A group of academic researchers from the ETH Zurich university have devised a new attack that breaks existing virtualization isolation to leak arbitrary memory and expose cryptographic keys.

The researchers discovered weaknesses in domain isolation in virtualized environments, proving that host–guest boundaries are not sufficiently isolated, thus leading to sensitive information leaks on various microarchitectures.

Their proof-of-concept (PoC) exploit, called VMScape (PDF), is a Spectre branch target injection (Spectre-BTI) attack targeting cloud environments, and can be used against all AMD Zen CPUs, as well as older Intel CPUs.

Virtual machines (VMs) represent the main mechanism for securely isolating workloads in the cloud, but Spectre attacks, such as Spectre-BTI, can compromise this isolation by targeting the shared branch predictor state within the CPU.

To mitigate the attack surface, CPU vendors have extended speculative execution attack mitigations to the branch predictor state, but gaps in those mitigations enable attack scenarios such as VMScape, the academics say.

The researchers’ analysis of these mechanisms, which do not consider the privilege levels the hypervisor and VMs have, revealed new Virtualization-based Spectre-BTI (vBTI) attack primitives that enable new Spectre-BTI attacks that target the host from the VM, or the VM from the host.

To demonstrate the vBTI primitives, the academics devised VMScape, which they describe as “the first Spectre-based end-to-end exploit in which a malicious guest user can leak arbitrary, sensitive information from the hypervisor in the host domain, without requiring any code modifications and in default configuration.”

The attack targets Kernel Virtual Machine (KVM)/QEMU as the hypervisor, focusing on QEMU as the hypervisor’s user-space component on the host.

“VMScape can leak the memory of the QEMU process at a rate of 32 B/s on AMD Zen 4. We use VMScape to find the location of secret data and leak it, all within 1092 s, extracting the cryptographic key used for disk encryption/decryption as an example,” the researchers note.

While branch target buffer (BTB) entries lack the necessary isolation on AMD Zen CPUs and older Intel CPUs, Intel has implemented eIBRS to isolate the BTB contents between the host and guest. However, gaps in this mitigation could render recent Intel CPUs vulnerable to virtualization Branch History Injection (vBHI) primitives.

The academics explain that the VMScape attack only affects virtualized environments, and that systems that do not run untrusted code in local VMs are not exploitable. However, they warn that existing cloud infrastructure likely contains vulnerable hardware.

Mitigations against the attack involve the use of an Indirect Branch Prediction Barrier (IBPB), the academics say. An IBPB, they note, is necessary on each VMexit before entering the hypervisor in user-space.

The researchers responsibly disclosed their findings in June 2025, and patches against VMScape, tracked as CVE-2025-40300 (CVSS score of 6.5), have been rolled out for major Linux distributions. Simply updating to the latest releases should address the issue.

“For VMware, Hyper-V, or other non-KVM hypervisors, we trust that AMD and Intel have responsibly disclosed the vulnerabilities and that proper mitigations have been implemented by the respective vendors,” the researchers noted.

Related: New SLAP and FLOP CPU Attacks Expose Data From Apple Computers, Phones

Related: In Other News: Microsoft Finds AMD CPU Flaws, ZuRu macOS Malware Evolves, DoNot APT Targets Govs

Related: Controversial Windows Recall AI Search Tool Returns With Proof-of-Presence Encryption, Data Isolation

Related: Chipmaker Patch Tuesday: Intel, AMD, Arm Respond to New CPU Attacks

https://www.securityweek.com/vmscape-academics-break-cloud-isolation-with-new-spectre-attack/

SEC Consult, a cybersecurity consulting firm under Eviden, says payment solutions company KioSoft took a long time to address a serious vulnerability affecting some of its NFC-based cards.

KioSoft manufactures unattended self-service payment machines, including for laundromats, arcades, vending machines, and car washes. The company is based in Florida and has offices in seven countries around the world. Its website claims it has deployed over 41,000 kiosks and 1.6 million payment terminals across 35 countries. 

