Cloud Security Integrations, Plus CISA ICS and Ransomware Updates

Google Announces Unified Security Recommended Program

🔒 Google Cloud is launching the Google Unified Security Recommended program to validate deep integrations between its security portfolio and third-party vendors. Inaugural partners CrowdStrike, Fortinet, and Wiz bring endpoint, network, and multicloud CNAPP capabilities into Google Security Operations. Partners commit to cross-product technical integration, a collaborative support model, and investment in AI initiatives such as the model context protocol (MCP). Qualified solutions will be available via Google Cloud Marketplace for simplified procurement and consolidated billing.

Looker Conversational Analytics Reaches General Availability

💬 Google Cloud has made Looker Conversational Analytics generally available, bringing natural-language data queries to all Looker users. Built on the Looker semantic layer and powered by Gemini and Google’s agentic frameworks, the feature provides instant, explainable answers and supports multi-turn exploration across up to five connected Explores. Analysts can build and share agents, use LookML for fine tuning, and rely on a governed foundation that surfaces “How was this calculated?” explanations. Admins can enable the capability now to accelerate data discovery and improve self-service across teams.

ECS Service Connect: Cross-Account Support in GovCloud

🔗 Amazon ECS Service Connect now supports cross-account communication in AWS GovCloud through integration with AWS Resource Access Manager (AWS RAM). You can share the underlying AWS Cloud Map namespaces with individual accounts, Organizational Units (OUs), or your entire AWS Organization to register services from multiple accounts in a single namespace. The capability works for both Fargate and EC2 launch modes in GovCloud (US-West and US-East) and is available via Console, API, SDK, CLI, and CloudFormation, simplifying service discovery and reducing duplication.

Fortinet Named Google Unified Security Recommended Partner

🔒 Fortinet has been named the inaugural Google Unified Security Recommended partner for network protection, integrating FortiSASE and the FortiGate NGFW to run natively on Google Cloud. The integration delivers unified policy and shared telemetry with Google Security Operations, combining FortiGuard Labs and Google threat intelligence for AI-driven detection and response. Customers gain consolidated management, improved performance via Google’s backbone, and simplified procurement through the Google Cloud Marketplace.

Google Cloud expands Hugging Face support for AI developers

🤝 Google Cloud and Hugging Face are deepening their partnership to speed developer workflows and strengthen enterprise model deployments. A new gateway will cache Hugging Face models and datasets on Google Cloud so downloads take minutes, not hours, across Vertex AI and Google Kubernetes Engine. The collaboration adds native TPU support for open models and integrates Google Cloud’s threat intelligence and Mandiant scanning for models served through Vertex AI.

Rockwell Automation FactoryTalk DataMosaix Vulnerabilities

🔒 Rockwell Automation disclosed multiple vulnerabilities in FactoryTalk DataMosaix Private Cloud that can enable MFA bypass and persistent cross-site scripting. The issues, tracked as CVE-2025-11084 and CVE-2025-11085, affect 7.11 and selected 8.x releases and carry CVSS v4 scores up to 8.6, indicating high severity. Rockwell has released patches and CISA advises applying updates, minimizing network exposure, and isolating control networks to reduce remote exploitation risk.

From Vulnerability Management to Exposure Platform

🛡️ CrowdStrike argues legacy vulnerability management cannot keep pace with AI-accelerated adversaries. Their Falcon Exposure Management platform leverages a single lightweight sensor to deliver continuous, native visibility across endpoints, cloud, and network assets. It pairs adversary-aware risk prioritization with agentic automation and Charlotte Agentic SOAR to reduce manual triage and remediate high-risk exposures quickly. The emphasis is on speeding effective action, cutting tool sprawl, and focusing teams on the small subset of issues that drive most breach risk.

CISA Orders Feds to Patch Actively Exploited Cisco Flaws

🔒 CISA has ordered U.S. federal agencies to fully patch two actively exploited vulnerabilities in Cisco firewall appliances within 24 hours. Tracked as CVE-2025-20362 and CVE-2025-20333, the flaws permit unauthenticated access to restricted URL endpoints and remote code execution; chained together they can yield full device takeover. The agency emphasized applying the latest updates to all ASA and Firepower devices immediately, not just Internet-facing units.

Zero-day Campaign Targets Cisco ISE and Citrix Systems

🔒 Amazon Threat Intelligence disclosed an advanced APT campaign that weaponized zero-day vulnerabilities in Citrix NetScaler (Citrix Bleed 2, CVE-2025-5777) and Cisco Identity Services Engine (CVE-2025-20337). Attackers achieved pre-auth remote code execution via input-validation and deserialization flaws and deployed an in-memory web shell masquerading as the ISE IdentityAuditAction component. The implant registered as a Tomcat HTTP listener, used DES with nonstandard Base-64 encoding, required specific HTTP headers, and relied on Java reflection and bespoke decoding routines to evade detection.

CISA Adds Critical WatchGuard Fireware Flaw to KEV

🔒 CISA has added a critical WatchGuard Fireware vulnerability, CVE-2025-9242 (CVSS 9.3), to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The out-of-bounds write in the OS iked process affects Fireware OS 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.3 and 2025.1 and can allow remote unauthenticated code execution. Researchers at watchTowr Labs attribute the flaw to a missing length check on an identification buffer used during the IKE handshake, which permits a pre‑authentication code path before certificate validation. Shadowserver scans show over 54,300 vulnerable Firebox instances worldwide (about 18,500 in the U.S.), and Federal Civilian Executive Branch agencies are directed to apply WatchGuard patches by December 3, 2025.

