October 4, 2025 - Red Dot Security

Header image for the Red Dot Weekly Cyber Security News https://reddotsecurity.news

Hello all,

This past Saturday I attended BSides St. Petersburg, Florida, not Russia. This is a local convention, aka ‘con’, that draws around 500 cyber security minded people together to network, learn, and hear from some of the most dedicated and brilliant minds in our industry. I’m blessed to live in an area that has a very large pool of cyber security professionals with many conferences annually. Tampa, which is nearby, draws around 3000 people yearly to their BSides. And in two weeks a new conference named CyberBay.org is coming. If you live in or near a metropolitan area, I encourage you to watch for nearby conferences. You never know who you’ll meet and how that may impact your life and career.

This email and video commentary is from the RedDotSecurity.news website that contains a plethora of links to other items, not mentioned here, that are worth skimming to see if they interest you or pertain to your particular environment or of those you support. There is a lot more than what is provided in these opening comments. So, on to the headline news.

Headline NEWS:

Broadcom made patches available for defects in VMware NSX and vCenter. The US National Security Agency (NSA), and others, reported three different defects to Broadcom. Additionally, the vendor revealed that three more defects received patches, one of which has been exploited by Chinese threat actors as a zero-day since October 2024. However, as per policy, the fixes needed are hidden behind a paywall. In addition to the two aforenamed products, six other Broadcom products are affected. If you have a valid support contract with the vendor, update quickly. If you don’t, it may be time to renew, or to migrate to different technology.
DrayTek Vigor Routers need to be patched to plug an Unauthenticated Remote Code Execution defect. These are as bad as they get since no credentials are needed to exploit it. Full details of how to exploit this are being held back to give potential victims time to patch. So, patch sooner than later.
Splunk Vulnerabilities Let Attackers Execute Unauthorized JavaScript is a bit of an ironic headline since Splunk is a platform used to locate issues in a network or device. Six different holes were plugged by the patches. Update soon.
Critical Western Digital My Cloud bug allows remote command injection. Basically, someone can do whatever they want to your device. If your device is still under support, and you have auto updates enabled, it should have already done so. If yours doesn’t automatically update the firmware, you should disconnect it from the internet until you manually apply the updates. If your device is End Of Life (EOL), leave it disconnected from the internet as no updates are available.
WhatsApp 0-Click Flaw Abused via Malicious DNG Image Files. This particular defect targets Apple devices via a malformed DNG (Digital Negative) image. Simply receiving the image is enough to trigger the exploit. Users may not even be aware that the WhatsApp message was received, yet their device becomes compromised. Make sure that you update to the latest version of WhatsApp and apply any Operating System updates as soon as they become available.

In Ransomware, Malware, and Vulnerabilities News:

Akira ransomware breaching MFA-protected SonicWall VPN accounts is a rather terrifying headline. It seems that this dirtbag criminal organization may have found a way to breach fully patched SonicWall firewalls via their SSL VPN connections. Speculation at this time is that Initial Access Brokers (or Akira themselves) were able to harvest credentials and MFA seeds due to CVE-2024-40766 that was patched in August of 2024. They may have been sitting on those credentials ever since, waiting for the opportunity to abuse them. Due to this, it is being recommended that all credentials and MFA be reset for any SonicWall firewalls that ever utilized the vulnerable firmware described above.

In Other News Events of Note and Interest:

Windows 25H2 launched, I think. Compared to other version number releases of Windows, this one, which started gracing desktops last week, has been mostly a non-event. The system applies an update for a few minutes and other than a version number, there are no noticeable changes. There are cool new things coming, just not in this initial release. Check out the links in the full RedDotSecurity.news to see what some of them will be.

Musings:

I find myself somewhat surprised at how quickly I’m adjusting to having AI involved in my daily life. Most of us that have been using navigation apps for a while didn’t realize at the time that we were relying on AI to provide us with that real time routing guidance. For years, our shopping habits on Amazon and other vendors have been logged, categorized, and stored in massive data-lakes and are now being analyzed by increasingly adept machine learning processes so that we are presented with suggested items and advertisements that interest us, and at the appropriate calendar time of the year. The integration has been subtle and gradual, but I now get annoyed when I look for something online and I get a regular search with mere links, and not an AI summary. It is rapidly becoming ubiquitous. However, I don’t know if I’ll ever get used to seeing advertisements in Facebook for things that I’ve only ever thought about and never actually put into words. Creepy.

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Like this: