Microsoft has acknowledged a critical issue affecting Windows Server 2025 systems enrolled in the Hotpatch program. A recent Windows Server Update Services (WSUS) patch was inadvertently distributed to machines configured to receive Hotpatch updates, causing disruptions to the seamless patching process that allows security updates without requiring system restarts. Distribution Error Impacts Hotpatch-Enrolled Systems The […]
Microsoft has disclosed details of a novel backdoor dubbed SesameOp that uses OpenAI Assistants Application Programming Interface (API) for command-and-control (C2) communications.
“Instead of relying on more traditional methods, the threat actor behind this backdoor abuses OpenAI as a C2 channel as a way to stealthily communicate and orchestrate malicious activities within the compromised
A new security issue discovered by researchers reveals that Anthropic’s Claude AI system can be exploited through indirect prompts, allowing attackers to exfiltrate user data via its built‑in File API. The attack, documented in a detailed technical post on October 28, 2025, demonstrates how Claude’s Code Interpreter and API features could be manipulated to send […]
Cybercriminals are orchestrating sophisticated attacks against trucking and freight companies in elaborate schemes designed to steal cargo shipments worth millions. These threat actors are exploiting the digital transformation of the logistics industry, compromising transportation companies to fraudulently bid on legitimate cargo loads before stealing and reselling the goods. At the center of these operations is […]
Apple has rolled out new security updates for iOS 26.1 and iPadOS 26.1, released on November 3, 2025, introducing important fixes for a wide range of vulnerabilities. The update is available for iPhone 11 and later models, along with several iPad models including iPad Pro (3rd generation and later), iPad Air (3rd generation and later), […]
AMD has disclosed a critical vulnerability affecting its Zen 5 processor lineup that compromises the reliability of random number generation, a fundamental security feature in modern computing.
The flaw, tracked as CVE-2025-62626, impacts the RDSEED instruction used by systems to generate cryptographically secure random numbers essential for encryption, authentication, and other security operations.
The vulnerability stems from a defect in the RDSEED instruction implementation on Zen 5 processors. Under certain conditions, the instruction returns a value of zero while incorrectly signaling success through the carry flag (CF=1).
This behavior creates a dangerous scenario where software believes it has received a valid random number when it has actually obtained a predictable zero value. The issue affects both 16-bit and 32-bit forms of the RDSEED instruction, though the 64-bit version remains unaffected.
Understanding the RDSEED Flaw
AMD learned about this bug through an unconventional channel. The issue was first reported publicly on the Linux kernel mailing list rather than through AMD’s standard Coordinated Vulnerability Disclosure process.
This public disclosure path highlights the collaborative nature of open-source security research but also underscores the challenge of managing security information across diverse reporting channels.
The severity of this vulnerability cannot be understated. Random number generation forms the backbone of cryptographic security in modern systems.
When RDSEED fails silently by returning zeros while indicating success, applications may generate weak encryption keys, predictable authentication tokens, or compromised security protocols.
CVE
CVE Description
CVSS Score
CVE-2025-62626
Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potentially resulting in the consumption of insufficiently random values.
An attacker with local system access could potentially exploit this weakness to predict or influence cryptographic operations, leading to data breaches or unauthorized access.
System administrators can utilize the 64-bit form of RDSEED exclusively, mask the RDSEED capability from software detection by modifying boot parameters, or implement software logic to treat zero returns as failures requiring retry attempts. The company plans to release microcode updates and AGESA firmware revisions across its product portfolio.
AMD EPYC 9005 Series processors will receive updates by mid-November 2025, while consumer Ryzen 9000 Series, Ryzen AI 300 Series, and Threadripper 9000 processors target late November releases. Embedded processor variants will see patches deployed through January 2026.
Organizations running affected Zen 5 systems should prioritize applying these updates once available through their original equipment manufacturers.
Until patches are deployed, implementing the recommended software workarounds provides essential protection against potential exploitation of this random integrity vulnerability.
The Open VSX Registry and the Eclipse Foundation have completed their investigation into a significant security incident involving exposed developer tokens and malicious extensions.
The comprehensive response reveals how the platform is strengthening defenses across the entire VS Code extension ecosystem following the breach.
The security incident began when researchers at Wiz identified multiple extension publishing tokens inadvertently exposed by developers in public repositories.
Investigation confirmed that a limited number of tokens associated with Open VSX accounts had been compromised, creating a direct pathway for attackers to publish or modify extensions without authorization.