SEC Consult researchers discovered back in 2023 that some of KioSoft’s stored-value cards — digital wallets that customers reload for use at specific payment terminals — are affected by a vulnerability (CVE-2025-8699) that can be exploited for free balance top-ups. The hack relies on the fact that the balance is stored locally on the card rather than a secure online database. 

The impacted cards identified by SEC Consult relied on MiFare Classic NFC card technology, which is known to have significant security issues.

Building on the known MiFare card vulnerabilities and analyzing how data is stored on the cards, SEC Consult researchers managed to read data from the card and write data on the card, enabling them to “create money out of thin air”. A hacker can increase the card’s balance to up to $655, but the process can be repeated, SEC Consult’s Johannes Greil told SecurityWeek.

An attacker can conduct an attack using a hardware tool such as the Proxmark, which is designed for RFID security analysis, research and development. The attacker also needs to have some knowledge of the MiFare card vulnerabilities to carry out a hack, Greil explained.

SEC Consult published an advisory describing its research this week. The company has made available a detailed timeline of its interaction with KioSoft, revealing that it took the vendor well over a year to release a patch.

The security firm first contacted KioSoft in October 2023, but the vendor was unresponsive until the CERT Coordination Center at the Software Engineering Institute of Carnegie Mellon University became involved. 

SEC Consult claims to have sent many requests for a status update since October 2023, with many going unanswered. The timeline shows that the vendor has requested several extensions to the disclosure deadline, and ultimately informed the security firm that a firmware patch was released in the summer of 2025. The vendor indicated that new hardware would also be rolled out in the future. 

KioSoft refused to provide version numbers of impacted and patched releases, arguing that affected customers would be privately notified, the security firm said. While KioSoft’s products are widely used, the vendor told SEC Consult that most of its solutions do not use the vulnerable MiFare card technology.

SEC Consult no longer has access to the terminals it initially conducted its research on and it could not verify the vendor’s patch. 

KioSoft has not responded to SecurityWeek’s request for comment. 

Related: eSIM Hack Allows for Cloning, Spying

Related: Major Backdoor in Millions of RFID Cards Allows Instant Cloning

https://www.securityweek.com/payment-system-vendor-took-year-to-patch-infinite-card-top-up-hack-security-firm/

Il 14 ottobre 2025 potrebbe segnare una data storica: il giorno in cui l’Europa deciderà se adottare la normativa più controversa del decennio tecnologico, il cosiddetto “Chat Control”, ufficialmente conosciuto come Regolamento per la Prevenzione e il Contrasto dell’Abuso Sessuale sui Minori (CSAR).

Chat Control: l’ultima battaglia per la privacy

La proposta, guidata dalla Presidenza danese del Consiglio UE, ha già ottenuto il supporto di 19 dei 27 Stati membri, inclusa l’Italia, creando una maggioranza qualificata che potrebbe far passare la legge. Il 12 settembre 2025, gli Stati membri europei hanno dovuto finalizzare le loro posizioni sulla controversa normativa, mentre esperti di cybersecurity in tutto il continente lanciano l’allarme su quello che definiscono un potenziale “disastro per la sicurezza digitale”.

La tecnologia che cambia le regole del gioco

Client-Side Scanning: l’arma a doppio taglio

Al cuore della controversia si trova una tecnologia apparentemente innocua ma dalle implicazioni rivoluzionarie: il client-side scanning. Questa metodologia prevede che i messaggi vengano analizzati sul dispositivo dell’utente prima che siano criptati, aggirando di fatto le protezioni fondamentali della crittografia end-to-end.

La proposta obbligherebbe piattaforme come WhatsApp, Signal, Telegram e ProtonMail a implementare sistemi automatici di scansione per individuare materiale pedopornografico (CSAM). Il piano prevederebbe la scansione obbligatoria di ogni messaggio, foto e video inviato dagli utenti a partire da ottobre, anche se protetto da crittografia end-to-end.