Operation Endgame Takedown Disrupts Major Malware Campaign

🛡️ Investigators disrupted the infrastructure for the Rhadamanthys credential stealer and targeted the VenomRAT remote‑access trojan as part of Operation Endgame. Authorities secured data linked to more than 650,000 victims and published it on information platforms so people can verify exposure. A suspect was arrested in Greece, 11 premises were searched and over $200 million in cryptocurrency assets were frozen.

CISA Updates Advisory: Akira Ransomware Evolution Update

🔐 CISA and partner agencies published an updated advisory on Nov. 13, 2025, detailing new indicators, tactics, and detection guidance related to Akira ransomware. The update documents expanded targeting across Manufacturing, Education, IT, Healthcare, Financial, and Food and Agriculture, and links activity to groups such as Storm-1567 and Punk Spider. Key findings include exploitation of edge and backup vulnerabilities, use of remote management tools for defense evasion, and a faster, more destructive Akira_v2 variant that complicates recovery.

Rockwell Studio 5000 Simulation Interface Vulnerabilities

⚠️ Rockwell Automation disclosed two local vulnerabilities in Studio 5000 Simulation Interface (version 2.02 and earlier) that allow path traversal–based local code execution (CVE-2025-11696) and a local SSRF that can trigger outbound SMB requests for NTLM hash capture (CVE-2025-11697). Both issues carry high severity (CVSS v4: 9.3 and 8.8) and are exploitable by low-complexity local attackers. Rockwell recommends upgrading to version 3.0.0 or later; CISA advises isolating control system networks, minimizing exposure, and following secure remote-access practices.

Rockwell FactoryTalk Policy Manager DoS Vulnerability

⚠ Rockwell Automation reported a remotely exploitable vulnerability (CVE-2024-22019) in FactoryTalk Policy Manager that can lead to resource exhaustion and denial of service. The issue stems from Node.js HTTP handling of chunked transfer encoding (CWE-404) that permits unbounded reads from a single connection. Affected releases include Version 6.51.00 and earlier; Rockwell corrected the issue in Version 6.60.00. CISA assigns a high severity rating (CVSS v4 8.7) and recommends upgrading, minimizing network exposure, and isolating control networks behind firewalls.

Siemens Spectrum Power 4 Vulnerabilities and Patches

🔒 Siemens disclosed multiple vulnerabilities in Spectrum Power 4 that allow privilege escalation and remote command execution in affected versions prior to V4.70 SP12 Update 2. Several issues carry high severity ratings (CVSS v4 up to 8.7) and include weaknesses such as incorrect privilege and permission assignments (CWE-266, CWE-732), incorrect use of privileged APIs (CWE-648), and inclusion of untrusted control-sphere functionality (CWE-829). Siemens recommends updating to V4.70 SP12 Update 2 and limiting network exposure; CISA reiterates defensive best practices.

Brightpick Mission Control and Internal Logic Control Flaws

⚠️ CISA published an advisory on November 13, 2025, warning that Brightpick AI devices — Mission Control and Internal Logic Control — contain multiple high-severity weaknesses that are remotely exploitable. Tracked as CVE-2025-64307, CVE-2025-64308, and CVE-2025-64309, the issues include missing authentication, hardcoded credentials in client-side JavaScript, and an unauthenticated WebSocket endpoint. Calculated scores reach up to CVSS v4 8.7, and CISA advises isolating affected systems, minimizing network exposure, and using secure remote access while conducting impact assessments.

Critical Flaws in General Industrial Controls Lynx+ Gateway

⚠️ CISA reports multiple high-severity vulnerabilities affecting General Industrial Controls Lynx+ Gateway, including weak password requirements, missing authentication for critical functions, and cleartext transmission of sensitive data. These issues carry CVSS v4 scores up to 9.2 and permit remote exploitation with low attack complexity, potentially enabling unauthorized access, device resets, information disclosure, or denial-of-service. Affected firmware versions include R08, V03, V05, and V18; the findings were disclosed in November 2025. CISA recommends minimizing network exposure, isolating control devices behind firewalls, and using secure remote access methods such as updated VPNs while coordinating with the vendor.

Siemens LOGO! 8 Vulnerabilities: Remote Exploitation Risk

⚠️ Siemens published an advisory for LOGO! 8 and SIPLUS LOGO! devices detailing three vulnerabilities (CVE-2025-40815, CVE-2025-40816, CVE-2025-40817) that could enable remote code execution, denial-of-service, or unauthenticated device manipulation. CVE-2025-40815 is a buffer overflow (CVSSv4 8.6) caused by improper TCP packet validation; the others are missing-authentication issues affecting IP and time configuration. Siemens is preparing fixes; interim mitigations include protecting LSC access with a strong password and restricting UDP port 10006 to trusted IPs while CISA recommends impact analyses before changes.

Operation Endgame Disrupts Multiple Malware Networks

🛡️ A coordinated law enforcement operation led by Europol and Eurojust between November 10–13, 2025 disrupted major malware infrastructures, including Rhadamanthys Stealer, Venom RAT, and an Elysium botnet. Authorities seized 20 domains, took down more than 1,025 servers and arrested a primary suspect in Greece on November 3. Europol said the dismantled networks encompassed hundreds of thousands of infected machines and several million stolen credentials, and that the infostealer operator had access to roughly 100,000 cryptocurrency wallets.

ThreatsDay Bulletin: Key Cybersecurity Developments

🔐 This ThreatsDay Bulletin surveys major cyber activity shaping November 2025, from exploited Cisco zero‑days and active malware campaigns to regulatory moves and AI-related leaks. Highlights include CISA's emergency directive after some Cisco updates remained vulnerable, a large-scale study finding 65% of AI firms leaked secrets on GitHub, and a prolific phishing operation abusing Facebook Business Suite. The roundup stresses practical mitigations—verify patch versions, enable secret scanning, and strengthen incident reporting and red‑teaming practices.

