Leading the headlines is a severe zero-day vulnerability, CVE-2025-20393, affecting Cisco AsyncOS Secure Email Gateway (SEG) and Web Manager (SEWM) appliances. Cisco has attributed the exploitation of this flaw to a China-linked threat actor tracked as UAT-9686. The attackers are using this vulnerability to execute arbitrary commands with root privileges, effectively bypassing traditional defenses to plant backdoors and persistence mechanisms deep within corporate and industrial networks. This serves as a critical entry point for lateral movement into more sensitive OT segments.

For Belgians, the advisory page of the Centre for CyberSecurity Belgium (CCB) about this Cisco AsyncOS vulnerabilty is very important. This is part of their advisories offering that is a must-follow for cybersecurity professionals in Belgium, and yes, there is an RSS feed for these advisories. Each advisory contains a description, plus information on the risks, pointers to the specific Cisco advisory, and more on recommended actions like patches and workarounds. Very important are also the Indicators of Compromise (IoCs).

Simultaneously, the cybersecurity community is grappling with "React2Shell" (CVE-2025-55182), a maximum-severity vulnerability (CVSS 10.0) in the React library. While often seen as an IT issue, the prevalence of modern web-based HMIs (Human-Machine Interfaces) and cloud-connected industrial dashboards means this flaw poses a direct risk to OT visibility and control. Multiple espionage groups, including those with ties to China and Iran, have been observed weaponizing this flaw to deploy tunnelers and remote access tools. Read more on the CCB React2Shell Advisory page.

The threat landscape is further complicated by persistent activity from the Russian GRU. New analysis indicates a sustained campaign targeting edge devices (routers and firewalls) specifically within the energy and critical infrastructure sectors. By compromising these perimeter devices, attackers can harvest credentials and replay them to access internal control systems, often bypassing detection by "living off the land" (LOTL) attacks.

Perhaps the most alarming development, however, occurred in the maritime domain. French authorities arrested a crew member aboard a GNV (part of the MSC Group) ferry for attempting to deploy a Remote Access Trojan (RAT) on the ship's navigation and control systems. This incident highlights the growing "insider threat" in OT and the specific vulnerability of the maritime transport sector, which acts as a crucial logistical backbone for global trade. More technical reports on this "attack" like this CSO Online article, mention the use of a Raspberry Pi class device with a cellular modem. As the article concludes: "You might not catch the person planting the device, but you should instantly catch the device when it connects to the internet”. On the other hand, physical security remains crucial, blocking access to computer rooms, USB ports, wired/wireless equipment, and doing background checks for staff with critical system access.

Finally, industrial giants including Siemens, Rockwell Automation, and Schneider Electric have released their monthly security advisories. Notably, Mitsubishi Electric addressed a high-severity OS command injection flaw (CVE-2025-11774) in its ICONICS suite. Operators are urged to prioritize these patches, as reverse-engineering of these fixes by threat actors often begins immediately upon release. More info about these ICS systems vulnerabilities can be found in this article on the always interesting Industrial Cyber website.