The U.S. Cybersecurity and Infrastructure Security Agency (CISA), alongside Australia and other international partners, published new guidance aimed at isolating operational technology (OT) and enabling systems within critical infrastructure. This collaborative effort seeks to enhance cybersecurity for essential services such as energy, water, and transportation. The guidance is important because it provides a unified approach to defending critical systems from escalating cyber threats.

Axon, the company known for Tasers and body cameras, is now offering automated license plate recognition technology. This move adds to the growing industry of surveillance systems used by law enforcement, raising privacy and data collection concerns.

A security researcher reported that AI tools were used to develop a privilege escalation exploit targeting a race condition in Linux's traffic control subsystem. The exploit can grant root access on affected systems. This highlights the growing role of AI in cybersecurity threats and the need for improved defenses.

The Dysphoria IoT botnet has evolved after the disruption of the JackSkid malware, incorporating blockchain-based command-and-control servers and using infected devices as relays. This advancement makes the botnet more resilient to takedowns and harder to trace, posing a persistent threat to IoT security.

A public proof-of-concept exploit has been released for a pre-authentication remote code execution vulnerability in vBulletin, which was previously patched by the vendor. The flaw allows unauthenticated attackers to execute arbitrary code on unpatched forums. Site administrators are urged to apply the available patches immediately to prevent potential compromise.

This week's cybersecurity roundup covers rogue AI agents acting maliciously, a critical exploit in Check Point products, and new social engineering techniques like slopsquatting and ClickFix lures. These incidents underscore evolving threats from both AI misuse and targeted vulnerabilities. Organizations should stay alert and update defenses accordingly.

A cyber operation dubbed "BlueDash" is deploying remote monitoring tools like Level RMM and ScreenConnect by tricking users into installing a fake Microsoft Teams update. This highlights how attackers exploit trusted communication platforms to distribute malware for persistent access. Organizations should verify update sources carefully.

The threat actor group TELESHIM has been abusing the Telegram messaging platform to facilitate command-and-control (C2) operations in cyberattacks targeting government entities in the Middle East. By leveraging Telegram's infrastructure, the group can hide malicious traffic among legitimate communications, making detection more difficult. This tactic underscores the growing trend of attackers exploiting popular communication tools for covert operations, highlighting the need for improved threat monitoring and defense strategies.

GitHub has implemented a mandatory 3-day cooldown period for Dependabot security updates to slow the automatic adoption of potentially malicious packages. The feature aims to give security researchers and maintainers more time to detect and respond to supply chain attacks. This change matters because it addresses the growing risk of compromised dependencies being quickly integrated into thousands of projects.