Tag: update
-
Samba WINS Command Injection Vulnerability (CVE-2025-10230) Notice
Overview Recently, NSFOCUS CERT detected that Samba released a security update to fix the Samba WINS command injection vulnerability (CVE-2025-10230); Since WINS when Samba is used as an AD domain controller does not strictly verify the wins hook script command when processing registration messages, unauthenticated attackers can construct a special host name to inject commands…The…
-
Kundendaten geleakt – Cyberangriff auf australische Fluggesellschaft Qantas
First seen on security-insider.de Jump to article: www.security-insider.de/cyberangriff-auf-qantas-millionen-kundendaten-entwendet-a-7cccf733f59cb9e6fcca60a89e3604f5/
-
ConnectWise Flaws Let Attackers Deliver Malicious Software Updates
ConnectWise has issued a critical security update for its Automate platform after uncovering vulnerabilities that could allow attackers to intercept and tamper with software updates. The flaws, present in on-premises installations configured to use unsecured communication channels, put organizations at risk of deploying malicious code under the guise of routine patches. ConnectWise Automate 2025.9, released…
-
Microsoft’s Patch Tuesday: 172 Flaws Fixed
The tech titan is addressing 172 security flaws, including six zero-day vulnerabilities. Among these, eight are rated “Critical,” consisting of five remote code execution bugs and three elevation of privilege issues. The post Microsoft’s Patch Tuesday: 172 Flaws Fixed appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-patch-tuesday-october-2025/
-
Windows GDI Vulnerability in Rust Kernel Module Enables Remote Attacks
A newly discovered flaw in Microsoft’s Rust-based Graphics Device Interface (GDI) kernel component allows unprivileged attackers to crash or take control of Windows systems. Check Point Research (CPR) uncovered the issue in January 2025 and reported it to Microsoft. The company addressed the bug in the May 28, 2025 KB5058499 preview update (OS Build 26100.4202),…
-
Over 269,000 F5 Devices Found Exposed Online After Massive Breach
A recent breach of F5 Networks’ infrastructure has left more than 269,000 devices exposed and vulnerable to attack. Security researchers first detected unusual activity on F5’s management portal, prompting the company to issue an alert and patch critical vulnerabilities. However, despite swift action, a daily snapshot from Shadowserver shows that nearly 269,000 unique IP addresses…
-
KB5066835: Windows-11-Update macht Localhost unerreichbar
Im Netz klagen zahlreiche Anwender über Verbindungsprobleme zum Localhost. Auslöser ist offenbar das jüngste Update für Windows 11. First seen on golem.de Jump to article: www.golem.de/news/kb5066835-windows-11-update-macht-localhost-unerreichbar-2510-201268.html
-
VMware Releases Workstation Fusion 25H2 With Enhanced Features and OS Support
VMware has launched the latest versions of its desktop hypervisors, Workstation 25H2 and Fusion 25H2, bringing significant improvements to virtualization technology. These updates introduce a simplified versioning system, powerful new features, and expanded compatibility with modern operating systems and hardware. VMware has abandoned traditional version numbering like Workstation 17.6.x and Fusion 13.6.x in favor of…
-
Windows 11 updates break localhost (127.0.0.1) HTTP/2 connections
Microsoft’s October Windows 11 updates have broken the “localhost” functionality, making applications that connect back to 127.0.0.1 over HTTP/2 no longer function properly. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-11-updates-break-localhost-127001-http-2-connections/
-
F5 BIG-IP Breach: 44 CVEs That Need Your Attention Now
Tags: access, attack, breach, cisa, cloud, crowdstrike, cve, cvss, cyber, cybersecurity, data, data-breach, detection, edr, endpoint, exploit, government, Hardware, infrastructure, intelligence, Internet, kubernetes, malicious, mitigation, monitoring, network, risk, software, supply-chain, technology, theft, threat, tool, update, vulnerability, vulnerability-managementPartnering with an EDR vendor after a nation-state has already stolen your source code isn’t innovation, it’s a gamble. You don’t build a fire extinguisher while the house is burning. You find every spark before it becomes the next inferno. Key takeaways: F5’s BIG-IP is used to secure everything from government agencies to critical infrastructure. …
-
F5 BIG-IP Breach: 44 CVEs That Need Your Attention Now
Tags: access, attack, breach, cisa, cloud, crowdstrike, cve, cvss, cyber, cybersecurity, data, data-breach, detection, edr, endpoint, exploit, government, Hardware, infrastructure, intelligence, Internet, kubernetes, malicious, mitigation, monitoring, network, risk, software, supply-chain, technology, theft, threat, tool, update, vulnerability, vulnerability-managementPartnering with an EDR vendor after a nation-state has already stolen your source code isn’t innovation, it’s a gamble. You don’t build a fire extinguisher while the house is burning. You find every spark before it becomes the next inferno. Key takeaways: F5’s BIG-IP is used to secure everything from government agencies to critical infrastructure. …
-
Breach Roundup: Chinese Hackers Exploited ArcGIS
Also, Internet-Exposed Call Center Software Under Attack and Patch Tuesday. This week: Chinese hackers exploited ArcGIS, Internet-exposed call center software under attack, October patch Tuesday, Massachusetts student sentenced for $3 million extortion hack, New York fined eight insurers $14.2M over data breaches, more than 100 VS Code extensions leak secrets. First seen on govinfosecurity.com Jump…
-
Windows 11 update breaks localhost, prompting mass uninstall workaround
Microsoft’s quality control department caught napping again First seen on theregister.com Jump to article: www.theregister.com/2025/10/16/windows_11_update_localhost/
