Transcript
A (0:00)
From the CISO series, it's Cybersecurity Headlines.
B (0:07)
These are the cybersecurity headlines for Wednesday, September 3, 2025. I'm Sarah Lane. 2.5 billion Gmail users at risk entirely false, says Google. Google dismissed claims that 2.5 billion Gmail users were at risk from a major attack, calling them entirely false. The rumors seem to have stemmed from a Salesforce related breach tied to Shiny Hunters, which led to phishing and phishing attacks. But Google says Gmail itself was never compromised, adding that its protections block 99.9% of such threats and urged users to remain vigilant against scams. Cloudflare blocks Largest recorded DDoS attack, peaking at 11.5 terabits per second Cloudflare says it blocked the largest DDoS attack ever recorded, which peaked at 11.5 teraBits per second in a short lived UDP flood largely originating from Google Cloud. The company noted it has fended off hundreds of hypervolumetric attacks in recent weeks, following previous records of 7.3 terabits per second in June and 3.8 in 2024. Cloudflare reported a sharp rise in DDoS activity overall, with network layer attacks up more than 500% year over year. Jaguar Land Rover says cyber attack severely disrupted production Jaguar Land Rover says a cyber attack severely disrupted its production and retail systems, forcing the company to shut down operations at sites including its Solihull plant in the uk. The automaker stressed there is no evidence that customer data was stolen and it is working to restore systems, but offered no timeline or details on the type of attack. Amazon Stymies APT29 credential theft campaign Amazon says it disrupted a credential theft campaign by a Russian state linked group behind the SolarWinds hack. Attackers compromised legitimate websites to redirect visitors to fake claims cloudflare verification pages, exploiting Microsoft's device code authentication flow to gain account access. The campaign used obfuscation and selective targeting to avoid detection, but Amazon tracked and dismantled its infrastructure, urging organizations to review Microsoft's guidance and restrict device authentication if not needed. Huge thanks to our sponsor, ThreatLocker. ThreatLocker is a global leader in zero trust endpoint security, offering cybersecurity controls to protect businesses from zero day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit threatlocker.com CISO that's threatlocker.com CISO CISA taps Nicholas Anderson for executive Assistant Director of Cybersecurity Nicholas Anderson has been appointed Executive Assistant Director of Cybersecurity at cisa, Safeguarding Federal networks and critical infrastructure. Anderson previously served in the Department of Energy during the current US President's first term and was most recently president and COO of Invictus International Consulting. CISA officials say his government and private sector experience will help strengthen engagement with infrastructure partners. JSON Config File Leaks Azure Active Directory Credentials A misconfigured appsettings JSON file and ASP Net Core exposed Azure Active Directory credentials, letting potential attackers Access through Microsoft's OAuth 2.0 endpoints. With these secrets, attackers could steal data, escalate privileges or deploy malicious apps. Experts say the case underscores ongoing risks from cloud misconfigurations and hard coded secrets. Pennsylvania AG says recovery continues after office refused to pay ransomware gang Pennsylvania Attorney General David Sunday said that his office has largely restored operations after a ransomware attack on August 11, rejecting calls to pay the ransom. While some court cases were delayed, he confirmed prosecutions and investigations aren't expected to be affected. The attack was linked to Citrix bleed to vulnerabilities and looks like a broader trend of ransomware targeting state and local governments. Sangoma patches Critical Zero day exploited to hack free PBX servers Sangoma released emergency patches for a critical zero day and free PBX that allowed attackers to access the admin panel, manipulate databases and execute code remotely. The flaw has been exploited in The Wild since August 21, affecting versions 15 through 17 and stemming from insufficient sanitization of user supplied data. CISA added this to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch it by September 19th. Sangoma provided IOCs and mitigation guidance. Remember to join us this Friday for our Week in Review show. Each week we bring on a security leader to give us their take on the biggest cybersecurity news stories. This week, Rich Drofalino will be joined by Ray Espinosa from Elite Technology plus. We'll have a lively chat where you can hang out, have some fun and share your thoughts. We'd love to see you this Friday, 3:30pm Eastern Time for the show. Subscribe to the CISO Series YouTube channel to find it or go to our events page@ciso series.com and if you have thoughts on the news from today or about the show in general, be sure to reach out to us@feedbacksoseries.com we would love to hear from you. I am Sara Lane reporting for the CISO series, and I want you to stay classy.