Synnovis Notifies NHS Clients After 2024 Ransomware

🔔 Synnovis has begun notifying its NHS customers and affected data controllers about the volume of patient information compromised in a June 2024 ransomware attack. The incident, attributed to a Qilin affiliate, saw roughly 400GB of data published and caused widespread disruption to blood services, cancelled appointments and at least one reported death. Synnovis said notifications will be completed by 21 November, citing the 'exceptional scale and complexity' of an unstructured and fragmented dataset, a delay that has drawn sharp criticism from security experts.

Kraken Ransomware Benchmarks Hosts to Choose Encryption

🔒 The Kraken ransomware targets Windows and Linux/VMware ESXi hosts and runs on-host benchmarks to decide whether to perform full or partial encryption. Cisco Talos researchers found it creates temporary files, times encryption of random data, and uses the result to select an encryption mode that maximizes damage while avoiding overloads. Before encrypting it deletes shadow volumes, stops backup services, appends .zpsc to files, and drops a readme_you_ws_hacked.txt ransom note. The group continues big‑game hunting and data theft for double extortion and has launched a forum called 'The Last Haven Board'.

CISA: Akira Ransomware Now Targets Nutanix AHV VMs

🛡️ U.S. cybersecurity agencies warn that the Akira ransomware operation has expanded to encrypt Nutanix AHV virtual machine disk files, with the first confirmed incident in June 2025. Akira Linux encryptors have been observed targeting .qcow2 virtual disk files directly rather than using AHV management commands. The advisory cites exploitation of SonicWall CVE-2024-40766 and includes new IOCs and mitigation recommendations.

RCE Flaw in ImunifyAV Threatens Millions of Hosted Sites

⚠️ ImunifyAV, a widely used Linux malware scanner, contains a remote code execution flaw in its AI-bolit component affecting versions prior to 32.7.4.0. The vulnerability is rooted in unsafe use of call_user_func_array during deobfuscation, which can execute attacker-supplied PHP function names when the scanner performs active unpacking. CloudLinux released fixes in late October and backported them on November 10; administrators should update to 32.7.4.0 or newer immediately to mitigate risk.

Washington Post Oracle Breach Exposes Nearly 10,000

🔒 The Washington Post says a zero-day in Oracle E-Business Suite was used to access parts of its network, exposing personal and financial records for 9,720 employees and contractors. The intrusion occurred between July 10 and August 22, and attackers attempted extortion in late September. The activity has been tied to the Clop group exploiting CVE-2025-61884, and impacted individuals are being offered 12 months of identity protection and advised to consider credit freezes.

IndonesianFoods worm floods npm registry with spam packages

🔍 Security researchers have uncovered a large-scale, worm-like campaign targeting the npm registry. Dubbed IndonesianFoods, the operation has run for over two years and uses at least 11 npm accounts to publish tens of thousands of spam packages. Each package contains an auto.js or publishScript.js script that, when executed, forces packages public, randomizes versions and self-publishes in a loop. Endor Labs warns a single execution can produce ~12 packages per minute and the packages interlink as dependencies, creating exponential spread, registry strain and substantial supply-chain risk.

Google Sues to Disrupt China-Based SMS Phishing Operation

📱 Google has filed suit in the Southern District of New York to unmask and disrupt 25 unnamed operators tied to Lighthouse, a China-based phishing kit that has victimized over one million people across 120 countries. The complaint alleges Lighthouse powers a “Smishing Triad” that spoofs trusted brands, blasts mass text lures, and automates enrollment of stolen cards into mobile wallets using one-time verification codes. Google asserts trademark infringement and RICO claims and seeks to dismantle the coordinated groups behind the service.

Android photo frames download malware at boot, supply risk

⚠️ Quokka's assessment of the Uhale Android platform used in many consumer digital picture frames found devices that download and execute malware on boot. The tested units update to Uhale app 4.2.0, install a JAR/DEX payload from China-based servers, and persistently load it at every reboot. Devices were rooted, shipped with SELinux disabled and signed with AOSP test-keys, increasing exposure. Quokka disclosed 17 vulnerabilities (11 with CVEs) including remote code execution, command injection, an unauthenticated file server and insecure WebViews; researchers linked artifacts to Vo1d and Mezmess while the vendor did not respond to notifications.

Rockwell Automation Verve Asset Manager Access Control Flaw

🔒 Rockwell Automation disclosed an Incorrect Authorization vulnerability in Verve Asset Manager that allows unauthorized read‑only users to read, update, and delete user accounts via the product API. The issue is tracked as CVE-2025-11862 and CISA reports a CVSS v4 base score of 8.4, noting remote exploitability and low attack complexity. Affected releases include versions 1.33 through 1.41.3; Rockwell fixed the flaw in 1.41.4 and 1.42. Administrators should prioritize updates and apply network mitigations to limit exposure.

Siemens COMOS: Critical RCE and Data Exposure Fixes

⚠ Siemens warns that COMOS contains two high‑severity vulnerabilities — CVE-2023-45133 (CVSS 9.3) and CVE-2024-0056 (CVSS 8.7) — which can enable remote code execution or expose sensitive information. Siemens has released a patch in COMOS V10.4.5 and advises operators to update promptly. Implement network segmentation, avoid direct internet exposure of control systems, and follow Siemens and CISA guidance for secure remote access and system hardening.

CISA, FBI and Partners Issue Guidance on Akira Ransomware

🛡️ CISA, FBI, DC3, HHS and international partners released updated guidance to help organizations mitigate the evolving Akira ransomware threat. The advisory details new indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) used by the group, which primarily targets small and medium-sized businesses but has also struck larger organizations across multiple sectors. It strongly urges immediate actions such as regular backups, enforcing multifactor authentication, and prioritizing remediation of known exploited vulnerabilities.

