Security, FUD, and Advisories

posted by Roy Schestowitz on Aug 22, 2025

• LWN ☛ Security updates for Thursday

  Security updates have been issued by AlmaLinux (libarchive, mingw-sqlite, pki-deps:10.6, and tomcat), Debian (chromium and firefox-esr), Fedora (python3.6 and suricata), Oracle (go-toolset:rhel8, kernel, libarchive, mingw-sqlite, tomcat, and xterm), Red Hat (kernel), Slackware (mozilla), SUSE (aws-efs-utils, docker-machine-driver-kvm2, nova, pluto, polaris, and python310), and Ubuntu (ceph, gcc-10, gcc-11, gcc-12, linux-aws-6.8, linux-gcp, linux-gcp-6.8, linux-gkeop, linux-ibm,

  linux-ibm-6.8, linux-hwe-6.14, linux-oem-6.14, linux-ibm, linux-intel-iotg, linux-oracle, linux-raspi, linux-iot, poppler, and tiff).

• Pen Test Partners ☛ Start hacking Bluetooth Low Energy today! (part 1)

  TL;DR Before you start First off, before we start  Bluetooth hacking can be confusing, there are lots of references to tools that are a bit outdated, scripts that don’t run, and more. The actual Bluetooth specs are huge, but honestly, who cares as long as you can make a device do a thing?

• OpenSSF (Linux Foundation) ☛ OpenSSF Newsletter – August 2025

  Welcome to the August 2025 edition of the OpenSSF Newsletter! Here’s a roundup of the latest developments, key events, and upcoming opportunities in the Open Source Security community.

• Security Week ☛ Scattered Spider Hacker Sentenced to Prison

  Noah Urban was sentenced to 10 years in prison for his role in the notorious cybercriminal operation known as Scattered Spider.

• Security Week ☛ Telecom Firm Colt Confirms Data Breach as Ransomware Group Auctions Files

  Colt Technology Services is working on restoring systems disrupted by a ransomware attack that involved data theft.

• Silicon Angle ☛ Apple issues emergency update to fix unpatched flaw in ImageIO framework

  Apple Inc. has released an emergency security update to address a “zero-day” vulnerability in its ImageIO framework that has been actively exploited in the wild. A zero-day is a previously unknown software vulnerability that is discovered by attackers before the developer has created a fix.

• Scoop News Group ☛ Apple discloses actively exploited zero-day affecting iOS, iPadOS and macOS

  The defect, which affects the company’s most popular devices, has been exploited in an “extremely sophisticated attack against specific targeted individuals,” Fashion Company Apple said.

• Security Week ☛ Apple Patches Zero-Day Exploited in Targeted Attacks

  Apple has rolled out iOS and macOS updates that resolve a zero-day vulnerability exploited in highly targeted attacks.

• Silicon Angle ☛ Darktrace reports attackers are hijacking SaaS accounts through rented virtual private server nodes

  A new report out today from Darktrace Ltd. details how attackers are exploiting virtual private servers to compromise software-as-a-service accounts, launch phishing campaigns and evade detection. The company’s Inside the SOC report details coordinated incidents across customer environments, underscoring how virtual infrastructure abuse is reshaping the threat landscape for cloud and enterprise users.

• FUD

  • New DripDropper malware exploits then patches Linux cloud flaw [Ed: ActiveMQ is not Linux and this hole was patched nearly 2 years ago]

    According to Red Canary's threat intelligence team, the threat actor behind the campaign initially exploited the Apache ActiveMQ vulnerability CVE-2023-46604 to gain access to affected systems. Unusually, after gaining control, the attacker proceeded to patch the very same vulnerability, thereby preventing other malicious actors from exploiting it and retaining exclusive access to the compromised server.

  • Attackers patch 10.0 Apache ActiveMQ bug after gaining access to Linux systems [Ed: This was patched years ago]

    The maximum-severity flaw – CVE-2023-46604 – is a remote code execution (RCE) bug in Apache ActiveMQ, a widely-used open-source message broker written in Java that attackers have already exploited.

