need to be custom-built for a given context. NIST includes 19 examples of zero-trust architectures built by organizations using commercial, off-the-shelf tools and technologies. The guidance is meant to augment NIST’s previous conceptual-level ZTA documentation, released in 2020. It emphasizes a phased deployment that starts by identifying and cataloging assets, building out access policies, and eventually achieving continuous monitoring and improvement.

(Dark Reading)

CISA issues multiple advisories

CISA warns that ransomware actors are exploiting CVE-2024-57727, a path traversal flaw in SimpleHelp RMM software, to target customers of a utility billing software provider. The vulnerability, with a CVSS score of 7.5, allows attackers to steal credentials and API keys. It was patched in January 2025, along with two related flaws. DragonForce ransomware previously exploited this in May. CISA urges immediate patching, disconnection of vulnerable systems, and threat hunting, especially for users running SimpleHelp version 5.5.7 or earlier.

CISA also issued ten new ICS advisories addressing vulnerabilities in products from Siemens, AVEVA, and PTZOptics. These advisories cover critical systems including Siemens SCALANCE, RUGGEDCOM, SIMATIC S7-1500 CPUs, Tecnomatix Plant Simulation, and AVEVA’s PI software suite. One advisory also targets pan-tilt-zoom cameras. CISA urges industrial system administrators to review these advisories for detailed vulnerability information and recommended mitigations to protect against potential exploits in industrial environments.

(SecurityWeek)

Uncle Sam wants an AI chatbot

Less than a month from launch, the federal government is preparing to unveil AI.gov, a new initiative designed to bring artificial intelligence tools into widespread use across agencies. Discovered through a GitHub repository that has since been archived, the site appears to be a central hub to help agencies integrate AI into their operations.

Led by Thomas Shedd, a former Tesla software engineering manager and current head of the General Services Administration’s Technology Transformation Services (TTS), the project is built around three core features: a chatbot, an “all-in-one API” to connect with models from providers like OpenAI and Google, and a tool called CONSOLE for monitoring AI usage across agencies.

According to the staging site, the platform will use FedRAMP-certified services via Amazon Bedrock, although one listed model—by Cohere—may not yet be certified. AI.gov is expected to launch July 4, signaling a major push to modernize federal operations through artificial intelligence.

Finally, a chatbot to fix government inefficiency.  What could possibly go wrong?

(The Register)

UK woefully unprepared for undersea cable sabotage, says report

Following up on a story that we have been covering over the past few months, a report from the China Strategic Risks Institute (CSRI) showed that 10 out of 12 incidents of alleged undersea cable sabotage between January 2021 and April 2025, eight of the suspected vessels were directly linked to China or Russia through flag-state registration or company ownership. As described in The Guardian, “99% of intercontinental data transmission takes place through submarine cable systems, playing a vital role in civilian and defense infrastructure. Without these cables, much of the economy – from international banking and cloud computing to virtual communications and global logistics – would cease to function.” The report continues that “the UK’s defense infrastructure is woefully inadequate in protecting against such grey-zone tactics.”

(The Guardian)

 

Cyber News Roundup for June 13, 2025

/by

Hacking the Hackers: When Bad Guys Let Their Guard Down

A string of operational security failures by threat actors has unexpectedly empowered defenders in what’s being dubbed “Hacking the Hackers.” According to Dark Reading’s analysis, live leaks of memory footprints and internal communications—often resulting from poor cleanup or disgruntled insiders—have provided defenders with direct visibility into the playbooks of malware and ransomware groups like DanaBot, Black Basta, and Conti . These lapses let researchers reconstruct attack sequences, tooling choices, and command-and-control (C2) infrastructures with clarity rarely afforded. Notably, this trend emphasizes that sometimes cyber defenders gain an upper hand not through flawless attacks, but thanks to threat actors’ own mistakes. This shift enables more proactive defense measures, including early detection signatures and threat hunting routines built on adversary-specific artifacts. The analysis highlights how vigilant defenders are increasingly “hacking the hackers” by exploiting adversaries’ carelessness to enhance organizational resilience.

(Dark Reading)

GitLab patches multiple vulnerabilities in its DevSecOps platform

GitLab has issued urgent security updates to patch multiple vulnerabilities in its DevSecOps platform. The flaws include account takeover risks and the ability for attackers to inject malicious jobs into CI/CD pipelines. The fixes are included in GitLab versions 18.0.2, 17.11.4, and 17.10.8. Critical issues addressed include HTML injection (CVE-2025-4278), missing authorization (CVE-2025-5121), cross-site scripting (CVE-2025-2254), and a denial-of-service flaw (CVE-2025-0673). GitLab.com is already patched, and users of self-managed instances are urged to upgrade immediately.

(Bleeping Computer)

Researchers unveil a covert method for exfiltrating data using smartwatches

Researchers in Israel have unveiled “SmartAttack,” a covert method for exfiltrating data from air-gapped systems using smartwatches. The attack involves malware on a secure, isolated computer emitting ultrasonic signals via built-in speakers. These inaudible tones, modulated to carry data, are picked up by a smartwatch microphone worn nearby. The watch then transmits the data via Wi-Fi, Bluetooth, or cellular networks. Though challenging and theoretical, the attack shows how insider threats can bypass physical isolation. Experts recommend banning smartwatches and disabling speakers in sensitive areas to mitigate risk.

