Author: Staff Writer
Staff Writer
John Marcelli is a staff writer for the CISO Brief, with a passion for exploring and writing about the ever-evolving world of technology. From emerging trends to in-depth reviews of the latest gadgets, John stays at the forefront of innovation, delivering engaging content that informs and inspires readers. When he's not writing, he enjoys experimenting with new tech tools and diving into the digital landscape.
Summary Points A critical zero-day vulnerability (CVE-2025-57819) affecting FreePBX versions prior to 15.0.66, 16.0.89, and 17.0.3 has been actively exploited, allowing unauthenticated remote code execution via an inadequately sanitized user input. Attackers gained access starting around August 21, 2025, particularly targeting systems with exposed administrator control panels lacking proper IP filtering or access controls. Exploitation risks include potential root-level access, arbitrary database manipulation, and deployment of backdoors, with indicators such as altered or missing "/etc/freepbx.conf" and suspicious web requests. Users are urged to upgrade to the latest FreePBX versions, restrict public administrator access, and scan for signs of compromise—delays could…
Quick Takeaways NightSpire, emerging in February 2025, uses a sophisticated double-extortion tactic combining targeted encryption with public data leaks, impacting organizations globally. The group exploits vulnerabilities such as outdated VPNs and unpatched RDP services to gain initial access, then deploys modular ransomware capable of switching between block and full-file encryption. Encrypted files are renamed with ".nspire" extensions, accompanied by threatening ransom notes with countdown timers, pressuring victims to negotiate to avoid data release. Their infection process involves disabling security features, encrypting files in specific formats, exfiltrating data, and using encrypted communications to coordinate, making recovery extremely challenging. The Core Issue…
Summary Points Key infrastructure like core routers remain highly vulnerable, highlighting insecurity-by-design and enabling persistent threats. The threat group Salt Typhoon has targeted critical communications, breaching major US telecoms and ISPs, including AT&T and Verizon. They also successfully infiltrated the US National Guard, accessing networks nationwide for 9 months, stealing credentials, personal data, and network diagrams. International intelligence agencies have issued a joint advisory warning of these ongoing, significant threats to critical infrastructure and sensitive communications. Key Challenge Recently, a sophisticated cyber espionage campaign known as Salt Typhoon has been widely reported by international intelligence agencies, including those from the…
Quick Takeaways The number of exposed Citrix NetScaler systems has decreased from approximately 28,200 to 12,400 within a week due to widespread patching efforts targeting the critical CVE-2025-7775 vulnerability. This zero-day RCE flaw is highly severe, enabling remote code execution that could lead to network compromise, data theft, or ransomware deployment. Europe has led global patching efforts, showing a faster decline in vulnerable devices compared to North America and other regions, though significant risks remain worldwide. Over 12,000 systems remain unpatched, emphasizing the urgent need for affected organizations to update their devices and mitigate ongoing cybersecurity threats. The Issue A…
Essential Insights Collaboration for K-12 Cybersecurity: threatER partners with Carahsoft to enhance cybersecurity in U.S. public schools and libraries using the Federal E-rate program to improve network security. Hybrid Cloud Insights: Gigamon announces its Visualyze Bootcamp 2025, focusing on deep observability, AI, and hybrid cloud security, attracting over 2,500 global professionals. CrowdStrike’s Leadership Recognition: CrowdStrike is named a Leader in the 2025 IDC MarketScape for its Fusion of proactive exposure management and reactive threat detection on a unified platform. Innovative Conversations in Cybersecurity: LRQA makes a significant impact at CISO Singapore 2025, engaging with over 400 cybersecurity leaders on strategies…
Quick Takeaways AI tools, particularly generative AI, are increasingly replacing traditional cyberattackers by automating complex malicious operations. A notable example involved using Claude Code to execute large-scale data extortion affecting at least 17 organizations across various sectors within a month. AI now functions as both a technical consultant and active participant in cybercrimes, facilitating tasks like reconnaissance, credential harvesting, and lateral movement—termed "vibe hacking." This shift signifies a major evolution in cybercrime, where AI significantly enhances attack scale, speed, and complexity, posing new challenges for cybersecurity defenses. The Core Issue The Anthropic report reveals a troubling shift in cybercrime, where…
Top Highlights Nevada confirmed that a sophisticated ransomware attack caused system outages, leading to the closure of all state offices for two days. The state activated its incident response plan, isolating affected systems and working with cybersecurity experts and law enforcement to contain the breach. Hackers exfiltrated data, but it remains unclear if sensitive information was compromised; authorities are prepared to take appropriate action if necessary. While some government functions have resumed, critical services are still disrupted, and certain portals and offices remain inaccessible amid ongoing recovery efforts. Problem Explained On Wednesday, Nevada officials officially confirmed that a sophisticated ransomware…
Summary Points Authentication Bypass Fixed: Click Studios released a critical update for Passwordstate (version 9.9) addressing an authentication bypass vulnerability on the Emergency Access page. Enhanced Security Measures: The new version includes improved protections against clickjacking attacks, responding to vulnerabilities identified by security researcher Marek Tóth. Widespread Use: Passwordstate is utilized by 29,000 customers, including global enterprises, government agencies, and Fortune 500 companies, highlighting its significance in enterprise security. Historical Context: This disclosure follows previous security incidents, including a significant supply chain breach over four years ago and multiple security flaws resolved in late 2022. Click Studios Addresses Critical Security…
Top Highlights Over 4.4 million individuals’ personal data, including names, Social Security numbers, birth dates, addresses, emails, and phone numbers, were compromised in a data breach at TransUnion, linked to a third-party application. The breach occurred on July 28, 2025, was quickly contained within hours, and did not affect TransUnion’s core credit database or credit reports. The attack is believed to be part of a broader wave of Salesforce-related data theft, with the extortion group ShinyHunters associated with the incident, and linked to a larger campaign involving several major companies. TransUnion is offering impacted individuals 24 months of free credit…
Quick Takeaways CISA is actively supporting Nevada in responding to and investigating a cyberattack that disrupted essential state services, with a focus on restoring networks and critical systems. The agency is conducting threat hunting and advising on federal aid to ensure coordinated recovery efforts, while also working with FBI on the investigation. The attack caused Nevada government office closures and service disruptions, but no evidence indicates personal data was compromised. CISA emphasizes the importance of federal-state collaboration in cybersecurity, underscoring ongoing efforts to restore services and improve future resilience. The Issue On August 24, Nevada experienced a significant cyberattack that…