AI Guardrails, ICS Patches, and Exploitation Drive Security

YouTube Experiences Worldwide Outage With Playback Error

⚠️ Users worldwide are reporting a widespread YouTube outage causing playback errors and site load failures across web and mobile. Reports began within the last 30 minutes and affected regions include the U.S., Europe, India, Japan, and Australia, according to outage aggregator DownDetector. Some users see messages such as "Playback error" or "Something went wrong," while others experience slow or incomplete page loads. Google has not yet confirmed a cause; it remains unclear whether the issue stems from server problems, maintenance, or network disruptions.

Encoding-Based Attack Protection with Bedrock Guardrails

🔒 Amazon Bedrock Guardrails offers configurable, cross-model safeguards to protect generative AI applications from encoding-based attacks that attempt to hide harmful content using encodings such as Base64, hexadecimal, ROT13, and Morse code. It implements a layered defense—output-focused filtering, prompt-attack detection, and customizable denied topics—so legitimate encoded inputs are allowed while attempts to request or generate encoded harmful outputs are blocked. The design emphasizes usability and performance by avoiding exhaustive input decoding and relying on post-generation evaluation.

Nation-state Breach Exposes F5 BIG-IP Source Code

⚠️ F5 has confirmed a nation-state actor maintained persistent access to its development systems, including the BIG-IP product development environment and engineering knowledge management platforms, with discovery in August and customer notification on October 15. The breach included stolen files containing BIG-IP source code and information on undisclosed vulnerabilities. While F5 reports no known active exploitation, it and CISA have urged immediate patching and mitigations, and the US government delayed public disclosure in September after a Justice Department order.

Azure Storage Discovery GA: Enterprise Data Visibility

🔍 Azure Storage Discovery is now generally available as a fully managed service that provides enterprise-wide visibility across Azure Blob Storage and Azure Data Lake Storage. It delivers out-of-the-box dashboards, advanced visualizations, and multi-dimensional reports for capacity, activity, security, configuration, and error trends to help optimize costs and operations. Integrated Copilot in Azure allows users to ask natural-language questions and receive rich charts and tables without coding skills.

Microsoft Adds Copilot Actions for Agentic Windows Tasks

⚙️ Microsoft is introducing Copilot Actions, a Windows 11 Copilot feature that allows AI agents to operate on local files and applications by clicking, typing, scrolling and using vision and advanced reasoning to complete multi-step tasks. The capability will roll out to Windows Insiders in Copilot Labs, extending earlier web-based actions introduced in May. Agents run in isolated Agent Workspaces tied to standard Windows accounts, are cryptographically signed, and the feature is off by default.

Rockwell FactoryTalk ViewPoint XML External Entity Flaw

🔒 Rockwell Automation reported a FactoryTalk ViewPoint XML External Entity (XXE) vulnerability (CVE-2025-9066) that can be exploited remotely with low attack complexity to induce a temporary denial-of-service via crafted SOAP requests. Affected devices include PanelView Plus 7 terminals (version 14 and prior). Rockwell released firmware fixes and patches, and CISA recommends minimizing network exposure, isolating control networks, and applying vendor updates promptly. The vulnerability is scored CVSS v4 8.7 (CVSS v3.1 7.5).

Amazon Timestream Now Adds Managed InfluxDB 3 Support

🚀 Amazon Timestream now offers managed support for InfluxDB 3, enabling developers and DevOps teams to run InfluxDB 3 databases as a managed service. InfluxDB 3 introduces a new architecture built on Apache Arrow for in-memory processing, Apache DataFusion for query execution, and columnar Parquet storage with persistence to Amazon S3 to improve query performance and scale for high-cardinality workloads. The service is available in two editions—Core (open source, near real-time) and Enterprise (multi-node, HA, compaction for long-term storage)—with Enterprise supporting initial multi-node clusters up to three nodes. Available in all Regions where Timestream for InfluxDB is offered; see the console, documentation, and pricing to get started.

Vertex AI SDK Adds Prompt Management for Enterprises

🛠️ Google Cloud announced General Availability of Prompt Management in the Vertex AI SDK, enabling teams to programmatically create, version, and manage prompts as first-class assets. The capability bridges Vertex AI Studio’s visual prompt design with SDK-driven automation to improve collaboration, reproducibility, and lifecycle control. Enterprise security and compliance are supported via CMEK and VPCSC, and the SDK exposes simple Python methods to create, list, update, and delete prompt resources tied to models such as gemini-2.5-flash. Get started using the documented code examples to centralize prompt governance and scale generative AI workflows.

Microsoft adds Hey Copilot wake word to Windows 11 PCs

🤖 Microsoft has added the "Hey Copilot" wake word to Windows 11, letting users initiate conversations with the AI-powered Copilot assistant hands-free. The feature is opt-in and must be enabled in the Copilot app's Settings under Voice mode; when active a chime sounds and a microphone icon appears above the taskbar. Wake word detection uses an on-device 10-second audio buffer stored locally and never recorded, while request processing requires internet access. Copilot Vision can analyze screen content for troubleshooting and guidance, and optional connectors let Copilot generate Office documents and access third-party accounts.

