Security Leaders Discuss Texas Hunting, Fishing License Data Breach

The Texas Parks and Wildlife Department (TPWD) reported that the personal information of more than three million Texas hunting and fishing license customers may have been affected by a recent data breech.

According to a notification on the department’s website, the Texas Cyber Command recently detected a cybersecurity incident involving the TPWD license system vendor that handles the sale of hunting and fishing licenses.

According to the report, the investigation revealed that an unauthorized actor may have obtained personal information – including driver license information, passport numbers, email addresses, phone numbers and residential addresses for more than 3 million Texas hunting and fishing license customers. However, Social Security numbers, dates of birth and financial information, including credit card details were not obtained from this incident. The notification also stated that there was no evidence that customers under the age of 18 were involved or that any specific group was targeted.

Here, some security leaders share their thoughts on the incident.

“It’s no surprise that TPWD used an external contractor for this. That’s incredibly common among local and state agencies since it’s usually far cheaper to outsource this than to build and maintain their own IT systems,” says Jake Williams: former NSA hacker, Faculty at IANS Research, a Boston-based cybersecurity research and advisory firm. “I actually work with one of the largest companies providing these services to state and local government agencies in the US (not the one implicated in this breach). I can tell you first hand that the complexity in these systems is absolutely wild. Often the provider wants to do the right thing for security, but the government agency requires some security downgrade to be compatible with their other systems (usually because they’re legacy or outdated).

“It won’t surprise me at all to see other state wildlife licensing platforms being targeted. Many will use similar software and interfaces to outsourcing vendors. Threat actors will take the lessons they learn from the Texas attack to make future attacks more successful.”

“Breaches like this don’t end at the point of exposure. When driver’s license numbers and passport data hit the market, they become fuel for account takeover, synthetic identity fraud, and targeted phishing at scale,” says Kevin Gosschalk, founder and CEO Arkose Labs a fraud prevention and digital trust company and author focused on trust, AI, and the future of human-machine decision-making. “The victims here aren’t just the three million Texans whose data was taken — they’re anyone whose accounts those credentials get used to access next. Organizations need to assume this data is already in circulation and act accordingly.”

https://www.securitymagazine.com/articles/102397-security-leaders-discuss-texas-hunting-fishing-license-data-breach

Amazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories

Researchers at Wiz have disclosed a high-severity vulnerability in the Amazon Q Developer extension for Visual Studio Code that could allow attackers to steal developers’ cloud credentials by luring them into opening a booby-trapped code repository.

Amazon Q Developer is an AI-powered coding assistant that offers developers features such as code suggestions, automated refactoring, and access to external tools and services via integrations with local processes.

AWS was notified about the issue on April 20 and a patch was released on May 12. The cloud giant published a security advisory this week.

The root cause of the vulnerability was that the extension would automatically act on configuration files embedded in a workspace without first asking the user for permission.

That meant a malicious repository could quietly run attacker-controlled commands in the background the moment a developer opened it, gaining access to whatever cloud credentials and API keys were loaded in their environment at the time.

Attack path examples include fake coding tests like those used by North Korean hackers, a typosquatted open source package, or a malicious pull request to a popular project, Wiz said.

Advertisement. Scroll to continue reading.

Developers authenticated to AWS or other cloud services would be particularly exposed, since active session credentials could be captured and exfiltrated without any visible warning.

“The combination of auto-execution, shell spawning, and environment inheritance created a high-severity vulnerability in a widely-used developer tool. A single malicious repository could compromise not just the developer’s local machine, but their cloud infrastructure as well,” Wiz noted.

AWS has patched the vulnerability, tracked as CVE-2026-12957, and a related issue involving symbolic link handling (CVE-2026-12958).

Fixes are available across all affected Amazon Q Developer plugins covering VS Code, JetBrains, Eclipse, and Visual Studio, as well as the language server.

“We would like to thank Wiz for collaborating with us on this issue. We have remediated this issue in language server version 1.65.0,” an AWS spokesperson told SecurityWeek.

