Parse notes
Broadcom has patched two high-severity VMware NSX vulnerabilities (CVE-2025-41251 and CVE-2025-41252) reported by the NSA, both involving username enumeration flaws in password recovery mechanisms that allow unauthenticated attackers to identify valid usernames for potential brute-force attacks. These vulnerabilities affect VMware NSX, a critical networking virtualization solution widely used in enterprise private and hybrid cloud environments, making them attractive targets for state-sponsored hackers and ransomware groups that frequently exploit VMware products. Security professionals should immediately apply the available patches and review their VMware infrastructure for other recent vulnerabilities, as this follows a pattern of actively exploited VMware zero-days throughout 2025, including those used by Chinese state actors and disclosed at security conferences.
Volvo has reported that a hack of a third-party IT company, Miljödata, impacted it. The attackers breached the company's Adato support system for rehabilitation and Novi support system for HHR personnel notes. The Volvo Group stated that the incident impacted its employees' names and SSNs.
Security researchers discovered a wormable vulnerability in the Bluetooth Low Energy (BLE) Wi-Fi configuration interface used by several Unitree robots, which could result in remote code execution. Unitree robots utilize an initial BLE connection to facilitate the setup of a Wi-Fi connection. However, the encryption keys for the packets that the robot accepts were published on X. The researchers discovered that if an attacker encrypts the word “unitree” with these keys, the robot will allow them to inject arbitrary code masquerading as the Wi-Fi SSID and password, which will then be executed when the robot tries to connect to Wi-Fi.
1 in 5 websites built on "vibe coding" platforms (no-code/low-code tools) expose sensitive secrets, with 25,000 leaked API keys found across 130,000 scanned sites, including a surge in AI platform credentials (72% Google Gemini, 14% OpenAI) and 16,000+ Firebase backend keys. The root cause is non-technical users following tutorials that embed API keys directly into client-side code without understanding the security implications, creating opportunities for credential theft and unauthorized service usage. Security teams should implement continuous threat exposure management (CTEM) to monitor citizen developer activities, while platforms need pre-publish secret scanning and better secret management features to prevent these exposures.
In July, BleepingComputer reported that the Akira ransomware operation was exploiting SonicWall SSL VPN devices to breach corporate networks. SonicWall eventually linked the attacks to an improper access control flaw that was patched and disclosed in late 2024. Security firm Arctic Wolf now reports an ongoing campaign against SonicWall firewalls, where threat actors are successfully logging into accounts even when one-time passwords (OTPs) are enabled. Google Threat Intelligence Group suggests that the attackers may have harvested the OTP seeds earlier and waited to use them.
Threat actors have been exploiting APIs on over 572 Milesight industrial cellular routers to send smishing campaigns targeting European users since February 2022, with a primary focus on Belgium. The messages impersonate government services, including CSAM (the central system for identity and access management for the government's online services) and eBox. The attackers leverage CVE-2023-43261 and exposed APIs to remotely send SMS messages without authentication, utilizing routers as a distributed infrastructure across multiple countries to evade detection and enable mass phishing campaigns, with over 40,000 messages sent to Swedish and Italian numbers in a single campaign. Security professionals should audit cellular router configurations for exposed SMS APIs, implement authentication requirements, update firmware to versions beyond the vulnerable 32.x and 41.x versions, and monitor for unusual POST requests to /cgi endpoints. Additionally, they should educate users to scrutinize unsolicited SMS messages that contain shortened URLs or use urgent language.
Sponsored
Insecure APIs are your highest-risk assets. Invicti discovers and scans what others miss, verifies real vulnerabilities at runtime like BOLA/BFLA, and correlates API business logic errors across SAST, SCA, and DAST. Automate validation and remediation with AI-guided fixes—all in one ASPM layer.
The FLARE team has released a new tool called QuantumStrand (qs) as part of its FLOSS suite. qs is a static string analysis tool that extracts tags and presents strings within the hierarchical context of a file's structure.
Descope provides a no-code/low-code external IAM platform that supports user, business customer, partner application, and AI agent identity management, delivering comprehensive visibility and preventing account takeover.
sbomify is a Software Bill of Materials (SBOM) and document management platform that can be self-hosted. The platform provides a centralized location to upload and manage your SBOMs and related documentation, allowing you to share them with stakeholders or make them publicly accessible.
The Cybersecurity Information Sharing Act of 2015 expired on September 30 due to a government shutdown, removing critical liability protections that enabled private sector cybersecurity threat information sharing with the government and peers. Without these legal safeguards, organizations now face potential antitrust violations, FOIA disclosure risks, and loss of trade secret protections when sharing threat intelligence, significantly reducing real-time threat visibility across critical infrastructure sectors. Security professionals should immediately consult with legal counsel before engaging in any threat-sharing activities and may need to revert to pre-2015 bilateral agreements, where available, as the timing for congressional reauthorization remains uncertain.
Phantom Taurus is a Chinese state-sponsored APT group targeting government and telecom organizations across Africa, the Middle East, and Asia for espionage aligned with PRC interests. Evolving from email attacks to database targeting, it utilizes custom tools like the NET-STAR malware suite, which includes three fileless .NET backdoors (IIServerCore, AssemblyExecuter V1/V2), to compromise IIS web servers. It employs evasion tactics such as AMSI and ETW bypasses. Security teams should watch for TTPs such as timestomping, fileless execution within w3wp.exe, and ASPX web shells, including OutlookEN.aspx, while managing threat exposure to detect infrastructure sharing among Chinese APT groups.
A critical vulnerability (CVE-2025-10725) has been identified in Red Hat OpenShift AI that allows authenticated attackers to escalate privileges and potentially compromise entire cloud environments. Versions 2.19, 2.21, and RHOAI are affected. Red Hat recommends limiting permissions, especially for system groups, and suggests granting job creation rights only to specific users or groups to minimize risk.
Sponsored
Tired of babysitting your firewall? Intrusion Shield for AWS uses 30+ years of threat intelligence to auto-generate rules, block risky
Apple has introduced a "Display Pulse Smoothing" setting in iPhone 17 that addresses PWM flickering-induced eyestrain by enabling DC dimming as an alternative to pulse width modulation for OLED brightness control at low brightness levels below 25%.
A new privacy protection act, aiming to stop the sale of personal information and better shield Americans from stalking and violence, was blocked in the Senate by Ted Cruz.
WestJet, Canada's second-largest airline, experienced a significant data breach exposing the personal information of 1.2 million passengers, including names, birth dates, addresses, and travel documents, in a cyberattack attributed to the Scattered Spider group, known for its social engineering tactics.