A concise, fact-based update for security and risk professionals. Core security stories first, followed by broader context.

🔐 Core Security Intelligence

1) Coordinated firewall & VPN exploit attempts target major vendors

What’s new:
GreyNoise reports that attack campaigns targeting Cisco ASA, Palo Alto GlobalProtect, and Fortinet VPNs have been traced to the same subnet infrastructure. The campaigns include scanning, brute forcing, and early-stage probing conducted in parallel.
Source: SecurityWeek

Why it matters:
When multiple vendors are hit from the same infrastructure, it suggests a shared adversary or campaign rather than isolated opportunistic attacks. This increases the risk of zero-days or chained exploits across firewall and VPN stacks.

Defenses:

• Harden VPN and firewall configurations. Enforce strong password policies, disable weak authentication protocols, and limit administrative access by network zones.
• Throttle and monitor login attempts. Use rate limiting, IP blacklists, and anomaly detection to flag surges in login failures.
• Apply vendor patches promptly and isolate externally-exposed appliances. Many firewall or VPN flaws are only exploitable from the network edge — minimize exposure of management APIs and block access from unknown IPs.

Expert Insight:
This campaign is a red flag for firewall and VPN vendors: once the perimeter devices are targeted, the breach surface jumps dramatically. Organizations must treat those appliances as bastions — not just networking gear. Regular patching, strong access control, and anomaly monitoring become mission-critical defenses.

2) Sophisticated malware revealed in Oracle EBS zero-day attacks

What’s new:
Google, working with Mandiant, uncovered malware components in the Oracle EBS exploit campaign. The attackers deployed malicious templates and payloads targeting CVE-2025-61882 and believe attacks may date back to July. Dozens of victims have reportedly suffered data theft.
Source: SecurityWeek

Why it matters:
The attack has matured beyond extortion emails into a fully weaponized exploit chain. The discovery of custom malware and backdoor templates suggests deep access, persistence, and data exfiltration.

Defenses:

• Audit and patch EBS systems immediately. Treat all Oracle EBS instances as compromised until proven otherwise.
• Run template integrity scans and forensic checks. Look for unauthorized templates, suspicious database objects, or modifications to core modules.
• Isolate EBS from general network. Segregate the EBS environment into a hardened zone with limited lateral connectivity and logging/alerting at every access point.

Expert Insight:
The evolution of this campaign from simple extortion to sophisticated malware use shows an escalation in attacker commitment. Defenders must assume privilege and persistence, not just opportunistic compromise. Survivability now depends on rigorous validation, isolation, and rapid detection—not just patching.

🌐 Extended Reading / Broader AI Risk & Governance

3) Google expands AI bug bounty, adds $20,000 rewards

What’s new:
Google announced a revamped AI Vulnerability Reward Program (VRP), with up to $20,000 in payouts for critical issues in its AI products. The update includes clearer scope definitions across flagship, standard, and “other” tiers.
Source: SecurityWeek

Why it matters:
By offering higher incentives and clearer rules, Google encourages proactive security research into AI systems. It sets a benchmark for how enterprise-grade models should be defended openly.

4) Radiflow launches AI-powered OT security platform

What’s new:
Radiflow unveiled Radiflow360, a platform tailored to industrial networks. It combines asset discovery, anomaly detection, and AI-assisted risk scoring under one OT-aware umbrella.
Source: SecurityWeek

Why it matters:
Securing operational technology (OT) is increasingly central as cyber-physical systems converge. AI in OT platforms helps unify disparate control systems against modern threats.

⚠️ Updates / Follow-ups

Oracle EBS campaign continues to expand

What’s new:
New malware components tied to the Oracle attack were confirmed, and the campaign’s scope is broader than previously known.
Source: SecurityWeek
Also covered: SecurityWeek

Why it matters:
Attackers remain active, suggesting that defenses have not yet contained the threat. Organizations using EBS need heightened vigilance and rapid response capabilities.

Defenses:

• Maintain aggressive threat hunting in EBS environments. Look for lateral movement, abnormal queries, or templating anomalies.
• Review access logs and revoke unnecessary privileges. Immediately remove stale or never-used administrative accounts.
• Rotate credentials and monitor data flows. Frequent credential turnover, combined with network egress monitoring, helps limit attacker window.

Expert Insight:
The persistence and aggression of this campaign warn that patching alone is insufficient. The difference now lies in detection, containment, and response. Organizations must act as if attackers are inside — until they prove otherwise.

Summary Table

Categories: Cybersecurity News

Tags: AI Security, Bug Bounty, Infrastructure Attacks, Oracle Exploit, OT Security