“The AWS Language Server updates automatically unless the customer’s network configuration prevents it, so no action is required in most cases. For existing customers, reloading the IDE will trigger an update to the latest language server version, which includes this fix. If auto-update is blocked, we recommend upgrading to the latest version of the Amazon Q Developer plugin for your IDE. New customers require no action, as the latest patched version will be downloaded automatically,” the AWS spokesperson added.

Wiz noted that the underlying issue is not unique to Amazon Q; other researchers have identified similar problems in VS Code and other AI coding tools, including Claude and Cursor.

The Google-owned cloud security giant published technical details and PoC code on Friday.

https://www.securityweek.com/amazon-q-flaw-enabled-cloud-credential-theft-via-malicious-repositories/

Data breach Trenitalia: esposti dati di contatto e di viaggio dei passeggeri, alto il rischio phishing

Il data breach Trenitalia, comunicato il 26 giugno, espone i dati di contatto e di viaggio di una parte dei passeggeri. La principale compagnia ferroviaria italiana ha inviato ai clienti interessati una email con oggetto “Comunicazione di violazione dei dati personali ai sensi dell’art. 34 del Regolamento UE 679/2016”, attribuendo l’accesso non autorizzato ai database dei titoli di viaggio a “soggetti esterni non identificati”; al termine delle verifiche tecniche, spiega l’azienda nella comunicazione inviata agli interessati, sono state individuate le persone potenzialmente coinvolte. L’azienda, contattata dalla stampa, ha collocato l’origine dell’incidente nell’ottobre 2025: la ricostruzione tecnica degli accessi e l’identificazione degli interessati hanno richiesto mesi prima dell’invio delle comunicazioni.

Va detto subito ciò che, secondo la stessa Trenitalia, non è stato compromesso: i dati di accesso agli account, le credenziali personali e le informazioni di pagamento come numero della carta, data di scadenza o codice di sicurezza. Non risultano, al momento, rivendicazioni note né elementi che qualifichino l’evento come ransomware: la società parla di accesso non autorizzato ai database dei titoli di viaggio.

Data breach Trenitalia: quali dati sono coinvolti

La violazione potrebbe aver interessato, qualora presenti nei sistemi associati al titolo di viaggio, diverse categorie di dati personali: dati anagrafici e identificativi (nome, cognome, data e luogo di nascita del passeggero e dell’eventuale acquirente); recapiti di contatto come indirizzo email e numero di telefono; informazioni sul viaggio, tra cui tratta, data, orario e numero del titolo; codice della carta fedeltà associata al biglietto; società o ente datore di lavoro; tipologia di offerta o servizio associata al titolo di viaggio e i dati necessari per fruirne; estremi del documento d’identità; dati tecnici connessi alla generazione del titolo di viaggio. L’ampiezza esatta della platea coinvolta non è stata quantificata ufficialmente. Si tratta, nel complesso, di informazioni che descrivono chi viaggia, come raggiungerlo e quando: un profilo prezioso per chi voglia confezionare comunicazioni fraudolente credibili.

Notifica a Garante e CSIRT, denuncia alla Procura

Trenitalia dichiara di aver adottato immediatamente le misure per contenere l’incidente, interrompendo l’intrusione e rafforzando i controlli sui sistemi. L’accaduto è stato notificato al Garante per la protezione dei dati personali e al CSIRT Italia, e una denuncia è stata presentata alla Procura della Repubblica presso il Tribunale di Roma per avviare le indagini. La società richiama l’articolo 34 del GDPR e le Linee guida EDPB n. 9/2022 (versione 2.0 del 28 marzo 2023) sulla notifica delle violazioni di dati personali, spiegando che la ricostruzione degli accessi e l’identificazione dei clienti hanno richiesto tempo: un passaggio che illustra bene le tempistiche e le valutazioni di rischio dietro la notifica al Garante e la comunicazione agli interessati.

