Patch/Configuration Management

CloudDefense.AI founder and CEO Anshu Bansal warns that cloud misconfigurations remain the leading driver of breaches, despite global security spending topping $183.9 billion last year, according to Forbes.

BleepingComputer reports that more than 48,800 internet-exposed Cisco Adaptive Security Appliance and Firewall Threat Defense devices remain at risk to intrusions involving the actively exploited flaws, tracked as CVE-2025-20362 and CVE-2025-20333.

Chinese state-sponsored threat actor UNC5174, also known as Uteus or Uetus, has been launching intrusions leveraging the recently addressed high-severity VMware Tools and VMware Aria Operations zero-day, tracked as CVE-2025-41244, since October 2024, reports The Hacker News.

The exploited Sudo flaw could be used to run arbitrary commands as root.

The vendor fixed the bugs after being notified from NSA, which indicated there are national security implications.

While not confirmed, researchers link incident to previously exploited bugs that may have exposed credentials.

Attacks exploiting the Cisco Adaptive Security Appliance zero-days CVE-2025-20362 and CVE-2025-20333 were noted by the UK's National Cyber Security Centre to have deployed the newly emergent RayInitiator and LINE VIPER malware strains as part of a more sophisticated and clandestine campaign, Security Affairs reports.

Experts advise to patch immediately and take services offline until remediation is complete.