JLR Cyberattack Financial Impact Estimated at $2.5B; F5 Breach Highlights Need for Federal CDM Visibility; Maryland Establishes Bug Bounty Program

The cyberattack and subsequent shutdown experienced by Jaguar Land Rover (JLR) in late August 2025 may be the "most economically damaging cyber event to hit the UK," with an estimated financial impact of £1.9 billion (about US$2.5 billion), according to the Cyber Monitoring Centre (CMC), a UK non-profit that monitors, categorizes, and reports on cyber events. The CMC rates the JLR incident as "a Category 3 systemic event on the five-point Cyber Monitoring Centre scale," an analysis ideally conducted within 30 days by a technical committee, based on the total financial losses and number of UK organizations that experienced a financial impact of at least £1,000 (US$1,332.40). In late September the UK government guaranteed a £1.5 billion (about US$2 billion) commercial bank loan to support the vulnerable JLR supply chain during shutdown. On October 7, JLR announced the gradual restoration of manufacturing operations in a phased restart.

Following F5’s breach disclosure, officials at the Cybersecurity and Infrastructure Security Agency (CISA) said they faced difficulties tracking instances of F5 throughout civilian branch of the government. CISA issued an emergency directive regarding the F5 vulnerability, instructing agencies to identify and patch all F5 instances, after the disclosure that a nation-state had had persistent access to F5 systems. The directive also instructed the agencies to help CISA identify F5 instances on federal systems. CISA's Continuous Diagnostics and Mitigation (CDM) program, on which the government has spent billions of dollars, was intended to make this type of process simpler. One of the program's four main goals is "increasing visibility into the federal cybersecurity posture." CyberScoop communicated with several experts who spoke to various reasons that current CDM practices lack visibility into F5 instances and other network edge devices. Matt Hartman, former deputy executive assistant director for cybersecurity at CISA, told CyberScoop, "Today, CDM excels on traditional IT assets, like servers and workstations, but is not fully optimized for specialized systems like OT and IoT, or cloud-native resources and containerized workloads that change dynamically. The positive news is that CISA fully acknowledges these gaps and they are on the CDM deployment roadmap." Last year, CMD program manager Matt House spoke to Federal News Network about the program's efforts to expand its purview to the cloud: “We can tackle the infrastructure-as-a-service piece fairly directly as a logical, if not concrete extension of what we’re doing for traditional assets. But we’re largely blind right now if we try to take the tools that we have in place today and apply them to platform as a service and software as a service. It just doesn’t work. It’s not applicable, so we are somewhat blind there.” CISA also offers Cyber Hygiene (CyHy) services which may be of some help in identifying devices that are frequently missed.

Maryland State CISO James Saunders has announced that Maryland's "Office of Security Management has launched a Statewide Vulnerability Disclosure Policy (VDP) covering every unit of government in Maryland." The program, which is being run with support from Bugcrowd, "will provide a secure and legal channel for security researchers to report potential vulnerabilities in State systems." The VDP covers "systems and services that are publicly accessible and either ... use state-managed domain names like *.maryland.gov, *.md.gov, or *.state.md.us; or are connected to the state’s secure government network, networkMarylandTM." While not unheard of, few non-federal government organizations run VDPs; California and New York City have VDPs, and Ohio's Secretary of State operates a VDP for that state’s election-related websites. In a separate, related story, Saunders has issued a "directive requir[ing] all entities of the State of Maryland to become members of the Maryland Information Sharing and Analysis Center (MD-ISAC)."

Researchers at Sansec have observed threat actors actively exploiting a known vulnerability in Adobe Commerce and Magento Open Source, CVE-2025-54236, known as SessionReaper. Adobe released updates for the improper input validation vulnerability on September 9, 2025. Sansec says they recently "blocked over 250 SessionReaper exploitation attempts in the wild," and estimates that 62 percent of Magento stores are still vulnerable. Earlier this week, Assetnote/Searchlight Cyber researcher Tomais Williamson published analysis of the vulnerability and the patch Adobe released for it, determining that while Adobe has labeled the issue a “security feature bypass,” Searchlight Cyber "believe[s] that this is a critical vulnerability. In instances that use file-based session storage, remote code execution can be easily achieved by an unauthenticated user." According to the US National Institute of Standards and Technology's (NIST's) National Vulnerability Database (NVD) description, the vulnerability could be exploited "to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction."

