SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape.
This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving cybersecurity environment.
Here are this week’s highlights:
ICS-Sniper attack picks off critical OT traffic
University of British Columbia researchers have detailed ICS-Sniper, a proof-of-concept attack aimed at industrial facilities that rely on cloud-hosted SCADA systems. An attacker who controls a router on the network path could study the size, direction and timing of VPN-encrypted packets to predict when critical commands or data will be exchanged, then drop payload-carrying packets during those windows. In tests on emulated versions of the SWaT water treatment testbed, the attack delayed the start of clean water pumping by about 15 minutes and, in a separate test, kept a valve open more than nine minutes longer than intended.
Intel pulls SGX from Xeon roadmap after Diamond Rapids
Intel says Diamond Rapids, its next-generation Xeon platform, will be the last to include SGX, as it focuses its confidential computing roadmap on TDX. The company says the industry has moved toward VM isolation technologies like TDX because they’re easier to deploy and scale. Platforms with SGX will keep receiving support and security updates into the early 2030s, giving customers several years to migrate.
XWorm operators’ panels open to takeover
Mootoo, an independent researcher based in Oman, has published a PoC exploit for an unauthenticated RCE flaw in the XWorm RAT’s C2 panel (versions up to 7.4). The researcher found it on October 4 while reverse-engineering an XWorm sample used in an attempt to compromise them. An attacker who has the panel’s address, port and communication key (all of which can be pulled from an XWorm client’s configuration) can pose as an infected machine, overwrite a DLL through path traversal, and get code running on the C2 host without any action from the operator. Mootoo told SecurityWeek they used the flaw to compromise infrastructure tied to the person behind the attack, and that it appears to be exploited on a limited scale.