In October 2025, cybersecurity researchers at Cyble Research and Intelligence Labs (CRIL) uncovered a sophisticated malware campaign distributing weaponized ZIP archives disguised as military documents. The attack specifically targeted Belarusian military personnel through a lure document titled “ТЛГ на убытие на переподготовку.pdf” (TLG for departure for retraining.pdf), with evidence suggesting the operation focused on collecting […]
The U.S. Cybersecurity and Infrastructure Security Agency has added a critical Linux kernel vulnerability to its Known Exploited Vulnerabilities catalog, warning that threat actors are actively leveraging the security vulnerability in ransomware campaigns targeting organizations worldwide. The vulnerability, tracked as CVE-2024-1086, represents a significant threat to Linux-based systems and requires immediate attention from cybersecurity teams. […]
Cybersecurity authorities are raising urgent alarms as threat actors continue to exploit a critical vulnerability in Cisco IOS XE devices, deploying a malicious implant known as BADCANDY across networks worldwide. The Australian Signals Directorate (ASD) has confirmed that over 150 devices remain compromised in Australia alone as of late October 2025, despite ongoing remediation efforts […]
The notorious Akira ransomware group announced on October 29, 2025, that it successfully breached the systems of Apache OpenOffice, exfiltrating a staggering 23 gigabytes of sensitive corporate data.
The group, known for its aggressive double-extortion tactics, posted details on its dark web leak site, threatening to release the information unless a ransom is paid. This incident underscores the escalating risks facing even non-profit software foundations in an era of sophisticated cyber threats.
Apache OpenOffice, a cornerstone of free office productivity tools developed under the Apache Software Foundation, has long served as an accessible alternative to proprietary suites like Microsoft Office.
The software includes Writer for word processing, Calc for spreadsheets, Impress for presentations, Draw for vector graphics, Base for databases, and Math for formulas, supporting over 110 languages across Windows, Linux, and macOS platforms.
With millions of users worldwide, including in education and small businesses, the project relies on volunteer contributors and community funding. The alleged breach does not appear to compromise the public download servers, leaving end-users’ installations safe for now.
Details of the Alleged Breach
According to Akira’s post, the stolen data encompasses highly personal employee records, including physical addresses, phone numbers, dates of birth, driver’s licenses, Social Security numbers, and credit card details.
Financial records, internal confidential documents, and extensive reports detailing application bugs and development issues are also purportedly included in the haul.
The group boasted, “We will upload 23 GB of corporate documents soon,” highlighting the breadth of the intrusion into the foundation’s operational backbone.
As of November 1, 2025, the Apache Software Foundation has neither confirmed nor denied the breach, with spokespeople declining immediate comment to cybersecurity outlets.
Independent verification remains elusive, raising questions about whether the data is fresh or repurposed from prior leaks. If authentic, the exposure could fuel identity theft and phishing campaigns targeting staff, though the open-source nature of OpenOffice limits direct risks to the software’s codebase.
Akira, a ransomware-as-a-service operation that surfaced in March 2023, has amassed tens of millions in ransoms through hundreds of attacks across the U.S., Europe, and beyond.
Specializing in data exfiltration before encryption, the group deploys variants for Windows and Linux/ESXi environments, even hacking victim webcams for added leverage.
Communicating in Russian on underground forums, Akira notably spares systems with Russian keyboard layouts, hinting at geopolitical selectivity.
This incident comes during a rise in ransomware attacks targeting open-source projects, leading to calls for enhanced security in volunteer-driven ecosystems.
Organizations using Apache OpenOffice are advised to monitor for unusual activity and ensure data backups are isolated. As Akira’s listing persists without resolution, the cybersecurity world watches closely for proof—or fallout—that could reshape trust in collaborative software development.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert about a critical use-after-free vulnerability in the Linux kernel, tracked as CVE-2024-1086.
