Week of August 18, 2025: Data I/O Ransomware Disclosure, Apple Zero-Day Hits CISA KEV

Security leaders watching the week of August 18, 2025 saw Data I/O disclose a ransomware incident to the SEC, CISA add an actively exploited Apple zero-day to its Known Exploited Vulnerabilities Catalog, and researchers publish a working exploit chain for two critical SAP NetWeaver flaws. The same week also brought an FBI-Cisco warning about Russian exploitation of a legacy Cisco bug, Commvault patches for chainable remote-code-execution flaws, and a new CISA draft on Software Bill of Materials guidance.

Data I/O Discloses Ransomware Incident in SEC Filing

On August 16, 2025, Data I/O Corporation experienced a ransomware incident on certain internal IT systems, prompting the Redmond, Washington-based manufacturer to take platforms offline and bring in outside cybersecurity experts for containment and investigation. The company's Form 8-K, filed August 21, said the incident disrupted internal and external communications, shipping, receiving and manufacturing production, with a full restoration timeline not yet known. Data I/O stated that while the incident did not appear material to operations as of the filing date, expected response and recovery costs were reasonably likely to affect its financial results. (SEC EDGAR)

Apple Patches Zero-Day Tied to 'Extremely Sophisticated' Attack

Apple shipped fixes for CVE-2025-43300 across iOS 18.6.2, iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8 and macOS Ventura 13.7.8 after confirming the Image I/O out-of-bounds write flaw had been exploited as a zero-day. Apple described the activity as "an extremely sophisticated attack against specific targeted individuals," language consistent with spyware deployment rather than broad-based targeting. CISOs managing Apple device fleets were urged to prioritize the update given the confirmed in-the-wild exploitation tied to the same CVE that CISA added to its exploited vulnerabilities catalog days earlier. (Help Net Security)

Public Exploit Chains Two Critical SAP NetWeaver Vulnerabilities

Onapsis researchers reported on August 20, 2025 that a working exploit chaining CVE-2025-31324 and CVE-2025-42999 in SAP NetWeaver had surfaced on a Telegram channel claiming ties to Scattered Spider, ShinyHunters and LAPSUS$. The chain allows attackers to execute operating-system commands with SAP administrator privileges without dropping a webshell, broadening risk even for organizations that already patched the original zero-day. The Shadowserver Foundation reported fewer than 50 unpatched internet-facing NetWeaver systems remained, but the public exploit code raised urgency for confirming patch status across SAP environments. (Help Net Security)

Commvault Patches Four Flaws Enabling Remote Code Execution

Commvault fixed four vulnerabilities in its on-premises backup suite, CVE-2025-57788, CVE-2025-57789, CVE-2025-57790 and CVE-2025-57791, after watchTowr Labs published technical details on August 20, 2025 showing the bugs could be chained for unauthenticated remote code execution against the Web Server, Command Center and CommServe components. The flaws affected Commvault main-branch versions 11.32.0-11.32.101, 11.36.0-11.36.59 and the 11.38.20-11.38.25 innovation branch, with fixes released in 11.32.102, 11.36.60 and 11.38.32. Commvault said its SaaS offering was not affected, but urged on-premises customers to update without delay. (Help Net Security)

CISA Opens Comment Period on Updated SBOM Minimum Elements

On August 22, 2025, CISA released a draft update to the Minimum Elements for a Software Bill of Materials, opening a public comment period running through October 3, 2025. The revision adds fields such as component hash, license, tool name and generation context to the 2021 NTIA baseline, reflecting expanded SBOM tooling and adoption since then. The update is intended to give federal agencies and other organizations a scalable, interoperable baseline for documenting and sharing software component information across the supply chain. (CISA)