Heroes, a detailed look at the current cybersecurity landscape for October 16, 2025.
Critical Threats
CISA Flags Adobe AEM Flaw with Perfect 10.0 Score — Already Under Active Attack
The Hacker News·4:26 AM·CVE-2025-54253
▾
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Adobe Experience Manager (AEM) vulnerability, CVE-2025-54253, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw has a perfect 10.0 CVSS score and is confirmed to be under active exploitation, posing an immediate and severe risk to unpatched systems.
Business Impact
Unpatched AEM instances are highly susceptible to complete system takeover, leading to potential data exfiltration, service disruption, and deployment of further malware. This poses a significant risk to data integrity and availability, with direct compliance implications for organizations governed by SOX.
Recommended Action
Immediately apply the patches provided by Adobe. Due to active exploitation, organizations should hunt for signs of compromise on vulnerable systems and activate incident response protocols if any evidence is found.
Hackers Deploy Linux Rootkits via Cisco SNMP Flaw in Zero Disco Attacks
The Hacker News·11:38 AM
▾
A threat campaign codenamed "Operation Zero Disco" is actively exploiting a recently disclosed flaw in Cisco IOS and IOS XE software. Attackers are weaponizing the vulnerability to deploy persistent Linux rootkits on older, unpatched network devices, enabling long-term, stealthy access to compromised networks.
Business Impact
Compromised network infrastructure can lead to widespread data interception, network traffic manipulation, and a persistent foothold for lateral movement within the corporate environment. The deployment of rootkits makes detection and remediation exceptionally difficult, threatening core network operations.
Recommended Action
Prioritize patching of all vulnerable Cisco IOS and IOS XE devices immediately. Network administrators should monitor for anomalous SNMP traffic and outbound connections from network devices. Isolate and forensically analyze any devices suspected of compromise.
U.S. CISA adds SKYSEA, Velociraptor, Microsoft, and IGEL OS flaws to KEV Catalog
Security Affairs·8:56 AM
▾
CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog with new flaws affecting a diverse range of products: SKYSEA Client View, Rapid7 Velociraptor, Microsoft Windows, and IGEL OS. The inclusion in the KEV catalog confirms these vulnerabilities are being actively exploited in the wild, requiring urgent attention from federal agencies and private organizations.
Business Impact
These vulnerabilities impact endpoint management, incident response tools, operating systems, and thin client solutions. Exploitation could lead to privilege escalation, remote code execution, and loss of control over critical IT assets, posing a severe risk to enterprise security and compliance.
Recommended Action
Federal agencies are required to patch these vulnerabilities by the CISA-mandated deadline. All other organizations are strongly advised to review the KEV catalog, identify affected assets, and apply necessary patches or mitigations without delay.
F5 has disclosed a major security breach, attributing the intrusion to a highly sophisticated nation-state actor. The attackers successfully exfiltrated source code for F5's BIG-IP product line and information related to undisclosed vulnerabilities, creating a high potential for future zero-day exploits.
Business Impact
The theft of source code allows threat actors to conduct deep analysis to find new, unpatched vulnerabilities. Organizations relying on BIG-IP for application delivery and security are at an elevated risk of targeted attacks. This incident could have long-term implications for the security of a foundational enterprise technology.
Recommended Action
F5 has released patches for the stolen vulnerabilities. All F5 customers must apply these updates immediately. Monitor F5 security advisories closely for any new information and be prepared for potential future attacks leveraging this stolen data.
Fuji Electric HMI Configurator Flaws Expose Industrial Organizations to Hacking
SecurityWeek·11:57 AM
▾
Multiple vulnerabilities have been discovered in Fuji Electric's Human-Machine Interface (HMI) configuration software, potentially exposing industrial control systems (ICS) to remote attacks. Japan's JPCERT has issued an alert, and Fuji Electric has released patches to address the flaws, which could impact critical infrastructure and manufacturing operations.
Business Impact
Successful exploitation could allow attackers to alter or disrupt industrial processes, leading to operational downtime, equipment damage, or safety incidents. This poses a direct threat to organizations in the manufacturing and critical infrastructure sectors.
Recommended Action
Organizations using Fuji Electric HMI configurators should apply the available patches immediately. Isolate ICS networks from corporate IT networks and restrict access to HMI systems to authorized personnel only.