This vulnerability, hidden within the netfilter: nf_tables component, allows local attackers to escalate their privileges and potentially deploy ransomware, which could severely disrupt enterprise systems worldwide.
First disclosed earlier this year, the vulnerability has now been linked to active exploitation campaigns targeting unpatched Linux servers, according to CISA’s Known Exploited Vulnerabilities (KEV) catalog updated on October 31, 2025.
As Linux powers everything from cloud infrastructure to IoT devices, this warning underscores the growing threat to open-source ecosystems amid rising ransomware incidents.
Security researchers have confirmed that attackers exploit CVE-2024-1086 by crafting malicious netfilter rules that trigger improper memory deallocation. Once a user with local access often gained through phishing or weak credentials runs the exploit, the system frees memory associated with a network table but fails to nullify the pointer, allowing reuse of dangling references.
This leads to arbitrary code execution with root privileges, paving the way for ransomware deployment like LockBit or Conti variants.
CISA emphasizes immediate patching, noting that affected versions span widely used distributions such as Ubuntu, Red Hat Enterprise Linux, and Debian, particularly in versions predating kernel 6.1.77.
Linux Kernel Use-After-Free Vulnerability Exploited
The vulnerability stems from a classic use-after-free error (CWE-416), where the kernel’s netfilter subsystem mishandles table destruction during rule evaluations. An attacker needs only local execution rights, making it a potent second-stage payload after initial access.
In ransomware scenarios, threat actors chain this with social engineering to encrypt files and exfiltrate data, demanding ransoms in cryptocurrency. Exploitation proofs-of-concept have circulated on underground forums since March 2024, with real-world attacks spiking in Q3 2025 against healthcare and financial sectors.
For a detailed overview, see the CVE specifications below:
CVE ID
Description
Affected Products/Versions
CVSS v3.1 Score
Technical Details
Mitigation
CVE-2024-1086
Use-after-free in netfilter: nf_tables leading to local privilege escalation
Memory deallocation flaw in nftables rule processing; requires local access; enables root shell via dangling pointer reuse
Update to kernel 6.1.77+; disable nf_tables if unused; apply vendor patches (e.g., Ubuntu USN-6190-1)
Organizations should scan environments using tools like Lynis or OpenVAS for vulnerable kernels and apply mitigations per vendor guidance.
If updates are unavailable, CISA advises discontinuing use of affected products. This incident highlights the risks of legacy Linux deployments in hybrid clouds, where attackers increasingly target open-source flaws for high-impact ransomware.
As exploitation evolves, proactive kernel hardening, such as enabling SELinux and monitoring netfilter logs, remains essential to thwart these stealthy threats.
Cybercriminals and state-sponsored actors are ramping up attacks on unpatched Cisco IOS XE devices across Australia, deploying a persistent Lua-based web shell known as BADCANDY to maintain unauthorized access.
This implant, first spotted in variations since October 2023, has seen renewed exploitation throughout 2024 and into 2025, exploiting the critical CVE-2023-20198 vulnerability in the software’s web user interface.
The Australian Signals Directorate (ASD) warns that over 400 devices were potentially compromised since July 2025, with more than 150 still infected as of late October, highlighting the ongoing threat to network infrastructure.
BADCANDY Web Shell Exploiting Unpatched Devices
The CVE-2023-20198 flaw, rated at a maximum CVSS score of 10.0, allows remote unauthenticated attackers to create highly privileged accounts on affected Cisco IOS XE routers and switches, granting full system control without credentials.
Cisco patched this zero-day in October 2023 amid active exploitation, but public exploits emerged shortly after, fueling widespread abuse by groups like the Chinese state-sponsored SALT TYPHOON.
ASD reports that attackers often apply a non-persistent patch post-compromise to hide the vulnerability, while installing BADCANDY—a lightweight implant that enables root-level command execution via a hidden URI path in an Nginx configuration file named cisco_service.conf.
