Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network powered by N2K.
Podcast Host / Announcer (0:12)
At Talas, they know cybersecurity can be tough and you can't protect everything. But with Thales, you can secure what matters most. With Thales industry leading platforms, you can protect critical applications, data and identities anywhere and at scale with the highest roi. That's why the most trusted brands and largest banks, retailers and healthcare companies in the world rely on Talas to protect what matters most applications, data and identity. That's Talas T H A L E S. Learn more@talasgroup.com Cyber CISA warns of active exploitation of a critical vulnerability in the pseudo utility Broadcom patches 2 High severity vulnerabilities in VMware NSX South Korea raises its national cyber threat level after a data center fire. Formbricks patches a critical token validation flaw. Microsoft blocks a credential phishing campaign that made use of malicious SVG files. Landlords are accused of scraping sensitive payroll data. Cybercriminals lay the groundwork for large scale FIFA fraud. Burnout takes a heavy toll on cybersecurity professionals. On our threat vector segment, David Moulton is joined by Kyle Wilhoit talking about the evolution of hacker culture and cybersecurity and London Police bag the biggest Bitcoin.
Dave Bittner (1:51)
Bus.
Podcast Host / Announcer (1:57)
Foreign September 30, 2025 I'm Dave Bittner and this is your CyberWire Intel Briefing. Thanks for joining us here once again. It's great as always to have you with us. The Cybersecurity and Infrastructure Security Agency has issued an urgent warning about active exploitation of a critical vulnerability in the Sudo utility, a core Linux and Unix tool. The flaw affects Sudo's R option, allowing attackers with limited Sudo rights to bypass restrictions and gain full root access. CISA warns that successful exploitation could result in complete system compromise, enabling data theft, service disruption, or malware installation. The agency urges administrators to identify vulnerable systems, apply vendor patches, or disable the chroot option until fixes are available. The flaw was added to CISA's known exploited vulnerabilities catalog, with mitigations required by October 20th. CISA stresses proactive patching as essential defense. Broadcom has issued security updates addressing two high severity vulnerabilities in VMware NSX. Both were reported by the U.S. national Security Agency. VMware NSX, part of VMware Cloud foundation, supports networking virtualization for private and hybrid clouds. The flaws allow unauthenticated attackers to enumerate valid usernames, potentially enabling brute force or unauthorized access. Attempts to Broadcom also patched a separate high severity SMTP header injection flaw in VMware VCenter and disclosed three vulnerabilities in VMware ARIA operations and VMware tools that could permit privilege escalation, credential theft and cross VM access. These updates follow earlier fixes to zero days exploited at PWN to own Berlin 2025 and by attackers in the wild VMware products remain frequent targets for state sponsored groups and cybercrime gangs. South Korea has raised its national cyber threat level after a fire at a government data center crippled critical digital infrastructure. The blaze, caused by ignited lithium ion batteries during replacement work shut down 647 government systems, halting email, intranet, banking, tax, real estate and healthcare services. As of Tuesday, 89 systems were restored, but 96 were destroyed and will require weeks to rebuild, leaving disruptions expected through upcoming holidays. The intelligence service warned hackers may exploit the weakened systems during recovery. President Lee Jae Myung apologized, criticizing the lack of backup protocols as foreseeable with the upcoming APEC summit. Concerns about resilience and preparedness have intensified while political leaders face growth. Criticism over South Korea's digital reliability. Formbricks, an open source experience management platform, has patched a critical flaw that could let attackers hijack accounts with forged authentication tokens. The issue stemmed from improper JSON web token validation, where the software decoded tokens instead of verifying them. Exploitation required only a victim's predictable user identifier, enabling password resets and full account takeover. Users should upgrade immediately to the latest version. It comes as no surprise that cybercriminals are leveraging artificial intelligence to create highly sophisticated phishing attacks that evade traditional defenses. Microsoft Threat Intelligence recently blocked a credential phishing campaign on Aug. 18 that primarily targeted U.S. organizations. The attack used a compromised business email account to send what looked like a PDF file but was actually an SV VG file laced with disguised malicious code. The payload redirected victims to a fake sign in page with its code structure suggesting large language model involvement. Microsoft's security co pilot determined the complexity was unlikely from a human author. Microsoft