Kraken Ransomware: Cross-Platform Big-Game Hunting

🐙 Kraken is a Russian-speaking ransomware group active since February 2025 that conducts double-extortion, big-game hunting campaigns across multiple regions. In a documented intrusion Talos observed, attackers exploited SMB flaws for access, used Cloudflared for persistence, exfiltrated data via SSHFS, then deployed cross-platform encryptors for Windows, Linux and ESXi. The family includes on-host benchmarking to tune encryption, and Talos maps detections and IOCs to Cisco protections to aid response.

CISA Alerts Agencies to Exploited WatchGuard Firewall Flaw

🔔 CISA has warned federal agencies to patch a critical, actively exploited vulnerability in WatchGuard Firebox firewalls that permits remote code execution through an out-of-bounds write in Fireware OS 11.x (EOL), 12.x, and 2025.1. The agency added CVE-2025-9242 to its Known Exploited Vulnerabilities catalog and imposed a three-week remediation deadline under BOD 22-01. WatchGuard released patches on September 17 but only marked the flaw as exploited on October 21. Internet scans tracked over 75,000 vulnerable appliances before counts fell to roughly 54,000.

Amazon EC2 I8g storage-optimized instances expand to EU/Asia

🚀 Amazon Web Services has made Amazon EC2 I8g storage-optimized instances generally available in Europe (Stockholm) and Asia Pacific (Osaka). Built on the AWS Nitro System and using third-generation Nitro SSDs, I8g delivers up to 65% better storage performance per TB, plus lower I/O latency and reduced latency variability versus I4g. The family spans up to 48xlarge and one metal size with up to 1.5 TiB memory, 45 TB local NVMe storage, and up to 100 Gbps network performance, targeting transactional databases, NoSQL, real-time analytics, and LLM pre-processing workloads.

Operation Endgame 3.0 Disrupts Three Major Malware Networks

🔒 Operation Endgame 3.0 targeted and dismantled infrastructure supporting three prominent malware families — Rhadamanthys, VenomRAT and the Elysium botnet — in coordinated actions carried out between 10 and 13 November. Authorities disrupted or seized more than 1,025 servers and 20 domains, searched 11 locations across multiple countries and arrested a suspected VenomRAT operator in Greece. The initiative was led by Europol with Eurojust, national law enforcement partners and over 30 private cybersecurity organizations.

Ransomware Fragmentation and Rising Attacks in Q3 2025

🔍 The ransomware landscape in Q3 2025 reached a critical inflection point: despite law enforcement takedowns earlier in the year, attacks remained at historically high levels. Check Point Research identified 1,592 new victims across 85 active extortion groups, a 25% year‑over‑year increase. While major brands such as RansomHub and 8Base disappeared, numerous smaller actors rapidly filled the void, driving unprecedented RaaS fragmentation and complicating response efforts.

AADvance Trusted SIS Workstation: Rockwell Automation Flaw

⚠️ Rockwell Automation's AADvance-Trusted SIS Workstation has a directory traversal vulnerability (CWE-22) in DotNetZip (v1.16.0 and earlier) that can enable remote code execution if a user opens a crafted file. The issue is tracked as CVE-2024-48510 and has a CVSS v4 base score of 8.6 (CVSS v3.1 8.8). Affected versions are 2.00.00 through 2.00.04; Rockwell reports the defect is corrected in Version 2.01.00. Users unable to immediately upgrade should follow vendor guidance, minimize network exposure of control devices, isolate control networks, use secure remote access, and contact Rockwell support for assistance.

Siemens Solid Edge: Improper Certificate Validation

⚠️ Siemens disclosed an improper certificate validation vulnerability in Solid Edge SE2025 that could enable unauthenticated remote man-in-the-middle attacks against the product's license service connections. The issue is tracked as CVE-2025-40744 and carries a CVSS v3.1 base score of 7.5 and a CVSS v4 base score of 8.7, indicating high impact and low attack complexity. Siemens recommends updating to V225.0 Update 11 or later and restricting network access to licensing endpoints; CISA also advises network segmentation, use of secure remote access, and standard anti-phishing protections. No known public exploitation targeting this vulnerability has been reported.

What CISOs Should Know About Securing MCP Servers Now

🔒 The Model Context Protocol (MCP) enables AI agents to connect to data sources, but early specifications lacked robust protections, leaving deployments exposed to prompt injection, token theft, and tool poisoning. Recent protocol updates — including OAuth, third‑party identity provider support, and an official MCP registry — plus vendor tooling from hyperscalers and startups have improved defenses. Still, authentication remains optional and gaps persist, so organizations should apply zero trust and least‑privilege controls, enforce strong secrets management and logging, and consider specialist MCP security solutions before production rollout.

Over 46,000 Fake npm Packages Flood Registry Since 2024

📦 Researchers warn a large-scale spam campaign has flooded the npm registry with over 46,000 fake packages since early 2024, a coordinated, long-lived effort dubbed IndonesianFoods. The packages harbor a dormant worm in a single JavaScript file that only runs if a user manually executes commands like node auto.js, enabling automated self-publishing of thousands of junk packages. The campaign appears designed to waste registry resources, pollute search results, and possibly monetize via the Tea protocol; GitHub says it has removed the offending packages.