Qilin Ransomware Group Expands Operations Using Bulletproof Hosting
Security Affairs·7:42 PM
▾
The Qilin ransomware-as-a-service (RaaS) group continues to claim new victims, leveraging a global network of bulletproof hosting (BPH) providers to ensure the resilience of its extortion operations. Research from Resecurity highlights the group's sophisticated infrastructure, which complicates takedown efforts and enables sustained campaigns against various industries.
Business Impact
The Qilin group's activities pose a severe financial and operational risk, including data encryption, exfiltration for double extortion, and significant business disruption. Their reliance on BPH makes them a persistent and hard-to-disrupt threat.
Recommended Action
Ensure robust, offline backup and recovery procedures are in place. Implement network segmentation to limit lateral movement and deploy advanced endpoint detection and response (EDR) solutions to identify ransomware precursors.
Matters.AI Raises $6.25 Million to Safeguard Enterprise Data
SecurityWeek·12:42 PM
▾
Matters.AI has secured $6.25 million in funding for its platform, which features an "AI Security Engineer" designed to autonomously protect enterprise data across different devices and environments. This investment highlights the growing market demand for AI-driven solutions to automate complex data security challenges.
Business Impact
As data sprawl increases with remote work and cloud adoption, automated solutions like Matters.AI aim to reduce the burden on security teams and minimize the risk of data leaks. This technology could help organizations maintain compliance and protect sensitive information more effectively.
Recommended Action
Security leaders should evaluate emerging AI-powered data security platforms to understand how they can augment existing security programs, improve efficiency, and address gaps in data visibility and control.
New Pixnapping Attack Steals Signal Messages and 2FA Codes from Android Devices
aboutDFIR·3:08 PM
▾
A novel attack technique on Android, named "Pixnapping," allows malicious applications to covertly capture sensitive information displayed on a user's screen. This includes encrypted messages from apps like Signal, 2FA codes, emails, and financial data, bypassing many existing security protections by capturing the rendered image.
New Pixnapping Attack Steals Signal Messages and 2FA Codes from Android Devices
aboutDFIR·3:08 PM
▾
A novel attack technique on Android, named "Pixnapping," allows malicious applications to covertly capture sensitive information displayed on a user's screen. This includes encrypted messages from apps like Signal, 2FA codes, emails, and financial data, bypassing many existing security protections by capturing the rendered image.
Amazon Web Services has introduced Guardrails for Amazon Bedrock, a feature designed to provide configurable safeguards for generative AI applications. This addresses a critical need for safety and privacy protections as enterprises increasingly adopt large language models (LLMs). The guardrails work across multiple foundation models to help prevent harmful content generation, data leakage, and other AI-specific risks, enabling safer at-scale deployment of generative AI.
The concept of "Shadow AI"—where employees use AI tools without organizational approval or oversight—is a growing security risk. This practice can lead to unintentional data leaks, compliance violations (GDPR, etc.), and the introduction of insecure AI models into the corporate environment. This trend requires CISOs to develop new governance policies and technical controls specifically for AI usage to mitigate these emerging threats.
Spotlight Rationale: Today's intelligence is dominated by the rapid exploitation of newly disclosed vulnerabilities, such as the Adobe AEM flaw ([CVE-2025-54253](https://nvd.nist.gov/vuln/detail/CVE-2025-54253)) and the Cisco SNMP flaw. The speed from disclosure to exploitation highlights the inadequacy of traditional, manual patching cycles. AISLE's approach directly targets this problem.
AISLE is a new security startup emerging from stealth with a platform designed to automate the entire vulnerability management lifecycle. Instead of just detecting and reporting flaws, its AI-based system aims to autonomously and safely exploit vulnerabilities to confirm their risk and then apply patches in real time. This model represents a paradigm shift from human-driven remediation to machine-speed defense, which is necessary to counter automated attacks like those seen against Adobe and Cisco systems today.
Actionable Platform Guidance: Organizations should engage with emerging autonomous remediation platforms like AISLE by initiating a proof-of-concept (POC) on a non-production segment of their network. Key evaluation criteria should include the platform's accuracy in identifying vulnerabilities, the safety and reliability of its automated exploitation and patching engine, and its ability to integrate with existing asset management and security information systems.