Il rischio vero: phishing su misura

Proprio perché non sono in gioco password o dati di pagamento, il pericolo più concreto si sposta sull’inganno. Recapiti e dettagli di viaggio sono il materiale ideale per costruire messaggi credibili: la stessa Trenitalia avverte i clienti della possibilità di ricevere email, SMS o telefonate che facciano riferimento a viaggi reali, invitando a non fornire dati personali o finanziari e a verificare sempre il mittente. È la logica dello spear phishing, la truffa personalizzata che usa informazioni autentiche della vittima per abbassarne la guardia. La società ricorda che non contatterà mai i clienti per chiedere password o dati di pagamento e ha attivato un servizio dedicato tramite il webform “Privacy – Gestione dei dati personali”.

Per chi si occupa di sicurezza, il caso conferma che una violazione senza dati finanziari non è una violazione minore: l’esposizione di contatti e abitudini di viaggio alimenta campagne di frode mirata che possono colpire a distanza di settimane. Trenitalia rientra inoltre tra i soggetti essenziali per il Paese ai sensi della direttiva NIS2, e un episodio simile mostra quanto la superficie d’attacco di queste realtà comprenda ormai l’intera base clienti, non solo i sistemi operativi del trasporto. La difesa, lato utente, resta la verifica del canale e del mittente prima di cliccare; lato organizzazioni, il monitoraggio delle ondate di phishing che sfruttano il marchio Trenitalia nei prossimi giorni.

Un contesto più ampio: la notifica parallela di Trenitalia Tper

L’episodio si inserisce in una sequenza che ha interessato l’ecosistema informatico del gruppo Ferrovie dello Stato. Nello stesso arco temporale dell’origine dichiarata dall’azienda, tra fine novembre e dicembre 2025 era emerso un attacco ad Almaviva, fornitore IT del gruppo FS, con l’esfiltrazione di circa 2,3 terabyte di dati poi comparsi su un forum della rete Tor e riconducibili a numerose società del gruppo, Trenitalia inclusa.

Va tenuta distinta una seconda notifica, formalmente autonoma. Trenitalia Tper S.c.a.r.l., società che gestisce il servizio regionale in Emilia-Romagna, ha inviato nelle settimane precedenti una propria comunicazione ai sensi dell’art. 34 GDPR a clienti e dipendenti, con lo stesso impianto: accesso non autorizzato da parte di soggetti esterni non identificati, esclusione di credenziali e dati di pagamento, avviso sul rischio di phishing mirato. La comunicazione Tper differisce però da quella nazionale su punti verificabili: notifica al solo Garante con generico rimando alle Autorità competenti, assistenza tramite numero telefonico dedicato anziché webform, nessun richiamo alle Linee guida EDPB, invio via SMS anziché email. Si tratta quindi di due soggetti giuridici distinti e di due comunicazioni separate. Allo stato, le aziende non hanno dichiarato un nesso ufficiale tra le notifiche e l’attacco ad Almaviva: la coincidenza temporale è documentata, mentre l’attribuzione a un’unica matrice resta una ricostruzione non confermata.

Condividi sui Social Network:

https://www.ictsecuritymagazine.com/notizie/data-breach-trenitalia-passeggeri-phishing/

Identifying Government Leaders Who Will Succeed in Corporate Security

The demand for executive and senior security leadership in the corporate sector has never been more competitive or more consequential. Organizations across a wide range of industries are increasingly turning to candidates with backgrounds in government, military, and law enforcement to fill their most critical security leadership roles. These candidates bring real-world experience in threat assessment, crisis response, and high-stakes decision-making that no graduate program replicates. Yet background and career level by themselves do not forecast results.

The transition from government service to corporate security leadership is one of the most psychologically demanding career changes in professional life. The factors that predict success are distinct from the factors that drove excellence in the originating organization.

The market for government-background corporate security leadership is full of talent but also full of preventable failures. The problem is not the capabilities of the individuals. Every agency we have examined contains exceptional security professionals with real-world experience that you will not find solely in commercial markets.

The failure lies in placing a candidate whose mindset was shaped by one institutional environment into a role governed by a completely different logic. Success does not happen by expecting that transition to occur on its own.

