September 28th, 2025

• Researchers Use Legit Windows Tools to Freeze Windows Security Software Forever
• Yet Another Creative Use of AI
• CMMC Q&A
• Update to SIM Farm Story – Probably Not a Terrorist
• UK’s NCSC and US CISA Say Patch Cisco ASA Firewalls NOW!
• European Airports Discover the Benefits of Disaster Preparedness-Too Late
• Vulnerabilities Discovered in Supermicro Baseband Management Controller (BMC)
• US and UK Charge UK Nationals as Principals in Scattered Spider
• Cops Make Arrest in Ransomware Attack Against EU/UK Airports
• False Claims Act – A Path to Balance the Federal Budget
• Cyberattack on British Retailer Co-op Cost $275 Mil in Lost Revenue + Cost of the Attack
• Collins Aerospace Ransomware Attack Affects Some EU Airports

Security News for the week ending September 26, 2025

This week’s news bites: president signs EO raising fee on H-1B visa to $100,000, Congress
does what it does best:kick the can down the road, OpenAI, Oracle and Softbank plan 5 AI data
centers worth $5 billion, the record keeps getting broken-not for the better and Trump derails his
own AI plan.

Read details here.

Russian troll farms producing fake news are alive and well. One, run by a former
sheriff’s deputy, was spewing garbage to 200+ fake local media sites. Are your employees
ready for this or will they fall for it? If you are not sure, please contact us.

Mitch
www.CyberCecurity.com
www.TurnkeyCybersecurityAndPrivacySolutions.com
[email protected]

September 21st, 2025

• New Attack Bypasses Rowhammer Defenses in DDR5 Memory
• CMMC Q&A
• Microsoft to Force-Install Microsoft 365 CoPilot
• Apple Changes Version Number Scheme for its Operating Systems
• Self Replicating Worm infects Software on Javascript Repository
• Samsung Patches Actively Exploited Android Zero-Day
• Chegg Study App Pays $7.5 Mil for Nearly Impossible to Cancel Auto-Renewal
• It’s a Good Thing That Salesforce Can Afford Many Lawyers – They will Need Them
• Former Chinese Defector Was Illegal Chinese Agent
• Gucci/Balenciaga/YSL Parent Hacked

Security News for the week ending September 19th, 2025

This week’s news bites: Google adds support to detect modified content in Pixel 10,
congressional UFO hearing over hellfire missile video, I got a $1 payment from the Park Mobile
class action settlement, fakes and scams on online marketplaces and DHS’s ICE using spyware
to hack phones with no oversight.

Read details here.

Supply chain – the place where hackers hack
Why do they hack there? Likely because it is less protected and more lucrative than hacking
your company directly. You still get the benefit of being sued for your supplier’s breach. If you
need assistance with your vendor risk management program, please contact us.

Mitch
www.CyberCecurity.com
www.TurnkeyCybersecurityAndPrivacySolutions.com
[email protected]

September 14th, 2025

• Plex Urges Users to Change Passwords After Breach
• Apple Leaves CarPlay Exploit Unpatched in Most Cars
• CMMC Q&A
• Apple Adds Memory Protection Feature to iOS to Keep Up With Microsoft, Google
• US Dept. of Transportation Warns of Roadside Signs Containing Undocumented Radios
• Appeals Court Upholds Much of California\s Social Media ‘Addictive Feeds’ Law
• Burger King Parent Restaurant Brands Hacked, Kind of
• Do as I Say, Not as I Do
• Brazilian Lesbian Dating App Shuts Down After Bugs Expose Sensitive Data

Security News for the week ending July 11th, 2025

This week’s news bites: 45 new domains linked to China’s Salt Typhoon, this genie cannot be
put back in the bottle-Expedia tells you how to make a Molotov Cocktail, nearly 500 researchers
urge EU to come up with a real plan to combat CSAM, Senator urges FTC to investigate
Microsoft over security defaults and Scammers use Grok to spread malware on Twitter.

Read details here.

The hacking of Burger King points to a bigger problem
Restaurant Brands, from what we know, left the door open with a welcome sign, for hackers. I
am sure that they didn’t do that on purpose and, I suspect, they were not aware that they had
done that. Have you left your security door open? Are you sure of that answer? Let us know if
we can assist. Please contact us.

Mitch
www.CyberCecurity.com
www.TurnkeyCybersecurityAndPrivacySolutions.com
[email protected]

September 7th, 2025

• FCC Allows Phone Companies to Accelerate Abandoning Copper Phone Lines (POTS)
• EU Commission President’s Plane Forced to Land Using (Gasp!) Paper Maps
• Industrial Controllers (IIoT or OT) Putting Us at Risk
• CMMC Q&A
• NIST SP 800-53 5.2.0 Released With New Controls
• Apple Patches WhatsApp Zero-Day Exploit
• The Soft Part Under Attack
• Is There Money in AI Cybercrime – YES!
• EU’s General Court Upholds EU-US Data Privacy Agreement, Likely to be Appealed
• Maryland Online Data Privacy Law About to Go Into Effect
• Anthropic Agrees to Pay $1.5 Billion to Settle Copyright Lawsuit – As I Predicted
• More Brands Admit They Were Breached in Salesloft Attack
• Jaguar ‘Cybersecurity Incident’ Having Major Impact
• Hackers Breach Brazil’s Real Time Payment Processor Sinqia, Halting Processing

Security News for the week ending September 5, 2025

This week’s news bites: China demolishes Starlink in satellite performance, Cloudflare blocks
11+ terabit per second DDoS attack, DC cuts threaten intel sharing center, likely leaving holes in
sharing, hackers target state and local governments in wake of losing federal assistance and
side effects of Jaguar Land Rover cyber attack.

Read details here.

Get Ready for New NIST 800-53 Requirements
With revision 5.2.0 there are new controls for resiliency by design, software development
and testing best practices, software integrity and validation and root cause analysis.
Expect these to show up in a compliance standard you have to comply with in the next year or
two. If you already have these requirements handled, then great. If not, then you need to start
now because these are not easy to do. Contact us for assistance.

Mitch
www.CyberCecurity.com
www.TurnkeyCybersecurityAndPrivacySolutions.com
[email protected]