Team of figures on laptop displaying error code with shields, locks, globe, and wireless security icons

Daily Dose of Cybersecurity News - September 29, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

September 29, 2025 6:01 AM 4 min read

Akira Ransomware Exploits SonicWall VPNs, Bypasses MFA

Critical

What happened

The Akira ransomware group has been exploiting vulnerabilities in SonicWall SSL VPN devices to gain unauthorized access to corporate networks, even bypassing multi-factor authentication (MFA) protections.

Who is affected

Organizations utilizing SonicWall SSL VPN devices, particularly those with unpatched firmware or default configurations, are at risk.

Why it matters

This exploitation allows attackers to infiltrate networks rapidly, often deploying ransomware within hours, leading to significant operational disruptions and potential data breaches.

How it could have been prevented

Regularly updating SonicWall firmware to the latest versions and resetting all SSL VPN credentials can mitigate this threat. Additionally, implementing robust MFA configurations and monitoring for unusual login activities are essential preventive measures.

Relevant professional terms

SSL VPN: A virtual private network that uses the Secure Sockets Layer protocol to encrypt and secure data transmitted over the internet.
Multi-Factor Authentication (MFA): A security system that requires more than one method of authentication from independent categories of credentials to verify the user's identity.

Recommended reading: arcticwolf.com

Source: bleepingcomputer.com

Harrods Data Breach Exposes Customer Information

Medium

What happened

Harrods, the luxury British department store, reported that a third-party provider's system was compromised, leading to the exposure of some customers' personal data, including names and contact details.

Who is affected

Customers who have used Harrods' online services and whose information was stored by the affected third-party provider.

Why it matters

The breach highlights the vulnerabilities associated with third-party service providers and underscores the importance of robust supply chain security measures to protect customer data.

How it could have been prevented

Implementing stringent security assessments and continuous monitoring of third-party vendors, along with enforcing strict data protection agreements, could mitigate such risks.

Relevant professional terms

Third-Party Risk Management: The process of identifying, assessing, and controlling risks associated with outsourcing to third-party vendors or service providers.
Data Breach: An incident where unauthorized individuals gain access to confidential data, leading to potential exposure or theft of sensitive information.

Recommended reading: National Cyber Security Centre: Supply Chain Security

Source: securityweek.com

Cybersecurity Leaders Underreporting Incidents Amid Rising Threats

High

What happened

A recent survey revealed that 71% of security leaders observed an increase in cyberattacks over the past year, with 61% noting these incidents have become more impactful. Additionally, nearly half of the respondents admitted to not disclosing significant breaches to their executive teams or boards.

Who is affected

Organizations across various sectors, including retail, healthcare, and hospitality, are experiencing heightened cyber threats, particularly from nation-state actors and AI-driven attacks.

Why it matters

The underreporting of cyber incidents can lead to uninformed decision-making at the executive level, potentially compromising an organization's overall security posture and resilience against future attacks.

How it could have been prevented

Implementing transparent incident reporting protocols and fostering a culture of open communication between security teams and executive leadership can ensure timely awareness and response to cyber threats.

Relevant professional terms

Nation-state attack: Cyberattacks orchestrated by government-affiliated groups aiming to disrupt, damage, or steal information from other nations or organizations.
Insider threat: Security risks originating from within an organization, often involving employees or contractors who have access to sensitive information.

Recommended reading: helpnetsecurity.com

Source: helpnetsecurity.com

Cisco ASA Zero-Day Vulnerabilities Exploited in Active Attacks (CVE-2025-20333, CVE-2025-20362)

Critical

What happened

Cisco has disclosed two zero-day vulnerabilities in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software-CVE-2025-20333 and CVE-2025-20362-that are actively being exploited by attackers. These vulnerabilities allow remote code execution and unauthorized access to restricted URLs.

Who is affected

Organizations utilizing Cisco ASA and FTD software are at risk, particularly those with internet-facing devices running unpatched versions.

Why it matters

Exploitation of these vulnerabilities can lead to unauthorized access, data breaches, and potential control over affected devices, posing significant security risks to organizations.

How it could have been prevented

Regularly updating and patching software to address known vulnerabilities; implementing network segmentation to limit exposure of critical systems.

Relevant professional terms

Zero-Day Vulnerability: A security flaw unknown to the vendor, leaving systems vulnerable until a patch is developed.
Remote Code Execution (RCE): An attack that allows an attacker to run arbitrary code on a remote device.

Recommended reading: bleepingcomputer.com

Source: helpnetsecurity.com

Multiple Vulnerabilities in Inetutils (CVE-2019-0053, CVE-2020-10188, CVE-2022-39028, CVE-2023-40303)

High

What happened

Multiple security vulnerabilities were identified in Inetutils, including improper handling of escape characters, memory operations, and set*id function return values, potentially leading to denial of service, arbitrary code execution, or privilege escalation.

Who is affected

Users and administrators of systems running affected versions of Inetutils on Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, and 20.04 LTS.

Why it matters

Exploitation of these vulnerabilities could allow attackers to disrupt services, execute arbitrary code, or escalate privileges, compromising system integrity and security.

How it could have been prevented

Regularly updating and patching software to address known vulnerabilities; implementing strict input validation to prevent improper handling of escape characters and memory operations.

Relevant professional terms

Denial of Service (DoS): An attack that aims to make a system or service unavailable to its intended users by overwhelming it with a flood of illegitimate requests.
Privilege Escalation: The exploitation of a bug, design flaw, or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user.

Recommended reading: CVE-2022-39028 Details

Source: ubuntu.com

Multiple Vulnerabilities Identified in Qt Framework (CVE-2023-24607, CVE-2023-32762, CVE-2023-33285, CVE-2023-34410)

High

What happened

Multiple security vulnerabilities have been discovered in the Qt framework, including issues in the SQL ODBC driver plugin, strict-transport-security header parsing, DNS input handling, and TLS certificate validation. These vulnerabilities could lead to denial of service, information leakage, arbitrary code execution, or unauthorized resource access.

Who is affected

Users and developers utilizing the Qt framework across various platforms, particularly those on Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, and 22.04 LTS.

Why it matters

These vulnerabilities pose significant risks, including potential system crashes, unauthorized data access, and execution of arbitrary code, which could compromise the security and stability of applications built with the Qt framework.

How it could have been prevented

Regularly updating the Qt framework to the latest versions and applying security patches promptly can mitigate such vulnerabilities. Additionally, implementing rigorous input validation and secure coding practices can prevent exploitation.

Relevant professional terms

Denial of Service (DoS): An attack that aims to make a system or network resource unavailable to its intended users by overwhelming it with a flood of illegitimate requests.
Arbitrary Code Execution: The ability of an attacker to execute any command of their choice on a target machine or process, often leading to full system compromise.

Recommended reading: USN-7780-1: Qt vulnerabilities

Source: ubuntu.com