Cloud Outage, Platform Safeguards, and Active Exploits

Microsoft DNS Outage Disrupts Azure and Microsoft 365

⚠️ Microsoft is experiencing a global DNS outage that began about an hour ago, causing widespread access problems to Azure and Microsoft 365 services. Customers worldwide report they cannot log into corporate networks or reach portals including Azure, Intune, and the Exchange admin center, and some report the Azure Front Door CDN is also unavailable. Microsoft attributes the interruptions to DNS failures, warns of intermittent request failures and latency, and is reviewing telemetry while working on mitigation; it recommends programmatic access (PowerShell/CLI) when portals are unreachable.

Stability AI Image Tools Expanded in Amazon Bedrock

🖼 Amazon Bedrock now offers four new image-editing tools in Stability AI Image Services: Outpaint, Fast Upscale, Conservative Upscale, and Creative Upscale. These additions expand the platform's Edit, Upscale, and Control capabilities, enabling creators to perform targeted edits and resolution enhancements with greater precision. The tools are accessible via the Bedrock API and are initially supported in US West (Oregon), US East (N. Virginia), and US East (Ohio).

Amazon Web Grounding for Nova Models Now Generally Available

🌐 Web Grounding is now generally available as a built-in tool for Nova models, usable today with Nova Premier via the Amazon Bedrock tool use API. It retrieves and incorporates publicly available information with citations to support responses, enabling a turnkey RAG solution that reduces hallucinations and improves accuracy. Cross-region inference makes the tool available in US East (N. Virginia), US East (Ohio), and US West (Oregon). Support for additional Nova models will follow.

Google Public Sector Summit: A New Era for Government AI

🔔 At the Google Public Sector Summit in Washington D.C., leaders highlighted a shift toward agentic AI and large-scale cloud modernization. Google introduced Gemini for Government, an accredited platform providing an AI Agent Gallery, agent-to-agent protocols, enterprise connectors, and governance controls to deploy and monitor AI agents. Speakers showcased real-world deployments across defense, city, and education sectors, and Google announced expanded partner investments plus an enhanced partnership with NVIDIA to support on-premises and air-gapped environments.

TwelveLabs Marengo 3.0 Now on Amazon Bedrock Platform

🎥 TwelveLabs' Marengo Embed 3.0 is now available on Amazon Bedrock, providing a unified video-native multimodal embedding that represents video, images, audio, and text in a single vector space. The release doubles processing capacity—up to 4 hours and 6 GB per file—expands language support to 36 languages, and improves sports analysis and multimodal search precision. It supports synchronous low-latency text and image inference and asynchronous processing for video, audio, and large files.

Chrome to Enable HTTPS-First Mode by Default in 2026

🔒 Beginning in April 2026 and completing in October 2026, Google will make the Always Use Secure Connections feature the default in Chrome, attempting HTTPS for all public site navigations and prompting users before loading non-HTTPS pages. The phased rollout starts with Enhanced Safe Browsing users in Chrome 147 and expands to all global users in Chrome 154. Internal addresses such as routers and intranets will be exempt, and Google reports early tests showed warnings on fewer than 3% of navigations, typically under one alert per week, while the browser will avoid repeatedly warning about frequently visited sites.

Fortinet Expands Unified SASE with Global POPs and AI

🚀 Fortinet announced enhancements to Fortinet Unified SASE, expanding its global footprint to over 170 points of presence and embedding AI-powered operations. FortiAI-Assist automates diagnostics and remediation to accelerate mean time to resolution, while an agentless Secure Browser and SaaS Security Posture Management extend DLP and compliance controls across 80+ SaaS apps. These updates aim to boost performance, simplify operations, and strengthen data protection for distributed workforces.

Signal Rolls Out Quantum-Safe Triple Ratchet (SPQR)

🔐 Signal has rolled out a quantum-safe update that adds a third ratchet, branded SPQR, to its secure messaging protocol. Instead of replacing the existing Double Ratchet, Signal runs a parallel KEM-based ratchet and derives encryption keys by mixing outputs from both ratchets with a KDF. Developed with PQShield, AIST, and NYU, the design preserves familiar behaviors while adding post-quantum resilience for forward secrecy and post-compromise protection.

