A (0:02)

You're listening to the Cyberwire network, powered by N2K.

B (0:12)

And now a word from our sponsor. The Johns Hopkins University Information Security Institute is seeking qualified applicants for its innovative Master of Science in Security Informatics degree program. Study alongside world class interdisciplinary experts and gain unparalleled educational research and professional experience in information security and assurance. Interested U.S. citizens should consider the Department of Defense's Cyber Service Academy program, which covers tuition, textbooks and a laptop, as well as providing a $34,000 additional annual stipend. Apply for the fall 2026 semester and for this scholarship by February 28th. Learn more at CS JHU. Edu MSSI A Critical Zero Day in Oracle business suite is under active exploitation ICE plans a major expansion of its social media surveillance operations. Discord confirms a third party data breach. A critical vulnerability in the Unity game engine could allow arbitrary code execution. New variants of the X Worm remote access Trojan spread through phishing campaigns. Researchers uncover a critical command injection flaw in Dell storage appliances. There's been a sharp surge in reconnaissance scans targeting Palo Alto Network's login portals. A new hacking competition offers $4.5 million in prizes for exploits targeting major cloud and AI software. We got our Monday business brief on our afternoon Cyber Tea segment with Microsoft's Ann Johnson. Ann and guest Volker Wagner, Chief Information Officer at basf, share some lessons from the front lines of industrial security and don't spend that Park Mobile settlement all in one. Foreign October 6, 2025 I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. Happy Monday. It is great as always to have you with us. A critical zero day vulnerability in Oracle E Business suite is being actively exploited after Proof of Concept code was released. The flaw, rated 9.8, enables unauthenticated remote code execution over HTTP. Attackers are using reverse shell commands to gain persistent access. Forensic evidence links the exploit toolkit to groups such as Scattered Spider, Lapsus and Clop. Oracle urges immediate patching, noting only supported systems will receive fixes. Organizations can detect exposure using nuclei templates or shodan queries. Continuous monitoring and patch validation are essential to mitigate this active threat. U.S. immigration and Customs Enforcement, you know them as ICE is planning a major expansion of its social media surveillance operations, seeking to hire nearly 30 private contractors to monitor platforms such as Facebook, TikTok and YouTube for intelligence that could inform deportation raids and arrests. According to federal contracting records reviewed by Wired. The program would operate from ICE's targeting centers in Vermont and Southern California, running 24. 7 and processing cases within hours Contractors will use open source intelligence and commercial databases like LexisNexis and Clear to assemble digital dossiers. Planning documents also invite proposals incorporating artificial intelligence and automated data collection. Privacy groups, including the ACLU and the Electronic Privacy Information center, warn that ice's growing use of surveillance technologies and data brokers threatens civil liberties and may blur the line between immigration enforcement and political monitoring. ICE has not yet commented on the proposal, which remains in early planning stages. Discord has confirmed a data breach affecting users who contacted its support or trust and safety teams after a third party customer service vendor was compromised. Exposed data includes names, emails, billing details and in some cases, government ID images. Attackers also accessed IP addresses, messages and attachments allegedly seeking ransom. Discord emphasized its own systems were not breached, cut off vendor access and alerted law enforcement. The company calls the impact limited, though it hasn't disclosed how many users were affected. A critical vulnerability in the Unity game engine could allow attackers to execute arbitrary code through compromised Unity built apps affecting Android, Windows, Linux and macOS users. The flaw lets malicious files exploit app permissions to access confidential data, though Unity says any code execution remains limited to the app's privilege level. No active exploitation has been detected and patches are now available. Microsoft urged users to keep games updated and ensure defender protection is enabled while Steam is blocking risky launch parameters. The bug discovered by researcher Ryotac of GMO Flat Security underscores the vast risk tied to Unity's global footprint, powering major titles like Pokemon Go and the mobile version of Call of Duty. New variants of the Xwyrm Remote Access Trojan are spreading through phishing campaigns months after its creator, Xcoder, abandoned the product. The latest versions are being adopted by multiple threat actors and now include over 35 modular plugins for data theft, remote control, file encryption and