(TechCrunch)

Erie Insurance has confirmed a cyberattack as the root cause of recent operational disruptions, raising concerns about potential data exposure

The Pennsylvania-based insurer acknowledged that a June 2024 cybersecurity incident was responsible for delays and interruptions to its customer services. Although the company has not disclosed the exact nature of the attack, it confirmed the involvement of an unauthorized third party and is actively working with forensic experts to investigate the scope of the breach. Erie has also involved law enforcement and taken steps to restore normal operations. At this time, it’s unclear whether customer or employee data was compromised, but the company promises to notify affected individuals should any data exposure be confirmed. This incident highlights the growing risk that cyberattacks pose to financial services organizations, which are often prime targets for threat actors seeking sensitive personal information.

(BleepingComputer)

Google Cloud and Cloudflare outages reported

Google Cloud and Cloudflare suffered outages yesterday, affecting services such as Google Home/Nest, SnapChat, Discord, Shopify and Spotify, as well as creating access authentication failures and Cloudflare Zero Trust WARP connectivity issues. Downdetector received tens of thousands of reports, with impacted users experiencing Cloudflare and Google Cloud server connection, website, and hosting problems. The issue started around 1:15 p.m. ET and was being resolved through the afternoon.

(The Verge)

 

Journalists are confirmed targets of Paragon’s Graphite spyware

A forensic investigation by Citizen Lab has confirmed that Paragon’s Graphite spyware was used in zero-click attacks targeting iPhones of at least two journalists in Europe. The attacks exploited a then-unknown vulnerability with a CVE number (CVE-2025-43200) in iOS 18.2.1, which allowed malicious photos or videos shared via iCloud Links to compromise devices. Apple notified the victims on April 29, identifying the spyware as “advanced.” The Graphite platform is believed to be part of Paragon’s mercenary spyware operations. The flaw has since been patched by Apple.

(BleepingComputer)

Librarian Ghouls’ Cyberattackers Strike at Night

A stealthy threat group known as “Librarian Ghouls” has been quietly targeting Russian organizations in a prolonged cyberespionage campaign.
According to Kaspersky researchers, the group has operated since at least December 2024 and focuses on stealing sensitive data while minimizing its digital footprint. Librarian Ghouls employs “living-off-the-land” techniques, using legitimate administrative tools like 4t Tray Minimizer and Mipko employee monitoring software to blend into normal system activity and avoid detection. They launch their attacks during off-hours—primarily at night and on weekends—reducing the likelihood of triggering alarms. The attackers also leverage PowerShell scripts and custom info-stealers to extract data, particularly targeting email communications. This campaign exemplifies the increasing sophistication of threat actors who avoid traditional malware in favor of covert, tool-based persistence.

(Darkreading)

AI-powered “ghost students” enrolling in online college courses to steal government funds

Financial aid fraud is on the rise, fueled by identity theft and AI-powered “ghost students” enrolling in online college courses to steal government funds. Criminals use stolen personal data to apply for grants and loans, often enrolling in community colleges where low tuition means more aid goes directly to students. In 2024 alone, California colleges reported 1.2 million fake applications, leading to over 223,000 suspected fraudulent enrollments and at least $11.1 million in unrecoverable aid. Victims often learn about the fraud only after seeing credit score drops or loan notifications. Clearing their names can take years. To combat the trend, the U.S. Education Department now requires ID verification for new aid applicants. However, federal staffing cuts may undermine efforts to detect and prevent these increasingly sophisticated scams.

(SecurityWeek)

Mozilla  patches two critical FireFox security flaws

Mozilla has released Firefox 139.0.4 to patch two critical security flaws that could crash the browser or allow hackers to run malicious code. The first, CVE-2025-49709, involves memory corruption in Firefox’s canvas rendering system. If triggered by specially crafted web content, it could let attackers exploit memory issues and compromise browser stability. The second flaw, CVE-2025-49710, is an integer overflow in Firefox’s JavaScript engine, specifically in the OrderedHashTable structure. This could lead to heap buffer overflows and similar risks when handling JavaScript-heavy websites. Both vulnerabilities are rated high severity with CVSS scores over 8. Mozilla urges users and enterprise admins to update to version 139.0.4 immediately via the built-in updater or Mozilla’s website to protect against potential exploitation.

(Cyber Security News)

Zero-click data leak flaw in Copilot

Researchers at Aim Labs documented a flaw in Microsoft 365 Copilot dubbed EchoLeak, part of an emerging class of “LLM Scope Violation” vulnerabilities. By sending an email with a hidden prompt injection in an otherwise banal business email, the researchers could get around Microsoft’s cross-prompt injection attack classifier protections. When a user later asks about the email, the Retrieval-Augmented Generation, or RAG engine, pulls in the malicious injection, inserting internal data into a crafted markdown image and sending it to a third-party server. Aim Labs reported the issue to Microsoft back in January, which subsequently issued a server-side fix in May.

