Hacker figure on laptop surrounded by screens, fire, tornado vortex, locks, and red warning symbols

Daily Dose of Cybersecurity News - September 24, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

September 24, 2025 6:04 AM 5 min read

Boyd Gaming Data Breach Exposes Employee Information

High

What happened

Boyd Gaming Corporation experienced a cybersecurity incident where unauthorized parties accessed internal IT systems and exfiltrated data, including employee information and data from a limited number of other individuals.

Who is affected

Employees of Boyd Gaming and a limited number of other individuals whose data was stored on the company's systems.

Why it matters

The breach exposes sensitive personal information, potentially leading to identity theft or other malicious activities targeting affected individuals. It also highlights vulnerabilities in the security infrastructure of major corporations.

How it could have been prevented

Implementing robust access controls, regular security audits, and employee training on cybersecurity best practices could have mitigated the risk of unauthorized access.

Relevant professional terms

Data Exfiltration: The unauthorized transfer of data from a computer or network.
Access Controls: Security measures that regulate who or what can view or use resources in a computing environment.

Recommended reading: Boyd Gaming's Data Security Practices

Source: bleepingcomputer.com

Libraesva ESG Vulnerability (CVE-2025-59689) Exploited by State-Sponsored Actors

Medium

What happened

Libraesva released an emergency update for its Email Security Gateway (ESG) to address a command injection vulnerability (CVE-2025-59689) that was exploited by state-sponsored threat actors. The flaw allowed attackers to execute arbitrary shell commands via specially crafted email attachments.

Who is affected

Organizations using Libraesva ESG versions 4.5 and later are impacted. The product serves over 200,000 users across small and medium businesses as well as large enterprises worldwide.

Why it matters

Exploitation of this vulnerability could lead to unauthorized command execution, potentially compromising sensitive information and system integrity. The involvement of state-sponsored actors underscores the critical nature of the threat.

How it could have been prevented

Regularly updating software to the latest versions and promptly applying security patches can mitigate such vulnerabilities. Additionally, implementing strict email attachment filtering policies can reduce the risk of exploitation.

Relevant professional terms

Command Injection: A security vulnerability that allows an attacker to execute arbitrary commands on a host operating system via a vulnerable application.
State-Sponsored Actors: Cyber attackers who are supported or directed by nation-states to conduct espionage or disruptive activities.

Recommended reading: Libraesva's Security Bulletin on CVE-2025-59689

Source: bleepingcomputer.com

Cloudflare Mitigates Record-Breaking 22.2 Tbps DDoS Attack

Critical

What happened

Cloudflare successfully mitigated a distributed denial-of-service (DDoS) attack that peaked at 22.2 terabits per second (Tbps) and 10.6 billion packets per second (Bpps), marking the largest DDoS attack recorded to date.

Who is affected

The specific target of the attack has not been disclosed; however, Cloudflare's infrastructure and its clients were directly involved in mitigating the assault.

Why it matters

The unprecedented scale of this attack underscores the escalating capabilities of threat actors to launch massive DDoS attacks, posing significant risks to online services and infrastructure worldwide.

How it could have been prevented

Implementing robust DDoS mitigation strategies, including scalable network infrastructure, real-time traffic monitoring, and collaboration with specialized security providers, is essential to prevent and mitigate such large-scale attacks.

Relevant professional terms

Distributed Denial-of-Service (DDoS) Attack: A malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet traffic.
Packets per Second (Pps): A measurement of the number of data packets transmitted through a network per second, indicating the volume of traffic.

Source: bleepingcomputer.com

Federal Agency Breached via GeoServer Vulnerability (CVE-2024-36401)

High

What happened

Attackers exploited an unpatched GeoServer instance to breach a U.S. federal civilian executive branch agency's network, leveraging the CVE-2024-36401 vulnerability to gain unauthorized access and move laterally within the network.

Who is affected

An unnamed U.S. federal civilian executive branch agency was compromised in this incident.

Why it matters

This breach underscores the critical importance of timely patching, as unpatched vulnerabilities can serve as entry points for attackers to infiltrate and navigate through sensitive government networks.

How it could have been prevented

Regularly applying security patches and updates to software systems, especially those identified in vulnerability catalogs, can prevent such exploits. Additionally, continuous monitoring of network activity for anomalies can aid in early detection of unauthorized access.

Relevant professional terms

Remote Code Execution (RCE): A type of vulnerability that allows an attacker to execute arbitrary code on a target system remotely.
Lateral Movement: The technique used by attackers to move through a network after gaining initial access, seeking to access additional systems and data.

Recommended reading: CISA Known Exploited Vulnerabilities Catalog

Source: bleepingcomputer.com

SolarWinds Releases Third Patch for Web Help Desk RCE Vulnerability (CVE-2025-26399)

Critical

What happened

SolarWinds has issued a hotfix for a critical remote code execution (RCE) vulnerability (CVE-2025-26399) in its Web Help Desk (WHD) software, marking the third attempt to address this security flaw.

Who is affected

Organizations utilizing SolarWinds Web Help Desk version 12.8.7 are impacted by this vulnerability.

Why it matters

The vulnerability allows unauthenticated attackers to execute arbitrary code on the host machine, posing a significant risk of system compromise and data breaches.

How it could have been prevented

Implementing secure coding practices to prevent unsafe deserialization and conducting thorough security testing before releasing patches.

Relevant professional terms

Remote Code Execution (RCE): A type of vulnerability that allows an attacker to run arbitrary code on a target system remotely.
Deserialization: The process of converting serialized data back into its original object form; if not handled securely, it can lead to vulnerabilities.

Recommended reading: SolarWinds Security Advisory

Source: bleepingcomputer.com

SonicWall Releases Firmware Update to Remove OVERSTEP Rootkit from SMA 100 Devices

High

What happened

SonicWall has released firmware version 10.2.2.2-92sv for SMA 100 series devices, designed to detect and remove the OVERSTEP rootkit malware that has been targeting these appliances.

Who is affected

Organizations using SonicWall SMA 100 series products, specifically models SMA 210, 410, and 500v, are impacted by this malware.

Why it matters

The OVERSTEP rootkit enables attackers to maintain persistent access to compromised devices, steal sensitive information such as credentials and certificates, and potentially facilitate further attacks within the network.

How it could have been prevented

Regularly updating firmware to the latest versions and monitoring for unusual device behavior can help prevent such infections.

Relevant professional terms

Rootkit: A type of malicious software designed to gain unauthorized access to a computer system while concealing its presence.
Reverse Shell: A method where an attacker forces a compromised system to initiate a connection back to the attacker's system, allowing remote control.

Recommended reading: SonicWall SSL-VPN SMA100 Version 10.X Vulnerabilities

Source: bleepingcomputer.com

GitHub Enhances npm Security with Mandatory 2FA and Access Tokens

High

What happened

GitHub is implementing new security measures for the npm package registry, including mandatory two-factor authentication (2FA) for local publishing and the enforcement of granular access tokens with a 7-day lifespan.

Who is affected

All npm package maintainers and publishers utilizing GitHub's npm registry are impacted by these changes.

Why it matters

These enhancements aim to mitigate supply-chain attacks that have previously compromised thousands of accounts and private repositories, leading to data theft and significant remediation costs.

How it could have been prevented

Proactive implementation of 2FA and the use of short-lived, granular access tokens could have reduced the risk of unauthorized access and subsequent attacks.

Relevant professional terms

Two-Factor Authentication (2FA): A security process requiring two forms of identification before granting access to an account.
Supply-Chain Attack: A cyberattack that targets less secure elements in the supply chain to compromise a system or network.

Source: bleepingcomputer.com