Russian Phishing Campaign Creates 4,300 Fake Travel Sites

💳 A Russian-speaking threat actor has registered more than 4,300 domains since early 2025 to host convincing fake travel and hotel booking pages that harvest payment card data. According to Netcraft researcher Andrew Brandt, the campaign—active since February—uses a customizable phishing kit that serves branded pages for platforms like Booking, Expedia, and Airbnb and supports 43 languages. The kit requires a unique AD_CODE in the URL to render targeted branding (otherwise visitors see a blank page), employs fake Cloudflare-style CAPTCHA, and persists state in a cookie so subsequent pages maintain consistent impersonation. Victims are prompted to pay a deposit; entered card numbers, expiry and CVV are processed in the background while a bogus support chat guides users through a sham 3D Secure step to complete the theft.

Fake Chrome Extension 'Safery' Exfiltrates Ethereum Seeds

🔒 A malicious Chrome extension posing as Safery: Ethereum Wallet was found to exfiltrate Ethereum wallet seed phrases by encoding mnemonics into synthetic Sui addresses. Socket security researcher Kirill Boychenko and Koi Security report the extension broadcasts micro-transactions (0.000001 SUI) from an attacker-controlled wallet to smuggle seed phrases on-chain without a traditional C2 server. Uploaded on September 29, 2025 and updated November 12, it remained available at the time of reporting. Users should stick to trusted wallet extensions and defenders should flag unexpected RPC calls and on-chain writes during wallet import or creation.

Police Disrupt Rhadamanthys, VenomRAT and Elysium Botnets

🔒 Law enforcement from nine countries disrupted infrastructure used by the Rhadamanthys infostealer, VenomRAT remote access trojan and the Elysium botnet during a phase of Operation Endgame. Coordinated by Europol and Eurojust with private partners, officers seized 20 domains, took down 1,025 servers and executed searches at 11 locations between 10 and 14 November 2025. A key suspect linked to VenomRAT was arrested in Greece, and authorities warn that the dismantled infrastructure contained hundreds of thousands of infected machines and several million stolen credentials, plus access to over 100,000 crypto wallets.

AVEVA Edge cryptographic weakness enables password recovery

🔒 AVEVA has released advisory ICSA-25-317-03 addressing a cryptographic weakness in AVEVA Edge (formerly InduSoft Web Studio) that could allow a local actor with read access to project or offline cache files to brute-force user or Active Directory passwords. The issue is tracked as CVE-2025-9317 and carries a CVSS v4 base score of 8.3. AVEVA provides a 2023 R2 P01 Security Update and recommends project migration, password resets, and tightened file access controls. This vulnerability is not remotely exploitable according to CISA.

Siemens DLL Hijacking in Software Center and Solid Edge

⚠ Siemens disclosed a DLL hijacking vulnerability (CVE-2025-40827) affecting Siemens Software Center and Solid Edge SE2025. The issue is an uncontrolled search path element (CWE-427) that could permit arbitrary code execution if a crafted DLL is placed on a system. Siemens has published fixes (Software Center v3.5+, Solid Edge V225.0 Update 10+) and recommends network isolation, access controls, and following its industrial security guidance to reduce risk.

IndonesianFoods Worm Floods npm with 100,000 Packages

🪲 A self-replicating campaign named IndonesianFoods is spamming the npm registry by creating new packages roughly every seven seconds, with Sonatype reporting more than 100,000 published components. The packages use random Indonesian names and food terms and currently contain no known data-stealing payloads, but researchers warn a future update could introduce malware. Some packages appear to exploit the TEA Protocol to inflate contribution scores and earn tokens, pointing to a financial motive. Developers are urged to lock dependencies, monitor unusual publishing patterns, and enforce strict signature validation.

AWS Transform Generates LZA Network Configurations

🔁 AWS now enables AWS Transform for VMware to automatically generate network configuration YAML files that are directly compatible with the Landing Zone Accelerator on AWS (LZA). Building on Transform’s existing infrastructure-as-code outputs for AWS CloudFormation, AWS CDK, and Terraform, the capability converts VMware network environments into LZA-ready YAML that can be imported into LZA’s deployment pipeline. The feature is available in all AWS Transform target Regions and is intended to reduce manual effort and deployment time while improving consistency across multi-account environments.

Amazon EC2 I8g Storage-Optimized Instances Expand Regions

🚀 Amazon Web Services announced general availability of Amazon EC2 I8g Storage Optimized instances in Asia Pacific (Seoul) and South America (São Paulo). These instances use third-generation AWS Nitro SSDs to deliver up to 65% better real-time storage performance per TB, with significantly lower storage I/O latency and variability. I8g instances target I/O-intensive, low-latency workloads with up to 45 TB local NVMe storage, up to 100 Gbps networking, and 60 Gbps dedicated EBS bandwidth across multiple sizes including a metal option.

Viasat KA-SAT Attack and Satellite Cybersecurity Lessons

🛰️ Cisco Talos revisits the Feb. 24, 2022 KA‑SAT incident where attackers abused a VPN appliance vulnerability to access management systems and deploy the AcidRain wiper. The malware erased modem and router firmware and configs, disrupting satellite communications for many Ukrainian users and unexpectedly severing remote monitoring for ~5,800 German Enercon wind turbines. The piece highlights forensic gaps, links to VPNFilter-era tooling, and the operational choices defenders face when repair or replacement are on the table.

Siemens Altair Grid Engine Vulnerabilities Advisory Notice

⚠️ Siemens Altair Grid Engine contains multiple local vulnerabilities that can enable privilege escalation and arbitrary code execution with superuser rights. One issue discloses password hashes in error messages (CWE-209, CVE-2025-40760, CVSS 5.5) and another allows library path hijacking via uncontrolled environment variables (CWE-427, CVE-2025-40763, CVSS 7.8). Siemens and CISA recommend updating to V2026.0.0 and applying mitigations such as removing setuid bits from affected binaries where appropriate.