Amazon EC2: Optimize CPU for Windows license instances

🔧 Amazon EC2 now lets customers customize CPU options on Windows Server and SQL Server license-included instances, including changing vCPU counts and disabling hyperthreading. This capability targets workloads that need high memory and IOPS but fewer logical CPUs, enabling lower vCPU-based licensing costs while preserving instance memory and I/O performance. AWS highlights an r7i.8xlarge example where turning off hyperthreading reduces 32 vCPUs to 16, cutting licensing expenses by roughly 50%. The feature is available in all commercial AWS Regions and AWS GovCloud (US).

Nation-State Actor Steals F5 BIG-IP Source Code Exposed

🔒 On Oct. 15, 2025, F5 disclosed a nation-state compromise that exfiltrated source code and undisclosed vulnerability information from the BIG-IP product development and engineering knowledge platforms. F5 reports no evidence of modification to its software supply chain or access to CRM, financial, support case management, iHealth, NGINX or distributed cloud products. Unit 42 warns the theft could accelerate exploit development and recommends immediate patching, hardening, and targeted threat hunting for anomalous admin activity and configuration changes.

Microsoft Named Leader in 2025 Gartner SIEM Magic Quadrant

🔒 Microsoft has been recognized as a Leader in the 2025 Gartner® Magic Quadrant for Security Information and Event Management (SIEM). The announcement highlights Microsoft Sentinel as a cloud- and AI-powered SIEM that centralizes security data via a purpose-built data lake and supports agentic AI through the Model Context Protocol (MCP) server. The platform emphasizes cost optimization, SOC automation, and integrated SOAR, UEBA, and threat intelligence to accelerate detection and response.

Microsoft Disrupts Rhysida Ransomware Targeting Teams

🔒 Microsoft disrupted a campaign by the financially motivated group Vanilla Tempest (also tracked as VICE SPIDER/Vice Society) after revoking over 200 code signing certificates used to sign malicious Microsoft Teams installers. The attackers used malvertising and SEO-poisoned domains mimicking Teams to distribute fake MSTeamsSetup.exe files that deployed the Oyster backdoor. The intervention curtailed a wave of Rhysida ransomware launches.

North Korean Group Adopts EtherHiding for Malware Campaign

🔐 Google Threat Intelligence has linked a campaign to UNC5342, a cluster tied to North Korea, that now uses EtherHiding to distribute malware via smart contracts on public blockchains such as BNB Smart Chain and Ethereum. The attackers lure developers through LinkedIn recruitment ruses, move conversations to Telegram or Discord, and deliver npm-package downloaders that chain into BeaverTail, JADESNOW, and the Python backdoor InvisibleFerret. By embedding payloads in on-chain contracts, the group turns blockchains into tamper-resistant dead-drops that are hard to takedown and easy to update, enabling sustained cryptocurrency theft and long-term espionage.

CISA Warns: Critical Adobe AEM Flaw Actively Exploited

🚨 CISA has added a maximum-severity vulnerability in Adobe Experience Manager (AEM) Forms to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. Tracked as CVE-2025-54253, the flaw is an authentication bypass via Struts DevMode that can result in unauthenticated remote code execution on AEM JEE 6.5.23 and earlier. Adobe released fixes on August 9 after public proof-of-concept code appeared; CISA requires federal agencies to remediate by November 5 and urges all organizations to prioritize patching, apply vendor mitigations, or restrict Internet access to affected AEM Forms deployments.

DPRK Actor UNC5342 Employs EtherHiding for Crypto Theft

🧩 GTIG reports that DPRK-linked UNC5342 has adopted EtherHiding, using smart contracts on public blockchains to store and deliver malicious JavaScript payloads. The actor leverages social engineering—fake recruiter lures and technical interviews—to deploy the JADESNOW downloader, which fetches and decrypts on-chain payloads and stages the Python backdoor INVISIBLEFERRET. Google recommends enterprise controls and Chrome management policies to disrupt this resilient, decentralized C2 method.

Missing Authentication in Siemens SIMATIC ET 200SP Modules

⚠️ Siemens ProductCERT and CISA report a Missing Authentication for Critical Function vulnerability (CVE-2025-40771) affecting SIMATIC ET 200SP CP modules. The flaw allows an unauthenticated remote actor to access device configuration data and is rated highly severe (CVSS v4 9.3; CVSS v3.1 9.8). Siemens advises updating affected modules to V2.4.24 or later and restricting access to trusted IP addresses; CISA recommends minimizing network exposure, isolating control networks, and using secure remote access methods.

Rockwell FactoryTalk Linx MSI Privilege Chaining Flaw

⚠️ Rockwell Automation disclosed two privilege-chaining vulnerabilities in FactoryTalk Linx (versions 6.40 and prior) that allow authenticated Windows users to escalate to SYSTEM privileges by hijacking MSI repair console windows. The issues are tracked as CVE-2025-9067 and CVE-2025-9068 and carry a CVSS v4 base score of 8.5 (CVSS v3.1 7.8). Rockwell recommends applying the Microsoft MSI patch and upgrading to FactoryTalk Linx 6.50 or later; CISA notes these flaws are not remotely exploitable and no public exploitation has been reported.