(Fortune, Bleeping Computer)

Friendly skies…or friendly spies? 

It turns out the major U.S. airlines—yes, the ones that can’t find your luggage—have been quietly selling your domestic flight data to Customs and Border Protection (CBP). An investigative report from 404 Media reveals that through a data broker the airlines own called ARC, airlines shared names, itineraries, and payment info, all while telling CBP not to mention them by name. This cloak-and-dagger data deal, documented through FOIA requests, supports tracking “persons of interest” without pesky things like warrants. The program, known as the Travel Intelligence Program, updates daily and holds over a billion records. Civil liberties advocates are, unsurprisingly, unimpressed. One called it a digital-age revival of the “collect it all” mentality. Meanwhile, Congress is starting to ask airlines why their loyalty programs apparently come with complimentary government surveillance.

Turn out, when it comes to data collection…the sky’s the limit.

(404 Media)

Five zero-day vulnerabilities in Salesforce Industry Cloud are uncovered

Security researchers at AppOmni uncovered five zero-day vulnerabilities and 15 serious misconfigurations in Salesforce Industry Cloud, potentially impacting tens of thousands of organizations. Salesforce Industry Cloud offers low-code tools tailored for sectors like healthcare, finance, and government, but its ease of use can lead to risky default settings. Three of the five flaws were fixed by Salesforce directly, while two require customer action. The remaining issues stem from common misconfiguration traps, often caused by non-technical users unknowingly applying insecure access settings. These missteps could lead to major data breaches, including exposure of sensitive health or financial data. AppOmni’s scans show these risks are widespread among Industry Cloud users, raising serious concerns about security in low-code enterprise platforms designed for speed and simplicity.

(SecurityWeek)

PoC Code escalates Roundcube Vuln threat

A critical Roundcube webmail flaw with a CVSS score of 9.9 is now a major threat after proof-of-concept code was publicly released. The 10-year-old bug lets authenticated attackers execute remote code via a malicious URL exploiting PHP’s object handling. Over 85,000 unpatched servers are exposed globally. Login credentials are required to exploit it, but attackers can pair it with older credential-theft bugs for full compromise. A patch is available , but researchers warn organizations to update immediately and monitor for malicious activity.

(Dark Reading)

SentinelOne rebuffed a China-linked “PurpleHaze” APT targeting its internal infrastructure

SentinelOne revealed that it was the target of a thwarted cyberattack in October 2024 by a group linked to Chinese nation-state actors, specifically associated with APT15 (also known as Ke3chang or Vixen Panda). The threat actor, referred to as “UNC5174” or “PurpleHaze,” was also found to have compromised over 70 global organizations spanning the defense, telecommunications, and IT sectors. The attackers used legitimate software tools and the ShadowPad malware framework to quietly infiltrate systems and conduct espionage. SentinelOne worked with international security partners to identify and warn affected victims, stressing the importance of proactive threat hunting and detection capabilities. The attack underscores the growing boldness of state-sponsored groups and the strategic value they place on targeting cybersecurity firms themselves.

(Cybersecurity Dive) 

Chinese hackers target U.S. smartphones 

A recent cyberattack targeting smartphones of U.S. officials and professionals in politics, tech, and journalism has raised alarms among cybersecurity experts. Investigators at iVerify linked the unusual crashes to a zero-click hack, likely by Chinese hackers, that allowed access to phones without user interaction. Victims had ties to fields of interest to China’s government.

Experts say smartphones, often less protected than other systems, are becoming key targets for espionage. Devices belonging to Donald Trump’s campaign and top aides were also reportedly targeted. Lawmakers fear Chinese state-owned firms could exploit their tech presence in global networks. The U.S. is responding with new initiatives like a “cyber trust mark” for secure connected devices. Still, officials warn that even the most secure device is vulnerable if users ignore basic precautions. Cyber lapses, like misconfigured apps or unsecured connections, remain a serious national security risk.

(Associated Press) 

United Natural Foods hit by cyberattack

The company confirmed it discovered a cyberattack on June 5, 2025, according to an 8-K filing with the US SEC. United Natural Foods is North America’s largest publicly traded wholesale food distributor, with 53 distribution centers. The company proactively took some systems offline due to the attack, disrupting customer orders. At the same time, anecdotal posts on social media mention some worker shifts cancelled as well. No ransomware group took credit for the attack, and the company has not released further details about any data loss or what systems the attacker accessed.

(Bleeping Computer)

Russian companies hit with LockBit

You don’t tug on Superman’s cape, you don’t spit into the wind, you don’t pull the mask off of old Lone Ranger, and you don’t have your ransomware affiliates attack Russia. Those used to be the rules. However, the Russian cybersecurity firm Positive Technologies identified a financially motivated group called DarkGaboon that was doing just that: deploying LockBit 3.0 ransomware. Unlike typical LockBit affiliates, DarkGaboon seems to operate entirely independently, using Russian-language phishing emails with malicious attachments claiming to have legitimate financial documents. Researchers say the group has appeared to operate since at least 2023, but its use of open-source tools in other parts of its attack chain made attribution difficult.