CISA Releases 18 Industrial Control Systems Advisories

🔔 CISA released 18 Industrial Control Systems (ICS) advisories addressing security flaws across a broad set of vendors and product families. The advisories cover firmware, application software, and cloud services used in operational technology and industrial environments, including products from Siemens, Rockwell Automation, AVEVA, and Mitsubishi Electric. Administrators should review the advisories for technical details and apply vendor mitigations, patches, and compensating controls promptly to reduce risk to availability and safety.

Rust in Android: Faster Development and Fewer Bugs

🦀 Rust adoption in Android is delivering both security and speed gains, with 2025 data showing memory-safety flaws falling below 20% of total vulnerabilities. Android reports a ~1000x reduction in memory-safety vulnerability density for Rust versus C/C++, plus 20% fewer revisions, 25% shorter code review time, and a ~4x lower rollback rate. Expansion includes kernel, firmware, and first-party apps; a near-miss CVE was fixed pre-release and led to improved allocator crash reporting and additional unsafe-Rust training.

Amazon RDS for PostgreSQL: New Minor Versions Available

🐘 Amazon RDS for PostgreSQL now supports minor versions 17.7, 16.11, 15.15, 14.20, and 13.23; AWS recommends upgrading to address known security vulnerabilities and receive community bug fixes. The release adds the pgcollection extension for RDS PostgreSQL 15.15 and above (including 16.11 and 17.7), providing an ordered, efficient key-value collection type usable inside PostgreSQL functions to speed in-memory data processing. Extension updates include pg_tle 1.5.2 and H3_PG 4.2.3, and operators can use automatic minor version upgrades or Blue/Green deployments to minimize disruption during upgrades.

Microsoft deploys Teams screen-capture prevention rollout

🔒 Microsoft is rolling out a new Teams Premium setting that blocks screenshots and recordings in meetings on Windows desktop and Android devices. The feature, called 'Prevent screen capture', was announced for July 2025 but the rollout was delayed and is being introduced in late November 2025. The control is off by default and must be enabled per meeting by organizers or co-organizers; unsupported clients will join audio-only.

Amazon EC2 U7i-12tb Instances Launch in Stockholm Region

🚀 Amazon has made EC2 High Memory U7i instances with 12TB of DDR5 memory available in the Europe (Stockholm) Region. The u7i-12tb.224xlarge offers 896 vCPUs, up to 100 Gbps for both EBS and networking, and supports ENA Express for improved network performance. Powered by custom fourth‑generation Intel Xeon (Sapphire Rapids), these instances target mission‑critical in‑memory databases such as SAP HANA, Oracle, and SQL Server, enabling higher transaction throughput and faster data loading.

AI Sidebar Spoofing Targets Comet and Atlas Browsers

⚠️ Security researchers disclosed a novel attack called AI sidebar spoofing that allows malicious browser extensions to place counterfeit in‑page AI assistants that visually mimic legitimate sidebars. Demonstrated against Comet and confirmed for Atlas, the extension injects JavaScript, forwards queries to a real LLM when requested, and selectively alters replies to inject phishing links, malicious OAuth prompts, or harmful terminal commands. Users who install extensions without scrutiny face a tangible risk.

Widespread Outdated and Unmanaged Devices Threaten Networks

🔒 Palo Alto Networks found that 26% of Linux systems and 8% of Windows systems are running outdated versions across telemetry from 27 million devices spanning 1,800 companies. The analysis also shows 39% of devices lack active endpoint protection and roughly one-third of devices operate outside IT control. Poor segmentation and unmanaged edge devices increase the risk of undetected compromise.

Rogue MCP Servers Can Compromise Cursor's Embedded Browser

⚠️ Security researchers demonstrated that a rogue Model Context Protocol (MCP) server can inject JavaScript into the built-in browser of Cursor, an AI-powered code editor, replacing pages with attacker-controlled content to harvest credentials. The injected code can run without URL changes and may access session cookies. Because Cursor is a Visual Studio Code fork without the same integrity checks, MCP servers inherit IDE privileges, enabling broader workstation compromise.

AVEVA Application Server IDE Cross-Site Scripting Risk

⚠ AVEVA reported a basic cross-site scripting vulnerability (CVE-2025-8386) in the Application Server IDE affecting versions 2023 R2 SP1 P02 and earlier. An authenticated user with the aaConfigTools privilege can modify App Objects' help files to persist XSS that may execute in other users' sessions, potentially enabling horizontal or vertical privilege escalation. AVEVA provides a fix in System Platform 2023 R2 SP1 P03; CISA advises auditing permissions, minimizing network exposure, and using secure remote access methods.

Amazon EventBridge Adds SQS Fair Queue Target Support

🚀 Amazon EventBridge now supports sending events directly to Amazon SQS fair queues, improving message distribution across consumer groups and reducing noisy-neighbor effects in multi-tenant systems. You can choose a fair queue as an EventBridge target via the AWS Management Console, AWS CLI, or AWS SDKs and must supply a MessageGroupID, either as a static value or using a JSON path. Fair queues let multiple consumers process messages from the same tenant concurrently while keeping processing times consistent. Support for Fair Queue and FIFO targets is available in all AWS commercial and AWS GovCloud (US) Regions.

AWS Expands EC2 G6f NVIDIA L4 GPU Instances to More Regions

🚀 Amazon Web Services has expanded availability of EC2 G6f instances powered by NVIDIA L4 GPUs to Europe (Spain) and Asia Pacific (Seoul), improving access for graphics and visualization workloads. G6f instances support GPU partitions as small as one-eighth of a GPU with 3 GB of GPU memory, enabling finer-grained right-sizing and cost savings compared to single‑GPU options. Instances are offered in multiple sizes paired with third‑generation AMD EPYC processors, and are purchasable as On‑Demand, Spot, or via Savings Plans; customers should use NVIDIA GRID driver 18.4 or later to launch these instances.