PhantomRaven campaign floods npm with credential theft

🐦 The PhantomRaven campaign distributes dozens of malicious npm packages that steal authentication tokens, CI/CD secrets, and GitHub credentials. Discovered by Koi Security, the activity began in August and involved 126 packages with over 86,000 downloads. The packages use a remote dynamic dependency mechanism to fetch and execute payloads during npm install, enabling stealthy credential exfiltration. Developers should verify package provenance and avoid unvetted LLM-generated package suggestions.

Spike in Automated Botnet Attacks Targeting PHP, IoT

🔍 Cybersecurity researchers warn of a sharp rise in automated botnet campaigns targeting PHP servers, IoT devices, and cloud gateways. The Qualys Threat Research Unit says Mirai, Gafgyt, Mozi and similar botnets are exploiting known CVEs, misconfigurations and exposed secrets to recruit vulnerable systems. Attackers leverage active debug interfaces (for example using '/?XDEBUG_SESSION_START=phpstorm'), scan from cloud providers to mask origin, and turn compromised routers and DVRs into residential proxies. Recommended mitigations include prompt patching, removing development tools from production, securing secrets with AWS Secrets Manager or HashiCorp Vault, and restricting public cloud access.

Ransomware Hits Swedish Grid Operator Svenska kraftnät

🔒 On October 25, 2025 the ransomware group Everest listed state grid operator Svenska kraftnät on its darknet leak site, claiming about 280 GB of stolen data. Svenska kraftnät confirmed on October 26 that attackers accessed certain sensitive information via an isolated external file-transfer solution and said investigations are underway. The utility — which operates roughly 16,000 km of high-voltage lines — said there is currently no indication the physical grid was affected and that it is coordinating with police and national cybersecurity authorities.

New Airstalk Malware Abuses AirWatch for Covert C2

🛡️ We have discovered a new Windows-based malware family named Airstalk that abuses the AirWatch (Workspace ONE UEM) API to establish a covert command-and-control channel and exfiltrate browser artifacts. Two variants were observed: a PowerShell variant focused on Chrome cookie and bookmark theft, and a more advanced .NET variant that adds multi-threaded C2, beaconing, versioning, and support for Microsoft Edge and Island Browser. Several .NET samples were signed with a likely stolen certificate that was revoked shortly after issuance. Unit 42 assesses with medium confidence that a suspected nation-state actor used Airstalk in a likely supply chain compromise and provides IoCs and mitigation guidance.

Protecting Moldova’s 2025 Parliamentary Election Online

🛡️ Cloudflare assisted the Moldovan Central Election Commission (CEC) during the September 28, 2025 parliamentary vote, rapidly onboarding election sites and deploying mitigations under the Athenian Project. On election day Cloudflare mitigated over 898 million malicious requests across multiple DDoS waves, including a peak of 324,333 rps, keeping official result reporting and civic sites online. Automated defenses and coordination with STISC ensured no interruptions to public access and authoritative information.

Aisuru Botnet Evolves from DDoS to Residential Proxies

🛡️ Aisuru, first identified in August 2024, has been retooled from launching record DDoS assaults to renting hundreds of thousands of compromised IoT devices as residential proxies. Researchers warn the change powers a massive proxy market that is being used to anonymize large-scale content scraping for AI training and other abuses. The botnet — roughly 700,000 devices strong — previously produced multi‑terabit attacks that disrupted ISPs and damaged router hardware. Industry and law enforcement are sharing blocklists and probing proxy reseller ecosystems tied to the infections.

Typosquatted npm Packages Deploy Cross-Platform Infostealer

🚨 Ten typosquatted packages on npm were found delivering a 24 MB PyInstaller infostealer that targets Windows, Linux, and macOS. Uploaded on July 4 and downloaded nearly 10,000 times, the packages used heavy obfuscation and a fake CAPTCHA to evade detection. Researchers at Socket say the malware harvests keyrings, browser credentials, SSH keys and API tokens, then exfiltrates data to a remote server. Developers who installed these packages should remove them, perform remediation, and rotate all secrets.

