Threatsday Bulletin: Rootkit Patch, Federal Breach, OnePlus SMS Leak, TikTok Scandal & More

Threatsday Bulletin rounds up a busy week of cybersecurity twists, led by SonicWall’s SMA 100 firmware update designed to remove rootkit malware after a report that UNC6148 deployed OVERSTEP on end-of-life SMA 100 devices. It also flags a text-message privacy flaw in OnePlus OxygenOS (CVE-2025-10184, CVSS 8.2) that could let any app read SMS/MMS data from the Telephony provider, still unpatched as of writing. The U.S.

Cybersecurity and Infrastructure Security Agency disclosed that threat actors exploited CVE-2024-36401 in GeoServer to breach a US federal civilian agency in July 2024, with later access and use of web shells and living-off-the-land techniques. The bulletin notes high-profile arrests linked to Scattered Spider, including Noah Urban, who pled guilty earlier this year and was sentenced to ten years in prison, as investigators described a multimillion-dollar hacking spree.

It also highlights a GoAnywhere MFT patch from Fortra for a CVSS 10.0 vulnerability, and a Canadian privacy probe into TikTok for collecting data from hundreds of thousands of under-13s, with assurances to tighten age verification and stop targeted advertising to under 18s. Finally, INTERPOL said a global operation recovered USD 439 million across 40 countries, including asset seizures and account closures, underscoring the scale of transnational cybercrime fighting.