Host Rich Stroffolino will be chatting with our guest, Derek Fisher, Director of the Cyber Defense and Information Assurance Program, Temple University about some of the biggest stories in cybersecurity this past week. You are invited to watch and participate in the live discussion.

We go to air at 12:30pm PT/3:30pm ET. Just go to YouTube Live here https://youtube.com/live/Zb2Oe9WaAKY or you can subscribe to the Cyber Security Headlines podcast and get it into your feed.

Here are the stories we plan to cover:

Unpatched flaw in LG surveillance cameras allows admin access CISA is warning of an unpatched authentication bypass vulnerability in a specific model of security camera – the type often mounted on ceilings in commercial buildings. The model number (LG LNV5110R) and CVE number (CVE-2025-7742) are listed in this episode’s show notes. Approximately 1,300 cameras are active and vulnerable to full unauthenticated RCE, allowing remote takeover and network pivoting. As CISA points out, this is a critical infrastructure threat, which is not just simply a risk to isolated devices, but potentially endangers facilities that are vital to public safety and national operations. “The manufacturer, LG Innotek is aware of the vulnerability, but it will not patch it because this particular camera model is an end-of-life product. (Security Affairs)

Microsoft cannot guarantee data sovereignty Speaking under oath in the French Senate, executives from Microsoft France said their company cannot guarantee data sovereignty to customers in France, and by extension to the wider European Union – due to the Cloud Act, a law that “gives the U.S. government authority to obtain digital data held by U.S.-based tech corporations irrespective of whether that data is stored on servers at home or on foreign soil. It is said to compel these companies, via warrant or subpoena, to accept the request.” The issue of access to data, and the enforceability of provisions of the Cloud ACT will require a great deal of litigation, especially considering, as AWS – who supported the bill, along with Microsoft and Google – stated, is that “the Cloud Act does not only apply to U.S. headquartered companies, it is applicable to all “electronic communication service or remote computing service providers” that do business stateside. (The Register)

French submarine secrets surface after cyber attack Hackers calling themselves Neferpitou have leaked 13 gigabytes of internal documents belonging to French submarine manufacturer Naval Group, everything from combat system source code and simulation software to weapons configurations and internal communications. They claim to have up to a terabyte of stolen data, and the leaked materials appear both legitimate and highly sensitive. Naval Group says it has found no evidence of a breach in its internal systems, no confirmed intrusion, no operational disruption. But somehow, its proprietary data is now circulating online. French authorities and cybersecurity experts are investigating, though the company is currently treating the event as a reputational attack rather than a verified compromise. Neferpitou hasn’t explained how they got the data, offered no ransom demand, and issued only a cryptic 72-hour ultimatum followed by the message: “ENJOY AND SEE YOU NEXT TIME.” The data is real, but the path it took to get out is still a mystery. (Bitdefender)

FBI, CISA warn about Scattered Spider’s evolving tactics The FBI and CISA issued an updated advisory warning that Scattered Spider remains a serious threat, using sophisticated social engineering and intrusion tactics including phishing, MFA fatigue, SIM-swapping, and ransomware like Dragonforce to breach systems, including encrypting VMWare ESXi servers. Despite recent arrests tied to the gang, U.S., U.K., Canadian, and Australian authorities emphasized that Scattered Spider’s evolving techniques continue to pose a big risk to national security and critical infrastructure. (Cybersecurity Dive) (CISA.gov)

Supply Chain Attacks Spotted in GitHub Actions, Gravity Forms, npm Researchers at Armis Labs uncovered major software supply chain attacks in GitHub Actions, the UAParser.js npm package, and the Gravity Forms WordPress plugin, all involving backdoors or poisoned code that jeopardized thousands of systems. These incidents remind us how trusted developer tools can be compromised, and how AI-driven coding practices are being exploited. Experts warn that attackers can now backdoor vast numbers of software projects in days, making early detection and code integrity checks more critical than ever. (Dark Reading)

ATM network breached and attacked through 4G Raspberry Pi This activity is being attributed to a financially motivated threat actor known as UNC2891. According to security firm Group-IB, this attack did require physical access in order to install the Raspberry Pi device and then connect it to the same network switch as the ATM, thus effectively joining the network. It is “currently not known how this access was obtained.” The scheme used a kernel module rootkit dubbed CAKETAP, which was “designed to hide network connections, processes, and files, as well as intercept and spoof card and PIN verification messages from hardware security modules (HSMs) to enable financial fraud.” Although the specific network, country or victim organization is not identified in the media or in the report from Group IB, the emphasis is on the physical penetration of the network which used “Linux bind mounts to hide backdoor processes from conventional detection tools.” As a consequence, “standard forensic triage failed to reveal the backdoor because the attacker leveraged a technique that had not been documented in public threat reports at the time.” (The Hacker News and Group IB report)

Kremlin monitors foreign embassies in Moscow at ISP level According to researchers at Microsoft, the Russian government is “monitoring foreign embassies in Moscow by installing malware through its control of local internet service providers (ISPs).” This campaign, which has been in operation since last year, is known by Microsoft as Secret Blizzard, but this is the first time it has been able to confirm that Secret Blizzard, also tracked as Turla, has the capability to conduct espionage activities at the ISP level. “In a blog post on Thursday, Microsoft said it first saw the spies using an adversary-in-the-middle (AiTM) technique to deploy the ApolloShadow malware against foreign embassies in February 2025 — allowing them to collect intelligence from diplomatic entities and maintain access to systems.” (The Record)

LG LNB, LND, LNU, and LNV smart network camera devices have broken access control. Attackers are able to download /updownload/t.report (aka Log & Report) files and download backup files (via download.php) without authenticating. These backup files contain user credentials and configuration information for the camera device. An attacker is able to discover the backup filename via reading the system logs or report data, or just by brute-forcing the backup filename pattern. It may be possible to authenticate to the admin account with the admin password.