BlueNoroff Returns with GhostCall and GhostHire Campaigns

🚨 BlueNoroff, a North Korea–linked subgroup of the Lazarus Group, has reemerged with two focused campaigns—GhostCall and GhostHire—targeting executives, Web3 developers and blockchain professionals. Operators use social engineering on Telegram and LinkedIn to stage fake investor meetings and recruiter coding tests, then deliver multi-stage, cross-platform malware. Samples were found written in Go, Rust, Nim and AppleScript and deploy implants such as DownTroy, CosmicDoor and Rootroy to harvest crypto keys, credentials and project assets.

Active Exploits Target DELMIA Apriso and XWiki — CISA

⚠️ CISA and researchers report active exploitation of critical vulnerabilities in Dassault Systèmes DELMIA Apriso and XWiki, including code injection, missing authorization, and eval injection flaws. Dassault addressed CVE-2025-6204 and CVE-2025-6205 for 2020–2025 releases in August and these issues were added to CISA’s Known Exploited Vulnerabilities catalog. The XWiki flaw (CVE-2025-24893) is being abused in a two-stage chain that stages and later executes a downloader to deliver a cryptocurrency miner. Organizations should apply vendor updates immediately and meet federal remediation deadlines where applicable.

PhantomRaven npm Campaign Uses Invisible Dependencies

🕵️ Researchers at Koi Security uncovered an ongoing npm credential-harvesting campaign called PhantomRaven, active since August 2025, that steals npm tokens, GitHub credentials and CI/CD secrets. The attacker hides malicious payloads using Remote Dynamic Dependencies (RDD), fetching code from attacker-controlled servers at install time to bypass static scans. The campaign leveraged slopsquatting—typo variants that exploit AI hallucinations—to increase installs; Koi found 126 infected packages with about 20,000 downloads and at least 80 still live at publication.

AI-targeted Cloaking Tricks Agentic Browsers, Warns SPLX

⚠ Researchers report a new form of context-poisoning called AI-targeted cloaking that serves different content to agentic browsers and AI crawlers. SPLX shows attackers can use a trivial user-agent check to deliver alternate pages to crawlers from ChatGPT and Perplexity, turning retrieved content into manipulated ground truth. The technique mirrors search engine cloaking but targets AI overviews and autonomous reasoning, creating a potent misinformation vector. A concurrent hTAG analysis also found many agents execute risky actions with minimal safeguards, amplifying potential harm.

BSI: Tens of Thousands of German Exchange Servers Vulnerable

⚠️ The German Federal Office for Information Security (BSI) warns that the majority of an estimated 33,000 publicly reachable Microsoft Exchange Server 2016 and 2019 installations still operate without vendor support after 14 October 2025. Without security updates, new critical Exchange vulnerabilities cannot be patched and affected systems may need to be taken offline to avoid compromise. The BSI highlights rapid network-wide compromise and ransomware risk and urges prompt upgrades, migrations, or protective measures such as VPNs or IP restrictions.

Russian-Origin Threat Actors Target Ukrainian Organizations

🔴 Symantec and Carbon Black reported a Russian-origin campaign that targeted a large business services firm and a local government entity in Ukraine, relying on web shells and living-off-the-land techniques to reduce detection. Early activity began on June 27, 2025 with deployment of the LocalOlive web shell, PowerShell exclusions, scheduled memory dumps and credential-theft attempts. Operators used dual-use tools (OpenSSH, RDP changes, winbox64.exe), PowerShell backdoors and native Windows utilities to maintain persistence while minimizing custom malware use. Researchers noted strong Windows tradecraft but could not conclusively attribute the intrusions to a named Russian group.