On Wednesday, October 22, the Internet Systems Consortium (ISC) released updates to the Berkeley Internet Name Domain (BIND) DNS resolver to address three vulnerabilities. Two of the vulnerabilities, CVE-2025-40778 and CVE-2025-40780, could be exploited to poison cache results and redirect users to malicious sites. CVE-2025-40778 allows cache poisoning attacks via unsolicited resource records (RRs); ISC notes that "under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache." CVE-2025-40780 is a weak Pseudo Random Number Generator (PRNG) issue that could make it "possible for an attacker to predict the source port and query ID that BIND will use." A third vulnerability, CVE-2025-8677, is described as "resource exhaustion via malformed DNSKEY handling ... [that] could overwhelm the server, significantly impacting performance and leading to denial of service for legitimate clients." All three of the flaws are high severity. Users are advised to updated versions of BIND as soon as possible.

Researchers at Check Point have published their analysis of the YouTube Ghost Network, a malware distribution scheme on YouTube that has posted more than 3,000 maliciously crafted videos purporting to offer pirated software or game cheats, but instead delivering infostealers, most frequently Lumma (which was disrupted earlier this year) or Rhadamanthys. Check Point defines a Ghost Network "as a collection of fake or ‘ghost’ accounts operating as a service, manipulating platform engagement mechanisms to disguise malicious activities as benign and enable large-scale malware distribution." Users often told to disable Windows Defender before downloading the sought-after content/software, and then to download a file from Dropbox, Google Drive, or MediaFire. Google has taken down most of the offending YouTube videos.

On Wednesday, October 22, the US Cybersecurity and Infrastructure Security Agency (CISA) added an improper verification of source of a communication channel vulnerability in Motex LANSCOPE Endpoint Manager (CVE-2025-61932) to the Known Exploited Vulnerabilities (KEV) catalog. The critical (CVSS 9.3) flaw could be exploited to execute arbitrary code. In an advisory, Motex writes that the "vulnerability exists in the client program (MR) and detection agent (DA) of the on-premise version of (Lanscope) Endpoint Manager," and acknowledges that exploitation attempts have been detected. Motex has patched the vulnerability in Lanscope Endpoint Manager On-Premise versions 9.4.7.3, 9.4.6.3, 9.4.5.4, 9.4.4.6, 9.4.3.8, 9.4.2.6, 9.4.1.5, 9.4.0.5, 9.3.3.9, and 9.3.2.7. Users are urged to update as soon as possible. Japan's CERT has published a related news flash that includes a list of IP addresses for the source of communication to the backdoor and the unauthorized communication destination.

TP-Link has released firmware updates to address four vulnerabilities in TP-Link Omada Gateways. The two advisories each describe a pair of vulnerabilities that could be exploited to achieve command injection. One of the advisories concerns CVE-2025-6541 and CVE-2025-6542, vulnerabilities that together allow "An arbitrary OS command [to] be executed on Omada gateways by the user who can log in to the web management interface or by a remote unauthenticated attacker." The second advisory concerns CVE-2025-7850, "a command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways," and CVE-2025-7851, an issue that could allow "an attacker [to] obtain the root shell on the underlying with the restricted conditions on Omada gateways." The flaws affect various ER, G, and FR models of Omada Gateways.

Public services in three US states suffered cyberattacks from late September to mid-October, 2025. Indiana's DeKalb County published a press release notifying residents of a cyberattack discovered on September 25, which disrupted county workstation logins. The county's "Emergency Management, Information Technology, ... County Commissioners, Attorney, and Auditor" informed law enforcement and cybersecurity officials, and collaborated with third-party contractors to restore computer systems and phone lines. 911 service remained operational. La Vergne, Tennessee announced on October 17 that the city took systems offline following a "network incident," engaging third-party cybersecurity experts and collaborating with law enforcement as well as the FBI and Tennessee Bureau of Investigation (TBI) to investigate. An update on October 21 announced that certain La Vergne public services would resume via "temporary paper-based procedures" while recovery is ongoing: no water billing late fees or shutoffs will occur while computer systems are down, and the city will accept only checks or money orders for water bills and property taxes; municipal court hearings have also been postponed. Kaufman County in Texas experienced a security incident on October 20, which infected some courthouse computers and prevented some employees from accessing files. A local news outlet alleges the attack appears to be ransomware. The county "notified appropriate agencies" and worked with cybersecurity experts and law enforcement to investigate. The Kaufman Sherriff's Department and emergency services, including 911 dispatch, have not been impacted.

The US Department of Justice (DoJ) has filed charges against a former Trenchant executive for allegedly stealing trade secrets and selling them "to a buyer based in the Russian Federation (Russia)." Peter Williams, an Australian national residing in the US, is the former "general manager of Trenchant, a specialized cybersecurity division within L3Harris, which provides hacking and surveillance tools to Western intelligence agencies." Federal prosecutors are seeking the forfeiture of Williams's home, luxury goods, and financial accounts.