NetSec News Articles of Interest From the Week of May 12, 2025

Read more cybersecurity news in this edition of NetSec News.

• 

  Jessica Owens

  MSSP Training & Development Coordinator, T2 SOC Analyst

ASUS Patches DriverHub RCE Flaws Exploitable via HTTP and Crafted .ini Files

ASUS has released updates to address two security flaws impacting ASUS DriverHub that, if successfully exploited, could enable an attacker to leverage the software in order to achieve remote code execution. (The Hacker News)

“Incidents like these highlight the ongoing risks associated with third-party driver management tools and reinforce the need for rigorous integrity checks in software updates. Organizations should treat vendor auto-update features as part of their attack surface, reviewing them for insecure update mechanisms, suspicious network activity, and weak certificate validation. Default trust in OEM utilities remains a blind spot that continues to expose organizations to risk.” –Chase Theodos, Threat Detection Specialist at C3 Integrated Solutions

CrowdStrike To Lay Off 5% of Staff, Reaffirms Forecasts

CrowdStrike, opens new tab reiterated its fiscal 2026 first quarter and annual forecasts on Wednesday and announced a plan to cut about 500 roles, roughly 5% of its workforce, to streamline operations and reduce costs. (Reuters)

Microsoft Ends Authenticator Password Autofill, Moves Users to Edge

Microsoft has announced that it will discontinue the password storage and autofill feature in the Authenticator app starting in July and will complete the deprecation in August 2025. (BleepingComputer)

Raytheon Companies and Nightwing Group to Pay $8.4 Million to Resolve False Claims Act Allegations Relating to Non-Compliance with Cybersecurity Requirements in Federal Contracts

Raytheon Company (Raytheon), RTX Corporation, and Nightwing Group, LLC, and Nightwing Intelligence Solutions, LLC (collectively, Nightwing), have agreed to pay $8.4 million to resolve allegations that Raytheon violated the False Claims Act by failing to comply with cybersecurity requirements in contracts or subcontracts involving the Department of Defense (DoD). (U.S. Department of Justice)

73% of CISOs Admit Security Incidents Due to Unknown or Unmanaged Assets

As IT infrastructures become increasingly complex, so do the attack surfaces. Many companies are doing too little to contain the risks. Only those who know their attack surfaces can defend against them effectively. What seems like a truism, however, appears to be causing problems for many companies. (CSO)

To Protect F-47 Plans From Hackers, Boeing Should Lean on CMMC, Zero Trust: DoD Official

In order to keep the plans for the US Air Force’s highly classified F-47 fighter secure from hackers, prime contractor Boeing will have to rely on the Department of Defense’s cybersecurity measures such as the Cybersecurity Maturity Model Certification (CMMC) and zero trust, Katie Arrington told Breaking Defense. (Breaking Defense)

Lockbit Ransomware Hacked – Leaked Database Exposes Internal Chats

The notorious LockBit ransomware operation has suffered a significant breach. Attackers defaced their dark web infrastructure and leaking a comprehensive database containing sensitive operational details on May 7. (Cyber Security News)