In today’s cybersecurity news…
Recent Windows updates break RemoteApp connections
Yesterday we reported on Microsoft’s December 2025 security update breaking Message Queuing (MSMQ) on older Windows 10 and Server systems. It appears another update related breakage is also occurring. This one, based on the November 2025 non-security update, is triggering RemoteApp connection failures on Windows 11 24H2/25H2 and Windows Server 2025 devices in Azure Virtual Desktop environments. “RemoteApp enables users to stream individual Windows applications from the cloud without loading an entire virtual desktop, making them run like local, native applications.” Microsoft said this issue does not affect personal devices running Windows Home or Pro editions, since Azure Virtual Desktop is predominantly deployed in enterprise settings. No timeline for a permanent fix has yet been announced.
France arrests threat actors for installing malware on Italian ferry
French authorities have arrested two crew members working on Italian passenger ferry. They are suspected of infecting the ship with malware that could have enabled them to remotely control the vessel. One of the pair, a Bulgarian national, has been released without charge, while the other, a Latvian suspect who recently joined the crew of the Italian owned ferry remains detained and faces charges of conspiring to infiltrate computer systems on behalf of a foreign power. This after a remote access tool was discovered aboard the ship. The malware was discovered by the shipping company itself, while the ship was docked at the Mediterranean port of Sète, which is located in southern France.
Senate Intel chair urges safeguard against open-source software threats
Tom Cotton, the Senate Intelligence Committee Chairman, is asking National Cyber Director Sean Cairncross to take steps to counter the risks of foreign adversaries playing too heavy a role in open-source software, describing the environment as one in which threat actors “assume that contributors are benevolent, [so they can] insert malicious code into widely used open source codebases.” Cotton mentioned a beta version of the compression utility XZ Utils, as well as a Russia-based developer that is the sole maintainer of some open-source software that exist inside Defense Department software packages as examples.
Chinese attackers exploit zero-day to target Cisco email security products
This exploit has a CVE number (CVE-2025-20393) and a maximum severity score of 10 and affects appliances with certain ports open to the internet that are running the company’s AsyncOS Software for its Secure Email Gateway and Secure Email and Web Manager. Chinese hackers have been exploiting this since late November, the company said Wednesday. The attribution to a Chinese threat group is based on the assessment of the tools and infrastructure used during attacks.
Huge thanks to our sponsor, Adaptive Security
Hackers breach Britain’s health service tech provider
DXS International, a UK technology company whose software is widely used by the country’s National Health Service (NHS), has disclosed a cybersecurity incident involving unauthorized access to internal office servers, detected on December 14. The company said the breach was contained and that clinical services remained fully operational. It is not yet known whether NHS patient data was affected, though the incident has been reported to the Information Commissioner’s Office. DXS is working with NHS cybersecurity teams and external specialists to investigate. The company does not expect a material financial impact. Its software supports clinical decision-making and referral management for GP practices and handles around 10% of NHS referrals in England.
Soaring increase in use of DIG AI, the uncensored Darknet AI assistant
A report from Resecurity shows a fourth quarter surge in the criminal use of DIG AI, a tool that enables malicious actors to “leverage the power of AI to generate tips ranging from explosive device manufacturing to illegal content creation.” Because DIG AI is hosted on the TOR network, these tools are difficult for law enforcement to find, which has resulted in a significant underground market. The recent surge in use can be attributed to the activities related to the Holiday Season, as well as the Winter 2026 Olympics in Milan and the FIFA World Cup.
CISA warns of critical and exploited ASUS Live Update flaw
This flaw has been added to CISA’s (KEV) catalog, after evidence of active exploitation emerged. The vulnerability, which has a CVSS score: 9.3, has been described as an “embedded malicious code vulnerability introduced by means of a supply chain compromise that could allow attackers to perform unintended actions.” According to a description of the flaw published in CVE.org, “certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise.”
New password spraying attacks target Cisco, PAN VPN gateways
“An automated campaign is targeting multiple VPN platforms, with credential-based attacks being observed on Palo Alto Networks GlobalProtect and Cisco SSL VPN.” This is according to a report from GreyNoise. The attacks originated from more than 10,000 unique IP addresses and were aimed at infrastructure located in the United States, Mexico, and Pakistan. The malicious traffic originated once again from the 3xK Germany IP space, indicating a centralized cloud infrastructure. This is different from that attack that occurred on December 12, also originating from 3xK, which impacted Cisco SSL VPN endpoints. The researchers stated that the threat actor “reused common username and password combinations.”