Merged BeaverTail and OtterCookie Tooling Observed in Attacks

🔍 Talos uncovered a campaign linked to the DPRK-aligned cluster Famous Chollima that used a trojanized Node.js package and a malicious VS Code extension to deliver merged BeaverTail and OtterCookie tooling. The combined JavaScript payloads include a newly observed keylogger and screenshot module alongside clipboard theft, targeted file exfiltration, remote shell access, and cryptocurrency extension stealing. Indicators, C2 addresses, Snort/ClamAV detections, and mitigation guidance are provided.

CISA Adds Adobe AEM Critical RCE Flaw with CVSS 10.0

⚠ Adobe's Experience Manager (AEM) has a critical misconfiguration—CVE-2025-54253—scored 10.0 and added to CISA's KEV after evidence of active exploitation. The flaw exposes the /adminui/debug servlet, which evaluates OGNL expressions without authentication, enabling arbitrary code execution via a single crafted HTTP request. Adobe addressed the issue in 6.5.0-0108; affected organizations should apply updates immediately and FCEB agencies must remediate by November 5, 2025.

Hackers Deploy Rootkit via Cisco SNMP Zero-Day on Switches

⚠️Threat actors exploited a recently patched SNMP remote code execution flaw (CVE-2025-20352) in older Cisco IOS and IOS XE devices to deploy a persistent Linux rootkit. Trend Micro reports the campaign targeted unprotected 9400, 9300 and legacy 3750G switches and has been tracked as Operation Zero Disco, named for the universal password that contains 'disco'. The implant can disable logging, bypass AAA and VTY ACLs, hide running-configuration items and enable lateral movement; researchers recommend low-level firmware and ROM-region checks when compromise is suspected.

Cisco SNMP Rootkit Campaign Targets Network Devices

🔒 Trend Micro detailed a campaign exploiting CVE-2025-20352 that installed Linux rootkits on exposed Cisco switches and routers, enabling persistent unauthorized access. The attackers combined an SNMP remote code execution with a modified Telnet flaw (based on CVE-2017-3881) to read and write device memory and deploy fileless backdoors. Affected models include Cisco 9400, 9300 and legacy 3750G series. Device owners should apply Cisco patches, disable or harden SNMP and restrict management access.

Rockwell Automation PanelView and FactoryTalk ME Flaws

🔒 Rockwell Automation disclosed vulnerabilities in FactoryTalk View Machine Edition and PanelView Plus 7 that can allow unauthorized access to device file systems and diagnostic data. CVE-2025-9064 is a network-exploitable path traversal issue; CVE-2025-9063 is an improper-authorization flaw tied to an ActiveX control. Rockwell recommends installing provided firmware and software updates, and CISA advises minimizing network exposure, isolating control networks, and using secure remote access.

Siemens TeleControl Server Basic: Remote Auth Bypass

🔒 Siemens TeleControl Server Basic V3.1 contains a critical missing-authentication vulnerability (CVE-2025-40765) that allows unauthenticated remote attackers to obtain user password hashes and perform authenticated database operations. The issue carries a CVSS v3.1 score of 9.8 and a CVSS v4 score of 9.3, with network attack vector and low attack complexity. Siemens advises updating to V3.1.2.3 or later and restricting access to port 8000; CISA emphasizes isolating control networks and minimizing internet exposure. Tenable reported the issue and, to date, CISA has not received reports of public exploitation.

SINEC NMS SQL Injection (CVE-2025-40755) — Siemens Advisory

🛡️ This advisory details an SQL injection vulnerability in Siemens SINEC NMS (versions prior to V4.0 SP1) affecting the getTotalAndFilterCounts endpoint. Assigned CVE-2025-40755 with high severity (CVSS v3.1 8.8 / CVSS v4 8.7), an authenticated low-privilege attacker could inject SQL to insert data and escalate privileges. Siemens advises updating to V4.0 SP1 or later and applying network protections such as segmentation and firewalls; CISA reports no known public exploitation.

Attackers Use Cisco SNMP Flaw to Deploy Linux Rootkits

🛡️ Researchers disclosed a campaign, Operation Zero Disco, that exploited a recently patched SNMP stack overflow (CVE-2025-20352) in Cisco IOS and IOS XE devices to deploy Linux rootkits on older, unprotected switches. The attackers achieved remote code execution and persistence by installing hooks into IOSd memory and setting universal passwords that include the string "disco." Targets included legacy 3750G and 9300/9400 series devices lacking EDR protections.

CrowdStrike Falcon Blocks Git Vulnerability CVE-2025-48384

🔒 CrowdStrike has identified active exploitation of Git vulnerability CVE-2025-48384 and confirms that Falcon detections can block the observed attack chain. The vulnerability, which affects macOS and Linux, arises from inconsistent handling of carriage return characters in configuration and submodule path parsing and can enable arbitrary file writes during a recursive clone. Observed attacks combined social engineering with malicious repositories that place crafted .gitmodules entries and submodule hooks to execute post-checkout scripts. CrowdStrike urges organizations to patch Git, enable layered protections, deploy provided detection rules and hunting queries, and use Falcon Insight XDR prevention settings to reduce exposure.

