September Roundup of Trending News in Cybersecurity

Read more cybersecurity news in this edition of NetSec News.

• 

  Jessica Owens

  MSSP Training & Development Coordinator, T2 SOC Analyst

Widespread supply chain compromise impacting NPM ecosystem

CISA is releasing this Alert to provide guidance in response to a widespread software supply chain compromise involving the world’s largest JavaScript registry, npmjs.com. A self-replicating worm—publicly known as “Shai-Hulud”—has compromised over 500 packages. (CISA)

“The recent CISA alert highlights a widespread supply chain compromise affecting the npm ecosystem. Attackers are using a self-replicating worm to steal developer credentials and distribute malicious packages. Given GitHub’s large community of over 150 million developers and more than 420 million repositories, this ecosystem is a significant target for threat actors. It is important for organizations to secure their software supply chains by rotating credentials, implementing phishing-resistant MFA, auditing dependencies, and tightening GitHub configurations.” –Andrea Spriet, MSSP Tier 2 SOC Analyst at C3 Integrated Solutions

Chinese hackers lurked nearly 400 days in networks with stealthy Brickstorm malware

Researchers in Google’s Threat Intelligence Group and Mandiant unit have analyzed a recent Chinese cyberespionage campaign where the hackers have managed to dwell in compromised networks for hundreds of days to obtain valuable information. (SecurityWeek)

AI vs. AI: Detecting an AI-obfuscated phishing campaign

Microsoft Threat Intelligence recently detected and blocked a credential phishing campaign that likely used AI-generated code to obfuscate its payload and evade traditional defenses. Appearing to be aided by a large language model (LLM), the activity obfuscated its behavior within an SVG file, leveraging business terminology and a synthetic structure to disguise its malicious intent. In analyzing the malicious file, Microsoft Security Copilot assessed that the code was “not something a human would typically write from scratch due to its complexity, verbosity, and lack of practical utility.” (Microsoft)

Cisco patches zero-day flaw affecting routers and switches

Cisco on announced patches for 14 vulnerabilities in IOS and IOS XE, including a bug that has been exploited in the wild. (SecurityWeek)

An American cybersecurity company releases critical patch for CVSS 10.0 GoAnywhere MFT vulnerability

An American cybersecurity company has disclosed details of a critical security flaw in GoAnywhere Managed File Transfer (MFT) software that could result in the execution of arbitrary commands. The vulnerability, tracked as CVE-2025-10035, carries a CVSS score of 10.0, indicating maximum severity. (The Hacker News)