Patches
An advisory, ICSA-25-231-02, details an improper verification of cryptographic signatures in the Siemens Mendix SAML module (CVE-2025-40758) that can enable account hijacking under specific single sign-on configurations. The affected Mendix module series span versions compatible with Mendix 9.24-, 10.12-, and 10.21-, with patched releases identified as V3.6.21, V4.0.3, and V4.1.2. The CVSS v3.1 base score is 8.7; the advisory cites high attack complexity and no known public exploitation to date. Recommended actions include updating to the fixed module versions and ensuring the UseEncryption option is enabled where applicable, alongside standard hardening guidance for minimizing control system exposure and securing remote access.
A second notice, ICSA-25-231-01, covers a local privilege escalation in the Wibu CodeMeter runtime (CVE-2025-47809) affecting Siemens Desigo CC (V5.0–V8) and SENTRON Powermanager (V5–V8). The flaw can allow an unprivileged local user to open a privileged instance of Windows Explorer immediately after installation, before a logoff or reboot, when specific conditions are met. It is not remotely exploitable but carries high impact (CVSS 8.2). The mitigation is to remove vulnerable CodeMeter runtime versions, install CodeMeter v8.30a, and restart client and server systems, alongside standard industrial control security practices and change-impact analysis.
A separate disclosure from Kaspersky summarizes the PerfektBlue vulnerability chain—four OpenSynergy Blue SDK issues (CVE-2024-45431 through CVE-2024-45434)—that can be combined to achieve remote code execution on automotive head units once a Bluetooth pairing succeeds. Exploitation abuses AVRCP to trigger an operating system error, then inherits Bluetooth privileges, potentially exposing microphones, location data, and address books, and—in some architectures—enabling movement toward CAN-connected ECUs. Patches were issued by OpenSynergy in September 2024, but distribution depends on vehicle manufacturers and dealers. Mitigations include applying available firmware updates, disabling Bluetooth when not needed, and relying on user confirmation prompts to block unauthorized pairing.
Incidents
KrebsOnSecurity reports that a 22-year-old from Oregon has been charged with operating the Rapper Bot DDoS-for-hire service, a botnet composed of tens of thousands of compromised IoT devices. According to a criminal complaint, the operation produced routine floods exceeding two terabits per second and occasionally surpassing six terabits, with more than 370,000 attacks against roughly 18,000 victims observed from April through early August 2025 across about 1,000 networks. Investigators traced infrastructure through payment and account records and recovered chat logs describing log wiping and vulnerability hunting to grow the botnet, which reused code from fBot/Satori and Mirai. The complaint links Rapper Bot to a March 10, 2025 attack that caused intermittent outages on Twitter/X. The defendant is charged with aiding and abetting computer intrusions.
Separately, the Netherlands’ Public Prosecution Service disconnected systems after signs of unauthorized access via Citrix vulnerabilities, causing collateral outages in traffic enforcement. As Bitdefender recounts, fixed speed cameras, average speed checks, and many portable cameras went offline because back-end systems were taken down during incident response; devices could not be reactivated until the threat was fully removed. The outage disrupted automated enforcement and slowed judicial processes that temporarily fell back to paper workflows.
Research
Cisco’s threat team documents a rise in ransomware activity targeting Japanese organizations. In H1 2025, Talos counted 68 incidents (roughly 1.4× H1 2024), averaging about 11 per month, with small and mid-sized enterprises making up 69% of victims. Manufacturing saw the largest share of cases. Following disruption of several prominent groups, Qilin emerged as the most active actor with eight confirmed victims. The report highlights Kawa4096’s KaWaLocker, which uses Salsa20 with chunking, registers custom file extensions and icons, supports multi-threaded and targeted encryption, attempts to delete backups and logs, and implements double extortion. Indicators and technical details are provided to support hunting and response.
Unit 42 examines how attackers are exploiting the rapid growth of web-based GenAI platforms for phishing and brand abuse. The analysis from Unit 42 notes AI use more than doubled within six months, with high-tech sectors leading adoption. Around 40% of observed phishing misuse involved AI website builders, ~30% writing assistants, and ~11% chatbots. The team identified live credential-stealing pages built on AI site generators with minimal verification and simple lures hosted on third-party writing platforms. The report recommends layered defenses, including advanced URL and DNS protections, and shares indicators to aid detection.
Platforms
AWS lowered friction for developers using open-weight models by making two OpenAI foundation models—gpt-oss-120b and gpt-oss-20b—available by default in its managed AI service. The announcement on Bedrock states that administrators retain governance through IAM and Service Control Policies. In parallel, Amazon RDS for SQL Server added Kerberos authentication with self-managed Active Directory, removing the prior requirement for AWS Managed Microsoft AD; the capability spans commercial and GovCloud regions, per the update for RDS. Together, the changes streamline AI experimentation while preserving access controls, and simplify lift-and-shift migrations for Windows-integrated authentication.
The contact center platform expanded its collaboration features: Amazon Connect now supports multi-user web, in-app, and video calling across all available regions. Agents can add participants during live calls or host scheduled sessions with audio, video, and screen sharing to keep multi-stakeholder engagements in a single interaction. The enhancement targets complex scenarios—such as joint financial or medical consultations—and prompts operational reviews around consent, recording, bandwidth, device requirements, and integration with routing and CRM workflows.