Sotheby's Data Breach Exposes Customer Financial Records

🔒 Sotheby's has notified customers that an intrusion detected on July 24 resulted in removal of sensitive data from its systems. After a two-month investigation the company determined exposed information includes full names, Social Security numbers and financial account details. Impacted individuals are being offered 12 months of free identity protection and credit monitoring through TransUnion while Sotheby's continues to assess the scope.

Have I Been Pwned Flags Prosper Breach Affecting 17.6M

🔐Prosper, a peer-to-peer lending marketplace, disclosed a security incident detected on September 2 that resulted in unauthorized access to company databases and the theft of customer and applicant data. While Prosper says it has found no evidence that attackers accessed customer accounts or funds, investigators report that Social Security numbers and other sensitive fields may have been exposed. Breach notification service Have I Been Pwned published that 17.6 million unique email addresses were impacted, though Prosper says it cannot yet validate that figure and is still determining which data elements were affected. The company has notified authorities and says it will offer free credit monitoring as appropriate.

Gladinet patches zero-day in CentreStack file sharing

🔒 Gladinet released an urgent update for its CentreStack business solution to fix a local file inclusion flaw tracked as CVE-2025-11371, which was abused in the wild as a zero-day. The LFI allowed attackers to read Web.config, extract the ASP.NET machine key, and then leverage a prior deserialization RCE (CVE-2025-30406) to achieve remote code execution. Administrators should upgrade to CentreStack version 16.10.10408.56683 immediately; if patching is not possible, disable the temp handler in Web.config for the UploadDownloadProxy component as a temporary mitigation.

DPRK Hackers Adopt EtherHiding to Conceal Malware Campaigns

🔒 Google Threat Intelligence Group (GTIG) reports that a DPRK-aligned threat actor tracked as UNC5342 has employed EtherHiding since February to host and deliver malware via smart contracts on Ethereum and the BNB Smart Chain. Campaigns begin with fake technical interviews that trick developers into running a JavaScript downloader named JADESNOW, which fetches a JavaScript build of InvisibleFerret for in-memory espionage and credential theft. The method offers anonymity, takedown resistance, and low-cost, stealthy payload updates.

Siemens HyperLynx and Industrial Edge Publisher Security

⚠️ Siemens disclosed a type confusion vulnerability (CVE-2025-6554) affecting HyperLynx and Industrial Edge App Publisher, which can enable remote arbitrary read/write and potential code execution via crafted HTML. The issue carries a CVSS v4 base score of 7.0 and a v3.1 score up to 8.1 depending on context. Siemens has released v1.23.5 for App Publisher; no fix is available yet for HyperLynx. Organizations should restrict network exposure, isolate control systems, use secure remote access, and follow Siemens and CISA guidance to mitigate risk.

Smart Contracts Abused to Serve Malware on WordPress

🪙 Google Threat Intelligence Group links a financially motivated actor, UNC5142, to widespread compromises of WordPress sites that leverage EtherHiding and on-chain smart contracts to distribute information stealers such as Atomic, Lumma, Rhadamanthys and Vidar. The campaign injects a multi-stage JavaScript downloader (CLEARSHORT) into plugins, themes and databases to query malicious BNB Smart Chain contracts, which return encrypted landing pages that use ClickFix social engineering to trick Windows and macOS users into executing stealer payloads. Google flagged roughly 14,000 infected pages through June 2025, and observed a move to a three-contract proxy-like architecture since November 2024 that improves agility and resistance to takedown.

UNC5142 EtherHiding: Smart-Contract Malware Distribution

🔐 Since late 2023, Mandiant and the Google Threat Intelligence Group tracked UNC5142, a financially motivated cluster that compromises vulnerable WordPress sites to distribute information stealers. The actor's CLEARSHORT JavaScript loader uses Web3 to query smart contracts on the BNB Smart Chain that store ABIs, encrypted landing pages, AES keys, and payload pointers. By employing a three-contract Router-Logic-Storage design and abusing legitimate hosting (Cloudflare Pages, GitHub, MediaFire), operators can rotate lures and update payload references on-chain without changing injected scripts, enabling resilient, low-cost campaigns that GTIG found on ~14,000 injected pages by June 2025 and which showed no on-chain updates after July 23, 2025.

Rockwell ArmorStart AOP: Uncaught Exception Causes DoS

⚠️ A remotely exploitable uncaught exception in Rockwell Automation's ArmorStart AOP for Studio 5000 Logix Designer can trigger a denial-of-service on versions V2.05.07 and earlier. The issue arises from invalid inputs to COM methods and is tracked as CVE-2025-9437 with a CVSS v4 base score of 8.7 (high). Rockwell reports no fix is available; users should apply vendor best practices and minimize network exposure.

Hitachi Energy MACH GWS Vulnerabilities — Patch Alert

⚠️ Hitachi Energy reported three vulnerabilities in MACH GWS (versions 3.0.0.0–3.4.0.0) that could enable local tampering, denial-of-service via IEC 61850 message handling, or remote man-in-the-middle attacks. The issues are categorized as Incorrect Default Permissions, Improper Validation of Integrity Check Value, and Improper Certificate Validation and carry CVSS v4 scores up to 7.1. Hitachi Energy recommends updating to MACH GWS 3.5 immediately and following deployment guidance such as network segregation, minimal exposed ports, scanning removable media, and enforcing strong password policies. CISA notes no known public exploitation at this time.

