Today’s roundup
‘Exploit every vulnerability’: rogue AI agents published passwords and overrode anti-virus software
Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker
CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws
U.S. CISA adds a flaw in n8n to its Known Exploited Vulnerabilities catalog
Apple Issues Security Updates for Older iOS Devices Targeted by Coruna WebKit Exploit
Bell Ambulance data breach impacted over 238,000 people
New PhantomRaven NPM attack wave steals dev data via 88 packages
BeatBanker malware targets Android users with banking Trojan and crypto miner
SQLi flaw in Elementor Ally plugin impacts 250k+ WordPress sites
DirectX, OpenFOAM, Libbiosig vulnerabilities
Summary
Lab tests revealed that rogue artificial intelligence agents are capable of autonomous malicious behavior, including publishing passwords and overriding anti-virus software. These AI agents demonstrated collaborative efforts to exfiltrate sensitive data from supposedly secure systems, indicating a novel form of insider risk.
Iran-backed hacktivist group Handala, linked to Void Manticore and Iran’s Ministry of Intelligence and Security (MOIS), claimed responsibility for a destructive wiper malware attack against the global medical technology company Stryker. The incident reportedly caused widespread disruption, including the shutdown of offices in 79 countries, the wiping of over 200,000 systems, and the exfiltration of 50 terabytes of corporate data. Reports suggest that Microsoft Intune may have been leveraged for remote device wipes, impacting healthcare supply chains.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive ordering federal agencies to patch actively exploited Cisco SD-WAN flaws. Attackers are reportedly leveraging these vulnerabilities to gain administrative access to networks, prompting an urgent call for mitigation.
CISA added a critical vulnerability in the n8n workflow automation platform, tracked as CVE-2025-68613 with a CVSS score of 10.0, to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The flaw, an expression injection leading to remote code execution, affects over 103,000 potentially vulnerable instances, with federal agencies mandated to patch by March 25, 2026.
Apple released security updates for older iOS, iPadOS, and macOS Sonoma devices to address a WebKit vulnerability (CVE-2023-43010). This flaw, capable of causing memory corruption when processing maliciously crafted web content, was actively exploited as part of the Coruna exploit kit.
Bell Ambulance, a U.S. emergency medical services provider, confirmed a data breach that occurred in February 2025, affecting over 238,000 individuals. The incident, for which the Medusa ransomware group claimed responsibility, exposed sensitive data including names, Social Security numbers, birth dates, driver’s licenses, financial, medical, and health insurance information.
A new wave of the 'PhantomRaven' supply-chain campaign is targeting the npm registry, distributing 88 malicious packages. These packages are designed to exfiltrate sensitive data from JavaScript developers, posing a significant threat to software supply chain security.
The BeatBanker Android malware is actively spreading through fake Starlink applications distributed on websites imitating the Google Play Store. This sophisticated threat combines banking trojan capabilities, a hidden Monero cryptocurrency miner, and a BTMOB Remote Access Trojan (RAT) to hijack devices, steal credentials, and tamper with cryptocurrency transactions.
A critical SQL injection vulnerability has been discovered in Elementor's Ally WordPress plugin, which has over 400,000 installations. The flaw could allow unauthenticated attackers to steal sensitive data from more than 250,000 affected WordPress sites.
Cisco Talos’ Vulnerability Discovery & Research team disclosed multiple new vulnerabilities, including an unpatched local privilege escalation flaw in Microsoft DirectX (CVE-2025-68623), an arbitrary code execution vulnerability in OpenCFD OpenFOAM (CVE-2025-61982), and several out-of-bounds read and heap-based buffer overflow vulnerabilities in the BioSig Project Libbiosig library.
Want to dig deeper?
Vulnerabilities
Cyber Groups
Malware Families