Defender for Office365 ultimately stopped the campaign by detecting behavioral anomalies. Experts warn that AI assisted phishing represents a major shift, urging organizations to focus on identity observability and behavioral detection. To counter AI scaled deception, some US Landlords are requiring prospective tenants to use screening tools that log directly into employer systems and scrape sensitive payroll data, according to 404Media. One renter in Atlanta said Approveshield, powered by a service called Argylle harvested far more than the requested four pay stubs, downloading every payslip and W4 from Workday going back to 2024. The renter described the process as credential harvesting since Argyll required corporate HR logins, raising concerns about potential violations of US hacking laws. Approved shield allegedly knew the 60 day requirement but still mined excessive data. Critics warn that refusing to participate effectively bars tenants from housing. Similar practices reportedly involve other companies, including PayScore, NovaCredit and Snapt. Neither Approveshield nor Argyll responded to requests for comment. With the 2026 FIFA World cup still months away, cybercriminals are already laying groundwork for large scale fraud. Researchers at Check Point identified more than 4,300 suspicious domains registered since August 2025, many in synchronized bursts and clustered around a few registrars. These domains mimic official branding to push counterfeit tickets, fake merchandise and malware laced streams. Evidence also suggests botnets are being prepared to flood ticket queues, distort prices and enable large scale resales. Fraudulent activity extends beyond domains into Telegram, dark web markets and social media channels, forming a multi platform ecosystem. Experts warn this isn't random opportunism, but coordinated infrastructure designed well in advance. Defenses must begin now, including registrar cooperation, anti bot protections and public awareness campaigns to prevent scams from overshadowing the tournament. Burnout is taking a heavy toll on cybersecurity professionals who often pour their passion into protecting organizations while facing relentless pressure, the BBC reports. Tony, who left his role at a major UK e commerce firm, described sleepless nights, overwhelming workloads and the strain of non stop incident response. Others, like former UK Health Security Agency leader Andrew Tillman, called cybersecurity the best job in the world, but also a dangerous place when stress mounts unchecked. Studies show declining job satisfaction with professionals asked to do more with less while remaining on call around the clock. Experts warn that constant alerts, nation state threats and blame culture fuel exhaustion, especially for younger workers. Initiatives like Cyber Minds advocate treating burnout with the seriousness of other frontline professions, urging proactive support and early recognition of warning signs. Signs coming up after the break on our Threat Vector segment, David Moulton is joined by Kyle Wilhoyt to talk about the evolution of hacker culture and London Police bag the biggest bitcoin bust Stick around. Foreign compliance regulations, third party risk and customer security demands are all growing and changing fast. Is your manual GRC program actually slowing you down? If you're thinking there has to be something more efficient than spreadsheets, screenshots and all those manual processes, you're right. GRC can be so much easier and it can strengthen your security posture while actually driving revenue for your business. You know, one of the things I really like about Vanta is how it takes the heavy lifting out of your GRC program. Their trust management platform automates those key compliance, internal and third party risk, and even customer trust so you're not buried under spreadsheets and endless manual tasks. Vanta really streamlines the way you gather and manage information across your entire business. And this isn't just theoretical. A recent IDC analysis found that compliance teams using Vanta are 129% more productive. It's a pretty impressive number. So what does it mean for you? It means you get back more time and energy to focus on what actually matters, like strengthening your security posture and scaling your business. Vanta GRC Just imagine how much easier trust trust can be. Visit vanta.com cyber to sign up today for a free demo that's V A N T a dot com Cyber AI adoption is exploding and security teams are under pressure to keep up. That's why the industry is coming together at the Data SEC AI Conference, the premier event for cybersecurity, data and AI leaders. Hosted by data security leader ciara. Built for the industry by the industry, this two day conference is where real world insights and bold solutions take center stage. Datasec AI25 is happening November 12th and 13th in Dallas. There's no cost to attend, just bring your perspective and join the conversation. Register now at datasecai2025.com CyberWire on this week's Threat Vector segment, David Bolton is joined by Kyle Wilhoyt to talk about the evolution of hacker culture.