The Open VSX team emphasized that these exposures resulted from developer mistakes rather than infrastructure compromise, immediately revoking all affected tokens upon discovery. The exposure highlighted a critical vulnerability in the development workflow where sensitive credentials can easily slip into version control systems.
Understanding the Threat
Open VSX collaborated with Microsoft Security Response Center to introduce a new token prefix format specifically designed for easier and more accurate scanning of exposed tokens across public repositories, enabling developers and security teams to identify compromised credentials faster.
Security researchers at Koi Security subsequently identified a coordinated malware campaign called “GlassWorm” that leveraged the leaked tokens to publish malicious extensions to the platform.
While initial reports characterized this as a self-propagating worm comparable to the ShaiHulud incident on npm, Open VSX clarified that the malware operated differently.
The extensions were designed to steal developer credentials, enabling attackers to expand their reach across the ecosystem, but the malware did not autonomously replicate or propagate across systems.
The campaign resulted in several malicious extensions reaching the marketplace before removal. Open VSX removed all identified malicious extensions immediately upon notification and revoked or rotated associated tokens without delay.
However, reported download statistics require context. The cited figure of 35,800 downloads includes inflated counts generated by bot traffic and visibility-boosting tactics employed by threat actors, potentially overstating actual user impact.
As of October 21, 2025, Open VSX declared the incident fully contained with no indication of ongoing compromise or remaining malicious extensions on the platform.
The response led to concrete improvements strengthening platform security, including implementing shorter default token validity periods to limit leak impact, streamlining token revocation workflows for faster response times, and deploying automated security scanning at publication to detect malicious code patterns before extensions reach users.
Open VSX continues intensive collaboration with affected developers, ecosystem partners, and independent researchers to maintain transparency and reinforce preventive measures.
These improvements demonstrate how security incidents, while disruptive, can drive meaningful ecosystem hardening and establish stronger protections for the broader developer community relying on open-source extension marketplaces.
Cybersecurity researchers and firewall monitoring services have detected a dramatic surge in reconnaissance activity targeting Windows Server Update Services (WSUS) infrastructure.
Network sensors collected from security organizations, including data from Shadowserver, show a significant increase in scans directed at TCP ports 8530 and 8531 over the past week.
While some scanning activity appears connected to legitimate security research initiatives, analysts have identified additional traffic from unknown sources not associated with known research organizations, raising concerns about potential exploitation attempts.
The scanning activity correlates directly with CVE-2025-59287, a critical vulnerability in WSUS servers that enables remote code execution.
Attackers can exploit this flaw by connecting to vulnerable WSUS infrastructure via either port 8530 (unencrypted) or 8531 (TLS-encrypted).
Successfully establishing a connection allows threat actors to execute arbitrary scripts directly on compromised servers with no authentication requirements.
Reconnaissance Followed by Full Compromise
SANS analysis reveals that threat actors typically follow a two-stage attack pattern when targeting WSUS servers. The initial phase involves reconnaissance and scanning to identify vulnerable systems, which aligns with the recent surge in port scanning activity.
Once attackers successfully identify and connect to susceptible servers, they proceed to the exploitation phase, deploying malicious scripts that grant them extensive control over the affected infrastructure.
Experts emphasize that any publicly exposed WSUS server displaying characteristics of vulnerability should be presumed compromised at this stage.
a significant increase in scans for port 8531/TCP
The availability of sufficient technical details in public disclosures has lowered the barrier to entry for potential attackers, enabling even moderately skilled threat actors to develop and deploy exploitation code.
Organizations should assume that exploitation attempts have already occurred against any systems matching the vulnerable profile that have been connected to internet-facing networks.
The severity of this vulnerability demands urgent action from system administrators and security teams managing WSUS deployments. Organizations must immediately audit their network perimeter to identify any WSUS servers accessible from untrusted networks.
CVE ID
Vulnerability
Affected Products
CVSS Score
CVE-2025-59287
WSUS Script Execution
Windows Server Update Services (Multiple versions)
9.8
Those discovering exposed instances should implement emergency isolation procedures and conduct comprehensive forensic investigations to determine whether compromise has occurred.
Organizations without immediate patch availability should implement network segmentation, restricting WSUS server access to authorized internal networks only.
Advanced threat detection systems should be configured to alert on suspicious outbound connections and script execution originating from WSUS processes, as these behaviors often indicate successful compromise.
Apple released iOS 26.1 and iPadOS 26.1, addressing multiple vulnerabilities that could lead to privacy breaches, app crashes, and potential data leaks for iPhone and iPad users.