(The Record)

FBI keeps Leatherman in its back pocket

FBI Director Kash Patel named agency veteran Brett Leatherman as assistant director and head of the Cyber Division. During his 22-year career, Leatherman served as section chief for cyber investigations and deputy assistant director for the last three years and has been the FBI’s public face for communications on major cyber incidents going back to the Colonial Pipeline attack. He takes over for Bryan Vorndran, who left the FBI to work as Microsoft’s deputy CISO. Given the number of personnel shakeups across government cybersecurity posts since January, this is a notable bit of continuity.

(Cyberscoop)

Cloudflare creates OAuth library with Claude

Last week, Cloudflare published the open-sourced OAuth 2.1 library, which was written almost entirely by Anthropic’s Claude LLM. Notably, the company also published comprehensive documentation of the process, including a full prompt history. Due to the sensitive nature of the library, this wasn’t an exercise in vibe coding, with human review in all parts of the process. Software developer Max Mitchell reviewed the process, finding the LLM excelled when given a substantial code block to work off of, with clear context and explanation of what needed to be changed. In all instances, the LLM excelled at generating documentation. However, the code needed human intervention for styling and other housekeeping tasks. Mitchell suggested looking at this the same as collaborating with a human developer, expect a back and forth rather than one-off prompting success. Cloudflare tech lead Kenton Varda, who oversaw the project, came into it with a healthy dose of skepticism, but ended up saying, “I was trying to validate my skepticism. I ended up proving myself wrong.”

(Maxe Mitchell, Neil Madden, GitHub)

SecOps teams must combat AI “hallucinations” to improve threat detection accuracy  Dark Reading warns that while generative AI accelerates incident detection and response, model hallucinations can generate false positives, mislead analysts, or gap investigations. Organizations are advised to implement robust model evaluation, training for AI oversight, and processes to cross-check alerts and avoid operational inefficiencies.

(Dark Reading)

ESET uncovers Iranian hackers targeting Kurdish and Iraqi government officials

Iran-linked hackers, identified as BladedFeline, have been conducting a years-long cyberespionage campaign targeting Kurdish and Iraqi government officials, according to ESET. Believed to be a subgroup of Iran’s OilRig (APT34), BladedFeline has operated since at least 2017, initially breaching the Kurdistan Regional Government (KRG) and later expanding to Iraq’s central government and even a telecom provider in Uzbekistan. The group uses custom malware like Shahmaran, Whisper, and PrimeCache to spy on systems, exfiltrate data, and maintain remote access. Entry points likely include exploited server vulnerabilities and webshells. Researchers say the campaign likely supports Iran’s geopolitical goals by monitoring the KRG’s Western ties and countering U.S. influence in Iraq. OilRig has a history of targeting critical sectors and using compromised networks for supply chain attacks.

(The Record)

Hitachi Energy, Acronis and Cisco patch critical vulnerabilities

Hitachi Energy has patched two critical vulnerabilities (CVE-2020-35198 and CVE-2020-28895) in its Relion 670, 650 series, and SAM600-IO devices, which are widely used in power grid protection and control. The flaws could allow remote attackers to trigger memory corruption, risking grid stability. Hitachi Energy has released targeted updates and recommends users upgrade to secure revisions. No public exploitation has been reported, but mitigation steps are advised for older systems.

Acronis Cyber Protect users are urged to update immediately due to multiple critical vulnerabilities, including three with the highest CVSS score of 10.0. These flaws allow attackers to bypass authentication, access sensitive data, and escalate privileges. Updates have been available for a month. If updating isn’t possible right away, restrict network access and monitor systems for suspicious activity.

Cisco has patched 12 vulnerabilities across its products, including a critical flaw (CVE-2025-20286, CVSS 9.9) in cloud deployments of Identity Services Engine (ISE). This bug affects AWS, Azure, and Oracle Cloud ISE instances where shared credentials are improperly generated, allowing attackers to access sensitive data or modify configurations. No workarounds exist, and proof-of-concept (PoC) code is public. Cisco also addressed two high-severity SSH flaws in its IMC and Nexus Dashboard Fabric Controller (CVE-2025-20261 and CVE-2025-20163), which could allow unauthorized access or man-in-the-middle attacks. Additionally, nine medium-severity bugs were patched across various Cisco communication and management tools. Two have public PoC code, though no active exploitation is reported. Cisco strongly urges users to apply updates immediately.

(Beyond Machine, [1]  SecurityWeek)

Presidential cyber executive order signed

The President signed a new executive order aimed at refocusing U.S. cybersecurity policy by emphasizing secure software development, updated encryption, and internet routing security. The order revokes parts of Biden- and Obama-era directives, including digital identity initiatives, which it claims could increase fraud risks. It criticizes the previous administration for politicizing cybersecurity and shifts AI policy from potential censorship to identifying vulnerabilities. The order rolls back compliance mandates for software vendors, instead encouraging collaboration with industry partners. It also targets post-quantum cryptography and consumer device security.

