Week of September 22, 2025: Cisco Zero-Day Emergency Directive and npm Supply-Chain Worm

Security leaders faced an emergency federal directive on Cisco firewall zero-days, a sprawling npm supply-chain worm compromising hundreds of packages, and fresh vendor incidents at SonicWall and Libraesva during the week of September 22, 2025. The period also brought a U.S. Secret Service takedown of a SIM-farm network near the United Nations General Assembly and a new CISA leadership appointment overseeing infrastructure security.

CISA Orders Emergency Mitigation of Cisco ASA and Firepower Zero-Days

On September 25, 2025, CISA issued Emergency Directive 25-03 after an advanced threat actor exploited zero-day vulnerabilities in Cisco Adaptive Security Appliances and Firepower devices that persisted through reboots and upgrades. CISA added CVE-2025-20333 and CVE-2025-20362 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to identify all in-scope devices, collect forensic memory files, and submit them by 11:59 p.m. EST on September 26, disconnecting end-of-support hardware. CISA urged all organizations running these devices to take the same mitigation steps immediately. (CISA)

Shai-Hulud Worm Compromises Over 500 npm Packages

CISA warned on September 23, 2025 that a self-replicating worm known as Shai-Hulud had compromised more than 500 packages across the npm JavaScript registry, the world's largest. After gaining initial access, the actor harvested GitHub Personal Access Tokens and cloud API keys for AWS, Google Cloud, and Microsoft Azure, then published malicious versions of packages to extend the compromise. CISA urged organizations to review dependency trees, pin packages to versions predating September 16, 2025, rotate developer credentials, and enforce phishing-resistant multifactor authentication. (CISA)

SonicWall Discloses MySonicWall Cloud Backup Incident

CISA reported on September 22, 2025 that SonicWall issued a security advisory after a malicious actor used brute force techniques against the MySonicWall.com portal to access a subset of customers' preference files stored in cloud backups. While credentials in the files were encrypted, the files contained information attackers could use to access customers' SonicWall Firewall devices. CISA directed SonicWall customers to log into their accounts to check device risk and apply containment and remediation steps immediately. (CISA)

CISA Names Steve Casapulla Executive Assistant Director for Infrastructure Security

On September 23, 2025, CISA announced the appointment of Stephen L. Casapulla as Executive Assistant Director for Infrastructure Security, expanding a role he already held within the agency. Casapulla previously served as Director for Critical Infrastructure Cybersecurity in the Office of the National Cyber Director and spent over thirteen years at CISA and its predecessor. He will continue as Interim Assistant Director for CISA's National Risk Management Center and Acting Chief Strategy Officer while taking on the infrastructure security portfolio. (CISA)

Secret Service Dismantles SIM-Farm Network Near UN General Assembly

The U.S. Secret Service disclosed on September 23, 2025 that it had dismantled a network of electronic devices in the New York tristate area capable of disrupting cell towers, launching denial-of-service attacks, and enabling anonymous communications. Investigators found more than 300 co-located SIM servers and 100,000 SIM cards at multiple locations within 35 miles of New York City during the United Nations General Assembly. Officials said forensic work showed some devices supported communications linked to nation-state actors, though no countries were named and the investigation remained active. (Help Net Security)

State-Linked Actor Exploited Libraesva Email Gateway Zero-Day

Libraesva confirmed on September 24, 2025 that suspected state-sponsored attackers had exploited a zero-day command injection vulnerability, CVE-2025-59689, in its Email Security Gateway via specially crafted compressed email attachments. The flaw affected ESG versions 4.5 through 5.5 and allowed arbitrary shell command execution under a non-privileged account. Libraesva released fixes across its 5.x branches, ran automated scans for indicators of compromise on all appliances, and said telemetry confirmed no other installations showed signs of compromise. (Help Net Security)

Fortra Patches Critical GoAnywhere MFT Deserialization Flaw

Help Net Security reported on September 22, 2025 that Fortra disclosed a critical deserialization vulnerability, CVE-2025-10035, in the License servlet of its GoAnywhere managed file transfer solution. The flaw carried a maximum severity CVSS score and could be exploited remotely without authentication to achieve command injection, though exploitation required access to the administrative console. Fortra urged customers to upgrade to version 7.8.4 or Sustain Release 7.6.3 and to ensure the admin console was not exposed to the public internet. (Help Net Security)