In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug

Summary

This week's security news roundup covers several significant incidents. CISA warns of active exploitation of the Ray vulnerability (CVE-2025-62593), with the RondoDox botnet leveraging it. GitHub clarified that an AI tool found a vulnerability in human-authored code, not AI-generated code. Threema faced DDoS attacks, while the Evooo1Bot Linux botnet targets internet-facing devices. T-Mobile physically cut a router cable to thwart Chinese state-sponsored hackers Salt Typhoon, and Medusa ransomware is exploiting GoAnywhere and BeyondTrust vulnerabilities.

Full text

SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers maintain a well-rounded awareness of the evolving cybersecurity environment. Here are this week’s highlights: CISA warns of actively exploited Ray vulnerability CISA has mandated that all federal civilian agencies prioritize fixing a severe code injection vulnerability (CVE-2025-62593) in Ray-Project Ray. The flaw was added to the Known Exploited Vulnerabilities catalog after threat actors were observed actively abusing it in the wild. BitSight saw the vulnerability being exploited by RondoDox, a Mirai-inspired botnet utilizing a staggering 174 distinct exploits to compromise vulnerable edge devices. Advertisement. Scroll to continue reading. GitHub says vulnerability found by autonomous Wiz agent not introduced by AI An autonomous AI tool developed by Wiz successfully identified and exploited a critical GitHub Actions workflow vulnerability in a public Snowflake repository, gaining unauthorized access to the company’s internal Jira tickets. Although initially reported as a flaw introduced by GitHub Copilot, GitHub has clarified for SecurityWeek that the vulnerable code snippet was entirely human-authored. Threema DDoS attack Encrypted messaging provider Threema recently endured significant service disruptions following a series of sophisticated, sustained DDoS attacks targeting its infrastructure and colocation partner. To stabilize operations, the company quickly implemented specialized upstream traffic filtering to block the malicious requests before they could reach and overload its servers. Evooo1Bot Linux botnet FortiGuard Labs is tracking Evooo1Bot, a highly modular Linux botnet that targets internet-facing devices by exploiting over a dozen known CVEs. Going beyond standard DDoS capabilities, this Mirai variant is equipped with an SSH brute-forcer, credential sniffer, and a SOCKS5 relay module designed to convert infected hosts into persistent proxy nodes for attackers. T-Mobile physically cut router cable to stop Chinese hackers To stop an active network intrusion by the Chinese state-sponsored hacking group Salt Typhoon in 2024, T-Mobile’s cybersecurity staff physically cut [paywalled Bloomberg report] a compromised router’s network cable with scissors at a Bellevue data center. T-Mobile was targeted in an extensive espionage campaign that impacted several other major US carriers. TeamPCP claims massive data theft from Alation Data catalog provider Alation confirmed an unauthorized intrusion into its internal network following a recent cyberattack. The hacking group TeamPCP has publicly claimed responsibility for the breach, alleging they successfully exfiltrated 73 gigabytes of sensitive data from the enterprise software company. Data breach at Japan’s Sakura Internet affects over 1 million customer records Japanese hosting provider Sakura Internet discovered a severe data breach in its sales management system, potentially compromising contract and membership information for up to 1.36 million users. The massive exposure was identified while security teams were investigating a completely separate malware infection that impacted a small subset of the company’s rental server accounts. Medusa ransomware targeting GoAnywhere and BeyondTrust vulnerabilities A joint advisory from CISA, the FBI, and HHS cautions that Medusa ransomware affiliates are rapidly exploiting newly disclosed vulnerabilities in Fortra GoAnywhere and BeyondTrust to compromise critical infrastructure. The updated alert highlights the group’s evolving evasion toolkit, which now includes utilizing Minidump for credential theft and Interactsh dynamic URLs to verify successful network exploitation. The advisory says over 500 critical infrastructure organizations have been hit to date. Zombie Card attack Academic researchers have demonstrated a new Zombie Card attack that bypasses cryptographic checks to complete contactless payments using physically expired Visa credit cards. By leveraging a smartphone relay setup to alter the expiration date fed to the POS terminal, attackers can exploit a communication gap between the local hardware and the issuing bank. The attack does not appear to work against Mastercard, American Express and Discover cards, and it does not work against all banks. Visa has not responded to SecurityWeek’s request for comment. Canadian security firm secures top-tier NIST certification for post-quantum hardware module Crypto4A has become the first company globally to achieve FIPS 140-3 Level 3 validation for an HSM supporting all NIST-approved post-quantum cryptographic algorithms. The newly certified QASM module delivers a tamper-resistant foundation to protect sensitive cryptographic keys from the future threat of advanced quantum computing attacks. Related: In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities Related: In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street Written By SecurityWeek News Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from SecurityWeek News Virtual Event Today: CodeSecCon – Secure Your Code and ApplicationsWebinar Today: Rethinking Cyber Defense for AI-Speed AttacksIn Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System VulnerabilitiesVenture Firm Team8 Secures Additional $365 MillionCorma Raises $60 Million for Defensive Cybersecurity AI ModelIn Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall StreetBlack Hat USA 2026 – Summary of Vendor Announcements (Part 4)Podcast: Compliance Won’t Save You: The Future of Cyber Risk with Edna Conway Latest News Encrypted Prompts Bypass AI Safety Guardrails in Grok and GeminiNew Phishing Toolkit Uses Passkeys to Maintain Access After Password ResetsCritical Isolated-vm Vulnerability Leads to RCE on HostRust Supply Chain Attack Linked to North Korean HackersContractors’ CMMC Confidence Rises as Ability to Prove It Falls BehindMicrosoft Patches Exploited Entra ID VulnerabilityCISA Urges Immediate Patching of Exploited TrueConf VulnerabilitiesHackers Target Zimbra Servers in Active Exploitation Campaign Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveUltraViolet Cyber has named Andrew Park Chief Information Security Officer.Glow has appointed Patti Degnan as Chief Information Security Officer.Daniel Dubowski has been named Senior Vice President and Chief Information Security Officer at Marriott International.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping s

Indicators of Compromise

• cve — CVE-2025-62593
• malware — RondoDox
• malware — Evooo1Bot
• malware — Medusa ransomware

Entities