(Cyberscoop)

OpenAI takes down ChatGPT accounts linked to state-backed hacking, disinformation  The owner of ChatGPT says threat actors from countries such as China, Russia, North Korea, Iran, and the Philippines are using the LLM product for three key areas of activity: social media comment generation; malware refinement and cyberattack assistance; and foreign employment scams. One example: using ChatGPT to publish comments on topics such as U.S. politics, on TikTok, X, Reddit, Facebook, and other social media platforms and then shifting to other accounts that would reply to the same comments. They have also been using it to assist with writing scripts for brute-forcing passwords, as well in conducting employment scams, including arranging for delivery of company laptops.

(The Record)

RedSeal Wins 2025 Intellyx Digital Innovator Award: A Milestone in Cybersecurity Innovation

/by

We’re thrilled to announce that RedSeal has been recognized with the 2025 Intellyx Digital Innovator Award, joining an elite group of companies that are reshaping the future of technology and digital transformation.

The Intellyx Digital Innovator Awards spotlight organizations that are not only adapting to the pace of digital change but actively driving it. As the only analyst firm dedicated to digital transformation, Intellyx celebrates companies whose solutions stand out in a crowded and competitive market. This recognition validates our mission to deliver groundbreaking security solutions that help organizations navigate today’s most complex networks.

Why This Matters 

In a time when attack surfaces are expanding and threats are more dynamic than ever, visibility and control across hybrid, multi-cloud environments are no longer optional — they’re essential. RedSeal’s platform enables security teams to visualize their entire infrastructure, understand exposure, and continuously prioritize risk. This award underscores our commitment to delivering practical, scalable innovation that helps security teams proactively protect what matters most.

A Team Effort 

This achievement is a reflection of the passion and dedication of every RedSeal team member. From engineering and product development to customer success and marketing, each person plays a critical role in building and evolving our platform. Your drive to solve hard problems and help our customers achieve resilience is what makes RedSeal a true digital innovator.

Looking Ahead

Winning the Intellyx Digital Innovator Award reinforces our momentum and sets the stage for what’s next. As we continue to evolve with the needs of our customers, we remain focused on helping enterprises achieve Continuous Threat Exposure Management (CTEM), stay compliant, and secure their growing and interconnected environments. Reach out to RedSeal or schedule a demo today.

Thank you to our customers, partners, and team members for being part of this journey. We’re just getting started! 

Why Modern Security Starts with a Map: The Critical Role of Network Visibility

/by

In today’s rapidly evolving digital landscape, where IT environments span on-premises, hybrid, and multi-cloud architectures, security leaders face a pressing challenge: you can’t secure what you can’t see.

Despite significant investments in cybersecurity tools, many organizations still lack an accurate, up-to-date map of their network infrastructure. As new endpoints, applications, and access points proliferate, blind spots become inevitable and dangerous.

That’s why network mapping isn’t a legacy process; it’s a strategic imperative.

The Shift from Static Diagrams to Dynamic Visibility

Historically, network maps were created using tools like Visio or PowerPoint, often becoming outdated as soon as they were completed. These static diagrams provided limited visibility and were cumbersome to update.

Today, manual mapping simply doesn’t scale. Modern enterprises require continuous, automated network and cloud visibility to:

  • Understand real-time connectivity between systems
  • Identify potential attack paths before adversaries do
  • Ensure compliance with evolving standards like NIST, ISO 27001, and GDPR

This need for dynamic visibility is underscored by the 2025 Verizon Data Breach Investigations Report (DBIR), which analyzed over 30,000 security incidents and more than 10,000 confirmed breaches. The report highlights a 34% increase in breaches initiated through vulnerability exploitation, with edge devices and VPNs being prime targets. Alarmingly, only 54% of these vulnerabilities were fully remediated, leaving organizations exposed to potential attacks.

Why It Matters Now

The 2025 DBIR reveals that 44% of all breaches involved ransomware, marking a significant rise from the previous year. Small and medium-sized businesses (SMBs) were particularly affected, with ransomware present in 88% of their breaches. This trend underscores the importance of proactive security measures and the need for comprehensive network visibility to detect and mitigate threats before they escalate.

Without comprehensive network visibility:

  • Incident response is delayed, increasing potential damage
  • Compliance audits become high-risk events, risking penalties
  • Attackers find vulnerabilities before defenders do, leading to breaches

A comprehensive network map enables faster detection, stronger defenses, and a proactive approach to securing infrastructure.

RedSeal and the Value of Strategic Visualization

RedSeal’s platform is designed to help CISOs, SecOps, NetOps, and Governance Risk & Compliance professionals build dynamic, accurate models of their enterprise environments. It aggregates data from routers, firewalls, cloud configurations, and more to simulate attack paths, identify misconfigurations, and validate access controls.

In the upcoming report by Dr. Edward Amoroso, CEO of TAG and Research Professor at NYU, he outlines the evolution of network mapping and highlights RedSeal’s approach as a leading example of automation done right.

