The attack surface is shifting again, Digital Defenders. |
From trusted tools quietly abused to AI lures that feel helpful by design, this week’s stories show how familiar systems are becoming the easiest way in.
👉🏽 What should we cover more (or less)? Tell us in a 60-second survey. |
|
|
Here’s what you need to know:
|
|
|
Cisco Expertise Weaponized in Nation-State Telecom Attacks |
Two Cisco Network Academy–trained hackers have been tied to a major nation-state espionage campaign targeting global telecom networks.
Researchers say the operators used deep Cisco expertise to quietly compromise routers and lawful intercept systems at over 80 telecom providers, intercepting unencrypted communications and metadata. |
The threat actors are still running campaigns in the wild.
Require MFA on network devices, isolate and monitor management planes, keep infrastructure patched, and apply zero-trust segmentation to detect persistence and limit attacker movement. |
GitLab Vulnerabilities Threaten CI/CD Pipelines |
Urgent GitLab patches address ten vulnerabilities that could let attackers execute XSS, trigger denial-of-service conditions, or bypass authentication entirely.
Several flaws allow unauthenticated actions and expose core GitLab components — such as Wikis, GraphQL APIs, and Swagger UI — to XSS and resource exhaustion. There are no reports of exploitation in the wild.
Patch GitLab immediately, reduce internet exposure, monitor GraphQL and API abuse, harden MFA and permissions, and add WAF and rate limiting. |
Jenkins Flaw Freezes CI/CD Pipelines |
A high-severity Jenkins flaw lets unauthenticated attackers freeze servers by exhausting request threads with a single crafted request.
The HTTP-based CLI flaw can exhaust threads and prevent Jenkins from handling builds, API calls, or admin actions, leading to stalled pipelines and failed deployments. No exploitation has been seen in the wild.
Patch Jenkins immediately, disable or restrict the HTTP CLI, apply rate limiting and allowlists, and monitor thread usage to detect and stop DoS abuse early. |
|
|
How exposed is your DevOps pipeline right now? |
|
|
Yesterday's Pulse Check Results |
Could You Slip Past Chrome’s AI Defenses? |
|
|
Security Tools You Can Use |
-
If you’ve visited DZone recently, please share your thoughts in our Community Survey.
- Safeguard your data with top tools that detect and block threats in real time.
-
Uncover emerging risks quickly using top vulnerability platforms designed to stop issues early.
|
|
|
Attackers Use Fake ChatGPT to Install macOS Malware |
A new malware campaign uses fake ChatGPT-style support to trick macOS users into installing the AMOS infostealer via routine-looking terminal commands. The campaign exploits trust in AI troubleshooting, steering users from malicious ads into realistic chat interfaces that harvest credentials and crypto data on both personal and BYOD macOS systems.
|
This is an active campaign in the wild.
Train users to distrust AI-suggested terminal commands, block curl | bash execution, filter malicious domains, and use macOS EDR with phishing-resistant MFA to catch abuse early. |
Rust-Based 01flip Drives Cross-Platform Ransomware Campaign |
Researchers uncovered a new Rust-based ransomware, 01flip, that launches coordinated attacks against both Windows and Linux systems.
The campaign targets Asia-Pacific critical infrastructure through manual attacks that exploit exposed services, deploy Sliver for reconnaissance, and use stealthy cross-platform ransomware that evaded Linux detection for months. This is a targeted attack in the wild.
Patch exposed systems, monitor for Sliver activity, enforce MFA, standardize EDR across platforms, and watch for early ransomware behaviors to stop attacks before encryption begins. |
|
|
We’re going live soon! Join TechnologyAdvice × Freshworks on December 16, 2025, at 1:00 PM ET for Straight from the Source: ITSM Customers Who Switched. Discover how real IT teams streamlined processes, reduced complexity, and built proactive, AI-powered service operations. Make sure you’re in the room. |
|
|
How Secure Is Your Network Right Now? |
Attackers target network infrastructure — routers, firewalls, VPNs, and management planes — because these systems provide broad, persistent access when compromised. Weak authentication, misconfigurations, and limited monitoring can quietly expose entire environments, making network security best practices more critical than ever. |
Source: Taylor Vick/Unsplash | How to strengthen your network security: |
- Enforce strong access controls by requiring MFA, disabling legacy protocols, and isolating network management interfaces to trusted networks.
- Reduce attack surface by patching network devices, monitoring for configuration drift, and maintaining secure, least-privilege configurations.
-
Improve detection and containment by centralizing network logs, monitoring for anomalies, and using segmentation to limit lateral movement.
|
By applying these practices consistently, organizations can reduce their attack surface and limit the blast radius of incidents. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
