Week of June 30, 2025: Iran Infrastructure Warning and Microsoft CISO Arsenault's Exit

Security leaders spent the week of June 30, 2025 watching a joint CISA-FBI-NSA warning about potential Iranian state-backed targeting of critical infrastructure, three new Known Exploited Vulnerabilities additions covering Citrix NetScaler, TeleMessage SGNL, and Chromium's V8 engine, and eleven industrial control systems advisories from Hitachi Energy, Mitsubishi Electric, Festo, and Voltronic Power. The week also marked a notable leadership change as Microsoft's longtime chief information security officer, Bret Arsenault, announced his retirement after 35 years with the company.

Agencies Warn Critical Infrastructure to Watch for Iranian Cyber Activity

On June 30, 2025, CISA joined the FBI, the Department of Defense Cyber Crime Center, and the National Security Agency to issue a fact sheet urging critical infrastructure operators to prepare for potential targeted operations by Iranian state-sponsored or affiliated actors. The agencies noted rising activity from hacktivists and government-affiliated groups that was expected to increase following recent events, though no coordinated campaign attributable to Iran had been observed in the United States at that time. Recommended mitigations included disconnecting operational technology from the public internet, enforcing strong passwords, applying patches, and adopting phishing-resistant multifactor authentication for OT network access. (CISA)

Microsoft's Longtime CISO Bret Arsenault Steps Back After 35 Years

SecurityWeek's industry-moves roundup for the week of June 30, 2025, reported that Bret Arsenault was retiring from his full-time role at Microsoft after 35 years with the company, having served more than 14 years as chief information security officer before moving into a Corporate Vice President and Chief Cybersecurity Advisor post. The same roundup noted Bobby Ford joining social engineering defense platform Doppel as Chief Strategy and Experience Officer after security leadership stints at Abbott Labs, Unilever, and Hewlett Packard Enterprise, alongside a new CISA Joint Cyber Coordination Group program director, Casie Antalis, and a new Cyber Command executive director, Patrick Ware. (SecurityWeek)

CISA Adds Citrix NetScaler Flaw to Exploited Vulnerabilities List

On June 30, 2025, CISA added CVE-2025-6543, a buffer overflow vulnerability affecting Citrix NetScaler ADC and Gateway, to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation. The listing triggers Binding Operational Directive 22-01 remediation deadlines for federal civilian executive branch agencies, and CISA urged all organizations to prioritize patching the flaw given its frequent use as an attack vector by malicious cyber actors targeting internet-facing network appliances. (CISA)

TeleMessage SGNL Flaws Added to CISA's Exploited Vulnerabilities Catalog

On July 1, 2025, CISA added two vulnerabilities in TeleMessage TM SGNL to its Known Exploited Vulnerabilities Catalog: an insecure default initialization flaw tracked as CVE-2025-48927 and a core-dump exposure flaw tracked as CVE-2025-48928, both confirmed as actively exploited. The additions meant federal civilian agencies faced mandatory remediation deadlines under Binding Operational Directive 22-01, and CISA again encouraged private-sector organizations to treat catalog entries as priority patching items within their broader vulnerability management programs. (CISA)

CISA Publishes Seven Industrial Control Systems Advisories

CISA released seven Industrial Control Systems advisories on July 1, 2025, covering products from Festo, Hitachi Energy, and Voltronic Power, including CODESYS-based controllers, hardware servo press kits, and UPS monitoring software. The advisories detailed current security issues, vulnerabilities, and exploits affecting the listed ICS products, and CISA encouraged asset owners and operators to review the technical mitigations for each entry as part of ongoing operational technology risk management. (CISA)

Actively Exploited Chromium Flaw Lands on CISA's KEV List

CISA added CVE-2025-6554, a type confusion vulnerability in Google Chromium's V8 engine, to its Known Exploited Vulnerabilities Catalog on July 2, 2025, citing evidence of active exploitation. The agency reiterated that such browser-engine flaws remain frequent attack vectors against federal networks and pressed both federal civilian agencies and private organizations to prioritize remediation alongside existing vulnerability management practices. (CISA)

CISA Issues Four More ICS Advisories for Hitachi Energy and Mitsubishi Electric

CISA released four additional Industrial Control Systems advisories on July 3, 2025, addressing products from Hitachi Energy, including the Relion 670/650 and SAM600-IO series and MicroSCADA X SYS600, as well as Mitsubishi Electric's MELSOFT Update Manager and MELSEC iQ-F series. The advisories provided technical details and mitigations for current security issues affecting the named ICS products, continuing a steady cadence of vendor-specific guidance issued that week. (CISA)