The goal is not to find a candidate who merely fits a commercial psychometric profile. It is to identify one whose government-based strengths align with the company’s real security risks. You are looking for someone with potential derailers that can be managed through structured onboarding and who has already begun shifting from institutional operator to commercial executive. Assessments such as the Hogan HDI, HDS, and MVPI, tools that SMR regularly offers its clients, reveal this data.

An interview structure based on assessment feedback helps reveal how far along the candidate is in adapting their professional identity. Specifically, moving from a government or military mindset that is rule-bound, hierarchical, and mission-driven, to a commercial one that is influenced by business strategy, stakeholder management, and risk-return balance.

This assessment framework backs up what we see in an individual’s behavior. The hiring manager can then use all this information to make a well-reasoned, evidence-based hiring decision. Two findings from this analysis process deserve particular emphasis for security practitioners and HR professionals.

First, the field-to-executive transition moment when a high-performing government professional is first hired into enterprise-level corporate leadership is the single highest-risk point in their career, and the least well-assessed moment in most corporate hiring processes.

The Army’s Battalion Commander Assessment Program, which produced a 34% change in selection outcomes versus traditional file review, is the most empirically rigorous model for what this transition assessment should look like. No civilian federal law enforcement agency, and no private sector corporation, has implemented anything close to this level of rigor at the senior leadership transition point. That gap is where the specialist practitioner adds the most value.

Second, the candidates who are going to succeed in corporate security leadership are already demonstrating it before they arrive at the assessment. They have been building a commercial understanding, voluntary cross-institutional relationships, and a new professional identity for months or years before the formal transition. The assessment process does not create these candidates; it identifies them. And that identification, done precisely with a well-run, highly informed, security executive search process, yields success.

Candidates from government backgrounds who thrive in corporate security leadership are not always the ones with the most impressive operational records. They are the individuals who, even before making the formal transition, have begun building a new professional identity rooted in commercial understanding, coalition-based influence, and genuine curiosity about the business they are entrusted to protect.

The candidates who thrive talk about what they are going to build. The candidates who struggle talk about what they are going to bring.

https://www.securitymagazine.com/articles/102383-identifying-government-leaders-who-will-succeed-in-corporate-security

AI Is Outpacing Cyber Defense: Security Must Shift from Reaction to Readiness

Cybersecurity is entering a phase in which the pace of artificial intelligence advancement is outpacing traditional defense models. Anthropic’s recent Mythos announcement underscored a truth cybersecurity leaders can’t ignore: security models cannot keep pace with the speed of AI acceleration.

The message, echoed across the industry, is stark — AI-enabled vulnerability may soon outpace defenders’ ability to respond in real time. In this environment, AI’s impact on cybersecurity is inevitable, and organizational resilience will depend on how quickly companies can adapt.

This turning point exposes a deeper issue: most enterprises still operate under outdated understandings of how security, AI, and workforce capabilities intersect. As AI systems become more capable and more autonomous, the critical gap between technological advancement and organizational readiness is also widening.

The Emerging Challenges of Speed, Complexity, and Misalignment

Modern AI systems are rapidly improving in their ability to generate code, identify vulnerabilities and simulate adversarial behavior. And AI-driven attack capabilities are evolving faster than traditional defensive controls and benchmark frameworks can accurately measure.

Furthermore, security teams often still rely on models built for earlier generations of technology that assume predictable systems and human-paced threat detection, and AI now undermines those assumptions. Compounding this disconnect, the broader conversation around AI often misrepresents its true impact within an organization. This includes narratives that jump between narrow use cases and speculation, ignoring the fact that individuals are already adopting AI in fast-moving, often poorly governed settings.

The speed of AI adoption is also exposing and amplifying a persistent communication gap between technologists and business leaders. As new functionalities are introduced across an organization, security teams often frame risks in technical terms — firewalls, models, configurations — while executives make decisions based on continuity and risk exposure. The result is a security program that may be technically sound but insufficiently integrated into a broader business strategy.

Addressing these challenges requires a shift in posture across three domains: governance, literacy and integration. Together, these three domains form the foundation of cyber resilience, enabling organizations to move beyond reactive defense and toward sustained readiness in an AI-driven environment.

