Security Leftovers and Windows TCO

posted by Roy Schestowitz on Sep 25, 2025

• LWN ☛ Security updates for Wednesday

  Security updates have been issued by AlmaLinux (kernel and kernel-rt), Fedora (expat), Red Hat (kernel and multiple packages), SUSE (avahi, busybox, busybox-links, kernel, sevctl, tcpreplay, thunderbird, and tor), and Ubuntu (isc-kea, linux, linux-aws, linux-gcp, linux-gke, linux-gkeop, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-aws-6.8, linux-gcp-6.8, linux-aws-fips, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-realtime, python-pip, and rabbitmq-server).

• Security Week ☛ Record-Breaking DDoS Attack Peaks at 22 Tbps and 10 Bpps

  The attack was aimed at a European network infrastructure company and it has been linked to the Aisuru botnet.

• Security Week ☛ Libraesva Email Security Gateway Vulnerability Exploited by Nation-State Hackers

  Tracked as CVE-2025-59689, the command injection bug could be triggered via malicious emails containing crafted compressed attachments.

• Federal News Network ☛ CISA names cyber policy vet to lead infrastructure security division

  Steve Casapulla has served at CISA for more than a decade and also led critical infrastructure efforts at the Office of the National Cyber Director.

• Security Week ☛ Hackers Target Casino Operator Boyd Gaming

  Boyd Gaming has informed the SEC about a data breach affecting the information of employees and other individuals.

• SANS ☛ Exploit Attempts Against Older Hikvision Camera Vulnerability, (Wed, Sep 24th)

  I notice a new URL showing up in our web honeypot logs, which looked a bit interesting: [...]

• Security Week ☛ GeoServer Flaw Exploited in US Federal Agency Hack

  The hackers remained undetected for three weeks, deploying China Chopper, remote access scripts, and reconnaissance tools.

• Scoop News Group ☛ Secret Service says it dismantled extensive telecom threat in NYC area

  In all, the agency said it discovered more than 300 servers and 100,000 SIM cards spread across multiple sites within 35 miles of New York.

• Security Week ☛ A Massive Telecom Threat Was Stopped Right As World Leaders Gathered at UN Headquarters in New York

  More than 300 servers and 100,000 SIM cards designed to mimic cellphones and overwhelm networks.

• Bruce Schneier ☛ US Disrupts Massive Cell Phone Array in New York

  This is a weird story:

  The US Secret Service disrupted a network of telecommunications devices that could have shut down cellular systems as leaders gather for the United Nations General Assembly in New York City.

  The agency said on Tuesday that last month it found more than 300 SIM servers and 100,000 SIM cards that could have been used for telecom attacks within the area encompassing parts of New York, New Jersey and Connecticut.

• Windows TCO

  • Security Week ☛ All Abusive Monopolist Microsoft Entra Tenants Were Exposed to Silent Compromise via Invisible Actor Tokens: Researcher

    The strength of responsible disclosure is that it can solve problems before they are actioned. The weakness is that it potentially generates a false sense of security in the vendor.

  • Security Week ☛ Microsoft Boosting Security in Response to Microsoft NPM Supply Chain Attacks [Ed: Microsoft transmitted malware; not the media paints Microsoft as the solution.]

    GitHub will implement local publishing with mandatory 2FA, granular tokens that expire after seven days, and trusted publishing.

  • Krebs On Security ☛ Feds Tie ‘Scattered Spider’ Duo to $115M in Ransoms

    U.S. prosecutors last week levied criminal hacking charges against 19-year-old U.K. national Thalha Jubair for allegedly being a core member of Scattered Spider, a prolific cybercrime group blamed for extorting at least $115 million in ransom payments from victims. The charges came as Jubair and an alleged co-conspirator appeared in a London court to face accusations of hacking into and extorting several large U.K. retailers, the London transit system, and healthcare providers in the United States.