The cyber frontlines are buzzing, Digital Defenders. |
This week delivers live zero-days, hijacked firewalls, and ransomware on the move. Even your mouse isn’t safe—from sensor to spy, no endpoint is too ordinary to turn against you. |
|
|
Here’s what you need to know: |
|
|
CISA Warns of Active Exploitation in Critical Windows Flaw |
CISA has issued an urgent alert as a critical Windows vulnerability faces active exploitation. CVE-2021-43226, a flaw in Windows’ CLFS driver, lets local attackers gain SYSTEM privileges for ransomware or lateral movement. It affects Windows 10, 11, and Server versions due to faulty memory validation. |
CISA is requiring Federal entities to patch by Oct. 27, 2025.
Patch immediately and leverage EDR tools to monitor for privilege escalation attempts. |
GoAnywhere Zero-Day Exploited to Deploy Medusa Ransomware |
A zero-day flaw in GoAnywhere MFT is being actively exploited to deliver Medusa ransomware.
CVE-2025-10035, a deserialization flaw, enables unauthenticated RCE via forged license responses. Microsoft reports Storm-1175 is exploiting it to steal data, persist with RMM tools, and encrypt networks.
This is an active attack in the wild, and a patch for the CVE is available. Apply the patch, restrict outbound traffic from file transfer servers, and enable EDR in block mode to stop ransomware payloads. |
Mic-E-Mouse Attack Turns Gaming Mice into Covert Microphones |
UC Irvine researchers unveiled Mic-E-Mouse, a proof-of-concept attack that turns high-DPI mice into covert microphones.
By sensing desk vibrations, the attack reconstructs speech with signal processing and AI—no microphone needed. It exposes how everyday peripherals, like gaming mice, can widen the attack surface. This is not an attack that has been seen in the wild. The research recommends stricter device permissions, limited HID data access, and reduced polling rates to mitigate risks associated with sensor-equipped endpoints. |
|
|
High-DPI mice can pick up desk vibrations to capture speech — how secure are your peripherals? |
|
|
Yesterday's Pulse Check Results |
Vendors are weak links—how secure are yours? |
|
|
Security Tools You Can Use |
|
|
Cisco ASA/FTD Zero-Day Exploited in Active Attacks |
Cisco confirmed active zero-day exploitation in its ASA and FTD products, allowing unauthenticated remote code execution.
Attackers are chaining CVE-2025-20362 (auth-bypass path traversal) with CVE-2025-20333 (WebVPN buffer overflow), resulting in unauthenticated RCE and full device takeover. |
This vulnerability is being actively exploited in the wild.
Apply patches, disable WebVPN if not essential, and monitor logs for “CSRF token mismatch” errors, which is an early indicator of attempted exploitation. |
Kibana Flaw Exposes CrowdStrike Credentials Across Workspaces |
Elastic warned of a flaw in the Kibana CrowdStrike Connector that could let attackers access cached API credentials from other users in shared environments.
Tracked as CVE-2025-37728, the flaw affects Kibana 7.x–9.1.4 and allows unauthorized cross-space access to cached CrowdStrike API tokens due to weak credential protection. Elastic has released patches for the vulnerability. Update Kibana to a patched version and rotate any CrowdStrike API keys that may have been exposed. Currently, there are no workarounds available for unpatched systems. |
|
|
AI-driven attacks are increasing, highlighting the need for stronger identity security. Learn how Duo’s security-first IAM protects against evolving threats. |
|
|
Stay Ahead of Zero-Day Exploits |
Zero days allow attackers to strike before patches are available or defenders can react.
As AI shrinks potential exploit windows to hours, rapid detection and response can mean the difference between a close call and a breach. |
How to stay one step ahead of zero-day attacks: |
-
Automate patch management: Use centralized tools to deploy updates rapidly across endpoints and servers.
-
Enable threat intelligence feeds: Subscribe to real-time intel to spot emerging zero-day campaigns early.
-
Run EDR in block mode: Let your endpoint detection tools automatically contain suspicious activity before it spreads.
- Use application allowlisting: Restrict software execution to trusted, verified programs only.
-
Segment critical assets: Separate vital systems from user networks to limit the blast radius of unknown exploits.
- Conduct IR tabletop exercises: Simulate zero-day attacks to ensure your team reacts quickly under real-world conditions.
|
You can’t predict the next zero-day, but layered defenses, rapid patching, and preparedness keep your organization resilient when attackers strike first. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
