← Back to stratcyberadvisors.com

Act first

Newly confirmed as actively exploited

These were added to CISA's Known Exploited Vulnerabilities catalog this week. Attackers are already using them, so they belong at the top of any patch queue.

Threat landscape

Incidents and threat activity

• Critical PHP flaws put most websites at risk, and attack attempts are surging

  US agencies urged fixes for flaws in PHP that could expose data and let attackers seize control of servers, and some government agencies urged taking sites offline until they were fixed. Cloudflare reported millions of exploitation attempts, while researchers said successful compromises have so far been slower than expected and millions of sites remain exposed.

  Sources: Cybersecurity Dive, Krebs on Security, Cybersecurity Dive, Nextgov, Nextgov, MS-ISAC (CIS)

• China-linked group used an AI tool in ConnectWise cloud backup attack

  Microsoft linked the actor, which it tracks as Storm-0940, to the attack and said it used an AI-enabled penetration-testing tool to automate and speed up the intrusions. Reports differ on scale, citing hundreds of Microsoft 365 users and more than 2,200 tenants.

  Sources: Cybersecurity Dive, Dark Reading

• Developer tools hit by supply-chain attacks involving exposed credentials

  LiteLLM said a key accidentally exposed in May and never revoked was behind an attack believed to have hit tens of thousands of users last week. Separately, an ongoing campaign called Gheist is reported to be harvesting credentials and sensitive data from thousands of developer repositories.

  Sources: The Record, Dark Reading

• Russia-linked hackers breached a NATO shipbuilder

  Symantec, which discovered the espionage operation, urged companies to scan their networks for signs of compromise.

  Source: Cybersecurity Dive

Government and regulation

Policy moves

• CISA sets a new strategy while losing a senior vulnerability official

  The agency, still recovering from major workforce cuts, promised proactive defense, a review of its services and a yearlong schedule for reporting progress. Separately, its vulnerability response chief is leaving after nearly six years.

  Sources: Cybersecurity Dive, Nextgov, Nextgov

• Lawmakers press tech firms on election security ahead of midterms

  Democratic lawmakers warned social media and AI companies about backsliding on safeguards against false voting information, foreign influence and deceptive AI content. Two senior lawmakers also said Russia is targeting Democrats and Ukraine supporters, with more targeted Chinese influence efforts.

  Sources: Nextgov, Nextgov

• DHS AI policy update lets its chief AI officer waive requirements

  Experts raised concerns about a new provision allowing waivers of any requirement in the directive, including prohibited use cases. The change is a reminder to check how exceptions are governed in your own AI policies.

  Source: FedScoop

• Judge rules OPM illegally shared employee records with DOGE

  The judge found the government gave no credible explanation for why DOGE needed access to personal information of millions of employees.

  Source: FedScoop

Compliance

Government regulation watch

New rules, guidance and deadlines for FISMA, FedRAMP, CMMC, the HIPAA Security Rule and other federal cybersecurity programs.

No major items this week.

Board and market

Governance and market signals

• Cyber insurance claims are fewer but costlier for large businesses

  A new report says AI-powered attacks and hidden supply-chain weaknesses are making insurers' work harder. Insurers are also moving beyond risk transfer and getting more involved in cybersecurity itself, which may affect underwriting expectations.

  Sources: Cybersecurity Dive, Dark Reading

• AI is making attacks cheaper and easier for less skilled attackers

  CrowdStrike warned that low-skilled hackers are likely to become much more dangerous over the next 12 months. Another report describes one campaign targeting 105 sites with open-weight models and another where public models gained full domain control for $12.

  Sources: Cybersecurity Dive, Dark Reading

• Monitoring AI agents with other AI agents may not reduce risk

  Microsoft is adding Guardian Agents to watch and contain anomalous AI agents, but experts warn that policing unpredictable agents with other agents could compound the risk.

  Source: Dark Reading

• Investigators suspect ransom negotiators were close to ShinyHunters

  Federal investigators reportedly identified executives at two ransomware negotiation firms who kept unusually close relations with the extortion group. Organizations that hire incident-response or negotiation vendors should scrutinize who they trust.

  Source: Krebs on Security

For leadership

Questions to ask your team this week