ThreatsDay Bulletin: $15B Crypto Seizure, Weekly Risks

🔔 This week’s ThreatsDay bulletin highlights a historic U.S. DOJ seizure of roughly $15 billion in cryptocurrency linked to an alleged transnational fraud network, alongside active commodity malware, phishing-as-a-service, and novel abuses of legitimate tools. Notable incidents include the Brazil-distributed Maverick banking trojan spread via a WhatsApp worm, consumer-grade interception of geostationary satellite traffic, and UEFI BombShell flaws enabling bootkit persistence. Priorities: identity resilience, patching, and monitoring of remote-access and cloud services.

Operation Heracles: Takedown of Fraudulent Crypto Sites

🔒 German authorities, working with BaFin, Europol and Bulgarian law enforcement, seized 1,406 fraudulent crypto and investment domains in Operation Heracles on October 3, 2025. The seized sites, which targeted German-speaking users, now display warning banners after roughly 866,000 access attempts were recorded in the first ten days. Authorities warn these professional-looking platforms often use AI-generated content, mobile apps and call centres to defraud victims.

LinkPro Rootkit Uses eBPF and Magic TCP Packets to Hide

🔒 An AWS-hosted compromise revealed a new GNU/Linux rootkit dubbed LinkPro, discovered by Synacktiv. Attackers leveraged an exposed Jenkins server vulnerable to CVE-2024-23897 and deployed a malicious Docker image (kvlnt/vv) to Kubernetes clusters, delivering a VPN/proxy (vnt), a Rust downloader (vGet) and vShell backdoors. LinkPro relies on two eBPF modules—Hide and Knock—to conceal processes and activate via a magic TCP packet, with a user-space fallback via /etc/ld.so.preload when kernel support is missing.

Improving JavaScript Trustworthiness via WAICT for the Web

🔒 Cloudflare presents an early design for Web Application Integrity, Consistency, and Transparency (WAICT) to address the risks of mutable JavaScript in sensitive web apps. The proposal pairs expanded Subresource Integrity (SRI) and a signed integrity manifest with append-only transparency logs and third-party witnesses to provide verifiable inclusion and consistency proofs. Browser preload lists, proof-of-enrollment, and client-side cooldowns are used to avoid extra round trips and to limit stealthy changes. Cloudflare plans to participate as a service provider and to collaborate on standardization.

Microsoft Digital Defense Report 2025: Threat Trends

🔒 Microsoft's 2025 Digital Defense Report finds that most attacks aim to steal data for profit, with extortion and ransomware responsible for over 52% of incidents while espionage accounts for only about 4%. Covering July 2024–June 2025, the report highlights rising use of AI, automation, and off‑the‑shelf tools that enable scalable phishing, malware, and identity theft. Microsoft urges adoption of phishing‑resistant MFA, AI‑driven defenses, and strengthened cross‑sector collaboration to protect critical public services and build resilience.

CISA Issues Thirteen ICS Advisories on October 16, 2025

🔔 CISA released thirteen Industrial Control Systems (ICS) advisories on October 16, 2025, providing details on vulnerabilities and mitigations affecting multiple vendors. The advisories cover products from Rockwell Automation (FactoryTalk View Machine Edition, Linx, ViewPoint, ArmorStart AOP), Siemens (Solid Edge, SiPass Integrated, SIMATIC ET 200SP Communication Processors, SINEC NMS, TeleControl Server Basic, HyperLynx and Industrial Edge App Publisher), Hitachi Energy (MACH GWS), and updates for Schneider Electric and Delta Electronics. Administrators and operators are urged to review the technical details and apply recommended mitigations to reduce exposure and maintain operational continuity.

Amazon EC2 C8gn Instances Expand to Additional Regions

🚀 Amazon EC2 C8gn instances, powered by AWS Graviton4 processors, are now available in Asia Pacific (Malaysia, Sydney, Thailand), expanding AWS compute availability. C8gn offers up to 30% better compute versus Graviton3-based C7gn, features 6th-generation Nitro Cards, and delivers up to 600 Gbps network throughput. Instances scale to 48xlarge (up to 384 GiB) and selected large sizes support EFA for lower latency and improved cluster performance, optimizing cost for network-intensive workloads.

AWS Global Accelerator Now Supports Two Asia Pacific Regions

🚀 AWS Global Accelerator now supports application endpoints in two additional AWS Regions — Asia Pacific (Thailand) and Asia Pacific (Taipei) — bringing total coverage to thirty-three Regions. The service offers static IP addresses, congestion-free AWS network routing, edge DDoS protections, and continuous health monitoring to enable deterministic multi-region failover without DNS dependencies. To use the new Regions, configure endpoints such as Application Load Balancers, Network Load Balancers, Amazon EC2 instances, or Elastic IPs and review the Global Accelerator documentation.