The report also explores:

  • The inefficiencies and risks of manual network mapping
  • How AI-driven tools are enabling proactive threat detection
  • Best practices for mapping multi-cloud and hybrid environments

A Resource for Strategic Security Planning

If you’re responsible for your organization’s IT security posture, this report will provide you with timely insights and practical considerations to help guide informed decision-making. Whether you’re reassessing your cloud architecture or planning your next audit, understanding the current state of network visibility is essential. View the report.

Cyber News Roundup for June 6, 2025

/by

Google warns a threat group is targeting Salesforce customers

Google has warned that threat group UNC6040 is targeting Salesforce customers in a widespread voice phishing (vishing) and data extortion campaign. The group impersonates IT support staff in phone calls, tricking employees into approving access for a modified Salesforce Data Loader app. This unauthorized tool allows attackers to exfiltrate sensitive data, which is later used for extortion. Around 20 organizations across sectors like education, retail, and hospitality in the Americas and Europe have been hit. UNC6040 often leverages social engineering alone—no Salesforce vulnerabilities were exploited. Once inside, they move laterally to platforms like Microsoft 365 and Okta. The group claims ties to ShinyHunters and shows overlap with tactics used by ‘The Com’ collective, including Scattered Spider. Google highlights this as part of a rising trend of attackers targeting IT support roles for initial access.

(SecurityWeek)

Researchers discover what may be China’s largest ever data leak

In what may be China’s largest data leak ever, over 4 billion personal records—totaling 631 GB—were exposed from an unsecured database. The leak includes sensitive financial data, WeChat and Alipay information, ID numbers, addresses, and more, potentially affecting hundreds of millions of users. Cybernews and researcher Bob Dyachenko discovered 16 data collections containing massive databases with hundreds of millions of records each. The data appears to be meticulously compiled, likely for surveillance or profiling purposes. The database was quickly taken offline, leaving no clear attribution or recourse for victims. Experts warn the data could fuel phishing, fraud, blackmail, or state-level espionage. This leak dwarfs previous Chinese breaches and underscores the severe privacy risks at play.

(Cybernews)

CrowdStrike cooperates with federal authorities following last year’s major software bug

CrowdStrike is cooperating with federal authorities following a major software bug last July that knocked millions of computers offline. In a recent SEC filing, the company revealed that the Justice Department and SEC are investigating the incident, as well as CrowdStrike’s revenue-recognition practices and reporting of annual recurring revenue. Other agencies and third parties have also requested information, with some customers threatening legal action. The July 19 outage, triggered by a flaw in the Falcon software, disrupted flights, back-end systems, and user devices. CrowdStrike disclosed the update alongside its fiscal Q1 report, showing a swing to a loss and a weaker outlook due to ongoing costs from the incident. Shares dropped 5.3% following the news, though the stock remains up 35% over the past year.

(Wall Street J⁠ournal)

Stolen Kettering Health data published

Following up on a story we covered last month, while the not-for-profit Ohio-based healthcare network Kettering Health has been rebuilding and restoring its systems and services, the Interlock ransomware gang appears to have posted “941 GB of data from the organization, including ID cards, financial reports, payment data, and more.” According to Security Week, “while the healthcare provider has not said much about the type of cyberattack it fell victim to, it appears that it did not give in to the threat actor’s extortion attempts and did not pay a ransom.”

(Security Week)

Cisco ISE Auth Bypass Flaw impacts cloud deployments on AWS, Azure, and OCI

This flaw, flaw impacting the Identity Services Engine (ISE) could allow unauthenticated actors to carry out malicious actions on susceptible systems. With a CVE number (CVE-2025-20286) and a CVSS score of 9.9, it is described as a static credential vulnerability. Cisco also acknowledges the existence of a proof-of-concept (PoC) exploit but says there is no evidence that it has been maliciously exploited in the wild.

(The Hacker News)

Ohio, Oklahoma, Puerto Rico governments suffer cyberattacks

Ransomware attacks have caused problems for residents of the city of Durant, Oklahoma, resulting in some issues for digital and credit card payments, and network outages for its police department. Meanwhile, the Justice Department of Puerto Rico has announced a cyberattack impacting the Criminal Justice Information Office. As part of its preventive measures for safeguarding the integrity of its data, the office has undertaken to suspend some services.

(The Record)

Iranian APT ‘BladedFeline’ Hides in Network for 8 Years

An Iranian state-sponsored threat group known as BladeFeline has been covertly operating inside an unnamed Middle Eastern telecommunications network for over eight years. According to a report from SentinelLabs, the group leveraged a combination of living-off-the-land techniques and legitimate administrative tools to evade detection, including remote administration utilities like PuTTY, AnyDesk, and SecureCRT. By avoiding custom malware and using normal network traffic patterns, BladeFeline was able to maintain long-term persistence and exfiltrate sensitive data without triggering traditional security alerts. Investigators uncovered evidence suggesting that the group targeted high-value accounts, demonstrating a high level of operational discipline and intent. The campaign is another example of how advanced persistent threats (APTs) are refining stealth tactics to remain embedded within critical infrastructure environments over long periods.

