British police arrest suspect in Collins Aerospace attack.

Summary

By the CyberWire staff

British police arrest suspect in Collins Aerospace attack.

British police have arrested a man in connection with the ransomware attack against Collins Aerospace that disrupted air travel across Europe, Reuters reports. The UK's National Crime Agency (NCA) said in a statement, "NCA officers, supported by the South East ROCU, arrested a man in his forties in West Sussex yesterday evening on suspicion of Computer Misuse Act offences. He has been released on conditional bail."

Collins Aerospace, a subsidiary of RTX (formerly Raytheon), provides check-in software for major airports. The BBC reports that Collins is having difficulty bringing its software back online, and "appears to be rebuilding the system again after trying to relaunch it on Monday." TechCrunch reports that as of yesterday, flights out of London, Brussels, Berlin, and Dublin were still seeing delays.

Protect data. Secure AI. Innovate now. Join us at DataSecAI 2025.

AI adoption is exploding, and security teams are under pressure to keep up. That’s why the industry is coming together at DataSecAI25, the premier event for cybersecurity, data, and AI leaders, hosted by Cyera.

Built for the industry, by the industry, this two-day event is where real-world insights and bold solutions take center stage. DataSecAI25 is happening November 12–13 in Dallas. No cost to attend - just bring your perspective and join the conversation. Register now to save your seat!

Libraesva fixes actively exploited flaw.

Email security firm Libraesva has issued an emergency patch for a flaw in its security gateway that was being exploited as a zero-day by a nation-state threat actor, BleepingComputer reports. The vulnerability (CVE-2025-59689) is a "command injection flaw that can be triggered by a malicious e-mail containing a specially crafted compressed attachment, allowing potential execution of arbitrary commands as a non-privileged user."

Libraesva users are advised to upgrade to the latest version.

CISA says attackers breached a government agency via GeoServer flaw.

The US Cybersecurity and Infrastructure Security Agency (CISA) has disclosed that attackers breached a US federal civilian executive branch (FCEB) agency last year via a vulnerability (CVE-2024-36401) in GeoServer, an open-source server for sharing geospatial data. CISA adds, "Over the three-week period, the cyber threat actors gained separate initial access to a second GeoServer via the same vulnerability and moved laterally to two other servers." The vulnerability had been disclosed eleven days before the exploitation took place. CISA describes the lessons learned during the incident response, emphasizing that the attack shows the importance of prompt vulnerability remediation.

Notes.

Today's issue includes events affecting , and the United Kingdom the United States.

Attacks, Threats, and Vulnerabilities

Supermicro server motherboards can be infected with unremovable malware (Ars Technica) Baseboard management controller vulnerabilities make remote attacks possible.

Boyd Gaming Suffers Cyberattack, Data Breach (Casino.org) Boyd Gaming hit by cyberattack stealing employee data, joins rising Las Vegas casino cybercrime trend amid industry-wide vulnerabilities.

Litigation, Investigation, and Law Enforcement

AI tool used to recover £500m lost to fraud, government says (BBC: World News & Stories) Ministers say software developed by the Cabinet Office has helped to ramp up fraud detection.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

US Cyber Team® Draft Day (Virtual and Washington, DC, USA, Sep 25, 2025) The mission of the US Cyber Games® is to bring talented cybersecurity athletes, coaches, and industry leaders together to build an elite US Cyber Team for global cybersecurity competition. Games, Esports, and Online Tournaments are the next evolution in preparing tomorrow's workforce.

AFRL Space Cyber Summit (Albuquerque, New Mexico, USA, Oct 15 - 16, 2025) The AFRL Space Cyber Summit is an annual event hosted by the Air Force Research Laboratory (AFRL) to bring together experts from government, academia, and industry to advance space cyber expertise and technologies, foster community-wide collaboration, and anticipate future technology growth in a cyber-contested space domain. The summit aims to develop cyber-secure systems for space, protect against evolving threats, and identify opportunities for collaboration and innovation.

Events

Open Source Security Summit 2025 (Virtual, Sep 25, 2025) The sixth annual Open Source Security Summit brings together business leaders, industry visionaries, and technology users to chart a path forward and highlight the future of open source security solutions at this free virtual event. Register now to explore advancements in open source security and how using open source tools can build trust with customers and consumers.

HackAICon 2025 (Lisbon, Portugal, Sep 25, 2025) The first conference dedicated to combining AI and Ethical Hacking. We're bringing together OffSec pros, hackers, and leading researchers to find practical ways of using AI to secure the internet. Learn about the latest AI Hacking cosmic trends and connect with fellow professionals in engaging conversations. We banned sales pitches from the event - just knowledge sharing, leadership and technical insights.

Don’t miss Jen Easterly, former CISA Director, headlining HIP Conf 25 (Charleston, SC, USA, Oct 7 - 9, 2025) Jen Easterly, former CISA Director, keynotes HIP Conf 2025. A globally recognized cybersecurity leader, Easterly brings unmatched insight into hybrid identity security and resilience. Register now for this must-attend event.

Uniting Women in Cyber 2025 (Crystal City, Virginia, USA, Oct 9, 2025) UWIC is the premier event for cybersecurity leaders, professionals, and aspiring practitioners. Connect with a vibrant community focused on emerging global trends, technological advancements, and workforce development. Attend UWIC 2025 to learn, share ideas, and expand your professional network!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 09.24.25

Top stories.

British police arrest suspect in Collins Aerospace attack.

Libraesva fixes actively exploited flaw.

CISA says attackers breached a government agency via GeoServer flaw.

Notes.

Attacks, Threats, and Vulnerabilities

Litigation, Investigation, and Law Enforcement

Newly Noted Events

Events