The threat landscape isn’t taking a break, Digital Defenders. |
Today’s news brings image-based spyware, hijacked dev tools, ICS flaws, AD takeovers… and AI as both target and shield. And the week is just getting started. |
|
|
Here’s what you need to know: |
|
|
Apple Zero-Day Exploit Hits iPhones in Active Attacks |
A newly disclosed Apple zero-day flaw (CVE-2025-43300) is being actively exploited in the wild through the company’s Image I/O framework.
The flaw is an out-of-bounds write letting attackers deliver malicious code through image files—mirroring Pegasus-style zero-click spyware. |
Devices like the iPhone XS and newer iPads are all at risk, and unpatched systems could be fully compromised without any user interaction.
Push iOS/iPadOS 18.6.2 updates via MDM to block enterprise exploitation. |
AI Agents Become Cyber Defenders in Google’s New Vision |
At its 2025 Security Summit, Google Cloud unveiled AI-driven tools to secure AI agents and use them as defenders.
Security Command Center now auto-discovers AI agents, while Model Armor blocks prompt injection, leaks, and jailbreaks. As enterprises deploy AI agents, attackers target them—Google’s “agentic SOC” aims to cut analyst fatigue, speed triage, and detect emerging threats.
Security leaders: Test Google’s AI posture controls and Alert Investigation agent to stay ahead of AI-driven threats. |
Microsoft VS Code Flaw Turns Remote Servers Into Local Threats |
Researchers found a critical VS Code Remote-SSH vulnerability that lets compromised servers execute code on developers’ local machines. The “Vibe Hacking” attack exploits built-in commands to silently open local terminals and run code, affecting even forks like Cursor. Teams often assume remote environments are isolated, but this flaw lets attackers pivot into local systems, turning dev tools into supply chain backdoors. Remember to allow only trusted servers, monitor ~/.cursor-server, and limit Remote-SSH until Microsoft adds user-approval safeguards. |
|
|
Apple Zero-Day Defense Check |
|
|
Friday's Pulse Check Results |
Government Access vs. Privacy: Which should take priority? |
|
|
Security Tools You Can Use |
-
Without centralized control, every unmanaged device becomes a crack in your armor. NinjaOne closes them before attackers can exploit them.
-
If your team isn’t using NordLayer, you might as well roll out a red carpet for hackers on public Wi-Fi.
-
Skip Keeper, and you’re gambling that weak, reused passwords won’t be the keys thieves use to empty your vault.
|
|
|
CISA Sounds Alarm on Critical ICS Flaws |
CISA sounds the alarm on critical ICS flaws hitting Siemens, Tigo, and EG4.
With CVSS scores as high as 9.8, these flaws open doors to privilege escalation, account hijacking, and even remote compromise of energy infrastructure. |
Energy and manufacturing operators face elevated risk as flaws in Siemens, Tigo, and EG4 systems threaten supply chains. Though no exploitation yet, the remediation window is brief.
Patch immediately, segment ICS networks, and enforce VPN-only remote access to cut exposure. |
MITM6 + NTLM Relay Cracks Active Directory |
Researchers warn MITM6 combined with NTLM relay can escalate network access to full Active Directory domain compromise. By exploiting Windows’ default IPv6 auto-configuration and the 10-machine account quota in AD, attackers can create malicious accounts and gain Domain Admin in minutes. This attack exploits built-in Windows protocols, exposing most AD environments and enabling stealthy theft of NTLM hashes, privileged access, and sensitive data. Mitigate by disabling IPv6, setting MachineAccountQuota=0, enforcing LDAP/SMB signing, and using DHCPv6 Guard to block rogue ads. | |
|
Is Your Active Directory the Next Target? |
Active Directory (AD) remains a prime target for attackers because of its central role in managing identities, permissions, and access. Recent attack chains like MITM6 + NTLM relay prove that default configurations can be abused quickly. Securing your AD now is crucial to prevent domain-wide compromise. |
How to lock down your Active Directory environment: |
- Block unauthorized machine accounts by setting ms-DS-MachineAccountQuota = 0.
- Require LDAP/SMB signing to stop NTLM relay attacks.
- Restrict Domain Admin logins and use a tiered admin model.
-
Isolate domain controllers and critical servers with network segmentation.
- Monitor for unusual Kerberos tickets, account creation, or auth spikes.
- Rotate local admin passwords automatically with LAPS or Entra ID.
|
Locking down Active Directory closes doors that attackers rely on, strengthening enterprise security and limiting adversary lateral movement across your network. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Protect your team with premium policies, guides, and more |
Cybersecurity Insider subscribers can now get 20% off an annual subscription to TechRepublic Premium and unlock unlimited access to hundreds of customizable policy templates, step-by-step checklists, and expert-written guides. Replace days of research and drafting with proven, plug-and-play resources that help your team harden defenses and stay audit-ready — fast. Use the code CSI20 at checkout. |
|
|
Protect your team with premium policies, guides, and more |
Cybersecurity Insider subscribers can now get 20% off an annual subscription to TechRepublic Premium and unlock unlimited access to hundreds of customizable policy templates, step-by-step checklists, and expert-written guides. Replace days of research and drafting with proven, plug-and-play resources that help your team harden defenses and stay audit-ready — fast. Use the code CSI20 at checkout. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA. |
|
|
|