Although BADCANDY vanishes upon reboot, attackers can retain access through stolen credentials or other persistence methods, making re-exploitation trivial on exposed web interfaces.
This vulnerability ranked among the top routinely exploited flaws in 2023, and ASD confirms ongoing attacks in 2025, particularly targeting internet-facing devices.
SALT TYPHOON, linked to Chinese intelligence, has leveraged similar Cisco weaknesses in global telecom breaches, often using legitimate credentials alongside exploits like CVE-2023-20198 and CVE-2023-20273.
Criminal actors and other nation-states are also reusing BADCANDY, scanning for unpatched systems and re-infecting those cleared by notifications.
The implant’s low footprint makes detection challenging without deep configuration reviews, underscoring risks to edge networks worldwide.
ASD’s Response
In response, ASD has issued bulk notifications to affected entities via service providers, urging immediate patching, reboots, and incident response since July 2025.
These efforts reduced infections from over 400 to around 150 by late October, but fluctuations suggest actors detect and re-exploit cleared devices.
A graph tracking BADCANDY implants from July to October 2025 shows a steady decline punctuated by spikes around bulk notification events in September and early October, with the line dropping from 350 in mid-July to about 138 by late October.
ASD attributes resurgences to unpatched systems left online, emphasizing that reboots alone won’t suffice without addressing the root vulnerability.
To combat this, ASD recommends reviewing running configurations for privilege 15 accounts, especially suspicious ones like “cisco_tac_admin” or those with random strings, and removing unauthorized entries.
Organizations should also scan for unknown tunnel interfaces, such as “interface tunnel[number]” with unexpected IPs, and check TACACS+ logs for changes if enabled.
Applying Cisco’s patch for CVE-2023-20198 is critical, alongside disabling the HTTP server feature and following the IOS XE hardening guide to restrict web UI access.
Rebooting removes the implant but requires post-reboot checks for lingering changes, and broader edge-device security, such as network segmentation, can prevent lateral movement.
Cisco provides indicators of compromise in its advisory to aid investigations, while ASD continues notifications to shrink the attack surface in Australia. By prioritizing these actions, networks can thwart re-exploitation and bolster defenses against evolving threats.
Windows Server Update Services (WSUS) vulnerability is actively exploited in the wild. Criminals are using this vulnerability to steal sensitive data from organizations in various industries.
The vulnerability, tracked as CVE-2025-59287, was patched by Microsoft on October 14, 2025, but attackers quickly began abusing it after proof-of-concept code became publicly available on GitHub.
Sophos telemetry indicates that exploitation began on October 24, 2025, just hours after technical analysis and exploit code were released online.
The threat actors targeted internet-facing WSUS servers in universities, technology companies, manufacturing firms, and healthcare organizations, primarily based in the United States.
While Sophos has confirmed six incidents so far, security experts believe the actual number of compromised organizations is significantly higher.
Sophos researchers have identified real-world exploitation of a newly disclosed vulnerability in Windows Server Update Services (WSUS), where threat actors are harvesting sensitive data from organizations.
The exploitation leverages a critical deserialization bug in WSUS that allows unauthenticated remote code execution. When attackers target vulnerable servers, they inject Base64-encoded PowerShell commands through nested command processes running under IIS worker privileges.
The malicious script executes silently on compromised systems, gathering valuable intelligence about targeted organizations.
The harvested data includes external IP addresses and ports of vulnerable hosts, enumerated lists of Active Directory domain users, and detailed network interface configurations. This information is then exfiltrated to webhook.site URLs controlled by the attackers.
Sophos researchers discovered four unique webhook.site URLs associated with the attacks, with three linked to the platform’s free service tier.
By analyzing the request logs on two publicly accessible URLs, researchers observed that exploitation began at 02:53 UTC on October 24 and reached the maximum threshold of 100 requests by 11:32 UTC the same day.