Windows 11 updates break localhost HTTP/2 (127.0.0.1)

⚠️ Microsoft’s October Windows 11 updates (notably KB5066835 and the September preview KB5065789) have disrupted HTTP/2 connections to localhost (127.0.0.1), preventing local services and developer tools from completing requests. Users report errors such as "ERR_CONNECTION_RESET" and "ERR_HTTP2_PROTOCOL_ERROR" when applications attempt to connect to the loopback interface. Affected software includes Visual Studio debugging, SSMS Entra ID authentication, and Duo Desktop; community workarounds include disabling HTTP/2 via Registry entries or uninstalling the problematic updates.

CISOs Brace for an Escalating AI-versus-AI Cyber Fight

🔐AI-enabled attacks are rapidly shifting the threat landscape, with cybercriminals using deepfakes, automated phishing, and AI-generated malware to scale operations. According to Foundry's 2025 Security Priorities Study and CSO reporting, autonomous agents can execute full attack chains at machine speed, forcing defenders to adopt AI as a copilot backed by rigorous human oversight. Organizations are prioritizing human risk, verification protocols, and training to counter increasingly convincing AI-driven social engineering.

Ransomware Victim Responses and Human Impact Analysis

🔒 Ransomware attacks inflict both operational and deep personal harm, often devastating small businesses lacking cash reserves and cybersecurity expertise. Research underscores lasting trauma, exhaustion, and financial ruin that can outlast technical recovery. Organizations should pair an incident response plan with compassionate leadership and employee support. Cisco Talos also warns of evolving supply‑chain campaigns targeting developers and job seekers, reinforcing the need for layered defenses.

Microsoft: 100 Trillion Signals Daily as AI Fuels Risk

🛡️ The Microsoft Digital Defense Report 2025 reveals Microsoft systems analyze more than 100 trillion security signals every day and warns that AI now underpins both defense and attack. The report describes adversaries using generative AI to automate phishing, scale social engineering and discover vulnerabilities faster, while autonomous malware adapts tactics in real time. Identity compromise is the leading vector—phishing and social engineering caused 28% of breaches—and although MFA blocks over 99% of unauthorized access attempts, adoption remains uneven. Microsoft urges board-level attention, phishing-resistant MFA, cloud workload mapping and monitoring, intelligence sharing and immediate AI and quantum risk planning.

Siemens SiPass integrated vulnerabilities and update

🔒 Siemens released security updates for SiPass integrated to address four vulnerabilities—an Accusoft ImageGear heap-based buffer overflow, stored cross-site scripting, an authorization bypass via user-controlled keys, and recoverable password storage. Exploitation could enable account compromise, data manipulation, impersonation, or arbitrary code execution on affected servers. Siemens recommends updating to V3.0, restricting access to trusted personnel, and avoiding untrusted image uploads; CISA advises isolating devices and using secure remote access.

IT Leaders Fear Regulatory Patchwork as Gen AI Spreads

⚖️ More than seven in 10 IT leaders list regulatory compliance as a top-three challenge when deploying generative AI, according to a recent Gartner survey. Fewer than 25% are very confident in managing security, governance, and compliance risks. With the EU AI Act already in effect and new state laws in Colorado, Texas, and California on the way, CIOs worry about conflicting rules and rising legal exposure. Experts advise centralized governance, rigorous model testing, and external audits for high-risk use cases.

US Q3 Report: Over 23 Million Data Breach Victims This Year

📊 The Identity Theft Resource Center (ITRC)'s Q3 2025 analysis found 835 publicly reported corporate data compromises in the United States, resulting in approximately 23 million victim notifications. That follows 1,732 incidents in H1 2025 and brings the year-to-date total to nearly 202 million victims. The report attributes 83% of breaches to cyber-attacks, highlights a rise in physical attacks, and criticizes the increasing frequency of notices that omit details about the cause. Major victims this quarter included Anne Arundel Dermatology, DaVita, TransUnion and several large healthcare providers.

Siemens Solid Edge: Multiple PRT Parsing Vulnerabilities

🔒 Siemens' Solid Edge CAD applications contain multiple vulnerabilities in PRT file parsing—two out‑of‑bounds writes (CWE‑787) and two out‑of‑bounds reads (CWE‑125)—tracked as CVE‑2025‑40809 through CVE‑2025‑40812. Affected releases include SE2024 versions prior to V224.0 Update 14 and SE2025 versions prior to V225.0 Update 6. Exploitation could crash the application or enable code execution in the context of the current process; Siemens and CISA recommend applying the listed updates, avoiding untrusted PRT files, and limiting network exposure.

AWS Security Hub CSPM Adds CIS AWS Foundations v5.0

🛡️ AWS Security Hub CSPM now supports the CIS AWS Foundations Benchmark v5.0, introducing 40 automated configuration checks aligned to the industry standard. The new standard is available in all Regions where Security Hub CSPM operates, including AWS GovCloud (US) and the China Regions. AWS recommends using Security Hub CSPM central configuration to enable the standard across selected accounts and Regions with a single action. Customers can subscribe to the CSPM SNS topic for updates and try Security Hub free for 30 days.

