weekly

[SIGNALS WEEKLY] Expanding State Cyber Powers Amid Exploitable Gaps

Exposed management planes are becoming the shortest path from ordinary web access to operational impact. Ray CVE-2025-62593 is now in CISA’s KEV, while new Haiwell and Metasys flaws put AI compute and OT interfaces on the same uncomfortable list.

Wes

Wes

— 4 min read
Share
[SIGNALS WEEKLY] Expanding State Cyber Powers Amid Exploitable Gaps
The front gate passed its audit. The side doors appreciated the privacy.

TL;DR

  • [Policy/Geopolitics] US and German governments are formalizing expanded offensive and intrusive cyber authorities (US public–private “disrupt and dismantle” operations; German intelligence hacking/sabotage), increasing cross-border operational tempo and potential for retaliatory activity against gov-adjacent infrastructure and vendors.
  • [Vulnerabilities/OT & AI] Active exploitation of Ray (CVE-2025-62593) and newly disclosed ICS web-layer flaws in Haiwell IoT Cloud HMI Gateway and Johnson Controls Metasys highlight exposed admin/management planes (AI/compute and OT) as high-value, low-friction entry points for code execution and process manipulation.
  • [Detection/Exposure] Recent incidents (e.g., French Finance Ministry) underscore that weak logging/retention and limited visibility around bulk access/exfiltration—especially for high-value citizen/financial data—are amplifying downstream fraud and regulatory risk, even when initial access is contained quickly.

Current Stories

TL;DR

  • [Policy/Geopolitics] The US issued a memo establishing a DOJ/DHS-led program to authorize vetted private companies to conduct government-directed cyber surveillance/effects operations against foreign cyber-enabled transnational criminal organizations.
  • [Policy/Geopolitics] Germany advanced reforms to expand intelligence services’ hacking/sabotage authorities (including compelled assistance from telecom/digital providers), increasing the likelihood of cross-border cyber friction and retaliation dynamics.
  • [Vulnerabilities/Exploitation] CISA added CVE-2025-62593 (Ray-Project Ray code injection) to KEV, citing active exploitation—prioritize patching/mitigation where Ray services are reachable from untrusted networks.
  • [OT/ICS] New ICS advisories highlight high-impact web-layer risks in widely deployed building/industrial products: Haiwell IoT Cloud HMI Gateway command injection (root) and Johnson Controls Metasys persistent XSS.
  • [AI Security] New guidance describes an “agentic” source-code review pipeline used to accelerate vulnerability discovery/validation at scale—reinforcing the shift toward AI-assisted vuln discovery (and faster attacker exploitation cycles).

References

Emerging Stories

TL;DR

  • [Breach/Exposure] France’s Finance Ministry acknowledged a cyberattack/data leak impacting the tax authority’s ecosystem; reporting indicates access was cut in late June but exfiltration was not detected at the time, consistent with delayed discovery/visibility gaps that can amplify downstream fraud risk.

References

Forecasts, Detection Opportunities and References...

Forecasts

TL;DR

  • Short-term: Expect continued “time-to-detection” gaps to be a primary impact multiplier (even when access is cut quickly), especially in identity- and tax-adjacent ecosystems.
  • Long-term: Expanded “disrupt-and-dismantle” cyber authorities (US and EU partners) will increase operational tempo and friction, raising the likelihood of retaliatory cyber activity and misattribution.
  • Overlooked: AI-accelerated code review compresses vuln-to-exploit timelines; weak inventory/SBOM hygiene and weak telemetry coverage will expand the “known vulnerable, unseen exploited” window.

Read more