The update targets devices starting from the iPhone 11 series and various iPad models, including the iPad Pro (3rd generation 12.9-inch and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (8th generation and later), and iPad mini (5th generation and later).
This release underscores Apple’s ongoing commitment to rapid response against evolving threats, especially as cyber risks intensify in an era of advanced malware and targeted attacks.
The patches address over 50 issues across core components like WebKit, the Kernel, and Accessibility features. Many stem from memory corruption risks, privacy issues, and sandbox escapes, which could allow malicious apps to snoop on user data or destabilize the system.
Security researchers from ByteDance, Trend Micro’s Zero Day Initiative, Google, and independent experts discovered most flaws, highlighting the collaborative nature of vulnerability hunting in the iOS ecosystem.
Key Privacy and Sandbox Vulnerabilities Patched
Several fixes focus on preventing apps from overstepping boundaries, a common vector for data theft. For instance, in Accessibility (CVE-2025-43442), a permissions flaw let apps detect other installed applications, potentially enabling fingerprinting.
Apple mitigated this with stricter restrictions. Similarly, the Apple Account component (CVE-2025-43455) blocked malicious apps from screenshotting sensitive info in embedded views through enhanced privacy checks.
In the Kernel and Apple Neural Engine, memory handling improvements (CVE-2025-43398, CVE-2025-43447, CVE-2025-43462) prevent unexpected crashes or kernel corruption, which could lead to denial-of-service attacks.
Assets and CloudKit updates (CVE-2025-43407, CVE-2025-43448) reinforce sandbox integrity by validating symlinks more rigorously and preventing apps from escaping their confines to access protected files.
Contacts and Photos also received logging and temporary file tweaks (CVE-2025-43426, CVE-2025-43391) to redact sensitive data and curb unauthorized access. A notable fix in Stolen Device Protection (CVE-2025-43422) adds logic to prevent physical attackers from disabling the feature, vital for protecting lost or stolen devices.
Component
CVE
Impact
Description
Researcher
Accessibility
CVE-2025-43442
App identifies installed apps
Permissions issue with added restrictions
Zhongcheng Li (ByteDance)
Apple Account
CVE-2025-43455
Malicious app screenshots sensitive info
Privacy issue with improved checks
Ron Masas, Pinak Oza
Kernel
CVE-2025-43398
Unexpected system termination
Improved memory handling
Cristian Dinca (icmd.tech)
Assets
CVE-2025-43407
App breaks sandbox
Improved entitlements
JZ
CloudKit
CVE-2025-43448
App breaks sandbox
Improved symlink validation
Hikerell (Loadshine Lab)
Contacts
CVE-2025-43426
App accesses sensitive data
Improved data redaction in logging
Wojciech Regula (SecuRing)
Stolen Device Protection
CVE-2025-43422
Attacker disables protection
Added logic
Will Caine
WebKit Overhaul Targets Web-Based Exploits
WebKit, powering Safari and web views, dominates the update with fixes for crashes, memory corruption, and cross-origin data exfiltration.
A use-after-free vulnerability (CVE-2025-43438) could crash Safari via malicious content, while buffer overflows (CVE-2025-43429) risked arbitrary code execution.
Apple addressed these through better memory management, bounds checking, and disabling risky optimizations like array allocation sinking (CVE-2025-43421).
Privacy threats include keystroke monitoring (CVE-2025-43495) and cross-origin image theft in Canvas (CVE-2025-43392). Visiting spoofed sites could trick users (CVE-2025-43493, CVE-2025-43503), now countered with UI state improvements.
Component
CVE
Impact
Description
Researcher
WebKit
CVE-2025-43480
Cross-origin data exfiltration
Improved checks (Bugzilla 276208)
Aleksejs Popovs
WebKit
CVE-2025-43438
Safari crash via use-after-free
Improved memory management (Bugzilla 297662)
shandikri (Trend Micro ZDI)
WebKit
CVE-2025-43495
Keystroke monitoring
Improved checks (Bugzilla 300095)
Lehan Dilusha Jayasinghe
WebKit Canvas
CVE-2025-43392
Cross-origin image exfil
Improved cache handling (Bugzilla 297566)
Tom Van Goethem
WebKit
CVE-2025-43429
Process crash via buffer overflow
Improved bounds checking (Bugzilla 298232)
Google Big Sleep
Other components like Camera, Siri, and Text Input received targeted patches for logic flaws and lock screen leaks (CVE-2025-43450, CVE-2025-43454, CVE-2025-43452).
