It’s been a dense week in security news, ranging from another wave of actively exploited zero-days to questions about whether AI agents are really “hacking” anything at all. A soldier gets prison time for telecom extortion, a forensics vendor allegedly hides Russian ties from federal buyers, and lawmakers try once again to nudge telecoms toward better cybersecurity after Salt Typhoon. Below is our rundown of what stood out and why it matters.
Citrix NetScaler admins had a rough week. CISA flagged eight new NetScaler vulnerabilities, two of which are already being exploited in the wild and were immediately added to the KEV catalog in a separate KEV update. NetScaler devices sit at the network edge for thousands of enterprises, and this is far from the first time they’ve been a favored entry point for attackers — expect this to become a go-to line item in incident reports for months to come.
That wasn’t CISA’s only KEV activity this week. A WordPress core remote file inclusion bug made the list in a Thursday advisory, while a Microsoft SharePoint code injection flaw and a Mikrotik RouterOS workflow bug landed together in another entry the same day. Add in a WSO2 path traversal bug and an Adobe Commerce/Magento authorization flaw from Wednesday’s catalog update, and you get a snapshot of just how broad the active-exploitation surface has become — content management systems, network appliances, and enterprise collaboration tools are all getting hit in the same 72-hour window. For federal agencies under BOD 26-04, this is a brutal patch cadence; for everyone else, it’s a reminder that “not federal” doesn’t mean “not targeted.”
On the hardware side, CISA’s ICS advisory on the Eufy Omni C20 and Omni X10 Pro robot vacuums is a good example of how consumer smart-home devices keep inheriting industrial-grade vulnerability classes — OS command injection and hardcoded credentials, with a CVSS score of 9.4. These are the kinds of devices that end up as persistent footholds inside home networks, quietly ignored long after the news cycle moves on. If you own one, check for that 1.6.4 firmware update.
Away from the vulnerability grind, Krebs on Security reports that a U.S. Army soldier has been sentenced to 70 months for hacking into AT&T and Verizon systems and stealing metadata on more than 100 million customers. The case is a stark illustration of insider-adjacent risk: this wasn’t a nation-state operation, just an individual with enough technical skill and audacity to go after telecom giants directly. The restitution order is almost beside the point — the real story is how much damage one determined actor can do against infrastructure most of us assume is well-defended.
Speaking of telecom defenses, Senators Mark Warner and Ted Cruz have introduced the Telecommunications Cybersecurity and Resilience Act, a direct response to the Salt Typhoon breaches that compromised nearly every major U.S. carrier. The bill’s voluntary nature will likely draw criticism from those who think the industry has already shown it won’t self-regulate effectively. Still, getting any bipartisan telecom security legislation moving post-Salt Typhoon is notable, even if the “voluntary” framing suggests it may end up as more theater than mandate.
Enterprise file-sharing platform Kiteworks made an unusual move this week, urging its own customers to stop using its platform after receiving threat intelligence from federal agencies about a possible targeted attack. Telling your customers to walk away from your product is a rare and reputation-costly step, and it says something about how seriously the company is taking the warning — or how little confidence it has in shoring up the platform quickly. Expect more details to surface once the dust settles on what “credible threat intelligence” actually meant here.
Labcorp’s $2.3 million settlement, detailed by The Record, requires the lab-testing giant to overhaul its vendor risk management practices, including a new incident response plan specifically for vendor failures. Healthcare data breaches routinely trace back to third-party vendors rather than the primary organization, and this settlement is a useful reminder that regulators are increasingly holding companies accountable not just for their own systems but for the security posture of everyone they share data with.
Meanwhile, healthcare tech firm Astrana became the latest company to disclose a breach via SEC filing, reporting that attackers gained access by impersonating company personnel. Social engineering remains embarrassingly effective even against organizations that have presumably invested in technical defenses, and the SEC disclosure requirement is doing exactly what it was designed to do: forcing these incidents into daylight faster than companies might prefer.
North Korea’s alleged theft of $387 million from crypto exchange Bitget, as reported by The Record, is another entry in what’s become a grimly routine ledger of DPRK-linked crypto heists funding the regime’s weapons programs. That Bitget can reportedly cover the losses from a $464 million user protection fund is reassuring for its customers, but it doesn’t change the broader trendline: crypto platforms remain the softest target in the current threat landscape, and North Korea’s operators keep getting better at hitting them.
In Wales, Dyfed-Powys Police confirmed a cyberattack disrupting non-emergency systems and potentially exposing staff data. Attacks on police forces carry an outsized psychological impact even when operational disruption is limited, since they undercut public confidence in institutions specifically tasked with protecting others’ security.
Leave a Reply