I numeri che fanno riflettere

Le statistiche più recenti sulla cybersecurity dipingono un quadro allarmante che rende ancora più delicata la discussione su Chat Control:

• Nel 2024, il costo globale medio di una violazione dei dati è stato di 4,88 milioni di dollari, con un aumento del 10% rispetto all’anno precedente
• Nel primo semestre del 2025, sono state rilevate 3.508 vulnerabilità zero-day, con una media di 585 scoperte al mese
• Nel 2025 sono previste oltre 33.000 nuove vulnerabilità CVE, con un tasso di crescita del 14,8%

L’opposizione scientifica: 500 esperti contro

Un gruppo di oltre 500 esperti in cybersecurity, crittografia e informatica provenienti da 34 paesi ha emesso un chiaro avvertimento contro la proposta Chat Control 2.0, descrivendola come “tecnicamente non realizzabile” e avvertendo che aprirebbe la strada a “capacità senza precedenti per sorveglianza, controllo e censura“.

Le vulnerabilità sistemiche

Gli esperti evidenziano diversi punti critici:

1. Falsi Positivi Inaccettabili: I sistemi di scansione su larga scala producono tassi di errore inaccettabili e potrebbero generare enormi quantità di segnalazioni false
2. Vulnerabilità di Sicurezza: I sistemi CSS (Client-Side Scanning) richiedono che i fornitori spostino parti dei loro modelli sensibili o liste hash dai server centralizzati e li distribuiscano sui client che potrebbero essere oggetto di reverse engineering
3. Brecce nella Crittografia: Il compromesso della crittografia end-to-end per la sicurezza crea un potenziale punto di attacco che hacker, governi ostili e cybercriminali possono sfruttare

Il posizionamento dell’Italia: tra sicurezza e controllo

L’Italia si posiziona tra i 15 Stati membri che supportano attivamente la proposta, insieme a Francia, Spagna, Svezia, Lituania, Cipro, Lettonia e Irlanda. Questa scelta riflette una tendenza globale verso misure di sicurezza più stringenti, ma solleva interrogativi sulla protezione dei diritti fondamentali.

Il framework normativo italiano

L’Italia ha già implementato robuste misure di cybersecurity attraverso l’Agenzia per la Cybersicurezza Nazionale (ACN), stabilita dal Decreto Legge n. 82 del 2021, che coordina le entità pubbliche coinvolte nella sicurezza informatica a livello nazionale e prepara la strategia nazionale di cybersecurity.

Il paese richiede già:

• Implementazione di misure di sicurezza avanzate inclusa la crittografia
• Controlli di accesso e meccanismi di protezione dei dati
• Conformità agli standard ISO/IEC 27001 e framework NIST

L’impatto globale: oltre i confini europei

Effetto domino sulla sicurezza mondiale

Se questo regolamento venisse approvato il 14 ottobre 2025, le conseguenze sarebbero devastanti per tutti, anche al di fuori dell’Unione Europea. Come avvenne con il GDPR nel 2018, che portò a migliori pratiche di privacy in tutto il mondo, Chat Control potrebbe avere l’effetto opposto.

Ogni piattaforma che gestisce potenzialmente dati di persone situate nell’UE sarebbe soggetta alla legge. Le piattaforme sarebbero obbligate a scansionare tutte le comunicazioni e tutti i file di almeno i soggetti dei dati situati nell’UE, anche i dati attualmente protetti con crittografia end-to-end.

Le minacce emergenti del 2025

Il panorama delle minacce informatiche nel 2025 presenta sfide senza precedenti:

• Il 35% di tutti gli attacchi sono ransomware, aumentati dell’84% rispetto all’anno precedente
• Il 47% delle aziende ha una politica per pagare i riscatti associati alle minacce informatiche
• Fino al 53% delle aziende si sente impreparata per i rischi di cybersecurity e i punti di attacco posti dall’IA

La resistenza democratica: voci dal parlamento

Membri dei Patrioti per l’Europa, il gruppo parlamentare di destra che attualmente è il terzo contingente più grande nel Parlamento UE, si sono fermamente opposti alla proposta Chat Control. L’ex pilota di Formula 1 e deputato europeo ceco Filip Turek ha dichiarato: “La mia posizione ufficiale sul voto per Chat Control è chiara. Voterò CONTRO! Ricevo centinaia di email su questo argomento ogni giorno, e sono contento che sosteniate la nostra posizione e la petizione contro lo spionaggio di Bruxelles!”