Malicious npm Packages Steal Developer Credentials

⚠️ Security researchers revealed 10 typosquatted npm packages uploaded on July 4, 2025, that install a cross-platform information stealer targeting Windows, macOS, and Linux. The packages impersonated popular libraries and use a postinstall hook to open a terminal, display a fake CAPTCHA, fingerprint victims, and download a 24MB PyInstaller stealer. The obfuscated JavaScript fetches a data_extracter binary from an attacker server, harvests credentials from browsers, system keyrings, SSH keys and config files, compresses the data into a ZIP, and exfiltrates it to the remote host.

Atroposia RAT Kit Lowers Barrier for Cybercriminals

⚠️ Researchers at Varonis have identified a turnkey remote access trojan called Atroposia, marketed on underground forums with subscription tiers starting at $200 per month. The kit combines advanced features — hidden remote desktop takeover, encrypted C2 channels, UAC bypass for persistence, an integrated vulnerability scanner, clipboard capture, DNS hijacking and bulk exfiltration — into a low‑skill, plug‑and‑play package. Enterprises should prioritize behavioral monitoring, rapid containment, multi‑factor authentication, restricted admin access and rigorous patching to detect and mitigate attacks enabled by such commoditized toolsets.

Microsoft fixes Media Creation Tool on affected PCs again

🛠 Microsoft has restored the Windows 11 Media Creation Tool after reports it failed to run on some up-to-date Windows 10 22H2, Windows 11 25H2 and Arm64 systems following the Windows 11 2025 Update. Microsoft says the issue was resolved in the optional KB5067036 preview update published October 28, 2025, and the updated tool is now available for download. As before, users can also obtain Windows ISO files directly to create bootable media.

Amazon S3 Adds Conditional Copy Support for Writes

🔐 Amazon S3 now supports conditional copy operations via the CopyObject API, enabling verification of an object's existence or content in the destination bucket before copying. You can supply the HTTP If-None-Match header to ensure the destination object does not exist, or If-Match with an ETag to validate content prior to copy. Administrators can enforce these checks using s3:if-match and s3:if-none-match bucket policy condition keys. This capability is available at no additional charge in all AWS Regions and removes the need for additional client-side coordination or pre-copy validation calls.

AWS Elastic Beanstalk: Corretto 25 with Tomcat 11 on AL2023

🚀 AWS Elastic Beanstalk now supports building and deploying Tomcat 11 applications using Amazon Corretto 25 on Amazon Linux 2023 (AL2023). The platform enables developers to leverage Java 25 and Jakarta EE 11 features such as compact object headers, ahead‑of‑time (AOT) caching, and structured concurrency while benefiting from AL2023’s security and performance improvements. Environments can be created through the Elastic Beanstalk Console, CLI, or API and are generally available in commercial and GovCloud regions.

Rise in Attacks on PHP Servers, IoT and Cloud Gateways

🔒 Qualys' Threat Research Unit reports a sharp rise in attacks targeting PHP servers, IoT devices and cloud gateways, driven by botnets such as Mirai, Gafgyt and Mozi exploiting known CVEs and misconfigurations. Researchers highlight active exploitation of flaws like CVE-2022-47945 (ThinkPHP RCE), CVE-2021-3129 (Laravel Ignition) and aging test/debug artifacts such as CVE-2017-9841, while attackers also harvest exposed AWS credentials. Qualys urges continuous visibility, timely patching, removal of debugging tools in production and managed secret stores to reduce risk.

Atroposia RAT Emerges on Dark Web with Modular Toolset

🔍 Security researchers at Varonis identified a modular remote access trojan named Atroposia, first seen on October 15 and promoted on underground forums. The toolkit includes encrypted C2 channels, hidden remote desktop takeover (HRDP Connect), credential and cryptocurrency wallet theft, DNS hijacking, vulnerability scanning and robust persistence. It is offered via subscription tiers and can be combined with services like SpamGPT and MatrixPDF to automate phishing and delivery. Recommended defenses include phishing reduction, timely patching, MFA enforcement and monitoring for post-compromise activity.

