Trump nominates Sean Plankey as new CISA director.

Summary

By the CyberWire staff

At a glance.

Trump nominates Sean Plankey as new CISA director.
Microsoft's Patch Tuesday fixes six zero-days.
Apple patches actively exploited WebKit vulnerability.

Trump nominates Sean Plankey as new CISA director.

President Trump has nominated Sean Plankey to run the Cybersecurity and Infrastructure Security Agency (CISA), CyberScoop reports. Plankey is a former Coast Guard officer who served as a director for cyber policy on the White House's National Security Council during the first Trump administration, focusing on maritime and Pacific cybersecurity policy. He also served as principal deputy assistant secretary for the Energy Department’s Office of Cybersecurity, Energy Security, and Emergency Response.

Plankey’s nomination now goes to the Senate for a confirmation vote. Axios notes that "[i]ndustry insiders on both sides of the aisle are likely to be pleased with his selection," and his nomination is unlikely to face pushback from Congress.

Stop Identity-Based Cybercrime with SpyCloud’s Holistic Identity Threat Protection

Stolen identity data is the hot commodity for cybercriminals. With the full scope of your users’ digital footprints at risk for exposure, traditional account-centric security is no longer enough to protect your business from cyberattacks. SpyCloud helps security teams correlate and automatically remediate individuals' hidden identity exposures from breaches, malware, and phishing across their many online personas. Eliminate identity-based cyber threats and proactively defend against account takeover, fraud, and ransomware with SpyCloud.

Microsoft's Patch Tuesday fixes six zero-days.

Microsoft yesterday issued patches for 57 vulnerabilities, including six actively exploited zero-days, KrebsOnSecurity reports. Two of the zero-days (CVE-2025-24991 and CVE-2025-24993) affect NTFS, and one (CVE-2025-24985) impacts the Windows Fast FAT File System. These three flaws require an attacker to trick a user into mounting a malicious virtual hard disk.

Another zero-day (CVE-2025-24983) is a privilege escalation flaw affecting Windows 8.1 and Server 2012 R2, which is being exploited by the PipeMagic backdoor, according to researchers at ESET. A fifth vulnerability (CVE-2025-24984) affects NTFS and "allows an unauthorized attacker to disclose information with a physical attack." The sixth zero-day (CVE-2025-26633) impacts the Microsoft Management Console and "allows an unauthorized attacker to bypass a security feature locally."

Many Voices. One Community.

Join Us at the RSAC 2025 Conference. Join us at RSAC, April 28 - May 1 in San Francisco and gain access to cybersecurity innovators, expert-led sessions, and hands-on workshops. Leave with new strategies, insights, and connections to elevate your cybersecurity journey.

Apple patches WebKit zero-day.

Apple has released an emergency patch for a critical zero-day affecting its WebKit browser engine. The company says the flaw "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2." The vulnerability is an out-of-bounds write issue that can allow maliciously crafted web content to break out of the Web Content sandbox.

Notes.

Today's issue includes events affecting , and the United States.

Attacks, Threats, and Vulnerabilities

Previously unidentified botnet targets unpatched TP-Link Archer home routers (The Record) Researchers at Cato Networks said that during a recent investigation into router vulnerabilities, they discovered a new botnet — which they named Ballista — infecting TP-Link Archer devices.

North Korean Lazarus hackers infect hundreds via npm packages (BleepingComputer) Six malicious packages have been identified on npm (Node package manager) linked to the notorious North Korean hacking group Lazarus.

Security Patches, Mitigations, and Software Updates

ICS Patch Tuesday: Advisories Published by CISA, Schneider Electric, Siemens (SecurityWeek) Industrial giants Siemens and Schneider Electric have released March 2025 Patch Tuesday ICS security advisories.

Legislation, Policy, and Regulation

CISA worker says 100-strong red team fired after DOGE action (The Register) : Election infosec advisory agency also shuttered

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

International Space Station Research and Development Conference (Seattle, Washington, USA, Jul 28 - 31, 2025) At ISSRDC, learn how to harness the International Space Station (ISS) and the unique conditions of space to help solve your most pressing research and development (R&D) challenges.

Events

GovMilSpace (Washington, DC, USA, Mar 10 - 13, 2025) Demystify the future of space technology. In alignment with the SATELLITE Conference & Exhibition, GovMilSpace brings together government and military agencies, the intelligence community, and satellite and space industry partners to explore how private industry can enhance critical missions for the U.S. and its global allies.

Satellite 2025 (Washington, DC, USA, Mar 10 - 13, 2025) For 40+ years SATELLITE has gathered the global space and satellite communities for four immersive days of enterprise, insights, and innovation. This year, with the debut of GovMilSpace, SATELLITE expands its reach to address the needs and priorities of the defense sector.

WICYS 2025 (Dallas and Virtual, Texas, USA, Apr 2 - 5, 2025) WiCyS 2025 is the go-to event for cybersecurity professionals, students, and organizations. The conference is the flagship event to recruit, retain and advance women in cybersecurity.

40th Space Symposium (Denver and Virtual, Colorado, USA, Apr 7 - 10, 2025) Bringing together leaders from commercial, government and military space from around the world, the Space Symposium provides a forum to discuss, address and plan for future achievements in space. The Space Symposium program delivers exclusive networking and engagement opportunities with influential participants in one convenient and extraordinary venue. Space Symposium luncheons and dinners provide additional contact with influential participants.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 03.12.25

At a glance.

Trump nominates Sean Plankey as new CISA director.

Microsoft's Patch Tuesday fixes six zero-days.

Apple patches WebKit zero-day.

Notes.

Attacks, Threats, and Vulnerabilities

Security Patches, Mitigations, and Software Updates

Legislation, Policy, and Regulation

Newly Noted Events

Events