iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
SecurityWeek’s July 18, 2025, roundup covered four different security stories: suspected Chinese state-linked access to a law firm’s Microsoft 365 email, a critical flaw in Symantec Altiris IRM, a Meta AI privacy bug, and an attempted authentication attack that did not bypass FIDO or reach its target. Expel later corrected the FIDO story’s initial successful-bypass characterization. These are historical reports, not a current threat bulletin.
What happened in the four stories?
| Story | What kind of issue? | Reported outcome |
|---|---|---|
| Wiley Rein | Email account compromise | Microsoft 365 accounts were reportedly accessed; attribution and motive were suspected. |
| Symantec Endpoint Management | Software vulnerability | A critical Altiris IRM flaw could allow remote code execution under the conditions described by LRQA. |
| Meta AI | Privacy bug | Users could see other users’ prompts and responses; Meta said it fixed the bug and found no evidence of abuse. |
| PoisonSeed and FIDO | Attempted authentication attack | The password factor passed, but subsequent MFA challenges failed and the attacker did not get access to the requested resource. |
Was the law firm hack linked to China?
SecurityWeek reported that Washington, DC-based law firm Wiley Rein told clients that an actor had accessed Microsoft 365 email accounts belonging to attorneys and advisers. The firm serves major companies and government clients. SecurityWeek’s account, attributed to CNN, described the actor as appearing to be Chinese state-sponsored and intelligence gathering as the apparent goal.
Those are reported assessments, not independently established attribution or motive. The report supports describing the incident as a compromise of attorney and adviser email accounts; it does not establish who carried it out or why.
What Symantec Altiris versions are affected?
LRQA’s disclosure identifies CVE-2025-5333 in Altiris Inventory Rule Management (IRM), a component of Broadcom’s Symantec Endpoint Management Suite. It lists affected versions as 8.6.x, 8.7.x, and 8.8, and rates the vulnerability Critical with a CVSS v4.0 score of 9.5. This is not a report about a consumer Symantec antivirus product.
Why the vulnerability matters
LRQA describes unauthenticated remote code execution through a reachable legacy .NET Remoting endpoint on port 4011. The cause is unsafe object deserialization. LRQA says it discovered the flaw during a red-team assessment, reported it to Broadcom in May 2025, received vendor confirmation that month, and saw it assigned a CVE in June before public disclosure in July.
#1 Best Overall
What administrators should do
LRQA relays Broadcom’s guidance to confirm that port 4011 is closed on the Notification Server. Broadcom documentation does not require that port to be open, and LRQA says the vulnerability is not exploitable when the firewall is enabled and the port is closed. LRQA also describes an optional configuration change. At the time of its disclosure, a future release or patch was planned to limit the service to localhost; the disclosure does not establish that this planned fix has since shipped.
What happened in the Meta AI hack?
TechCrunch reported that a bug allowed logged-in Meta AI users to view prompts and generated responses belonging to other users. Researcher Sandeep Hodkasia found that changing a unique number associated with a prompt could return someone else’s content because the server did not properly check authorization.
Meta deployed a fix on January 24, 2025. The company said it found no evidence that the flaw had been abused. TechCrunch reported that Meta paid Hodkasia a $10,000 bug bounty. The bounty was payment for responsible disclosure; it is not evidence of a successful attack by malicious actors.
Was the FIDO key bypass successful?
No. SecurityWeek’s July 18 roundup summarized an earlier Expel report as an attempt to bypass FIDO keys through a real-time QR-code flow. Expel later corrected its initial successful-authentication claim. Its update, dated July 25, 2025, and last updated October 8, 2025, says the attacker phished the targeted user’s username and password. The password factor passed, but all later MFA challenges failed, and the attacker was never granted access to the requested resource.
Rank #3
“The Okta logs show the password factor passing successfully, but all subsequent MFA challenges failed and the attacker is never granted access to the requested resource.”
Expel says the QR code initiated a FIDO Cross-Device Authentication flow. When properly implemented, that flow requires the device generating the code to be nearby; without local proximity, the request times out and fails. The incident was an attempted attack, not a demonstrated successful FIDO bypass.
Recommended Free Tools
What else did SecurityWeek’s roundup cover?
The roundup also mentioned an Italian police investigation into the Diskstation ransomware group and attacks on Synology NAS devices; ProPublica reporting about Chinese engineers helping maintain US Department of Defense systems under cleared “digital escorts”; the Co-op cyberattack; HP Wolf Security’s printer-security survey; a planned House Homeland Security subcommittee hearing concerning Stuxnet and operational technology; and suspected China-linked attacks on Taiwan’s semiconductor industry.
SecurityWeek reported that data on 6.5 million Co-op members had been stolen, including names, addresses, and contact details. It also relayed figures from an HP Wolf Security survey of 800 IT and security decision-makers: 36% of IT teams reportedly patched printer firmware; procurement, IT, and security teams worked together to define printer-security standards in 38% of cases; and IT and security teams were not involved in printer-vendor presentations in more than 40% of cases. More than half of respondents said they could not confirm that a printer had not been tampered with in the supply chain after arrival. These are figures as reported by SecurityWeek from HP Wolf Security, not independently validated findings here.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