# Conceptual Configuration for an Autonomous Remediation Platform
# Step 1: Define Asset Scope
# Target critical, internet-facing systems first, such as those running Adobe AEM.
policy.set_scope(tag="external-web-servers", criticality="high")
# Step 2: Set Remediation Policy
# For known exploited vulns like CVE-2025-54253, enable fully automated patching.
# For others, use a human-in-the-loop approval workflow.
policy.add_rule(cve="CVE-2025-54253", action="auto_patch", notify="soc_team")
policy.add_rule(cvss_score=">7.0", action="confirm_and_patch", approver="vuln_manager")
# Step 3: Configure Safe Exploitation
# Enable the platform to safely validate vulnerabilities without causing damage.
engine.set_exploitation_mode(mode="safe_validation_only")
# Step 4: Integrate with Monitoring
# Ensure all actions are logged to your SIEM for full visibility.
integration.connect_siem(type="splunk", endpoint="siem.mycorp.local:8088", token="$SECRET_TOKEN")
# Step 5: Activate Policy
policy.activate()
2. YARA Rule for Operation Zero Disco Linux Rootkit Indicators
rule Operation_Zero_Disco_Linux_Rootkit_Loader {
meta:
description = "Detects potential artifacts related to the Operation Zero Disco campaign that deploys Linux rootkits via Cisco flaws."
author = "Threat Rundown"
date = "2025-10-16"
reference = "https://thehackernews.com/2025/10/hackers-deploy-linux-rootkits-via-cisco.html"
severity = "high"
tlp = "white"
strings:
// Hypothetical strings based on common rootkit behavior
$s1 = "/tmp/.xz-preload"
$s2 = "ld.so.preload"
$s3 = "/usr/bin/.local/sshd-service"
$s4 = "Disabling system logging for stealth."
condition:
2 of them
}
// Query to identify anomalous outbound connections from Cisco devices following high-volume SNMP activity
// Part 1: Find Cisco devices with high SNMP traffic
let cisco_ips = T(30m) | `network_traffic`
| where dest_port in (161, 162) and device_vendor="Cisco"
| stats count by src_ip, dest_ip
| where count > 1000
| fields dest_ip;
// Part 2: Look for suspicious outbound connections from those IPs
`network_traffic`
| where src_ip in (cisco_ips) and action="allowed" and direction="outbound"
| where dest_port not in (80, 443, 53, 22) // Filter common/expected traffic
| stats count by src_ip, dest_ip, dest_port, protocol
| `get_threat_intel(dest_ip)` // Correlate with threat intelligence
| table _time, src_ip, dest_ip, dest_port, protocol, threat_level
| sort -_time
4. PowerShell Script — Find Vulnerable Adobe AEM Installs on Windows
# This script checks for common installation paths of Adobe AEM on Windows servers.
$servers = Get-Content -Path .\serverlist.txt
$aemPaths = @(
"C:\Program Files\Adobe\Experience Manager\*",
"C:\AEM\*",
"D:\Adobe\AEM\*"
)
Write-Host "Scanning for Adobe AEM installations..."
foreach ($server in $servers) {
if (Test-Connection -ComputerName $server -Count 1 -Quiet) {
Write-Host "- Checking $server..."
foreach ($path in $aemPaths) {
try {
$install = Invoke-Command -ComputerName $server -ScriptBlock {
Get-Item -Path $using:path -ErrorAction SilentlyContinue
} -ErrorAction SilentlyContinue
if ($install) {
Write-Host " [!] Found potential AEM installation at: $($install.FullName)" -ForegroundColor Yellow
Write-Host " -> Recommend immediate investigation for CVE-2025-54253."
}
} catch {
Write-Host " [x] Could not access paths on $server. Check permissions." -ForegroundColor Red
}
}
} else {
Write-Host "- Could not connect to $server."
}
}
This rundown should provide a solid overview of the current threat landscape. Thank you to all our cyberheroes for your diligence and hard work. Stay vigilant!
Cookie Notice
We use essential cookies to provide our cybersecurity newsletter service and analytics cookies to improve your experience.
About STIX 2.1: Structured Threat Information eXpression (STIX) is the machine language of cybersecurity. This bundle contains validated threat objects, indicators, and relationships that can be directly imported into your SIEM, TIP, or security orchestration platform.
Usage: Download or copy the JSON below and import it directly into your threat intelligence platform, SIEM, or security orchestration tools for automated threat detection and response.