-
Frightful Patch Tuesday gives admins a scare with 175+ Microsoft CVEs, 3 under attack
Plus: Adobe, SAP, Ivanti offer treats, not tricks First seen on theregister.com Jump to article: www.theregister.com/2025/10/14/microsoft_october_2025_patch_tuesday/
-
Gladinet fixes actively exploited zero-day in file-sharing software
Gladinet has released security updates for its CentreStack business solution to address a local file inclusion vulnerability (CVE-2025-11371) that threat actors have leveraged as a zero-day since late September. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/gladinet-fixes-actively-exploited-zero-day-in-file-sharing-software/
-
Gladinet fixes actively exploited zero-day in file-sharing software
Gladinet has released security updates for its CentreStack business solution to address a local file inclusion vulnerability (CVE-2025-11371) that threat actors have leveraged as a zero-day since late September. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/gladinet-fixes-actively-exploited-zero-day-in-file-sharing-software/
-
Phishing Alert: Fake ‘LastPass Hack’ Emails Spreading Malware
A new phishing campaign impersonating LastPass is circulating today, October 13, 2025, aiming to deceive users into downloading malicious desktop software. Emails purporting to come from “hello@lastpasspulse.blog” or “hello@lastpassgazette.blog” carry the alarming subject line “We Have Been Hacked Update Your LastPass Desktop App to Maintain Vault Security.” In reality, LastPass has not been compromised;…
-
Phishing Alert: Fake ‘LastPass Hack’ Emails Spreading Malware
A new phishing campaign impersonating LastPass is circulating today, October 13, 2025, aiming to deceive users into downloading malicious desktop software. Emails purporting to come from “hello@lastpasspulse.blog” or “hello@lastpassgazette.blog” carry the alarming subject line “We Have Been Hacked Update Your LastPass Desktop App to Maintain Vault Security.” In reality, LastPass has not been compromised;…
-
Senator presses Cisco over firewall flaws that burned US agency
Bill Cassidy letter asks if Switchzilla sat on critical flaws before feds were forced into emergency patching First seen on theregister.com Jump to article: www.theregister.com/2025/10/16/cisco_senate_scrutiny/
-
Senator presses Cisco over firewall flaws that burned US agency
Bill Cassidy letter asks if Switchzilla sat on critical flaws before feds were forced into emergency patching First seen on theregister.com Jump to article: www.theregister.com/2025/10/16/cisco_senate_scrutiny/
-
LastPass Warns Customers It Has Not Been Hacked Amid Phishing Email Scam
LastPass warns customers it has not been breached, after phishing emails falsely claim a hack and urge users to update their desktop app First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/lastpass-not-hacked-phishing-email/
-
F5 Reveals Nation State Breach and Urges Immediate Patching
F5 has admitted a nation state actor has stolen source code and information on undisclosed vulnerabilities First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/f5-nation-state-breach-immediate/
-
Security-Insider Podcast Folge 105, Teil 4 – Der letzte Patchday mit Windows 10 Updates
First seen on security-insider.de Jump to article: www.security-insider.de/windows-10-patchday-oktober-support-ende-podcast-a-95de84b9847bc711a44a5f56418c2665/
-
Patchday: Microsoft Office Updates (14. Oktober 2025)
Am 14. Oktober 2025 (zweiter Dienstag im Monat, Microsoft Patchday) hat Microsoft mehrere sicherheitsrelevante Updates für Microsoft Office 2016, sowie die C2R-Varianten (Office 2016-2021 und 365) und andere Produkte veröffentlicht. Diesen Monat wurden gravierende Schwachstellen in Office geschlossen. Nachfolgend finden … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/10/16/patchday-microsoft-office-updates-14-oktober-2025/
-
Source code and vulnerability info stolen from F5 Networks
Tags: access, apt, attack, automation, best-practice, breach, ceo, ciso, control, credentials, crowdstrike, cybercrime, data, data-breach, detection, edr, endpoint, exploit, group, guide, incident response, infrastructure, intelligence, mitigation, monitoring, network, programming, risk, sans, software, threat, tool, update, vulnerabilityF5 mitigations: IT and security leaders should make sure F5 servers, software, and clients have the latest patches. In addition, F5 has added automated hardening checks to the F5 iHealth Diagnostics Tool, and also suggests admins refer to its threat hunting guide to strengthen monitoring, and its best practices guides for hardening F5 systems.As a…
-
Source code and vulnerability info stolen from F5 Networks
Tags: access, apt, attack, automation, best-practice, breach, ceo, ciso, control, credentials, crowdstrike, cybercrime, data, data-breach, detection, edr, endpoint, exploit, group, guide, incident response, infrastructure, intelligence, mitigation, monitoring, network, programming, risk, sans, software, threat, tool, update, vulnerabilityF5 mitigations: IT and security leaders should make sure F5 servers, software, and clients have the latest patches. In addition, F5 has added automated hardening checks to the F5 iHealth Diagnostics Tool, and also suggests admins refer to its threat hunting guide to strengthen monitoring, and its best practices guides for hardening F5 systems.As a…
-
F5 Hack Exposes Fed Networks to Full Compromise
Federal Agencies Ordered to Patch or Decommission F5 Devices Amid Imminent Risk. An advanced nation-state threat actor stole sensitive F5 source code and vulnerability data to craft tailored exploits, prompting an emergency directive amid a U.S. government shutdown that has left cyber defenses strained and federal networks at imminent risk. First seen on govinfosecurity.com Jump…