Amazon DocumentDB Adds IPv6 Dual-Stack Support for AWS

🌐 Amazon DocumentDB now supports IPv6 addressing for new and existing clusters, enabling dual-stack (IPv4/IPv6) deployments within VPCs. Customers can enable IPv6 with a few clicks in the AWS Management Console or programmatically via the AWS CLI to reduce address overlap and simplify networking. The change helps teams standardize applications on IPv6 and is generally available on versions 4.0 and 5.0 in supported Regions. Amazon DocumentDB remains a fully managed, native JSON database designed for scale and operational simplicity.

Sotheby's Breach Exposes Employee Financial Data Records

🔐 Sotheby's disclosed a cybersecurity incident first detected on July 24, 2025, after threat actors removed data from its environment. A two-month investigation found exposed information included full names, Social Security numbers and financial account details. The company notified impacted individuals and offered 12 months of identity protection and credit monitoring through TransUnion. An October update clarified the breach involved employees, not customers.

AWS Location Service Introduces Advanced Map Styling

🗺️ Amazon Web Services announced enhanced map styling for Amazon Location Service, enabling developers to customize maps with terrain visualization, contour lines, real-time traffic, and transportation-specific routing. Users can adjust parameters such as terrain, contour-density, traffic, and travel-mode through the GetStyleDescriptor API. These options support use cases including outdoor navigation, logistics planning, and traffic management while maintaining reliable performance.

Microsoft Tops Brand Phishing Impersonations in Q3 2025

🔍 Cyber criminals continue to favor familiar brands, with Microsoft used in 40% of all brand impersonation attempts in Q3 2025, according to Check Point Research’s Brand Phishing Report. Google represented 9% and Apple 6%, and together these tech giants comprised more than half of brand-related phishing activity. The findings highlight persistent targeting of the technology sector and underscore the need for stronger defenses and user awareness.

Architectures, Risks, and Adoption of AI-SOC Platforms

🔍 This article frames the shift from legacy SOCs to AI-SOC platforms, arguing leaders must evaluate impact, transparency, and integration rather than pursue AI for its own sake. It outlines four architectural dimensions—functional domain, implementation model, integration architecture, and deployment—and prescribes a phased adoption path with concrete vendor questions. The piece flags key risks including explainability gaps, data residency, vendor lock-in, model drift, and cost surprises, and highlights mitigation through governance, human-in-the-loop controls, and measurable POCs.

Quantum Readiness: Why Incident Response Won't Work

🔐 The arrival of cryptographically relevant quantum computers will create a "silent boom" where adversaries can capture encrypted traffic today and decrypt it later, making intrusions neither observed nor observable. This undermines traditional incident response and shifts responsibility to engineering teams, not a vendor checkbox. Organizations must pursue quantum readiness by engaging developers to inventory algorithms and data, assess internet-facing assets for PQC support, and build testing capability for new ciphers within their release cycles.

Rethinking Enterprise Phishing Training Effectiveness

🔒 Phishing remains a pervasive threat—IBM attributes roughly 15% of data breaches to these attacks—yet standard training approaches are delivering limited protection. Recent studies cited in the article show annual awareness modules and embedded simulated-phish interventions often fail to change user behavior or secure genuine engagement, with many users closing training pages outright. Security leaders are advised to treat training as one element of a broader risk-reduction strategy that pairs behavioral design, clear escalation steps, measurable metrics, incentives, and technical controls such as two-factor authentication and improved phishing detection.

Amazon EC2 CPU Options Optimize License-Included Windows

🔧 Amazon EC2 now allows customers to modify CPU options on Windows Server and SQL Server license-included instances to reduce vCPU-based licensing costs. You can customize the number of vCPUs and disable hyperthreading to achieve higher memory-to-vCPU ratios while preserving instance memory and IOPS. This enhancement targets database workloads that need high memory and I/O but lower vCPU counts. See the Amazon EC2 User Guide and AWS blog post for implementation details and best practices.

2025 Insider Risk Report: Hidden Costs of Everyday Actions

🔍 The 2025 Insider Risk Report finds insider-driven data loss is widespread and costly, with 77% of organizations affected and many incidents stemming from human error or compromised accounts rather than malice. It warns that traditional DLP often lacks behavioral context and visibility across endpoints, SaaS, and GenAI. The report urges adoption of behavior-aware, AI-ready platforms and five practical practices to reduce false positives and prevent data loss.

CISO Role Expands: From Operator to Enterprise Risk Lead

🔒 The CISO role has evolved from a primarily technical post into a broad enterprise leadership responsibility. Foundry’s 2025 Security Priorities Study shows many security leaders now brief boards multiple times a month and oversee areas beyond cybersecurity, including risk, compliance, privacy, and AI oversight. This shift requires stronger strategic communication and executive influence in addition to operational expertise.

Microsoft: Office 2016 and 2019 Reach End of Support

⚠️ Microsoft has reminded customers that Office 2016 and Office 2019 reached the end of extended support on October 14, 2025. These releases will continue to operate but will no longer receive security updates, bug fixes, or technical support, increasing exposure to threats and compliance issues. Microsoft recommends migrating to Microsoft 365 Apps or newer perpetual releases such as Office 2024 or Office LTSC 2024, and notes that Visio, Project, and Skype for Business 2016/2019 are also out of support.