L’Eccezione che Conferma la Regola

Un dettaglio particolare della proposta solleva ulteriori interrogativi: gli account governativi e militari sarebbero esentati da questa invasione della privacy, mentre i dati di cittadini e imprese sarebbero esposti. Questa disparità di trattamento evidenzia l’ipocrisia intrinseca della proposta.

Prospettive future: scenari possibili

Scenario 1: approvazione e implementazione

Se Chat Control dovesse essere approvato, le conseguenze potrebbero includere:

• Indebolimento sistemico della crittografia europea
• Migrazione di servizi sicuri verso giurisdizioni più protettive
• Creazione di precedenti per regimi autoritari
• Aumento esponenziale delle vulnerabilità sistemiche

Scenario 2: blocco della proposta

Attualmente solo sei Stati membri dell’UE sono ufficialmente contrari all’attuale proposta Chat Control: Austria, Belgio, Repubblica Ceca, Finlandia, Paesi Bassi e Polonia. Serve una “minoranza di blocco” per fermare la proposta.

Raccomandazioni per un futuro sicuro

Per le Organizzazioni

1. Valutazioni Continue dei Rischi: Poiché i sistemi evolvono costantemente e nuove minacce appaiono continuamente, è fondamentale eseguire valutazioni frequenti della superficie d’attacco
2. Implementazione di Zero Trust: Adozione di architetture che non presuppongono fiducia intrinseca
3. Gestione Automatizzata delle Patch: Una delle principali cause delle violazioni sono le vulnerabilità non patchate, e l’automazione delle patch across sistemi operativi, app di terze parti e dispositivi IoT affronta questo problema

Per i Cittadini

• Utilizzare servizi con crittografia end-to-end robusta
• Rimanere informati sui propri diritti digitali
• Partecipare attivamente al dibattito democratico su queste tematiche

L’ora delle decisioni cruciali

L’Europa si trova a un bivio storico. La scelta tra sicurezza apparente e privacy sostanziale definirà non solo il futuro digitale del continente, ma stabilirà anche un precedente globale per l’equilibrio tra sorveglianza governativa e diritti fondamentali.

Chat Control mina completamente i valori che l’Unione Europea ha presentato al mondo negli ultimi anni. La strada verso una società sicura non passa attraverso la sorveglianza di massa, ma attraverso investimenti in educazione, tecnologie privacy-preserving e cooperazione internazionale basata sui diritti umani.

Il 14 ottobre 2025 non sarà solo una data nel calendario legislativo europeo, ma potrebbe segnare l’inizio di una nuova era digitale. La domanda rimane: sarà un’era di libertà protetta dalla tecnologia o di controllo facilitato da essa?

La risposta dipende dalle scelte che l’Europa farà oggi, e dalle voci che si leveranno a difesa di un futuro digitale veramente sicuro e libero.

Fonti e riferimenti:

https://www.ictsecuritymagazine.com/notizie/chat-control-sicurezza-privacy/

A report from Insikt Group dives into the motivations behind Putin’s foreign policy decisions, including “undermining the unity of international institutions, permitting hacktivist activity, ordering cyberattacks or influence operations, directing sabotage or kinetic military operations, and determining the use of nuclear weapons.” Though the report dives into a range of Putin’s foreign policy decisions, I’ve condensed the key areas that cybersecurity leaders should be aware of — especially those who defend supply chains or critical infrastructure. 

Cyberattacks

According to the report, Putin considers offensive cyber operations (including but not limited to deploying malware) to be “effective way to augment Russia’s military operations in Ukraine, degrade supply lines from NATO states to Ukraine, and gain insight into NATO and Ukrainian plans and intentions.”  

