Preventive measures led the day as Apple raised top rewards for high-end exploits and Google introduced a unified program for AI security reports. Apple’s move pairs incentives with new hardware memory protections, while Google set clear scope for AI product abuse and security flaws. Meanwhile, defenders contended with active exploitation against business software and record DDoS activity that stressed ISPs and mitigation providers.
Bounties and AI security programs
Apple increased its maximum payout to $2 million for iOS zero‑click system‑level RCE and expanded bonuses that can push total awards beyond $5 million, aligning incentives with new platform defenses such as Memory Integrity Enforcement in A19‑series chips that validate memory access across the kernel and dozens of user processes. The company also added programmatic Target Flags to speed verification and plans to distribute 1,000 iPhone 17 devices to civil society groups at high risk of surveillance. According to CSO Online, Apple cites recent zero‑day fixes and acknowledges that advanced adversaries will keep evolving, but argues that MIE and higher bounties raise the bar for exploit chains historically used by mercenary spyware vendors.
Google launched a dedicated AI Vulnerability Reward Program with a top base award of $20,000 and up to $30,000 per validated issue when multipliers apply, consolidating reviews across abuse and security categories. The program targets flaws in flagship products such as Search, Gemini apps and Workspace offerings (Gmail, Drive, Sheets, Calendar), and covers threats like rogue actions, sensitive data exfiltration, phishing enablement and model theft. Content issues such as prompt injections and jailbreaks are out of scope and should be reported in‑product. The new rules and single reward table, reported by Infosecurity, are intended to simplify submissions and maximize the highest applicable payout.
Looking ahead, an essay by Bruce Schneier and coauthors describes how autonomous agents are reshaping both attack and defense, from AI‑assisted bug discovery to operationalized “VulnOps” and continuous discovery/repair pipelines, while highlighting tradeoffs around patch correctness, compatibility and liability. The authors urge technologists and policymakers to prepare for rapid shifts in capability on both sides of the ball. See Schneier for the broader context.
Cloud platforms expand capacity and controls
AWS expanded regional options for performance‑sensitive databases and graph analytics. Amazon Aurora with PostgreSQL compatibility now supports Graviton4‑based R8g instances in Canada (Central), Asia Pacific (Singapore) and Asia Pacific (Seoul), adding sizes up to 48xlarge with DDR5 memory, up to 50 Gbps networking and up to 40 Gbps EBS bandwidth; AWS cites potential gains versus Graviton3 depending on workloads. Customers can modify existing instances to adopt R8g after benchmarking. Details are in AWS. The company also made Neptune Analytics available in Canada (Central) and Australia (Sydney), enabling in‑memory processing of large graphs, optimized graph algorithms and vector similarity search that integrates with graph traversals; data can be loaded from Neptune databases or Amazon S3. See AWS.
For I/O‑intensive enterprise workloads, AWS extended EBS io2 Block Express to the China (Beijing) and China (Ningxia) Regions, delivering single‑volume performance up to 256,000 IOPS, 4 GiB/s throughput and 64 TiB capacity with sub‑millisecond latency and 99.999% durability. Existing io1 users can upgrade via ModifyVolume with durability and performance gains at the same storage price as io1 and lower IOPS costs above 32,000 IOPS, according to AWS.
Microsoft upgraded Copilot on Windows with user‑controlled connectors for Microsoft and third‑party services, plus a new export workflow that turns responses into Word, PowerPoint, Excel or PDF files. After opting in and enabling connectors in settings, Insiders on supported builds can have Copilot search and summarize emails, files and calendars across OneDrive, Outlook, Gmail, Google Drive, Google Calendar and Google Contacts. The rollout, detailed by BleepingComputer, emphasizes explicit user configuration rather than automatic aggregation of personal data.
Active exploitation and urgent mitigations
Researchers observed in‑the‑wild exploitation of a zero‑day in Gladinet CentreStack and Triofox (CVE‑2025‑11371), where a local file inclusion was used to read Web.config and extract the machine key, which attackers then chained into a previously disclosed ViewState deserialization issue (CVE‑2025‑30406) to achieve remote code execution. Huntress advised an interim mitigation—disabling the temp handler in the UploadDownloadProxy Web.config—to block the LFI path until a vendor patch is available, noting possible functional impact. Organizations should restrict access, monitor for ViewState or Web.config access and prepare for patch deployment, per BleepingComputer.
Oracle E‑Business Suite environments faced sustained exploitation of an unauthenticated RCE zero‑day (CVE‑2025‑61882) that enabled data theft and extortion under the Clop brand, with activity dating to July and a significant ramp starting in August. Google Threat Intelligence Group and Mandiant report in‑memory loaders and malicious templates, with extortion emails beginning September 29. Oracle released an emergency patch on October 4; mitigations include prioritizing patching, hunting for malicious templates stored in the database, limiting non‑essential outbound traffic, monitoring network logs, and performing Java process memory forensics. Infosecurity notes systems updated with the patch are likely no longer vulnerable to known chains, but investigations should assume potential compromise until proven otherwise.
Threat actors also repurposed the open‑source DFIR tool Velociraptor during multi‑ransomware operations that deployed LockBit, Warlock and, for the first time in these investigations, Babuk. Intrusions included privilege escalation, lateral movement, Group Policy changes and disabling of protections, with attackers abusing a vulnerable Velociraptor build (CVE‑2025‑6264). Defenders should update to patched releases, audit GPO and privileged account changes, and monitor for misuse of legitimate tooling, according to The Hacker News.
Extortion, DDoS and forum disruptions
A Mirai‑derived botnet dubbed Aisuru has scaled to an estimated 300,000 IoT devices and repeatedly driven multi‑terabit floods against gaming infrastructure and U.S. ISPs, with a recent test peaking at 29.6 Tbps. Concentrations of infected endpoints at major broadband providers create outsized egress that can congest upstream links and degrade service for bystanders. Researchers call for universal outbound DDoS suppression, stronger device patching and larger mitigation budgets, per KrebsOnSecurity. In parallel, U.S. and French authorities seized domains and backend systems for BreachForums, a portal used by ShinyHunters and others for data‑extortion operations tied to claims of massive Salesforce‑related leaks. Nameserver control and database access give investigators potential visibility into escrow and negotiation records, according to BleepingComputer.
Unit 42 highlights a consortium of actors known as Scattered Lapsus$ Hunters (also referenced as Bling Libra, Muddled Libra and legacy LAPSUS$), which launched a public leak site listing dozens of victims and claims of more than a billion stolen Salesforce records. The group frames its model as extortion‑as‑a‑service, recruiting partners and taking revenue shares, and has collaborated with other clusters in recent operations. Tactical guidance includes automated secrets discovery, conditional access and least‑privilege controls within a zero‑trust approach, and participation in sector ISACs for real‑time sharing, per Unit 42. Separately, SonicWall disclosed that all customers using its MySonicWall cloud backup feature were affected by theft of backup files containing encrypted credentials and configurations; the vendor published an affected‑device list and a remediation playbook. Recommended actions include rotating credentials and certificates where feasible, enforcing MFA, isolating internet‑exposed devices until patched, tightening firewall rules and monitoring for lateral movement, as reported by CSO Online.