[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDdZK9QgbkF_5Nw1mbpQgMya8Q9tUFst4OCgiFg8n6Xw":3},{"article":4,"iocs":53,"watch_terms":67,"solutions":68,"lesson":174},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"1194158e-339e-4790-b949-1cb5d148bc8e","In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug","in-other-news-zombie-card-attack-t-mobile-cut-cable-to-stop-hackers-github-denie-a4a8e8","Other noteworthy stories that might have slipped under the radar: Threema DDoS attack, Evooo1Bot Linux botnet, Crypto4A secures top-tier NIST certification. The post In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug appeared first on SecurityWeek.","This week's security news roundup covers several significant incidents. CISA warns of active exploitation of the Ray vulnerability (CVE-2025-62593), with the RondoDox botnet leveraging it. GitHub clarified that an AI tool found a vulnerability in human-authored code, not AI-generated code. Threema faced DDoS attacks, while the Evooo1Bot Linux botnet targets internet-facing devices. T-Mobile physically cut a router cable to thwart Chinese state-sponsored hackers Salt Typhoon, and Medusa ransomware is exploiting GoAnywhere and BeyondTrust vulnerabilities.","Multiple cyber threats emerge: Ray vulnerability exploited, GitHub AI bug denial, T-Mobile cuts cable to stop hackers.","https:\u002F\u002Fwww.securityweek.com\u002Fin-other-news-zombie-card-attack-t-mobile-cut-cable-to-stop-hackers-github-denies-ai-caused-bug\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F10\u002Fcybersecurity-news.jpg","2026-08-21T15:11:16+00:00","2026-08-21T16:00:19.467056+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Ray-Project Ray","product",{"name":21,"type":19},"GitHub Actions",{"name":23,"type":19},"GitHub Copilot",{"name":25,"type":19},"Threema",{"name":27,"type":19},"GoAnywhere",{"name":29,"type":19},"BeyondTrust","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54,58,61,64],{"type":55,"value":56,"context":57},"cve","CVE-2025-62593","Actively exploited vulnerability in Ray-Project Ray",{"type":50,"value":59,"context":60},"RondoDox","Mirai-inspired botnet exploiting Ray vulnerability",{"type":50,"value":62,"context":63},"Evooo1Bot","Modular Linux botnet exploiting over a dozen CVEs",{"type":50,"value":65,"context":66},"Medusa ransomware","Exploiting GoAnywhere and BeyondTrust vulnerabilities",[18,21,23],{"controls":69,"vendors":152},[70,99,124],{"slug":71,"name":72,"problem":73,"products":74},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":100,"name":101,"problem":102,"products":103},"patch-management","Automated patch management","Known holes get closed in days, not months.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":100,"product_name":121,"url":122,"description":123},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":34,"name":125,"problem":126,"products":127},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[153,158,164,169],{"slug":154,"name":29,"logo_path":155,"roles":156},"beyondtrust","\u002Fvendor-logos\u002Fbeyondtrust.png",[157],"affected",{"slug":159,"name":160,"logo_path":161,"roles":162},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png",[163],"reported_by",{"slug":165,"name":166,"logo_path":167,"roles":168},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png",[163],{"slug":170,"name":171,"logo_path":172,"roles":173},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png",[163],{"slug":175,"title":176,"body":177,"framework_refs":178,"framework_notes":190},"unpatched-systems-and-active-exploits-dominate-this-weeks-threat-landscape","Unpatched Systems and Active Exploits Dominate This Week's Threat Landscape","This week's incidents share a common thread: attackers are aggressively targeting known, unpatched vulnerabilities in widely-used platforms such as Ray (CVE-2025-62593), GoAnywhere, and BeyondTrust, while botnets continue to sweep the internet for exposed devices. T-Mobile's drastic step of physically cutting a router cable to stop Salt Typhoon underscores how severe the consequences of unmitigated intrusions can be — and how organizations may be forced into disruptive remediation when earlier controls fail. The Medusa ransomware group's exploitation of multiple CVEs simultaneously illustrates that threat actors chain vulnerabilities quickly once they are publicly disclosed. Without rapid patch cycles and continuous exposure monitoring, organizations remain sitting targets for both state-sponsored actors and opportunistic criminal groups.",[179,180,181,182,183,184,185,186,187,188,189],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-40 Rev. 4 – Guide to Enterprise Patch Management","NIST SI-2 – Flaw Remediation","NIST SI-3 – Malicious Code Protection","NIST IR-4 – Incident Handling","NIST SC-7 – Boundary Protection (Network Segmentation)","ITIL – Problem Management (proactive vulnerability remediation)","CISA KEV Catalog – Active exploitation tracking","ISO\u002FIEC 27001 – A.12.6.1 Management of Technical Vulnerabilities",{}]