Daily Briefing for 09.16.25

Top stories.

1. Jaguar Land Rover extends shutdown for another week.
2. Poland increases cybersecurity budget to defend against Russian sabotage.
3. FlowiseAI patches critical account takeover flaw.

Jaguar Land Rover extends shutdown for another week.

Jaguar Land Rover (JLR) said this morning that its production will remain on pause until September 24th as it continues to investigate a cyberattack that occurred at the beginning of September, the Record reports. The company stated, "We have taken this decision as our forensic investigation of the cyber incident continues, and as we consider the different stages of the controlled restart of our global operations, which will take time."

The BBC cites industry sources as saying JLR's disruption may actually last into November, though JLR has dismissed these claims as "speculation." The company shut down its two primary manufacturing plants in the UK following the attack, and the BBC says the shutdown is likely costing the company at least £50 million (US$68 million) per week in lost production. The Record cites higher estimates saying JLR may be losing up to £72 million (US$98 million) in sales per day.

Poland increases cybersecurity budget to defend against Russian sabotage.

The Financial Times reports that the Polish government is increasing its cybersecurity budget to €1 billion (US$1.1 billion) this year following a string of alleged Russian cyberattacks designed to sabotage the country's critical infrastructure. Poland's Deputy Minister for Digital Affairs, Dariusz Standerski, told the publication that the country sees "between 20 and 50 attempts to damage critical infrastructure every day." While most of these attempts are thwarted, Standerski said several attacks against hospitals successfully disrupted operations. Standerski added that last month a Russian-backed group infiltrated the IT networks of a water facility serving one of Poland's largest cities, but the attackers were detected before they could cause any damage.

FlowiseAI patches critical account takeover flaw.

Open-source AI workflow automation platform FlowiseAI has issued a fix for a critical vulnerability (CVE-2025-58434) that could allow unauthenticated attackers to easily compromise user accounts, Beyond Machines reports. The flaw was assigned a CVSS score of 9.8, and can enable "any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover."

FlowiseAI users are urged to upgrade to version 3.0.6 as soon as possible.