Weekend Cybersecurity Recap - This Week's Most Pressing Cybersecurity Stories & News
Get the short version of a week's worth of shows. The latest cybersecurity news and risks
CyberHub Weekend Roundup: Focus on the Top Stories
Farewell to a Cybersecurity Leader
The community mourns the unexpected loss of Shawn Bowen, a long-serving CISO at Microsoft who exemplified professionalism, mentorship, and leadership. Shawn’s influence went beyond Microsoft, as he frequently shared insights at industry events and generously offered guidance to other security leaders. Our thoughts remain with his family and colleagues.
Tata Technologies Ransomware Attack
The Incident
Tata Technologies, a global IT subsidiary of Tata Motors, faced a ransomware attack that forced it to shut down certain internal IT systems. While the company quickly contained the breach and restored critical operations, security experts worry that attackers might have accessed proprietary or client data.
Why It Matters
Tata Technologies spans 18 countries, meaning even a brief outage can ripple across a vast supply chain. This underscores a growing trend: cybercriminals increasingly target large service providers to disrupt numerous enterprises simultaneously.
DeepSeek AI Bans Widen
State & Federal Restrictions
Texas became the first state to ban DeepSeek AI on government devices, citing concerns over data harvesting by a Chinese-owned company. Soon after, federal agencies, including NASA and the Pentagon, followed suit. Evidence suggests DeepSeek may transmit user data to servers linked to Chinese state-owned telecoms.
Why It Matters
As AI tools become more popular, governments worldwide are scrutinizing privacy and national security risks. DeepSeek’s sudden bans mirror earlier action taken against TikTok, illustrating an emerging trend to proactively block apps suspected of funneling personal data to foreign actors.
Poland’s Pegasus Spyware Scandal
High-Level Arrests
Polish authorities arrested their former Justice Minister and the ex-head of the internal security agency for allegedly sanctioning Pegasus spyware use against journalists and opposition figures. Reports suggest up to 600 people were under illicit surveillance from 2017 to 2022.
Broader Implications
This marks one of the few times a government has actively pursued top officials for digital spying abuses. Human rights groups view it as a potential turning point, signaling stricter accountability for political misuse of surveillance technology.
Political Email Compromises & UK Legacy IT Woes
Starmer’s Email Hack
Sir Keir Starmer, the UK’s Leader of the Opposition, had his personal email compromised, reportedly by Russia-linked actors. No public data leak emerged, but the National Cyber Security Centre stressed immediate adoption of multi-factor authentication.
Legacy Infrastructure Concerns
Separately, the UK’s National Audit Office warns that outdated government systems may not meet 2025 modernization deadlines. Legacy IT leaves critical services vulnerable, highlighting an urgent need for infrastructure overhauls.
E-Commerce Under Fire: Casio UK & Beyond
Skimmer Attacks
Casio UK (unrelated to Kaseya) and over a dozen other online retailers were hit by web skimmers. Poorly configured content security policies allowed malicious scripts to capture payment info at checkout.
Key Takeaway
Basic security hygiene—like correctly enforcing Content Security Policies (CSP)—remains one of the strongest defenses against evolving skimmer attacks.
Ransomware Dip & Okta Layoffs (Quick Hits)
Ransomware Payments: After a spike in early 2024, global ransomware payouts fell by roughly 35%, from $1.25B to $812M. Experts say this could be a short-lived reprieve.
Okta Layoffs: Identity security giant Okta announced its third round of February layoffs (3% of its workforce), citing a strategic realignment amid market pressures.
One-Line Vulnerabilities & Patches to Watch
Veeam: CVE-2025-0020 in Backup & Replication software enables remote code execution—patch now.
7-Zip: CVE-2025-0411 exploited by Russian actors to bypass Windows security—update to 24.09 or newer.
PyPI: Malicious packages (“deepeeeek,” “deepseekAI”) impersonating AI libraries—remove and scan for compromise.
Android: Critical kernel flaws patched; push OS updates immediately to prevent privilege escalation.
Microsoft Azure AI Face Service: Two critical vulns allowing privilege escalation; apply security fixes promptly.
Cisco ISE: CVE-2025-20124 and CVE-2025-20125 risk remote code execution—patch without delay.
Chrome & Firefox: New releases address multiple zero-days; update browsers for safe browsing.
Final Thoughts
Cyber threats remain a constant balancing act— large-scale data breaches keep hitting major providers like Tata Technologies, while governments race to address new risks posed by AI tools like DeepSeek. Meanwhile, ransomware trends are temporarily dipping, yet experts warn adversaries are likely regrouping. Patching critical vulnerabilities and reinforcing basic cyber hygiene—like multi-factor authentication and rigorous content security policies—remains the best way to stay secure in this ever-evolving landscape.
Stay vigilant, stay patched, and remember the community spirit embodied by Shawn Bowen—collaboration and mentorship are our strongest defenses.