Week of September 29, 2025: CISA KEV additions and a claimed Red Hat GitLab breach

Security leaders tracked a run of disclosures and defensive moves during the week of September 29, 2025, including claims that the Crimson Collective group had exfiltrated data from Red Hat's consulting GitLab instance, a Cl0p-linked extortion email campaign aimed at Oracle E-Business Suite customers, and CISA's addition of ten actively exploited vulnerabilities to its KEV catalog. CISA also published joint OT architecture guidance with the UK's NCSC and shifted its funding model for state, local, tribal and territorial cybersecurity support as its MS-ISAC cooperative agreement ended.

CISA Adds Five Vulnerabilities to KEV Catalog

CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog on September 29, 2025, citing evidence of active exploitation. The additions included CVE-2021-21311 in Adminer, CVE-2025-20352 affecting Cisco IOS and IOS XE Software, CVE-2025-10035 in Fortra GoAnywhere MFT, CVE-2025-59689 in the Libraesva Email Security Gateway, and CVE-2025-32463 in Sudo. Under Binding Operational Directive 22-01, federal civilian agencies must remediate these flaws by the dates CISA sets, and the agency urged all organizations to prioritize the same fixes in their vulnerability management programs. (CISA)

CISA Adds Five More Vulnerabilities to KEV Catalog

CISA added five more vulnerabilities to its Known Exploited Vulnerabilities catalog on October 2, 2025, again citing evidence of active exploitation. The list included CVE-2014-6278 in GNU Bash, CVE-2015-7755 in Juniper ScreenOS, CVE-2017-1000353 in Jenkins, CVE-2025-4008 in Smartbedded Meteobridge, and CVE-2025-21043 affecting Samsung mobile devices. Several of the flaws dated back roughly a decade, underscoring that older unpatched systems remained active targets. Federal civilian agencies were required to remediate the vulnerabilities under Binding Operational Directive 22-01, and CISA again encouraged broader adoption of the same remediation priorities. (CISA)

CISA and UK NCSC Release Joint OT Architecture Guidance

CISA, working with the FBI, the UK's National Cyber Security Centre, and other international partners, published joint guidance on September 29, 2025, on creating and maintaining a definitive view of operational technology architecture. The document built on earlier OT asset inventory guidance and explained how organizations could use asset inventories and manufacturer-provided software bills of materials to track their OT systems. It recommended closer coordination between OT and IT teams and alignment with standards such as IEC 62443 and ISO/IEC 27001 to support risk assessments and prioritize exposed systems. (CISA)

CISA Shifts to Direct SLTT Support as MS-ISAC Funding Ends

CISA announced on September 29, 2025, that it had moved to a new model for supporting state, local, tribal, and territorial governments as its cooperative agreement with the Center for Internet Security reached its planned end on September 30, 2025. The agency said it would instead offer SLTT partners grant funding through DHS and FEMA programs, no-cost tools such as Cyber Hygiene scanning, Regional Cybersecurity Advisors, and bi-monthly SOC calls. CISA said it would continue collaborating with MS-ISAC on information sharing, while partners using Albert sensors were told to keep coordinating directly with CIS. (CISA)

Akira Ransomware Hit SonicWall VPN Victims in Under Four Hours

Arctic Wolf researchers reported on September 29, 2025, that Akira ransomware affiliates were moving from initial access to full encryption in under four hours after logging into victim networks through SonicWall SSL VPN accounts. The attackers used credentials harvested in earlier intrusions tied to CVE-2024-40766, then used Impacket, RDP, and compromised domain accounts to reach backups and domain controllers before disabling security tools and exfiltrating data via rclone or FileZilla. Victims spanned multiple industries and sizes, pointing to opportunistic rather than targeted selection. (Help Net Security)

Crimson Collective Claims Breach of Red Hat Consulting GitLab

A group calling itself Crimson Collective claimed on October 2, 2025, that it had exfiltrated data from more than 28,000 internal repositories tied to Red Hat's consulting business, including customer engagement reports naming large banks, telecoms, and government bodies. Red Hat said it detected unauthorized access to a self-managed GitLab Community Edition instance used for consulting engagement data, promptly isolated it, and contacted authorities. The company said its investigation was ongoing and that the instance held project specifications, example code, internal communications, and limited business contact information. (Help Net Security)

Tens of Thousands of Cisco ASA Devices Remained Unpatched

Shadowserver Foundation scanning cited in an October 1, 2025, report found roughly 48,000 internet-facing Cisco ASA and FTD appliances remained vulnerable to zero-day flaws CVE-2025-20333 and CVE-2025-20362, months after Cisco and government agencies first warned of active exploitation. Most of the exposed devices sat in the United States, with others in the United Kingdom, Japan, Russia, Germany, and Canada. Cisco had tied the attack techniques to the same suspected state-sponsored actor behind the earlier ArcaneDoor campaign and urged customers to upgrade and reset credentials, certificates, and keys. (Help Net Security)