This week's cybersecurity roundup covers a range of notable incidents and developments, including CISA mandating fixes for an actively exploited Ray vulnerability, T-Mobile physically cutting a router cable to halt a Chinese state-sponsored intrusion, and researchers demonstrating a "Zombie Card" attack that enables contactless payments using expired Visa cards. Other highlights include a critical GitHub Actions vulnerability discovered by an AI agent (though the flawed code itself was human-written), Medusa ransomware affiliates exploiting GoAnywhere and BeyondTrust vulnerabilities across 500+ critical infrastructure organizations, and data breaches affecting Alation and Japan's Sakura Internet. Rounding out the week, Canadian firm Crypto4A achieved a landmark FIPS 140-3 Level 3 certification for post-quantum cryptography hardware.