AWS CloudFormation Hooks Add Granular Invocation Details

🔍 AWS CloudFormation Hooks now supports granular invocation details, allowing hook authors to attach per-control findings, severity levels, and remediation guidance to their evaluation responses. The Hooks console displays these details at the individual control level within each invocation so developers can drill down from the summary to see which controls passed, failed, or were skipped. Available in all commercial and GovCloud (US) regions, this follow-up to the September 2025 Hooks Invocation Summary accelerates troubleshooting and streamlines compliance reporting with actionable, control-level insights.

Amazon EC2 I7i Instances Expand to Additional Regions

🚀 Amazon Web Services has expanded availability of Amazon EC2 I7i Storage Optimized instances to AWS Europe (Ireland) and Asia Pacific (Seoul, Hong Kong). Powered by 5th‑generation Intel Xeon Scalable processors and 3rd‑generation AWS Nitro SSDs, I7i delivers up to 23% better compute and notable storage-performance and latency improvements versus I4i. Available in eleven sizes, including bare metal, these instances are aimed at I/O‑intensive, latency‑sensitive workloads that require very high random IOPS and multi‑TB dataset access.

AWS Health Adds Multi-Region EventBridge Resilience

🔁 AWS Health now sends events simultaneously to the impacted AWS Region and US West (Oregon), enabling customers to create multi-region, redundant Amazon EventBridge rules or a simplified single-rule path that captures all commercial-partition Health events. US West (Oregon) serves as the backup for all commercial regions, with US East (N. Virginia) as the backup for US West. In China and AWS GovCloud the service delivers events to their respective paired regions. The update is available in all AWS regions.

Amazon Kinesis Video Streams adds WebRTC multi-viewer

📹 Amazon Kinesis Video Streams now supports WebRTC-based multi-viewer streaming, enabling up to three concurrent viewers of a live feed without increasing device compute or bandwidth. The feature records session audio and video to the cloud for storage, playback, and analytics, and supports two-way audio so participants can communicate in real time. Developers can use the Kinesis Video Streams with WebRTC SDK across cameras, IoT devices, PCs, and mobile devices to build live and on-demand scenarios such as home security, remote proctoring, and robot control centers.

AWS Network Load Balancer Adds QUIC Passthrough Mode

🚀 AWS announced that the Network Load Balancer (NLB) now supports QUIC in passthrough mode, enabling low-latency forwarding of QUIC traffic while preserving session stickiness via the QUIC Connection ID. This helps mobile applications maintain consistent connections when client IPs change during roaming between cellular towers or when switching between Wi‑Fi and cellular. You can enable QUIC on existing or new NLBs through the AWS Management Console, CLI, or APIs. QUIC support is available at no additional charge in all AWS commercial and AWS GovCloud (US) regions and is metered under existing UDP Load Balancer Capacity Unit entitlements.

Machine-Speed Security: Patching Faster Than Attacks

⚡ Attackers are weaponizing many newly disclosed CVEs within hours, forcing defenders to close the gap by moving beyond manual triage to automated remediation. Drawing on 2025 industry reports and CISA and Mandiant observations, the article notes roughly 50–61% of new vulnerabilities see exploit code within 48 hours. It urges adoption of policy-driven automation, controlled rollback, and streamlined change processes to shorten exposure windows while preserving operational stability.

techUK Urges Collaboration to Tackle Rising Fraud Now

🔍 techUK has published its Anti-Fraud Report 2025, warning that fraud now accounts for 40% of crime in the UK and that an estimated 67% is cyber-enabled. The report urges improved collaboration across law enforcement, banks, tech platforms, telecoms and regulators and recommends a connected anti-fraud ecosystem, wider use of AI and machine learning, and a national Tell Us Once victim-reporting model. It highlights the scale of harm—global losses of about $1 trillion in 2024—and cautions that government action is still being finalised.

Amazon Connect adds completion metrics for agent evaluations

📊 Amazon Connect now provides metrics that track completion of agent performance evaluations, helping managers verify that required reviews (for example, five per agent per month) are finished. The capability displays real-time analytics in the Connect UI and exposes the same signals via APIs for integration with reporting workflows. Teams can also compare scoring patterns across managers to identify evaluation consistency and accuracy improvements.

Fortinet Named Google Unified Security Recommended Partner

🔒 Fortinet has been named the inaugural Google Unified Security Recommended partner for network protection, recognizing FortiSASE and FortiGate NGFW running natively on Google Cloud. The collaboration delivers a cloud-native SASE that unifies networking and security with global PoPs on Google’s private backbone, centralized policy and telemetry via FortiManager, and AI-enhanced threat protection from FortiGuard Labs. Customers can deploy through Google Cloud Marketplace and expect lower TCO through a consolidated architecture and simplified operations.

Time Travel Debugging for .NET Process Hollowing Analysis

🕒 This post introduces Time Travel Debugging (TTD) via WinDbg as a high-value tool for accelerating analysis of obfuscated, multi-stage .NET droppers that perform process hollowing. The authors demonstrate recording a TTD trace, querying the Debugger Data Model with LINQ to find CreateProcess and WriteProcessMemory calls, and extracting a hidden AgentTesla payload. It highlights practical tips, tooling (TTD.exe, FLARE-VM), and limitations such as user-mode scope and proprietary trace formats.

