CISA issues an urgent warning about active exploitation of a sudo utility critical vulnerability.

Summary

By the CyberWire staff

CISA issues an urgent warning about active exploitation of a sudo utility critical vulnerability.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about the active exploitation of a critical vulnerability in the sudo utility. The vulnerability, known as CVE-2025-32463, impacts sudo's -R (chroot) option and allows attackers with limited sudo rights to bypass restrictions and gain full root access.

CISA warned that successful exploitation could result in complete system compromise, enabling data theft, service disruption, or malware installation. Additionally, CISA urged administrators to identify vulnerable systems, apply vendor patches, or disable the chroot option until fixes are available.

Control what runs in your environment. Reduce your attack surface.

ThreatLocker helps organizations reduce risk by allowing trusted applications to run while limiting their access to only the resources they need. It’s a straightforward, default deny approach that gives you more control and visibility—without slowing down operations. Explore how ThreatLocker can help simplify your security strategy.

Broadcom patches two high-severity vulnerabilities in VMware NSX.

Broadcom has released security patches for two high-severity VMware NSX vulnerabilities. The vulnerabilities were both reported by the US National Security Agency (NSA). The first flaw, identified as CVE-2025-41251, is related to a weakness in the password recovery mechanism that allows unauthorized attackers to enumerate valid usernames. The second flaw, tracked as CVE-2025-41252, is a username enumeration vulnerability that lets unauthenticated actors enumerate valid usernames.

With these patches, Broadcom stated that it "would like to thank the [NSA] for reporting this issue to us."

Outside of these patches, Broadcom also patched another high-severity SMTP header injection flaw in VMware vCenter, identified as CVE-2025-41250, that allowed attackers with non-administrative privileges and permissions to create scheduled tasks to manipulate the notification emails for scheduled tasks.

South Korea raises its national cyber threat level after a data center fire.

South Korea raised its national cyber threat level after a fire occurred at a government data centre in Daejeon. The fire was caused after lithium-ion batteries ignited during replacement work, causing 647 government systems to shut down, halting email, intranet, banking, tax, real estate, and healthcare services. The intelligence service warned that hackers may exploit the weakened systems during this recovery process.

President Lee Jae Myung apologized on Sunday. In a crisis meeting, President Myung stated:

"This was a foreseeable incident, yet there were no countermeasures. It's not that the measures failed to work - they simply did not exist."

As of Tuesday, 89 systems have been restored and 96 have been destroyed. Repairing these systems will require weeks to rebuild.

Notes.

Today's issue includes events affecting , and South Korea the United States.

Attacks, Threats, and Vulnerabilities

Microsoft Flags AI Phishing Attack Hiding in SVG Files (Hackread - Latest Cybersecurity, Hacking News, Tech, AI & Crypto) Microsoft Threat Intelligence detected a new AI-powered phishing campaign using LLMs to hide malicious code inside SVG files disguised as business dashboards.

JWT signature verification bypass enables account takeover in Formbricks (BeyondMachines) Formbricks patched a critical authentication bypass vulnerability (CVE-2025-59934) caused by using jwt.decode() instead of jwt.verify() for token validation, allowing attackers to forge authentication tokens using the "none" algorithm and hijack user accounts through crafted password reset URLs.

Trends

Why burnout is a growing problem in cybersecurity (BBC: World News & Stories) Facing increasing stress, cybersecurity professionals are dropping out of the workforce.

Playing Offside: How Threat Actors Are Warming Up for FIFA 2026 - Check Point Blog (Check Point Blog) Every four years, the World Cup captures the attention of billions. With that attention comes opportunity – not only for sponsors, broadcasters, and legitimate merchants, but also for adversaries who see in this spectacle a marketplace of deception.

Landlords Demand Tenants’ Workplace Logins to Scrape Their Paystubs (404 Media) Screenshots shared with 404 Media show tenant screening services ApproveShield and Argyle taking much more data than they need. “Opt-out means no housing.”

Research and Development

Social Media Privacy Ranking 2025 [2025] | Incogni (Incogni Blog) The social media landscape has been a dynamic and unpredictable one since its inception, and 2025 has been no exception. With so much changing so quickly,

Litigation, Investigation, and Law Enforcement

Chinese woman convicted in UK after 'world's biggest' bitcoin seizure (BBC: World News & Stories) UK police seized crypto worth over £5bn from Zhimin Qian, who was known as 'the goddess of wealth'.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

CyberArk IMPACT25 World Tour Identity Security Summit (Long Beach, California, USA, Oct 7, 2025) We're bringing best-in-class insights from CyberArk IMPACT to a city near you! Join us in Long Beach for IMPACT World Tour, where you'll gain exclusive access to the latest advancements, technologies, and trends shaping the future of identity security. Engage with CyberArk experts and industry peers through strategic presentations and deep-dive discussions — all designed to arm you with the right tools and knowledge to strengthen your identity security program.

Events

DTEX NEXT (Virtual, Oct 7, 2025) DTEX NEXT is where the future of proactive security takes shape. Join us as we unveil our latest advancements in DTEX Insider Risk Management (IRM) and DTEX Risk-Adaptive Data Loss Prevention (DLP), powered by industry-leading behavioral science, advanced AI, and our strategic collaboration with AWS.

Don’t miss Jen Easterly, former CISA Director, headlining HIP Conf 25 (Charleston, SC, USA, Oct 7 - 9, 2025) Jen Easterly, former CISA Director, keynotes HIP Conf 2025. A globally recognized cybersecurity leader, Easterly brings unmatched insight into hybrid identity security and resilience. Register now for this must-attend event.

AI Agent Security Summit in San Francisco (San Franciso, California, USA, Oct 8, 2025) After launching in NYC, the AI Agent Security Summit heads to San Francisco to continue shaping how enterprises secure the next wave of AI. On Wednesday, October 8, join us at the historic Commonwealth Club in San Francisco.

Uniting Women in Cyber 2025 (Crystal City, Virginia, USA, Oct 9, 2025) UWIC is the premier event for cybersecurity leaders, professionals, and aspiring practitioners. Connect with a vibrant community focused on emerging global trends, technological advancements, and workforce development. Attend UWIC 2025 to learn, share ideas, and expand your professional network!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 09.30.25

Top stories.

CISA issues an urgent warning about active exploitation of a sudo utility critical vulnerability.

Broadcom patches two high-severity vulnerabilities in VMware NSX.

South Korea raises its national cyber threat level after a data center fire.

Notes.

Attacks, Threats, and Vulnerabilities

Trends

Research and Development

Litigation, Investigation, and Law Enforcement

Newly Noted Events

Events