The rapid exploitation of this vulnerability demonstrates how quickly threat actors move to weaponize newly disclosed flaws.
The indiscriminate nature of the attacks suggests cybercriminals are scanning for exposed WSUS servers on the internet and exploiting them opportunistically rather than targeting specific organizations.
According to Rafe Pilling, Director of Threat Intelligence at Sophos, “This activity shows that threat actors moved quickly to exploit this critical vulnerability in WSUS to collect valuable data from vulnerable organizations.”
The stolen data could be used for reconnaissance, follow-up attacks, or sold to other malicious actors on underground marketplaces. Organizations running WSUS services should immediately apply Microsoft’s security patches and conduct thorough reviews of their network configurations.
Additionally, companies should identify any WSUS server interfaces exposed to the internet and restrict access to WSUS ports 8530 and 8531 only to systems that genuinely require connectivity.
Security teams should review logs for signs of exploitation and implement network segmentation to prevent lateral movement if compromises are discovered.
Contractors who sell to the federal government have certain rights to recoup costs inflicted by the federal shutdown, but will they dare to exercise them?
“After the DOGE actions to eviscerate USAID and pretty much punish many, many agencies and terminate thousands of contracts, I think the contractor community is tentative to actually enforce their rights,” David Dixon, an attorney at Pillsbury Winthrop Shaw Pittman, said Thursday as part of the law firm's DC Disrupted webinar series.
Dixon said contractors are asking him a question that reveals the depth of their anxiety: Will the government retaliate for simply asking to be reimbursed for costs caused by the shutdown?
The processes for recovering costs are well-established; they include administrative means such as “requests for equitable adjustment.” Contractors use this process to seek compensation when government delays or changes increase their costs or extend timelines.
“These are regular administrative functions that every contractor should be aware of and should be able to process,” Dixon said. “Requesting an equitable adjustment should be a standard action that shouldn’t cause retaliation at all.”
But contractors are currently caught in a legal and operational vise created by the Anti-Deficiency Act, which prohibits agencies from spending money that hasn’t been allocated.
This means agency contracting officers cannot award new contracts, modify existing ones or exercise contract options.
Dixon shared a story of a company that completed work for a Federal Supply Schedule renewal on the eve of the shutdown. The company was negotiating large orders with customers.
But then the shutdown hit. The contracting officer could not exercise the option and the contract expired. The orders could not be awarded.
“What do they do with their employees now that they can’t get this contract?” Dixon said.
That is just one example of the mounting losses contractors face. Financial damage can accumulate in multiple ways:
Idle labor costs.
Storage expenses if deliverables stack up in warehouses.
Engineering delays as teams wait for approvals.
Contract termination risks because missed deadlines can trigger contract cancellations.
Contractors may have mechanisms to recovers some costs, but the Trump administration has created an atmosphere of fear.
“There was a belief among folks in the administration at the beginning of this shutdown that they could effectively create a little bit of pain for Democratic constituencies by canceling government funding, particularly grants,” said Craig Saperstein, another Pillsbury attorney.
The Office of Management and Budget made early moves to focus on “what we would think of as blue states or blue areas of states,” he said.
The tactic has brought little pressure on Democrats to come to the negotiating table. But Saperstein said the message to contractors is clear – the Trump administration is willing to use federal funding as a political weapon.
"A lot of times clients are finding they don’t want to rock the boat because the landscape’s just too uncertain,” said Aaron Ralph, a third Pillsbury attorney. “They have other awards they want to continue performing on.”
Despite the fear, contractors should not abandon their rights.
Dixon laid out three steps contractors should be taking:
Understand your contracts. Review the clauses that govern suspension of work, stop work orders, delay of work, and changes. Make sure your contract staff understand these clauses.
Document everything. Add memos to files noting what the government was supposed to do, when they did not do it and what the effect was. Accounting line items should track costs needed to be recovered.
