Week of June 23, 2025: UNFI's Cyber Incident Hits Earnings, CISA Pushes Code Safety

The week of June 23, 2025 brought a material-impact cybersecurity disclosure from United Natural Foods, a critical Citrix NetScaler patch echoing CitrixBleed, and a wave of CISA activity spanning eight ICS advisories, three new Known Exploited Vulnerabilities, and fresh memory-safety guidance with the NSA. Security teams also had to contend with a trojanized SonicWall VPN installer and a newly disclosed backdoor network hitting small office routers worldwide.

UNFI Discloses Material Financial Impact From Cybersecurity Incident

United Natural Foods, Inc. filed an 8-K dated June 21, 2025, updating investors on the IT security incident first disclosed June 9, 2025, after unauthorized activity on its systems was discovered on June 5, 2025. The filing stated the incident, which had temporarily disrupted order fulfillment and distribution, was reasonably likely to materially affect net income and adjusted EBITDA for its fiscal fourth quarter versus internal projections. UNFI said it does not expect to notify individual consumers because the incident did not involve personal or health information, and it carries cybersecurity insurance it expects will cover costs extending into fiscal 2026. (SEC EDGAR)

CISA Adds Three Actively Exploited Flaws to KEV Catalog

On June 25, 2025, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2024-54085, an authentication-bypass flaw in AMI MegaRAC SPx baseboard management controller firmware; CVE-2024-0769, a path traversal issue in D-Link DIR-859 routers; and CVE-2019-6693, a hard-coded credentials vulnerability in Fortinet FortiOS. Binding Operational Directive 22-01 requires federal civilian agencies to remediate catalog entries by set deadlines, and CISA urged all organizations to prioritize patching these three vulnerabilities as part of routine vulnerability management. (CISA)

CISA Issues Eight ICS Advisories Covering Schneider, Delta, Mitsubishi

On June 24, 2025, CISA published eight Industrial Control Systems advisories addressing products from Kaleris, Delta Electronics, Schneider Electric, ControlID, Parsons, and MICROSENS, plus an updated Mitsubishi Electric MELSEC-Q Series PLC advisory. Covered systems included Schneider Electric Modicon Controllers and EVLink WallBox charging stations, Delta Electronics CNCSoft software, and the Kaleris Navis N4 terminal operating system. CISA encouraged administrators managing these industrial environments to review the technical details and apply recommended mitigations promptly to reduce exposure to the disclosed vulnerabilities. (CISA)

Citrix Patches Critical NetScaler Flaw Echoing CitrixBleed

Citrix fixed a critical out-of-bounds read vulnerability, CVE-2025-5777, in NetScaler ADC and NetScaler Gateway that researchers said resembled the previously exploited CitrixBleed flaw and could let unauthorized attackers lift valid session tokens from device memory. A second flaw, CVE-2025-5349, affecting the NetScaler Management Interface, was fixed in the same update. Citrix said there was no indication of active exploitation of CVE-2025-5777 at disclosure but urged customers to install the updated builds immediately and terminate active ICA and PCoIP sessions to invalidate any already-stolen tokens. (Help Net Security)

CISA and NSA Release Joint Guidance on Memory-Safe Languages

On June 24, 2025, CISA and the National Security Agency published a joint guide on reducing memory-related vulnerabilities in software development, building on their earlier memory-safe roadmap publication. The guidance frames adoption of memory safe languages as the most comprehensive mitigation against this class of flaws and ties the recommendation to CISA's Secure by Design program, which pushes developers to build proactive security measures into the software lifecycle. The agencies encouraged academia, government, and private industry to review the guide and support the transition toward memory safe development practices. (CISA)

SonicWall Warns of Trojanized NetExtender VPN Installer Stealing Credentials

SonicWall warned on June 23, 2025, that attackers had trojanized its NetExtender SSL-VPN client and were distributing it through lookalike websites to steal remote-access credentials. The tampered installer disabled digital-certificate checks in a component called NeService.exe and modified NetExtender.exe to send captured VPN usernames, passwords, and domain details to a remote server over port 8080. SonicWall said the impersonating sites had been taken down, the certificate used to sign the malicious installer was revoked, and the trojanized file is now detected by Microsoft Defender and SonicWall's Capture ATP sandbox. (Help Net Security)

SecurityScorecard Uncovers LapDogs Backdoor Network in SOHO Devices

SecurityScorecard's STRIKE team disclosed on June 23, 2025, a network of more than 1,000 compromised small office and home office devices it calls LapDogs, built around a custom backdoor named ShortLeash that gives attackers root-level, persistent access. The campaign primarily targeted Linux-based routers from Ruckus Wireless and Buffalo AirStation across the United States, Japan, South Korea, Taiwan, and Hong Kong, researchers said, describing it as part of a broader shift by China-Nexus threat actors toward Operational Relay Box networks that mask their activity. Researchers advised phasing out legacy routers and requiring vendor telemetry. (Help Net Security)