AWS IoT Core Adds Location Resolution for Sidewalk Devices

📡 AWS IoT Core Device Location now resolves approximate positions for Amazon Sidewalk-enabled devices using inputs such as WiFi access points, GNSS, and Bluetooth Low Energy. The service converts those inputs into geo-coordinates and delivers them to AWS IoT rules or MQTT topics to support asset tracking and geo-fencing without GPS hardware. To get started, install Sidewalk SDK v1.19 or later, provision devices in AWS IoT Core for Amazon Sidewalk, and enable location during provisioning. This capability is available in the AWS US-East (N. Virginia) Region; the Amazon Sidewalk network is available only in the United States.

Siemens SICAM P850/P855: CSRF and Session Token Flaws

🔒 Siemens reported Cross-Site Request Forgery and incorrect permission assignment vulnerabilities affecting SICAM P850 and P855 devices (versions prior to 3.11). Exploitation could allow attackers to perform actions as authenticated users or impersonate sessions. Siemens recommends updating to v3.11+, restricting TCP/443 to trusted IPs, and hardening network access; CISA advises isolating control networks and avoiding internet exposure.

Kerberoasting in 2025: Protecting Service Accounts

🔒 Kerberoasting remains a persistent threat to Active Directory environments, enabling attackers to request service tickets for SPNs and crack their password hashes offline to escalate privileges. Adversaries use freely available tools like GetUserSPNs.py and Rubeus to extract tickets tied to service accounts, then perform offline brute-force attacks against the ticket encryption. Mitigations recommended include regular AD password audits, using gMSAs with auto-managed long passwords, preferring AES over RC4, enforcing non-reusable 25+ character passwords with rotation, and deploying MFA and robust password policies.

Google Asks US Court to Shut Down Lighthouse Phishing

🛡️ Google has asked a US court to dismantle infrastructure used by the Lighthouse phishing‑as‑a‑service operation after identifying at least 107 sign‑in templates that mimic Google branding. The service is marketed to attackers who send smishing links and host fraudulent sign‑in pages to harvest credentials. Google also urged Congress to consider GUARD, Foreign Robocall Elimination and SCAM bills to bolster enforcement and funding. The company declined additional comment.

Finding Salt failures: blaming commits to speed releases

🔍 Cloudflare explains how they accelerated triage and reduced release delays for Salt-managed configuration changes across thousands of servers. They implemented a local job cache on minions to retain job results, built a Salt Blame execution module to correlate failed highstates with commits, releases and external outages, and automated hierarchical triage from chat. These changes removed repetitive SSH-and-log workflows, made root-cause attribution self-service for SREs, and yielded a measurable >5% reduction in time lost to Salt-related release delays while enabling ongoing analytics and feedback.

Mitsubishi MELSEC iQ-F Series TCP DoS Vulnerability

🚨 Mitsubishi Electric disclosed a TCP communication vulnerability (CVE-2025-10259) in the MELSEC iQ-F Series CPU modules that can be triggered remotely to disconnect a session and cause a denial-of-service condition. The issue is remotely exploitable with low attack complexity and carries a CVSS v3.1 base score of 5.3. Mitsubishi recommends using VPNs and limiting physical and LAN access while applying vendor guidance and assessing risk.

Smashing Security Ep. 443: Tinder, Buffett Deepfake

🎧 In episode 443 of Smashing Security, host Graham Cluley and guest Ron Eddings examine Tinder’s proposal to scan users’ camera rolls and the emergence of convincing Warren Buffett deepfakes offering investment advice. They discuss the privacy, consent and fraud implications of platform-level image analysis and the risks posed by synthetic media. The conversation also covers whether agentic AI could replace human co-hosts, the idea of EDR for robots, and practical steps to mitigate these threats. Cultural topics such as Lily Allen’s new album and the release of Claude Code round out the episode.

CISO Pay Rises 6.7% as Budgets Slow and Mobility Grows

📰 IANS Research polled 566 CISOs across the US and Canada between April and October 2025 and found average total compensation (salary, bonus and equity) rose 6.7% year‑on‑year. The report highlights sharp pay dispersion: the top 1% report over $3.2m—about ten times the median—while 70% of CISOs receive equity that often drives top packages. Budgets grew just 4% (the slowest pace in five years), CISO mobility climbed to 15%, and tech and financial services led sector pay at averages of $844,000 and $744,000 respectively.

Password managers under attack: risks, examples, defenses

🔐 Password managers centralize credentials but are attractive targets for attackers who exploit phishing, malware, vendor breaches, fake apps and software vulnerabilities. Recent incidents — including a 2022 LastPass compromise and an ESET‑reported North Korean campaign — demonstrate how adversaries can exfiltrate vault data or trick users into surrendering master passwords. To reduce risk, use a long unique master passphrase, enable 2FA, keep software and browsers updated, install reputable endpoint security, and only download official apps from trusted stores.

Four Steps for Startups to Build Multi-Agent Systems

🤖 This post outlines a concise four-step framework for startups to design and deploy multi-agent systems, illustrated through a Sales Intelligence Agent example. It recommends choosing between pre-built, partner, or custom agents and describes using Google's Agent Development Kit (ADK) for code-first control. The guide covers hybrid architectures, tool-based state isolation, secure data access, and a three-step deployment blueprint to run agents on Vertex AI Agent Engine and Cloud Run.

Book Review: The Business of Secrets and 1970s Crypto

🔐 Fred Kinch’s memoir recounts his years selling commercial cryptographic hardware from 1969 to 1982, chronicling Datotek’s pivot from file to link encryption and the chaotic marketplace of the era. He describes regulatory battles, notably ITAR and NSA scrutiny, alongside anecdotal demonstrations of security that now seem alarmingly informal. Kinch’s stories reveal a world where vendors, customers, and even governments often accepted cryptographic strength on trust rather than proof.