(Dark Reading)

FBI warns about NFT scheme

A new advisory from the FBI warns about a new NFT airdrop scheme operating on the Hedera Hashgraph network. Threat actors target victims by sending unsolicited NFTs to a wallet, along with memos asking them to click a URL to claim a reward, but instead send them to phishing pages that ask for wallet seed phrases and passwords. This campaign also uses standard phishing emails, social media ads, and fake sites to draw in victims. The FBI advises verifying any NFT drops from official sources rather than emails. If you’re not familiar, hashgraph is a next-generation distributed ledger introduced in 2018, similar to a blockchain but based on a protocol aimed at speed, scale, and energy efficiency.

(Bleeping Computer)

PumaBot stalks vulnerable IoT devices

Researchers at PolySwarm have uncovered a stealthy new Linux-based botnet named PumaBot, targeting vulnerable IoT devices, especially surveillance systems. Written in Go, PumaBot differs from typical malware by using curated IP lists from command-and-control servers instead of scanning the internet broadly. This targeted approach helps it avoid detection.

PumaBot brute-forces SSH credentials to gain access, with a particular focus on devices from Pumatronix, a surveillance equipment maker. Once inside, it establishes persistence by disguising itself as legitimate services like Redis or MySQL and embeds into system directories to survive reboots.

Its main goal is cryptocurrency mining, executing tools like “xmrig” to generate illicit profits. The malware also gathers system data and sends it back to attackers, who maintain inventories of infected devices. PumaBot’s emergence underscores growing IoT risks tied to default credentials and weak security practices.

(Cyber Security News)

Fortinet Reports Surge in AI-Driven Cyberthreats

Fortinet’s latest report highlights a significant increase in cyberthreats driven by AI and automation, with global automated scanning activities rising to 36,000 scans per second. Cybercriminals are increasingly targeting vulnerable digital assets such as Remote Desktop Protocol, IoT systems, and Session Initiation Protocols earlier in attack cycles. The report also notes a 42% surge in credential-based targeted attacks, emphasizing the need for organizations to adopt modern defense strategies including AI, zero trust architectures, and real-time threat management.

(TechRadar)

LevelBlue Report: Healthcare Organizations Face Higher Risk

Healthcare organizations are facing a mounting wave of cyberattacks, yet many remain unprepared to effectively respond, according to a new report from LevelBlue. Theresa Lanowitz, Chief Evangelist at LevelBlue, highlights that nearly half of healthcare executives report an increase in cybersecurity incidents, including ransomware and data breaches. Despite this rise, many organizations lack the tools, personnel, and strategies to build resilience. The report calls for greater adoption of managed security service providers (MSSPs), which can offer 24/7 threat monitoring, incident response, and compliance support. Lanowitz emphasizes that as healthcare continues its digital transformation, ensuring cybersecurity is not optional—it’s mission-critical to protect patient trust and ensure continuity of care.

Experts warn congress that Chinese infiltrations are preparations for war

Retired Lt. Gen. H.R. McMaster warned lawmakers that China’s deep infiltration into U.S. telecommunications and critical infrastructure is part of a broader war preparation strategy. Speaking at a House Homeland Security Committee field hearing, McMaster linked recent cyber campaigns like Volt Typhoon to China’s growing military ambitions, including a 44-fold defense budget increase and a possible first-strike nuclear capability. He also cited Chinese surveillance balloons aimed at U.S. strategic communications. Palo Alto Networks’ Wendi Whitmore echoed concerns, noting that China, alongside Russia, Iran, and North Korea, is becoming more aggressive in cyberspace. Palo Alto blocks up to 31 billion attacks daily, including millions of new threats. Whitmore stressed the need for faster, two-way public-private collaboration and supported legislation to strengthen the Joint Cyber Defense Collaborative.

(The Register)

Exclusive: One-third of top U.S. cyber force has left since Trump took office

Axios reports that nearly 1,000 people in the U.S. Cybersecurity and Infrastructure Security Agency (CISA) workforce have left in the latest US administration. This includes 600 recent voluntary buyouts and 174 deferred resignations, with additional cuts hitting contract teams like election integrity and DEI units. Critics warn the loss of key figures and shrinking resources could undermine U.S. cyber defenses amid rising threats. CISA leadership says it’s still mission-ready.

(Axios) 

Black Owl group poses a threat to Russia

Researchers at Kaspersky released a report on the threat group Black Owl, also known as BO Team, which recently carried out a cyberattack in Russia that wiped out a large part of the Russian national electronic court filing system. The group first appeared online in 2024, operating exclusively against organizations in Russia. Unlike typical pro-Ukrainian hacktivists, Black Owl seems to work independently, showing no signs of coordination, collaboration, or tool-sharing with others. The group typically gains access through phishing emails, and can wait up to months to set up an attack. They use backdoors DarkGate, BrockenDoor and Remcos, and have been known to deploy Babuk ransomware as well.