Building Cyber Resilience in the Age of Rapid AI Deployment

An organization’s readiness to implement AI extends beyond technical capability, requiring clear operational processes, governance structures, and workforce skills necessary to evaluate, deploy, and oversee AI systems across the enterprise.

However, AI systems are already being deployed across enterprises in exploratory and semi-structured ways, often without consistent oversight. It’s critical to incorporate governance into system designs rather than attempting to retrofit it after deployment. Frameworks such as ISO/IEC 42001 provide a structured approach for operationalizing AI management systems, embedding security, ethics, and accountability at the core of AI governance.

Organizations also need to prioritize AI literacy at every level of the enterprise. The goal is to ensure that practitioners and their leaders understand AI’s current capabilities, limitations, and risks without necessarily requiring every employee to become a machine learning engineer. A grounded understanding of “where we are in the AI lifecycle” is essential for making informed decisions regarding AI’s role in the organization’s daily operations.

In addition to establishing these pillars of AI readiness, cybersecurity teams should reframe how they communicate their roles by connecting security initiatives to the organization’s long-term strategy. This alignment between security strategy and enterprise objectives will be critical as novel enterprise AI tools find new ways to compress the executive decision-making process across the board. Instead of focusing solely on vulnerabilities or controls, teams must articulate how security initiatives impact business resilience, regulatory compliance, and operational continuity.

Leaders must also invest in human capability as a core security control. As AI accelerates both offense and defense, the ability of teams to reason critically, adapt quickly, and collaborate effectively with AI systems becomes a primary determinant of security maturation. Organizations that cultivate these capabilities will be better positioned to navigate continuous cycles of experimentation, deployment and refinement that define the current AI landscape.

A New Security Mandate

Across industries, we are transitioning from AI experimentation to continuous adaptation. AI is now an active force reshaping the economics and speed of cybersecurity itself. Similar to the early days of the internet, where availability was prioritized over security, today’s AI systems are evolving faster than the governance structures designed to contain them.

As a result, the mandate for security leaders is clear: resilience must be built into dynamic AI systems through effective governance, elevated organizational AI literacy, and security strategies aligned with business outcomes.

In this era of rapid AI acceleration, competitive advantage will come from organizations that can combine human judgment, AI capabilities, and disciplined governance into a coordinated, resilient security strategy.

https://www.securitymagazine.com/articles/102388-ai-is-outpacing-cyber-defense-security-must-shift-from-reaction-to-readiness

Cal Water Confirms User Credentials Exploited in Hacking

After Iranian-linked threat actor Handala claimed to have hacked California Water Service (Cal Water), an organization spokesperson stated the company was investigating the claims. Recently, the Cal Water spokesperson reached out to Security magazine with an update on its investigation.

The spokesperson stated, “As a critical infrastructure company, California Water Service takes cybersecurity and the security of our data and systems very seriously. Following the cybersecurity incident allegations made on June 11, 2026, we activated our cybersecurity response plan and worked around the clock to conduct a robust investigation, supported by leading cybersecurity experts, including Mandiant.

“Based on its investigation, Mandiant has confirmed that the threat actor activity was limited to unauthorized access to a small number of specific user accounts within two third-party service provider platforms. Mandiant did not identify evidence of threat actor activity in Cal Water’s internal information technology or operational technology environments.

“The investigation determined that the threat actor accessed one active customer’s online Cal Water account using stolen user credentials. The customer account did not provide access to the billing system, and no payment information was compromised. The threat actor also accessed an external, third-party web site related to a GPS location correction tool; however, the website does not contain any confidential or sensitive information.

“We appreciate the collaboration and support our state and federal government partners provided throughout the investigation, and we will continue to work to maintain the security of our systems and data from malicious actors.”