The report goes on to cite examples, such as: 

• WhisperGate: In January 2022, a wiper malware known as WhisperGate was launched by GRU Unit 29155. This malware overwrote data on Ukrainian government systems. 
• Kyivstar Telecom attack: In December 2023, a Russian APT group (Sandworm) disrupted internet and mobile services in Ukraine. 

Furthermore, Putin’s offensive cyber strategy has included targeting NATO states, presumably to disturb supply chains to Ukraine. 

Hacktivism

The report also discussed Russian hacktivism initiatives, which it described as “low-sophistication hacktivist attacks.” While Putin does not outright direct pro-Russia hacktivism, it is suggested he enables it because it voices Russia’s discontent with adversaries in a deniable, low-risk manner. These actions have increased since Russia’s invasion of Ukraine in February 2022 and often target adversaries after actions that appear to undermine Russian interests. 

Attacks include: 

• Distributed denial-of-service (DDoS) attacks
• Ransomware
• Doxxing
• Website defacements

An example cited in the report is the joint attack launched by hacktivist entities NoName057(16) and the Russian Cyber Army against the Japanese government, which came shortly after Japan extended support to Ukraine. 

How to Defend Cyber Assets Against Russian Escalation

As Putin’s cyber operations escalate, there are steps organizations can take to bolster security. These include, but are not limited to: 

• Monitoring SOC analysts to 24/7 coverage
• Increasing regular log reviews and threat hunting
• Prioritizing alerts connected to known adversary Tactics, Techniques and Procedures (TTPs)
• Pushing high-priority vulnerability patching

While it is impossible to predict every cyberattack from foreign adversaries, organizations can take these steps to improve their current security measures and lessen the likelihood of a successful attack. 

https://www.securitymagazine.com/articles/101903-russian-offensive-cyber-operations-analyzing-putins-foreign-policy-actions

https://www.securitymagazine.com/blogs/14-security-blog/post/101902-zero-trust-vs-adaptive-identity-what-cisos-are-getting-wrong

A publicly exposed database, without password protection or encryption, was discovered by Cybersecurity Researcher Jeremiah Fowler and contained 1.6 million audio files. These audio files included phone calls and voice messages collected between 2020 and 2025, belonging to a range of gyms and fitness centers across the United States and Canada. However, the database itself appears to belong to Hello Gym, a third-party contractor. 

Fowler informed the contractor of the exposure, and within hours, the database was restricted. It is unknown how long the database was up or if it was accessed by malicious actors. 

Many exposed audio recordings contained personally identifiable information (PII) such as names and phone numbers. If such information was leaked to a malicious actor, it could leave individuals at risk of targeted spear-phishing or social engineering campaigns. Fowler also noted the potential for a “man-in-the-middle” attack, in which a malicious actor could call a target, impersonate gym or health facility staff, and convince the target to share their credit or debit card information. 

In one exposed audio sample, Fowler discovered a call in which a gym manager spoke with a security monitoring service regarding the establishment’s alarm system, sharing information such as name, location and password credentials. If accessed by a threat actor, this data could be leveraged to physically access the gym after hours. 

Another notable risk is the potential for AI voice cloning. Fowler states, “The fact that AI models are capable of cloning voices with a high level of accuracy is terrifying, especially considering that many companies often record our conversations. (We have all called a business or organization and heard the message ‘Your call may be recorded for quality and training purposes.’) In such instances, consumers or clients generally have little or no control over how long those files are kept — not to mention the potential outcomes should these recordings fall into the wrong hands.” 

https://www.securitymagazine.com/articles/101900-16m-calls-and-voicemails-exposed-online

Set 11, 2025 Marina Londei Approfondimenti, Attacchi, Attacchi, Campagne malware, In evidenza, Minacce, Minacce, News, RSS 0

---

Il ransomware continua a dilagare e rimane la minaccia principale per le aziende di medie e grandi dimensioni, soprattutto grazie al phishing e al social engineering basati su IA: a dirlo è l’Acronis Cyberthreats Report H1 2025, analisi sui principali vettori di attacco, gruppi cybercriminali più attivi e settori più colpiti della prima metà del 2025.