(The Record)

Fire panel security flaws could put OT systems in hot water

Consilium Safety makes fire- and gas-detection systems used across various sectors with an estimated installed base of 85,000. CISA issued an advisory about two flaws impacting its CS5000 Fire Panel. One flaw allows for a device takeover using a default account preinstalled. While owners can change this account over SSH, CISA found “t has remained unchanged on every installed system observed.” The other flaw comes from a hardcoded password that runs on a VNC server, which is, you know, bad. Consilium said it was aware of the flaws but chose not to mitigate them. Instead, it recommended that customers upgrade to its newer line of products.

(Dark Reading)

Microsoft and CrowdStrike partner to link threat actor names

The two companies announced a partnership to connect aliases used for specific threat groups. Unfortunately, this won’t set a single naming standard. Instead, Microsoft updated its threat actor reference guide with a linked map of common threat groups using each company’s naming system. The idea is to make attribution faster and clearer so defenders can maintain a comprehensive view of malicious campaigns. Microsoft also said Google/Mandiant and Palo Alto Networks’ Unit 42 will be contributing their information and would welcome support for the initiative from other companies.

(Bleeping Computer)

Demand for cybersecurity professionals surges with AI threat, cybersecurity and ethical hackers leading the pack

Data centers are deliberately throttling AI GPU performance to prevent regional power grid blackouts, highlighting a growing intersection between energy infrastructure and cybersecurity. As AI workloads surge, particularly from companies training large language models and other compute-intensive systems, energy consumption has spiked to unsustainable levels in some areas. This has prompted some facilities to intentionally slow GPU operations to avoid overwhelming local power grids. In response, Gridmatic, a California-based AI energy optimization firm, is proposing a smarter alternative: using predictive AI models to better manage electricity loads and reduce strain without compromising performance. The situation underscores the emerging risks at the intersection of AI, data center infrastructure, and national energy resilience, with implications for operational continuity and physical security.

(TechRadar Pro)

Decoding AI hallucinations with physics

No one truly knows how AI works—not even the people who build it. But physicist Neil Johnson and his colleague Frank Yingjie Huo have taken a swing at decoding the mystery by applying first-principle physics to AI’s Attention mechanism, the bit that decides what words an AI should “focus” on when generating text. Their theory treats words like quantum particles in a “spin bath,” where bad training data can skew outcomes, resulting in hallucinations or bias. Johnson likens current AI models to a 2-body Hamiltonian (two-particle system), which, it turns out, is about as stable as a toddler on espresso. A 3-body system might be better—but like railway gauges, the QWERTY keyboard and the Windows Registry, early design choices tend to stick. Still, Johnson’s math offers hope: with the right actuarial-style metrics, we may one day predict just when our friendly LLM might lose the plot. Literally.

(SecurityWeek)

Hackers Exploit PuTTY SSH Client to Deploy Malware on Windows Systems

A sophisticated malware campaign has been uncovered wherein attackers weaponize the legitimate PuTTY SSH client to install backdoors on Windows systems. By distributing trojanized versions of PuTTY, the attackers gain unauthorized access and maintain persistence on compromised machines. Security experts advise users to download software only from official sources and to verify digital signatures to prevent such intrusions.

(Cyber Security News)

Exploit for maximum severity Cisco IOS XE flaw now public

Following up on a story we covered at the start of May, details are now becoming available regarding the upload flaw, which suggests a working exploit may be available soon. As quoted in BleepingComputer, “a write-up by Horizon3 researchers does not contain a ‘ready-to-run’ proof of concept RCE exploit script, but it does provide enough information for a skilled attacker or even an LLM to fill in the missing pieces.” Given the immediate risk of weaponization and widespread use in attacks, it is recommended that impacted users act now to protect their endpoints. This flaw impacts software for wireless LAN controllers.

(BleepingComputer)

Hackers exploiting critical flaw in vBulletin forum software

There are actually two flaws, with CVE numbers and CVSS v3 scores of 10.0 and 9.0 respectively, and the affect open-source forum software vBulletin. One of these has been confirmed as actively exploited in the wild. The flaws are an API method invocation and a remote code execution (RCE) via template engine abuse. They affect vBulletin versions 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 when the platform runs on PHP 8.1 or later. Patches were released last year, meaning the danger lies with sites that have not upgraded. CVE-2025-48827 and CVE-2025-4882

(BleepingComputer)

ConnectWise warns of nation-state attack on its ScreenConnect customers

The company says it “recently learned of suspicious activity… [that it believes] …was tied to a sophisticated nation state actor.” This activity affected a very small number of ScreenConnect customers. ScreenConnect is IT remote management and monitoring software used by governments and large businesses. According to The Record, “hackers have frequently targeted vulnerabilities in the software, using it as a jumping off point for ransomware attacks and data thefts.” ConnectWise said it has launched an investigation with forensic experts from Mandiant.

(The Record)

Get the latest news, invites to events, and threat alerts

CONTACT US
Distinguished Vendor badge 2025

NEW Gartner® Report, Emerging Tech: The Future of Exposure Management is Preemptive.Download Report.
Footer
Connect on LinkedIn