This attack falls in line with official warnings earlier this year that Iranian actors may target critical infrastructure, including water and wastewater systems (WWS).

https://www.securitymagazine.com/articles/102392-cal-water-confirms-user-credentials-exploited-in-hacking

61% of Healthcare Organizations Predict a ‘Fatal’ Cyberattack Within 5 Years

A recent report by Omega Systems analyzed cybersecurity incidents within healthcare organizations. The report found that 85% of healthcare practices experienced at least one operational disruption caused by a third-party or “vendor-of-a-vendor” failure in the past 12 months. Despite this, 70% of leaders say they are confident in their vendors’ cybersecurity posture.

The report also found that 63% of practices do not continuously monitor their digital supply chains. That gap shows up most clearly when something goes wrong. If a healthcare practice’s EMR goes down due to a cyberattack, the most likely outcomes are billing and scheduling stopping instantly and freezing cash flow (53%), loss of access to patient histories and medication lists creating malpractice liabilities (47%), and temporary or permanent practice closure (25%).

According to the report, 61% of healthcare organizations expect a fatal cyberattack within five years. However, 62% still treat cybersecurity and compliance as a technical line item rather than a patient-safety priority. The report also found that more than eight in 10 practices have gaps in their recovery plans. Nearly a third (31%) are still running on legacy systems that can’t contain a breach quickly once it starts.

Ninety-three percent of practices are already using AI in patient-facing and administrative workflows, according to the report. Additionally, six in 10 leaders have self-attested to HIPAA compliance despite known, unpatched vulnerabilities. With the proposed 2026 HIPAA Security Rule, 76% of practices say they aren’t ready.

Fifty-two percent of practices have no managed security service provider (MSSP), and 39% manage cybersecurity entirely in-house. Thirty-five percent say this leaves their teams understaffed, and 23% describe their technology as antiquated. Practices that do partner with an MSSP report better access to capabilities such as managed threat detection and response (42%) and next-gen firewalls (35%).

Download the report

https://www.securitymagazine.com/articles/102393-61-of-healthcare-organizations-predict-a-fatal-cyberattack-within-5-years

Runlayer Raises $30 Million in Series A Funding

AI enablement and control platform Runlayer has raised $30 million in a Series A funding round that brings the total raised by the company to $42 million.

Founded in 2025, New York-based Runlayer offers a platform that functions as a secure control layer for AI tools across enterprise environments.

The solution monitors AI access and usage, allowing employees to build agents, use them across enterprise systems, and delegate work to agents.

It delivers the tools, permissions, and company context needed for control, enabling agent management from a single control plane that covers identity, permissions, and policy enforcement, while delivering real-time visibility into actions.

According to Runlayer, its platform can also identify and block prompt injections, tool poisoning, data exfiltration, output manipulation, intent drift, shadow MCPs, and unmanaged agents, to block risks and direct employees towards approved tooling.

Runlayer’s new investment round was led by Felicis, with additional support from Khosla Ventures. The company will use the funds to expand its engineering and go-to-market teams.

Advertisement. Scroll to continue reading.

The startup emerged from stealth in November 2025 and has already been adopted by Fortune 500s and high-growth companies.

“AI-maximalist companies already understand the future is not a handful of power users experimenting with agents, but entire workforces operating alongside them. The challenge is that most companies still do not have a secure, scalable way to make that possible. That is the problem Runlayer exists to solve,” said Runlayer co-founder and CEO Andrew Berman.

https://www.securityweek.com/runlayer-raises-30-million-in-series-a-funding/

Cal Water Finds No Evidence of OT Activity After Hackers Claimed They Could Disrupt Water Supply

The investigation conducted by California Water Service (Cal Water) into the recent cyberattack claimed by the Iranian hacker group Handala found no evidence of activity in the water utility’s operational technology (OT) environment.

Handala, which claims to be a hacktivist collective but is widely believed to be a front for Iranian government hacking operations, said it could have disrupted the water supply after gaining access to Cal Water systems but decided not to do so. The statement suggested that the hackers had gained deep access to industrial control systems (ICS).

The threat actor leaked 5 GB of data allegedly taken from Cal Water systems. Cybersecurity analysts discovered personal information in the published files and found evidence that a customer billing system and an internal application may have been compromised.