• CISA

  • CISA ☛ 2025-08-19 [Older] CISA Releases Four Industrial Control Systems Advisories

  • CISA ☛ 2025-08-19 [Older] Siemens Desigo CC Product Family and SENTRON Powermanager

  • CISA ☛ 2025-08-19 [Older] Siemens Mendix SAML Module

  • CISA ☛ 2025-08-18 [Older] CISA Adds One Known Exploited Vulnerability to Catalog

  • CISA ☛ 2025-08-14 [Older] CISA Releases Thirty-Two Industrial Control Systems Advisories

  • CISA ☛ 2025-08-14 [Older] Siemens SIMATIC RTLS Locating Manager

  • CISA ☛ 2025-08-14 [Older] Siemens COMOS

  • CISA ☛ 2025-08-14 [Older] Siemens Engineering Platforms

  • CISA ☛ 2025-08-14 [Older] Siemens Simcenter Femap

  • CISA ☛ 2025-08-14 [Older] Siemens Wibu CodeMeter Runtime

  • CISA ☛ 2025-08-14 [Older] Siemens Opcenter Quality

  • CISA ☛ 2025-08-14 [Older] Siemens Third-Party Components in SINEC OS

  • CISA ☛ 2025-08-14 [Older] Siemens RUGGEDCOM CROSSBOW Station Access Controller

  • CISA ☛ 2025-08-14 [Older] Siemens RUGGEDCOM APE1808

  • CISA ☛ 2025-08-14 [Older] Siemens SIPROTEC 5

  • CISA ☛ 2025-08-14 [Older] Siemens SIMATIC S7-PLCSIM

  • CISA ☛ 2025-08-14 [Older] Siemens SIPROTEC 4 and SIPROTEC 4 Compact

  • CISA ☛ 2025-08-14 [Older] Siemens SIMATIC RTLS Locating Manager

  • CISA ☛ 2025-08-14 [Older] Siemens RUGGEDCOM ROX II

  • CISA ☛ 2025-08-14 [Older] Siemens SINEC OS

  • CISA ☛ 2025-08-14 [Older] Siemens SICAM Q100/Q200

  • CISA ☛ 2025-08-14 [Older] Siemens SINEC Traffic Analyzer

  • CISA ☛ 2025-08-14 [Older] Siemens SIMOTION SCOUT, SIMOTION SCOUT TIA, and SINAMICS STARTER

  • CISA ☛ 2025-08-14 [Older] Siemens SINUMERIK

  • CISA ☛ 2025-08-14 [Older] Siemens RUGGEDCOM ROX II

  • CISA ☛ 2025-08-14 [Older] Siemens Web Installer

  • CISA ☛ 2025-08-14 [Older] Rockwell Automation FactoryTalk Viewpoint

  • CISA ☛ 2025-08-14 [Older] Rockwell FactoryTalk Linx

  • CISA ☛ 2025-08-14 [Older] Rockwell Automation Micro800

  • CISA ☛ 2025-08-14 [Older] Rockwell Automation FLEX 5000 I/O

  • CISA ☛ 2025-08-14 [Older] Rockwell Automation ArmorBlock 5000 I/O - Webserver

  • CISA ☛ 2025-08-14 [Older] Rockwell Automation ControlLogix Ethernet Modules

  • CISA ☛ 2025-08-14 [Older] Rockwell Automation Studio 5000 Logix Designer

  • CISA ☛ 2025-08-14 [Older] Rockwell Automation FactoryTalk Action Manager

  • CISA ☛ 2025-08-14 [Older] Rockwell Automation 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT

  • CISA ☛ 2025-08-13 [Older] CISA Adds Two Known Exploited Vulnerabilities to Catalog

• Integrity/Availability/Authenticity

  • Trail of Bits ☛ Weaponizing image scaling against production Hey Hi (AI) systems

    In this blog post, we’ll detail how attackers can exploit image scaling on Gemini CLI, Vertex Hey Hi (AI) Studio, Gemini’s web and API interfaces, Surveillance Giant Google Assistant, Genspark, and other production Hey Hi (AI) systems. We’ll also explain how to mitigate and defend against these attacks, and we’ll introduce Anamorpher, our open-source tool that lets you explore and generate these crafted images.