Il report di Acronis evidenzia che il numero di vittime dei ransomware è aumentato del 70% nel primo semestre dell’anno rispetto allo stesso periodo del 2024.

Tra i gruppi più attivi figurano Cl0p, Akira e Qin, ma anche gruppi minori si stanno facendo strada nel panorama delle minacce grazie a un uso più diffuso dell’IA. L’utilizzo di tecnologie deepfake e automazioni consente ai cybercriminali di impersonare in maniera convincente le figure chiavi aziendali e velocizzare le campagne di phishing. Questo cambiamento si riflette nei dati presentati da Acronis: gli attacchi di social engineering sono passati dal 20% al 25,6% tra gennaio e maggio 2025 rispetto allo stesso periodo del 2024.

“Sebbene la diffusione del ransomware rimanga l’obiettivo finale dei criminali, le modalità con cui vi arrivano stanno cambiando. Oggi anche gli attaccanti meno esperti possono accedere a funzionalità AI avanzate, generare attacchi di social engineering e automatizzare le proprie attività con uno sforzo minimo” ha affermato Gerald Beuchelt, CISO di Acronis. “Il risultato è che MSP, produttori, ISP e altri operatori sono costantemente esposti ad attacchi sempre più sofisticati, come i deepfake evoluti, e basta un solo errore per compromettere le prospettive future delle aziende. Per affrontare questo scenario ed evitare le pesanti conseguenze di un attacco ransomware, è fondamentale adottare una strategia di cyber protection olistica che integri funzionalità avanzate di rilevamento, risposta e ripristino“.

Anche il phishing è legato a numeri significativi: stando al report, rappresenta il 25% di tutti gli attacchi registrati e ben il 52% di quelli contro gli MSP, registrando un aumento del 22% rispetto al 1° settembre 2024.

Riguardo i settori, il più colpito risulta essere il manifatturiero con il 15% di tutti i casi registrati nel primo semestre dell’anno, seguito dal retail, dal food&beverages e da telecomunicazioni&media.

Guardando infine ai Paesi più colpiti da malware, l’India risulta essere al primo posto, seguita da Brasile e Spagna. Per quanto riguarda l’Italia, il nostro Paese è rimasto in cima alla classifica, alternandosi tra il quinto e sesto posto nel corso degli ultimi mesi.

---

---

---

https://www.securityinfo.it/2025/09/11/report-acronis-il-ransomware-rimane-la-minaccia-principale-grazie-a-phishing-basato-su-ia/?utm_source=rss&utm_medium=rss&utm_campaign=report-acronis-il-ransomware-rimane-la-minaccia-principale-grazie-a-phishing-basato-su-ia

Live Webinar | Thursday, September 11 at 2PM ET – Register

Large Language Models (LLMs) are reshaping enterprise technology and redefining what it means to secure software. But here’s the problem: most penetration testers are using the wrong tools for the job. Traditional techniques focus on exploits and payloads, assuming the AI is just another application. But it’s not.

This session makes the case that effective LLM security testing is more about persuasion than payloads. Drawing on hands-on research and real-world client engagements, we reveal a new model for AI pen testing – one grounded in social engineering, behavioral manipulation, and even therapeutic dialogue.

You’ll explore Adversarial Prompt Exploitation (APE), a methodology that targets trust boundaries and decision pathways using psychological levers like emotional preloading, narrative control, and language nesting. This is not Prompt Injection 101 — it’s adversarial cognition at scale – using real-world case studies to demonstrate success.

This virtual session tracks key operational challenges: the limitations of static payloads and automation, the complexity of reproducibility, and how to communicate findings to executive and technical leadership.

