Cybersecurity today.
Would like to thank Meter for their support in bringing you.
This podcast Meter delivers a complete networking stack with wired, wireless and
cellular, all in one integrated solution that's built for performance and scale.
You can find them at meter.com/cst.
Massive patch list.
Zero day flaw in Cisco.
Email gateways being actively exploited.
Latvian arrested trying to install rat in Italian ferry in a Hollywood style hack.
This is cybersecurity today, and I'm your host, David Shipley.
Let's get started.
Today's first story comes via Hacker News and involves a known exploited
vulnerability affecting Cisco's email security infrastructure.
Cisco is warning customers about active attacks, exploiting a
zero day flaw in Cisco Async os.
The operating system used by Cisco Secure email gateway and secure
email and web manager appliances.
Cisco attributes.
The activity to a China Nexus advanced persistent threat Tracked is UAT 96 86.
The vulnerability CVE 20 25 2 0 3 93 carries A-C-V-S-S score of 10.
The maximum It allows attackers to execute an arbitrary command with root
level privileges on affected appliances.
Cisco has confirmed that attackers are not just gaining access, but also
deploying persistence mechanisms, allowing them to maintain long-term
control of compromised devices.
All versions of Async OS are affected.
Exploitation requires one specific condition.
The spam quarantine feature must be enabled and reachable from the internet.
While this feature is not enabled by default, Cisco has identified a limited
number of exposed appliances that were accessible externally to the internet.
Cisco's investigation shows attackers deploying tunneling tools such as
Reverse SSH, and Chisel, along with a Python based backdoor called Aqua Shell.
The backdoor listens for specifically crafted HTTP requests and executes
attacker commands directly on the system shell giving threat actors
durable covert access inside email security infrastructure.
There is no patch available at this time.
Cisco is advising customers to immediately restrict internet exposure,
place appliances behind firewalls, disable unnecessary services, monitor
logs for suspicious activity, and separate mail and management interfaces.
Cisco also warns that if compromise is confirmed, rebuilding the
appliance is currently the only way to fully remove attacker persistence.
Not exactly great news a couple of days out from the holidays.
Importantly, A has added CVE 20 25 2 0 3 93 to its known exploited vulnerabilities
catalog with US federal agencies required to apply mitigations by December 24th.
Merry Christmas to you from China.
Our second story today comes via France 24, and it highlights a cyber
risk that crosses cleanly from the digital world and into physical safety.
French authorities are investigated.
Suspected foreign interference after malware capable of remote control
was discovered aboard a passenger ferry docked in southern France.
The vessel, the fantastic is operated by Italian shipping company GNV and
can carry more than 2000 passengers.
According to French prosecutors, the ship's operating system was infected with
what appears to be a remote access Trojan or rat malware that allows an attacker
to take control of a system from a fire.
Italian authorities had warned France in advance triggering an emergency
inspection once the ship reached port.
A Latvian National has been arrested and charged while a
second crew member was released.
investigators are examining whether the attack involved
complicity with in the crew.
Investigators are examining whether the attack involved
complicity within the crew.
As experts say, installing this type of malware would likely
require physical access, potentially via removable media like A USB
device, France's domestic Intel.
France's Domestic Intelligence Service.
The DGSI is leading the investigation, underscoring the seriousness of the case.
Prosecutors say they're looking into whether an organized group acted in the
interest of a foreign power attempting to compromise the ship's systems.
Officials have stopped short of naming a country, but France and other European
governments have warned of escalating interference campaigns linked to Russia.
Maritime cybersecurity experts are clear on the stakes.
Any attempt to interfere with ship control systems represents a critical
risk with potentially severe physical consequences for passengers and crew.
The ship was ultimately cleared to sail after inspectors confirmed no
ongoing danger, and the operator says the intrusion attempt was identified
and neutralized without impact.
Still the case has triggered international cooperation including searches in
Latvia with support from Euro just.
The broader takeaway here is hard to miss.
Cybersecurity failures and transportation systems are no longer just IT incidents.
They are safety issues, national security issues, and
increasingly geopolitical ones.
When software controls physical systems, the consequences of compromise
extend far beyond the digital screen.
I've been your host, David Shipley.
I'll be back on Monday covering the latest news as holiday 2025.
Looks sadly to be just as busy for security teams as previous years,
and we'll do our best to keep you informed on the latest threats and
what you can do about them so you can enjoy as much of the break as you can.
I'll be joining Jim and our regular panel guests for a special year in
review episode this weekend, and also.
One of our final reminders of the year.
If you enjoy the show, please help us spread the word, like, subscribe.
Consider leaving a review and if you enjoy the show, please tell others.
We'd love to grow our audience next year and we need your help.
I've been your host, David Chipley.
Jim Love will be back on the regular news desk in the new year.
We'd like to thank Meter for their support in bringing you this podcast
Meter delivers full stack networking infrastructure, wired, wireless, and
cellular to leading enterprises working with their partners Meter designs.
Deploys and manages everything required to get performant,
reliable, and secure connectivity.
They design the hardware, the firmware, build the software,
manage deployments, and run support.
It's a single integrated solution that scales from branch offices.
To warehouses and large campuses to data centers, book a demo at me.com/cst.
That's METE r.com/cst.