Consider timing strategically. Contracts require that companies notify contracting officers within 30 days if they need to make a request for equitable adjustment. Companies should also keep in mind that the Contract Disputes Act gives contractors six years to submit claims from the date they accrue. As Dixon said, "it's not the end of the world" if the customer does not negotiate.
“If you are fearful right now because of the uncertainty in this administration, you should make the request for equitable adjustment as soon as possible,” he said. “But you can wait it out a little bit if you need to.”
I have studied nuclear weapons for my entire adult life and I have watched more than a hundred movies with nuclear weapons in them—from Dr. Strangelove to Austin Powers, from The Day After to several Mission Impossible movies. I also served as Special Assistant to the President of the United States and Senior Director at the National Security Council responsible for things like nuclear arms control and policy. In short, I am a nuclear nerd and know a lot about nuclear weapons.
So I sat down to watch the new Netflix movie A House of Dynamite by Kathryn Bigelow knowing a few things about nuclear weapons in the real world and in the movies. And overall, I liked the movie it because it gets so many things right. Yet at the same time, this is not a movie for experts and nuclear wonks to love, because it gets so many other things wrong.
But as we say in government memos, the bottom line up front is they do get right perhaps the most important message: nuclear operators and officials like to project that they will always have perfect knowledge, get every decision right, and have every answer at their fingertips. In reality, it is certain that officials will not know enough, that they will get a lot of things wrong, and that the answer all along has been: do everything you can now to avoid a world where nuclear weapons can ever be used.
What it does well: The movie does very well on the process and the technology. They make the Nuclear Handbook—the binder with options for nuclear launches and strikes—look like the actual Nuclear Handbook. They make the offices for the Secretary of Defense, for the commander of U.S. Strategic Command, and even the President’s deep underground nuclear bunker look very authentic. A few liberties are taken, but the access they got to the White House and the facilities help it look and seem as realistic as any movie I have ever seen.
If I get one question more than any other from friends and family about my time at the White House, they want to know if it looks like The West Wing. And they are always disappointed when I say no: the Situation Room in the TV show was awesome, but the facilities in House of Dynamite are much closer to the truth.
Another thing the movie does well is portray the reality that America’s ability to shoot down incoming missiles is not very good. Perhaps my favorite line in the whole movie is from the defense secretary who says “$50 billion and the best you can do is a coin toss.” For analysts of U.S. missile defense efforts, we wish it were only $50 billion and as good as a 50-percent chance of intercepting an incoming missile.
What it does poorly: There is one major flaw in the movie, and that is the stereotype that the military leaders will be gung-ho to launch, and only some plucky civilian will be able to slow them down. This is neither how I have found the military leaders with whom I have worked, nor does the scenario painted in the movie justify the positions taken in the plot. Without giving anything away, the danger the U.S. faces is not one that would justify or likely even lead a gung ho military advisor telling the President he needed to launch any immediate retaliation. It is a shame, because some slight changes in the script could have made that stark reality and the dangerous premise of rapid launch, hair trigger responses more realistic. I will be curious to hear from laymen friends and family if they think that plot device misses the mark.
Lastly, the script makes some officials and personnel look great—from the situation room staff to the Secret Service—but makes others look weak and dithering. Sure, people can have off days, and a crisis can try even the best of minds. But trotting out the trope of people in high positions who do not take their jobs seriously, who do not know what they are supposed to be doing, and relying on that for a plot device is a little offensive to me. In reality, even the best people at their best in a nuclear crisis (or even a simulation) can make mistakes, misspeak, or get it wrong. An audience could come away from the film thinking a competent staff and president might have done better. Maybe. But maybe not.
In academia and think tanks, we debate nuclear strategy and doctrine, programs and numbers in a cold manner filled with certainty and conviction. There is a longstanding appreciation that discussing weapons of mass destruction capable of destroying humanity is often only possible by adopting cold, distanced language peppered with phrases like “collateral damage” and “single-shot kill probabilities.” So it is not surprising that in those debates, there is often an underlying assumption of ideal conditions, reliable communications, complete knowledge of the scenario, and confidence that decisions made will be well executed.
