Daily Briefing for 09.11.25

Top stories.

• US House passes $848 billion defense policy bill with provisions on cybersecurity and AI.
• US warns of backdoored solar-powered highway infrastructure.
• Akira ransomware gang targets unpatched SonicWall devices.

US House passes $848 billion defense policy bill with provisions on cybersecurity and AI.

The US House yesterday passed an $848 billion version of the National Defense Authorization Act (NDAA) that includes provisions on cybersecurity and AI, the Record reports. The bill requires the creation of a "software bill of materials" for AI-enabled technology utilized by the Defense Department, and directs the NSA to provide an update on its plans for the Cybersecurity Coordination Center. The Pentagon would also be authorized to create "up to 12 generative artificial intelligence lines of effort" looking at how AI can improve its cybersecurity and intelligence efforts. The bill also includes an amendment that would allow the NSA to share data with the private sector in order to improve security in the telecommunications industry.

The US Senate is expected to pass its own version of the NDAA next week.

US warns of backdoored solar-powered highway infrastructure.

Reuters reports that US officials have warned that solar-powered highway infrastructure, such as chargers, traffic cameras, and roadside weather stations, should be inspected for rogue devices hidden inside batteries and inverters. A private advisory issued last month by the US Department of Transportation's Federal Highway Administration said cellular radios had been discovered “in certain foreign-manufactured power inverters and [battery management systems]." The advisory didn't name any foreign countries, but Reuters notes that many of these devices are made in China.

Anomadarshi Barua, a researcher from George Mason University, told Reuters that such devices could be used to sabotage roadside infrastructure or disrupt traffic.

Akira ransomware gang targets unpatched SonicWall devices.

Rapid7 warns that the Akira ransomware gang is targeting unpatched SonicWall devices to gain initial access. The attackers are exploiting CVE-2024-40766, a critical improper access control vulnerability that was patched over a year ago. Rapid7 believes the attackers are combining this flaw with two other security risks, one of which "can over-provision access to SonicWall’s SSLVPN services based on the Default LDAP group configuration." The researchers add, "Rapid7 has also observed threat actors accessing the Virtual Office Portal hosted by SonicWall appliances. The Virtual Office Portal can be used to initially set up MFA/TOTP configurations for SSLVPN users. The Virtual Office Portal in certain default configurations allows public access to the portal, which can allow threat actors to configure MFA/TOTP with valid accounts if there is a prior username and password credential exposure."

SonicWall issued updated security guidance related to these risks last month.