Government shutdown furloughs most CISA staff
Roughly 35% of the agency’s staff remain active, and Agency spokesperson Marci McCarthy has stated that “while a government shutdown can disrupt federal operations, CISA will sustain essential functions and provide timely guidance to minimize disruptions.” CISA says more staff can be recalled in the event of an emergency.”
Microsoft Defender bug triggers erroneous BIOS update alerts
“Microsoft is working to resolve a bug that causes Defender for Endpoint to incorrectly tag some devices’ BIOS (Basic Input/Output System) firmware as outdated, prompting users to update it.” The company posted a service alert that said this known issue “affects Dell devices and is caused by a Defender for Endpoint logic bug.” A fix is on the way, but Microsoft has not yet said how many users may be impacted by these ongoing Defender XDR issues and in what regions.
Raid on Red Hat repos jeopardizes sensitive customer files
According to The Register, a group calling itself the Crimson Collective “claims to have broken into Red Hat’s private GitHub repositories, exfiltrating some 570GB of compressed data, including sensitive documents belonging to customers.” The group announced on Telegram that it “accessed more than 28,000 internal repos and stole hundreds of Customer Engagement Reports (CERs).” CERs usually “contain architecture diagrams, configuration details, authentication tokens, and network maps and are effectively a blueprint of a customer’s IT environment. The groups already published file listings and shared samples online.
Motility RV software company suffers cyberattack
The company which makes software for dealers who sell RVs, buses boats and other large vehicles warned customers Wednesday of a data security incident that was discovered on August 19. They company describes this as a ransomware attack in which their servers were encrypted. The company’s business operations were impacted and personal information of more than 760,000 people was stolen. A claim of responsibility was made by the Pear ransomware gang, which also attacked Motility’s parent company Reynolds & Reynolds several weeks ago.
Huge thanks to our sponsor, Nudge Security
What if you could continuously discover when people start using new apps or sharing data, then prompt them with security guidance right when and where they are working?
At Nudge Security, we call that securing the Workforce Edge. Instead of trying to control everything (which, let’s face it, is impossible), we give IT and security teams the visibility they need and automation to guide employees toward secure behaviors.
The result? Your workforce stays productive, your data stays secure, and you can finally get some sleep at night. Learn more at nudgesecurity.com/workforceedge
Executive extortion attempt uses with data allegedly stolen through Oracle tool
Incident responders at Mandiant and Google Threat Intelligence Group have released a warning about hackers possibly connected to the Clop ransomware gang who are attempting to extort corporate executives by threatening to leak sensitive information they claim was stolen through the Oracle E-Business Suite. This is a platform that contains several applications to manage a company’s finance, human resources and supply chain functions. The threat actors have already sent extortion emails to executives at “numerous organizations,” but Mandiant would not say how many companies may have been impacted or what information might have been stolen.
No more SVG images for Outlook
Microsoft has announced that Outlook for Web and the new Outlook for Windows will no longer display inline SVG images. SVG or Scalable Vector Graphics files have been used to deploy malware, and increasingly to display forms, used in phishing attacks. The change away from SVGs started in September and is expected to be completed for all customers by mid-October 2025.
Subpoena tracking platform blames outage on AWS social engineering attack
Kodex Global, a platform used by law enforcement and major tech firms to manage subpoenas and data requests, suffered a temporary outage on October 1 after attackers tricked AWS into freezing its domain. The disruption took down Kodex’s website, portal, API, and some email services for nearly four hours. Although attackers attempted to transfer the domain, ownership was never lost; AWS mistakenly froze it due to a fraudulent legal order. Kodex confirmed no breach or data compromise occurred. AWS has since resolved the issue and pledged safeguards. Experts note a successful attack could have exposed sensitive data and account access.
Researchers uncover spyware targeting messaging app users in the UAE
Researchers from ESET have discovered new spyware embedded in fake messaging apps that are targeting people in the United Arab Emirates. The two apps are named ProSpy and ToSpy which masquerade as Signal and ToTok, which is a free messaging and calling app that originated in the UAE. The spyware is made available through fake websites and app stores, which are made to look like legitimate app stores.