In House of Dynamite, no one can find the National Security Advisor. The secretary of defense drops off the call unexpectedly at a key moment. No one knows why the network of satellites the U.S. relies on to detect launches did not see the missile, so no one is really sure who it belongs to. On the basis of no evidence, they assume the missile is nuclear. And so the plot centers quietly but aptly on a key reality that often the experts and officials themselves forget or choose to ignore: people and knowledge are often imperfect. We assume all of the fingers on nuclear-launch buttons are rational, that phones and computers will work when needed, that people will be awake and around when called upon, and that on a sunny weekday, the president will be able to speak with and get informed advice from the right people in 20 minutes or less.
The reality is that time is limited and perfection elusive, and so some changes have been made to the nuclear system over the past 20 years. Officials and advisors have worked hard to reduce the need to respond to almost any attack immediately and to give the president or surviving successor time to make more informed decisions. But even with these changes, more must be done to create more reliable command-and-control systems, to ensure the ability of the government to survive an attack, to ensure leaders can talk to each other in crisis, and do more of it before a crisis strikes, to avoid nuclear weapons from ever being launched. It is a good thing that the United States and a number of other nuclear states have stated that a nuclear war cannot be won and must never be fought. It would be better if we believed it, and stopped the ongoing effort to prepare for one. Over the next 30 years, the U.S. alone will likely spend more than $2 trillion on nuclear weapons and missile defenses. Yet we lack a good sense of what might actually deter Russia, China, North Korea, or Iran from ever using a nuclear weapon against the U.S. or its friends and allies. By building more weapons and underinvesting in the real security that comes from nuclear risk reduction and stability, we ensure that the next generation too will be forced to live in a House of Dynamite.
Jon Wolfsthal is is the Director of Global Risk at the Federation of American Scientists.
Anduril’s robot wingman has notched its first flight Friday, more than a month after the neoprime defense contractor blamed software woes and a push to make the inaugural takeoff semi-autonomous for the delay.
The takeoff happened at a testing location in California, the Air Force said in an emailed news release. Anduril’s prototype for the service’s combat collaborative combat aircraft competition has now joined one from General Atomics going from concept to first flight in less than two years.
“This milestone demonstrates how competition drives innovation and accelerates delivery,” said Air Force Secretary Troy Meink in a statement. “These flights are giving us the hard data we need to shape requirements, reduce risk, and ensure the CCA program delivers combat capability on a pace and scale that keeps us ahead of the threat.”
After General Atomics announced their successful first flight in late August, Anduril executives said in September that they wanted to make its first drone wingman flight test semi-autonomous, and blamed the delay on software problems.
Friday’s first flight was semi-autonomous, the company confirmed, and it built the software for the CCA. General Atomics’ drone wingman flight in August was not semi-autonomous.
“YFQ-44A was not designed to be a remotely-piloted aircraft, and that is not how we are operating it — from first flight and forever onward,” an Anduril news release said. “All of our taxi and flight tests have been and will continue to be semi-autonomous. This is a new age of air power; there is no operator with a stick and throttle flying the aircraft behind the scenes.”
General Atomics spokesperson C. Mark Brinkley congratulated Anduril on its milestone.
“This is a really small aviation community, and we all have friends and professional relationships on both sides, so it's good to see their hard work rewarded with success,” Brinkley said. “It's been a great week for the Air Force CCA program. Congratulations all around."
The Air Force’s competitive first increment production design is scheduled to be awarded in 2026.
Last month, Lockheed Martin announced it aimed to fly a CCA candidate of its own by 2027 which may compete in future competitions. Additionally, Boeing announced earlier this month it was designing a tiltrotor drone wingman to support the Army’s helicopter fleet.