Minecraft mods — how malicious mods put players at risk

🛡️ Minecraft mods can enhance gameplay but also serve as vectors for malware. This article explains how threat actors disguise Trojans, infostealers, ransomware and cryptominers as mods or cheat tools and distribute them via GitHub, mod repositories and forums. It outlines practical precautions — sourcing mods from trusted repositories, checking developer reputation and file types, using non-admin accounts, backups and security software — and steps to take if a mod is suspected malicious.

Most Companies Remain Poorly Prepared for Cyberattacks

🔒 Markus Weber, founder and managing director of dokuworks, describes the immediate steps his team takes when called in after a cyberattack: isolate and secure affected systems so IT forensics can operate, preserve extortion correspondence to help identify perpetrators, assess operational impact, and initiate emergency operations. He warns that ransomware is the predominant threat and generally advises against paying ransoms, though there are rare exceptions. Many organizations are improving technically but still neglect documented emergency organization and trusted external partnerships, leaving them vulnerable.

AWS Marketplace Adds Purchase Order Line Number Support

🧾 AWS Marketplace now supports purchase order (PO) line numbers for Marketplace transactions, allowing customers to associate charges with a specific PO line during procurement and for future charges post-procurement in the AWS Marketplace console. Invoices show the related purchase order and PO line number in the Billing and Cost Management console, helping teams accurately match invoices to POs. This capability is available today in all supported AWS Regions.

Unified Exposure Management: Shift to Preemptive Security

🔒 Modern MSSP and MDR models that focus on detection and response are increasingly insufficient as hybrid infrastructures and rapid cloud and third‑party changes expand attack surfaces. Unified Exposure Management Platforms (UEMPs) continuously discover assets, validate exploitability with automated simulations and penetration testing, and coordinate remediation to produce verifiable, business‑aligned risk reduction. Vendors like Picus Security package CTEM stages into a workflow that prioritizes, validates, and mobilizes fixes to shift security from reaction to prevention.

LastPass: Phishing campaign impersonates product, warns users

🔒 LastPass has confirmed it was not breached after detecting a targeted phishing campaign that mimicked its branding. The emails used the subject line "We Have Been Hacked - Update Your LastPass Desktop App to Maintain Vault Security" and came from spoofed senders such as hello@lastpasspulse.blog and hello@lastpassgazette.blog. Links in the messages redirected recipients to phishing sites (lastpassdesktop.com and lastpassgazette.blog), and attackers have also registered lastpassdesktop.app for potential follow-ups. Cloudflare is displaying warnings and LastPass said it is working to have the malicious domains taken down.

Cryptocurrency ATMs Facilitate Scams and Extract High Fees

🪙Cryptocurrency ATMs are being used as vectors for fraud and exploitation, with operators charging steep, often opaque fees that compound victims’ losses. Scammers frequently direct victims to ATMs to purchase crypto on their behalf, effectively outsourcing the money transfer while the ATM companies continue to profit. At best, operators appear indifferent to the harm caused; regulators and industry participants need clearer accountability and consumer protections to address these systemic issues.

Majority in Germany Sees Threat from Hybrid Attacks

⚠️ A YouGov survey commissioned by the digital policy briefing Digitalwende for Süddeutsche Zeitung Dossier reports that 61% of more than 2,000 respondents view the threat from hybrid attacks as strong or very strong. The poll describes hybrid attacks as combinations of cyber operations, military actions and disinformation aimed at destabilizing societies. Perceived risk differs by party: Greens (72%), Union (71%), SPD (67%) and AfD (49%).

Hidden Costs of Penetration Testing and Alternatives

🛡️ Penetration testing remains a critical control, but the classic, one-size-fits-all approach can create hidden financial and operational burdens. Administrative overheads, complex scoping decisions and indirect remediation work all add time and cost while risking scope creep and disruption. The article recommends flexible, consumption-based models—such as PTaaS and Outpost24's CyberFlex—to improve coverage, transparency and ROI.

Young Europeans’ Digital Aspirations and Future Skills

🔍 Janice Richardson, researcher and Council of Europe expert, reflects on Google’s Future Report, based on more than 7,000 teens from seven EU countries. She highlights young people’s use of the internet for learning, cultural exploration and creative problem solving, noting strong critical thinking and pragmatic attitudes toward algorithms. Richardson stresses closing the digital literacy gap and equipping teachers and parents to support safe, balanced online engagement.

Supporting Teens Online: Beyond Bans Toward Guidance

👪 The early teen years are pivotal for digital development, and trust between parents and teens matters more than any single setting. Tools like Family Link and YouTube’s supervised experience are valuable, but parents juggling multiple children, apps and devices need simpler solutions—AI assistants could configure age- and app-specific controls. Rather than blanket bans, the piece calls for thoughtful restrictions developed with parents, schools and communities alongside independent digital literacy standards.

Leading Incident Response Through Empathy and Care

🛡️ Laura Faria, an incident commander with Cisco Talos Incident Response, discusses leading through chaos, empathy, and teamwork during high-pressure security incidents. She traces a career across multiple cybersecurity vendors and sales roles before joining Talos and stepping into incident command. Laura emphasizes purpose-driven response work, particularly when outages affect critical infrastructure and patient safety. The interview highlights resilience, collaboration, and practical leadership lessons.