Experts urge immediate updates, as unpatched devices remain vulnerable to zero-day exploits. Apple’s security page details all fixes, crediting researchers under its bounty program. With iOS 26.1, users gain stronger defenses against a landscape rife with sophisticated threats.
Identity compromise has become one of the most significant threats facing cloud infrastructure, particularly when attackers gain access to legitimate credentials.
These valid access keys enable adversaries to bypass traditional security defenses, creating opportunities for widespread exploitation.
Amazon Web Services environments have witnessed a surge in such attacks, with the Simple Email Service emerging as a preferred tool for conducting malicious email operations at scale.
The service provides attackers with a reliable, scalable platform to execute phishing campaigns and Business Email Compromise schemes once they’ve obtained valid AWS credentials.
FortiGuard Labs recently uncovered a sophisticated campaign that exploits stolen AWS credentials to abuse the Simple Email Service.
During this investigation, researchers identified a massive attack infrastructure known as TruffleNet, which leverages the open-source secret-scanning tool TruffleHog to systematically validate compromised credentials and conduct reconnaissance across AWS environments.
The campaign involved activity from over 800 unique hosts distributed across 57 distinct Class C networks, demonstrating the operation’s unprecedented scale and coordination.
Fortinet researchers noted that the infrastructure exhibited remarkably consistent characteristics, including specific port configurations and the presence of Portainer, a container management platform.
The initial TruffleNet connections typically began with a simple GetCallerIdentity API call to verify credential validity, followed by GetSendQuota queries targeting Amazon Simple Email Service.
Unlike typical cloud attacks that rely on VPN services or TOR nodes, the vast majority of TruffleNet IP addresses showed no prior malicious reputation, suggesting purpose-built infrastructure dedicated exclusively to this campaign.
Further analysis revealed that adversaries utilized compromised WordPress sites to obtain DKIM cryptographic keys, subsequently configuring AWS SES to send emails on their behalf.
This sophisticated technique involved creating multiple email identities within SES using stolen authentication credentials, enabling attackers to impersonate legitimate organizations.
The campaign culminated in targeted Business Email Compromise attacks against the oil and gas sector, with fraudsters sending invoices purporting to be from ZoomInfo and requesting $50,000 ACH payments.
The fraudulent communications directed payment inquiries to typosquatted domains, demonstrating the attackers’ attention to detail in maintaining credibility throughout the social engineering process.
Technical Infrastructure and Attack Methodology
The TruffleNet infrastructure demonstrated sophisticated operational security through its tiered architecture design.
Host-level analysis identified 10 hosting autonomous system numbers, with the majority mapped to US-based providers WS Telecom Inc. and Hivelocity LLC.
Most hosts maintained open ports 5432 and 3389, though these were repurposed from their standard PostgreSQL and RDP assignments.
The deployment of Portainer across numerous nodes provided attackers with a centralized management interface, effectively functioning as infrastructure-as-a-service for coordinating large-scale credential testing operations.
Identity Compromise and BEC (Source – Fortinet)
The attack progression involved multiple AWS API calls executed in a specific sequence. Following initial reconnaissance, attackers attempted privilege escalation by creating new IAM identities, though this effort failed in several instances.
However, one compromised user account possessed sufficient privileges to interact directly with SES. The CreateEmailIdentity API request included stolen DKIM signing attributes from previously compromised domains, with the following technical implementation observed in FortiGuard Labs’ analysis:
This request parameter demonstrates how attackers weaponized legitimate AWS functionality by importing compromised cryptographic keys from external sources.
Six email identities were ultimately established during the campaign, including domains such as cfp-impactaction[.]com, cndbenin[.]com, and novainways[.]com.
Several of these domains shared hosting infrastructure in France and exhibited connections to other malicious activities, including XMRig cryptomining operations and the Coroxy trojan.
The attackers executed their Business Email Compromise operation immediately following infrastructure preparation, sending vendor onboarding invoices with legitimate-appearing W-9 forms containing publicly available employer identification numbers to enhance credibility.
FortiCNAPP’s composite alerting technology successfully detected the campaign by evaluating multiple behavioral indicators simultaneously, including anomalous cloud connections, suspicious automation activity, and offensive tool usage.
The platform generated high-confidence alerts that correlated network anomalies with behavioral deviations, providing security teams with actionable intelligence to respond to the identity-driven threat effectively.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
.webp)
.webp)