Join Bishop Fox and SecurityWeek for the live webinar to learn:

• Why conventional penetration testing methodologies fail on LLMs
• How attackers exploit psychological and linguistic patterns, not code
• Practical adversarial techniques: emotional preloading, narrative leading, and more
• Frameworks for simulating real-world threats to LLM-based systems
• How to think like a social engineer to secure AI

Who Should Watch:

This session is perfect for anyone securing, testing, or building AI systems, especially those using LLMs. Pen testers and red teamers will explore a new adversarial framework focused on behavioral manipulation over payloads. AI/ML security pros and researchers will gain insight into psychological attack techniques like emotional preloading and narrative control. Developers will see real-world examples of how attackers engage with models, and CISOs/tech leads will benefit from guidance on operational challenges like reproducibility and communicating findings.

https://www.securityweek.com/webinar-today-breaking-ai-inside-the-art-of-llm-pen-testing/

Cisco on Wednesday released patches for three vulnerabilities in IOS XR software, as part of its September 2025 security advisory bundled publication.

Tracked as CVE-2025-20248 (CVSS score of 6), the first of the bugs is a high-severity issue in the IOS XR installation process that could allow attackers to bypass image signature verification.

Successful exploitation of the flaw, Cisco explains, could lead to unsigned files being added to an ISO image, which could then be installed and activated on a device.

Because of the potential bypass of the image verification process, Cisco has raised the security impact rating of the advisory from medium to high. 

The second IOS XR issue resolved this week is CVE-2025-20340 (CVSS score of 7.4), a bug in the software’s Address Resolution Protocol (ARP) implementation that could be exploited by adjacent, unauthenticated attackers to cause a denial-of-service (DoS) condition.

“This vulnerability is due to how Cisco IOS XR Software processes a high, sustained rate of ARP traffic hitting the management interface. Under certain conditions, an attacker could exploit this vulnerability by sending an excessive amount of traffic to the management interface of an affected device, overwhelming its ARP processing capabilities,” Cisco explains.

The third security defect is a medium-severity issue in IOS XR’s ACL processing feature that could allow unauthenticated, remote attackers to send traffic to a vulnerable device and bypass configured ACLs for the SSH, NetConf, and gRPC features.

Tracked as CVE-2025-20159 (CVSS score of 5.3), the flaw exists because IOS XR packet I/O infrastructure platforms for SSH, NetConf, and gRPC have not supported management interface ACLs.

Cisco says it is not aware of any of these vulnerabilities being exploited in the wild. Users are advised to apply the available patches as soon as possible, as hackers are known to have exploited Cisco bugs. 

Related: Fortinet, Ivanti, Nvidia Release Security Updates

Related: Apple Unveils iPhone Memory Protections to Combat Sophisticated Attacks

Related: ICS Patch Tuesday: Rockwell Automation Leads With 8 Security Advisories

Related: SAP Patches Critical NetWeaver Vulnerabilities

https://www.securityweek.com/cisco-patches-high-severity-ios-xr-vulnerabilities/

British train operator LNER (London North Eastern Railway) has disclosed a data breach impacting customer information. 

The company, which is in charge of many long-distance passenger services on the East Coast Main Line, revealed that hackers gained access to files managed by an unnamed third-party supplier.

The compromised information includes customer contact details and some information on previous journeys. 

However, LNER highlighted that banking, payment card, and password information have not been exposed as the impacted third-party does not have access to such information. 

It also pointed out that the incident has had no impact on ticket sales and train operations.

“Please be cautious of unsolicited communications, especially those asking for personal information. If in doubt, do not respond,” LNER told customers.

No additional information has been shared. It’s unclear whether the third-party supplier was specifically targeted or it was one of the multiple victims of a large-scale campaign, such as the recent Salesforce-Salesloft attack.

Last year, police in the UK launched an investigation after a ‘hack’ led to anti-Islam messages being displayed to people who were trying to use the Wi-Fi service at the country’s biggest railway stations. 

The probe showed that an employee of the company providing railway Wi-Fi services was behind the incident. 

Related: Train Brakes Can Be Hacked Over Radio—And the Industry Knew for 20 Years

Related: Hacktivist Sentenced to 20 Months of Prison in UK

Related: Four Arrested in UK Over M&S, Co-op Cyberattacks

Related: UK’s Ransomware Payment Ban: Bold Strategy or Dangerous Gamble?

https://www.securityweek.com/uk-train-operator-lner-warns-customers-of-data-breach/