Citrix patches critical zero-day. Cisco fixes two maximum-severity flaws.

Summary

By the CyberWire staff

At a glance.

Citrix patches critical zero-day.
Cisco fixes two maximum-severity flaws.
US Justice Department charges British hacker for allegedly causing $25 million in damages.

Citrix patches critical zero-day.

Citrix has issued a patch for a critical flaw (CVE-2025-6543) affecting NetScaler ADC and NetScaler Gateway appliances that are configured as gateway virtual servers or authentication, authorization, and accounting (AAA) virtual servers, the Register reports. The flaw is a "[m]emory overflow vulnerability leading to unintended control flow and Denial of Service." Citrix has observed exploitation of the vulnerability, though the company didn't share specifics.

Benjamin Harris, CEO of watchTowr, told the Register that the flaw's 9.2 CVSS score suggests attackers are using the vulnerability to carry out more than just denial-of-service (DoS) attacks. Harris stated, "The CVSS metrics reflect code execution or similar, not DoS as the most impactful outcome. Vulnerable appliances being observed to enter a 'denial of service condition' likely reflects failed exploitation, given the class of vulnerability being discussed here."

The vulnerability is separate from another critical Citrix flaw (CVE-2025-5777) that made headlines this week. Users are urged to update their Citrix products as soon as possible.

Control what runs in your environment. Reduce your attack surface.

ThreatLocker helps organizations reduce risk by allowing trusted applications to run while limiting their access to only the resources they need. It’s a straightforward, default deny approach that gives you more control and visibility—without slowing down operations. Explore how ThreatLocker can help simplify your security strategy.

Cisco fixes two maximum-severity flaws.

Cisco has patched two maximum-severity remote code execution flaws affecting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), Beyond Machines reports. The vulnerabilities (CVE-2025-20281 and CVE-2025-20282) "could allow an unauthenticated, remote attacker to issue commands on the underlying operating system as the root user."

CVE-2025-20281 is due to insufficient validation of user-supplied input, and can be exploited by submitting a crafted API request. CVE-2025-20282 results from "a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system," and can allow attackers to upload malicious files to vulnerable devices.

Workload security and next-generation firewall resources.

As application and service environments become more complex, traditional security practices based on static rules can struggle to adapt. Security and DevSecOps teams need zero-trust security solutions to mitigate issues that arise from running intricate workloads.

AWS uniquely integrates with Palo Alto Networks’ VM Series Next-Generation Firewall (NGFW) and App ID functionality for a scalable and centralized zero-trust security layer. Read an in-depth article for a technical overview on implementing them today. Read the article here.

US Justice Department charges British hacker for allegedly causing $25 million in damages.

The US Justice Department has charged a British national going by the online alias "IntelBroker" with causing an estimated $25 million in damages by stealing and selling data from organizations around the world. The suspect, 25-year-old Kai West, is accused of hacking more than forty entities over the past two years.

West was arrested in France in February 2025, and the US is seeking his extradition. BleepingComputer notes that IntelBroker's stolen data was usually posted for sale on the BreachForums hacking forum, and West allegedly served as an administrator of the forum until this past January. The Record reports that four suspected BreachForums administrators were arrested in France earlier this week, though the French police haven't commented on the matter.

What do you think of N2K CyberWire?

Your insights help us grow. Our annual audience survey is your chance to shape how N2K can better meet your needs. Complete the survey here.

Notes.

Today's issue includes events affecting France, the United Kingdom, and the United States.

Attacks, Threats, and Vulnerabilities

Ransomware attack contributed to patient’s death, says Britain’s NHS (The Record) A cybercrime group's attack against a London-based pathology service last year was one of the "contributing factors" in the death of a patient, U.K. officials said.

Glasgow council yanks services offline amid attack cleanup (The Register) : Nothing confirmed but authority is operating under the assumption that data has been stolen

Columbia University investigating cyber incident after tech outages (The Record) IT systems at Columbia University have been visibly disrupted for more than a day by an incident that caused the school to notify the NYPD.

CISA Adds Three Known Exploited Vulnerabilities to Catalog (CISA) CISA has added three new vulnerabilities to its KEV Catalog, based on evidence of active exploitation.

Products, Services, and Solutions

Sysdig Launches the First Fully Integrated AI Analyst for Cloud Security (Sysdig) With AI-driven precision across prevention, detection, investigation, and response, Sysdig Sage™ equips teams to outpace cloud threats in real time.

VulnCheck - Outpace Adversaries (VulnCheck) Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

fwd:cloudsec North America 2025 (Denver, Colorado, USA, Jun 30 - Jul 1, 2025) fwd:cloudsec is a non-profit conference on cloud security. At this conference you can expect discussions about all the major cloud platforms, both attack and defense research, limitations of security features, the pros and cons of different security strategies, and generally the types of things cloud practitioners want to know, but that don't fit neatly into a vendor conference schedule.

International Space Station Research and Development Conference (Seattle, Washington, USA, Jul 28 - 31, 2025) At ISSRDC, learn how to harness the International Space Station (ISS) and the unique conditions of space to help solve your most pressing research and development (R&D) challenges.

DEF CON 33 (Las Vegas, Nevada, USA, Aug 7 - 10, 2025) DEF CON is one of the oldest continuously running hacker conventions around, and also one of the largest.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 06.26.25