SecurityWeek ICS Cybersecurity Conference Heads to Nashville for Special 25-Year Anniversary Edition

Cal Water, one of the largest investor-owned water utilities in the United States, has hired cybersecurity experts, including Google’s Mandiant unit, to assist with the investigation into the cybersecurity incident.

In a statement to SecurityWeek, Cal Water said, “Based on its investigation, Mandiant has confirmed that the threat actor activity was limited to unauthorized access to a small number of specific user accounts within two third-party service provider platforms.”

Advertisement. Scroll to continue reading.

It added, “Mandiant did not identify evidence of threat actor activity in Cal Water’s internal information technology or operational technology environments.”

“The investigation determined that the threat actor accessed one active customer’s online Cal Water account using stolen user credentials. The customer account did not provide access to the billing system, and no payment information was compromised. The threat actor also accessed an external, third-party web site related to a GPS location correction tool; however, the website does not contain any confidential or sensitive information.”

The organization concluded, “We appreciate the collaboration and support our state and federal government partners provided throughout the investigation, and we will continue to work to maintain the security of our systems and data from malicious actors.”

The water sector continues to be a prime target for threat actors due to its heavy reliance on legacy systems and often inadequate cybersecurity measures.

https://www.securityweek.com/cal-water-finds-no-evidence-of-ot-activity-after-hackers-claimed-they-could-disrupt-water-supply/

Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning

A vulnerability that can facilitate attacks on operational technology (OT) systems is being exploited in the wild, according to the cybersecurity agency CISA.

The vulnerability is tracked as CVE-2025-67038 and it affects Lantronix EDS5000 serial-to-IP device servers, which enable organizations to remotely connect to and manage their serial devices.

The flaw can be exploited by an unauthenticated attacker to inject arbitrary OS commands into a username parameter, which leads to the execution of the commands with root privileges.

SecurityWeek ICS Cybersecurity Conference Heads to Nashville for Special 25-Year Anniversary Edition

CVE-2025-67038 was one of the 20 serial-to-IP product vulnerabilities disclosed by cybersecurity firm Forescout in April.

Collectively tracked as BRIDGE:BREAK, the vulnerabilities impact Lantronix and Silex products, and researchers demonstrated how they can be exploited to manipulate sensor readings in industrial and healthcare environments to conceal dangerous conditions that would normally require human intervention, or to cause disruption in a healthcare environment using malicious firmware.

Advertisement. Scroll to continue reading.

CISA added CVE-2025-67038 to its Known Exploited Vulnerabilities (KEV) catalog on June 23, instructing federal agencies to address it by June 26.

However, there do not appear to be any public reports describing the attacks exploiting the Lantronix product vulnerability. It’s unclear if the attacks are aimed at industrial, healthcare, or other OT environments.

Cybersecurity firm Aviatrix has described a potential attack scenario involving CVE-2025-67038. Once the attacker exploits the vulnerability to execute code with root privileges, they can gain full control of the device.

“The compromised device serves as a foothold for the attacker to move laterally within the network, targeting other connected systems. The attacker establishes a command and control channel to remotely manage the compromised device and issue further commands,” Aviatrix explained in an advisory.

It added, “Sensitive data is exfiltrated from the network through the compromised device. The attacker disrupts network operations by modifying configurations or deploying malware, causing significant impact to the organization’s infrastructure.”

ZoomEye shows thousands of internet-exposed Lantronix systems — a majority in the United States — but these include all Lantronix products and it’s unclear how many of them are vulnerable to attacks.

Lantronix has not responded to SecurityWeek’s request for comment regarding in-the-wild exploitation.

UPDATE: Forescout published a blog post on Thursday with additional details on the exploitation of the vulnerability. Researchers observed exploitation of CVE-2025-67038 in a Lantronix EDS5000 honeypot on April 5, after Lantronix released a patch, but before Forescout published BRIDGE:BREAK technical details, which suggests the attackers may have reverse-engineered the patch to develop an exploit.

The activity included automated command injection testing and Lantronix-specific fingerprinting, suggesting the attackers knew what they were targeting.

Researchers found the activity was not consistent with a typical botnet or broad vulnerability scanner.

https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/