ransomware. Researchers at Trellix report new infection chains combining social engineering and technical exploits, including malicious JavaScript, Excel macros and fake executables. The ransomware module encrypts user files and demands payment via Bitcoin. Exworm's architecture supports extensive surveillance and credential theft across browsers, email clients and crypto wallets. Despite its origins as a cracked underground tool, it remains a growing multipurpose threat across global campaigns, emphasizing the need for layered defenses, EDR monitoring, and strict email filtering. Researchers at Watchtower uncovered a critical command injection flaw in Dell Unity VSA storage appliance. The bug allows unauthenticated attackers to execute arbitrary commands by exploiting a flaw in the system's login redirection Logic, where unsanitized URIs are passed into a Perl command string. The latest version fixes the issue. Dell rates it with a high severity of 7.3, although others call it critical with a 9.8. Organizations should upgrade immediately. Security Researchers at Greynoise report a sharp 500% surge in reconnaissance scans targeting Palo Alto network's login portals, with activity peaking at 1300 IPs on October 3, compared to a typical volume below 200. Most scanning originated in the US and 93% of IPs were flagged as suspicious. Grainoise noted that similar surges have sometimes preceded new vulnerability disclosures, though no direct link has been established here. The activity mirrors recent spikes in Cisco, ASA and other remote access product scans showing overlapping tooling and TLS fingerprints. The increase underscores continued attacker interest in security appliances, which often serve as high value network entry points. Graynoise is continuing to monitor whether this surge signals emerging vulnerabilities or coordinated reconnaissance efforts. Cloud security firm Wiz has launched Zero Day Cloud, a new hacking competition offering $4.5 million in prizes for exploits targeting major cloud and AI software backed by aws, Google Cloud and Microsoft. The contest runs live at Black Hat Europe, with entries due December 1st. Categories include AI Kubernetes, containers, web servers, databases and DevOp tools, with top rewards reaching $300,000. Despite strong industry support, Trend Micro has accused Wiz of copying PWN to own rules verbatim. This week's Monday Business brief highlights a surge of mergers, acquisitions and investments shaping the global AI and cloud landscape. Accenture announced plans to acquire Japan's Idomey Inc. To strengthen its Learn Vantage service, while HoneyBook bought Fine.dev to expand its AI development capabilities Harness acquired Quiet AI to enhance application security, and taoping finalized a $21.3 million deal for Skyladder Group. Meanwhile, Liatrio purchased Superorbital's IP to merge consulting with advanced training. On the investment front, cerebras Systems raised $1.1 billion to expand AI chip innovation, while Vercel secured $300 million to scale its AI cloud platform. Other notable rounds include Dscope at $88 million, Xania at $18 million, Mondu with $17.5 million, Gelt with $13 million, Long I at $5 million and Hupside at $1.7 million. Clearwater and Inorbit AI also received undisclosed strategic and Series A funding, respectively. Ethan Cook is the editor of our Cyberwire Pro Business Brief newsletter. You can learn more and subscribe at. Coming up after the break, what does it really Take to defend one of the world's largest chemical companies Guest Volker Wagner joins N2K CyberWire's afternoon Cyber Tea podcast with Microsoft's and Johnson and don't spend that park mobile settlement all in one place. Stick around at Thales. They know cybersecurity can be tough and you can't protect everything. But with Thales, you can secure what matters most. With Thales industry leading platforms, you can protect critical applications, data and identities anywhere and at scale with the highest roi. That's why the most trusted brands and largest banks, retailers and health care companies in the world rely on Thales to protect what matters most applications, data and identity. That's Thales. T H A L E S learn more@thalesgroup.com Cyber what's your 2am Security worry? Is it do I have the right controls in place? Maybe are my vendors secure? Or the one that really keeps you up at night? How do I get out from under these old tools and manual processes? That's where Vanta comes in. Vanta automates the manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data and simplifies your security at scale. And it fits right into your workflows, using AI to streamline evidence collection, flag risks and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently and finally get back to sleep. Get started@vanta.com cyber that's V A N T A dot com cyber Microsoft's Ann Johnson is host of the Afternoon Cybertea podcast, which you can find right here on the N2K CyberWire Network. Anne recently got together with her guest Volker Wagner, Chief Information Security Officer at basf, to share some lessons from the front lines of industrial security.