Identity Crisis at the Perimeter: AI-Driven Impersonation

🛡️ Organizations face an identity crisis as generative AI and vast troves of breached personal data enable realistic digital doppelgangers. Attackers now automate hyper-personalized phishing, smishing and vishing, clone voices, and run coordinated multi-channel campaigns that reference real colleagues and recent projects. The article urges a shift to “never trust, always verify,” with radical visibility, rapid detection and phishing-resistant authentication such as FIDO2. It also warns of emerging agentic AI and recommends strict least-privilege controls plus continuous red-teaming.

Amazon EBS adds per-minute avg IOPS and throughput metrics

📈 Amazon EBS now emits two new per-volume CloudWatch metrics—VolumeAvgIOPS and VolumeAvgThroughput—providing one-minute average I/O and throughput visibility. These metrics are enabled by default at no extra charge for all EBS volumes attached to EC2 Nitro instances in Commercial Regions, including AWS GovCloud (US) and AWS China. Use them to monitor trends, troubleshoot performance bottlenecks, tune provisioned performance, and build dashboards or alarms to automate responses.

Detecting CGNAT to Reduce Collateral Damage Globally

🔎Cloudflare describes a supervised approach to detect large-scale IP sharing — especially CGNAT — to reduce collateral damage from IP-based security controls. They build labeled training data using distributed traceroutes (RIPE Atlas), PTR/WHOIS scraping, and lists of known VPN/proxy exit IPs, then extract per-IP and per-/24 behavioral features. An XGBoost model trained on these features achieves high accuracy, enabling operators to tune rate limits and blocklists with less harm to innocent users, particularly in regions with heavy IP sharing.

Open-Source b3 Benchmark Boosts LLM Security Testing

🛡️ The UK AI Security Institute (AISI), Check Point and Lakera have launched b3, an open-source benchmark to assess and strengthen the security of backbone LLMs that power AI agents. b3 focuses on the specific LLM calls within agent workflows where malicious inputs can trigger harmful outputs, using 10 representative "threat snapshots" combined with a dataset of 19,433 adversarial attacks from Lakera’s Gandalf initiative. The benchmark surfaces vulnerabilities such as system prompt exfiltration, phishing link insertion, malicious code injection, denial-of-service and unauthorized tool calls, making LLM security more measurable, reproducible and comparable across models and applications.

Google Cloud launches unified home for technical docs

📚 Google Cloud has consolidated all technical documentation onto a new, dedicated platform to improve discoverability and support AI-driven experiences. By centralizing content on a unified site and integrating Gemini into authoring tools, Google aims to accelerate content creation and deliver context-aware assistance. The site offers faster performance, AI-powered translation across 12 languages, and preserves existing URL patterns to minimize disruption.

AWS Control Tower Now Available in Asia Pacific (NZ)

🚀 AWS Control Tower is now available in the AWS Asia Pacific (New Zealand) Region, bringing the service to 34 AWS Regions plus the AWS GovCloud (US) Regions. The service simplifies setup and governance of a secure, multi-account AWS environment, enabling a landing zone in 30 minutes or less and centralized visibility into compliance status. Existing customers can extend governance to the new region via the Control Tower settings by selecting regions and updating their landing zone; once applied, governed accounts, managed accounts, and registered organizational units (OUs) will be managed in the new region.

Canada Warns Hacktivists Tampered With Critical Systems

⚠️ The Canadian Centre for Cyber Security warns that hacktivists recently breached multiple internet-exposed industrial control systems across Canada. Attackers modified settings at a water treatment facility, an oil and gas site (manipulating an Automated Tank Gauge), and a farm grain dryer, causing disruptions, false alarms, and potentially unsafe conditions. Authorities describe the intrusions as opportunistic attempts to attract media attention and erode public trust rather than highly sophisticated campaigns. The bulletin urges organizations to inventory exposed ICS assets, remove direct internet access, use VPNs with two‑factor authentication, keep firmware updated, and report suspicious activity.

Microsoft fixes 0x800F081F Windows Update failures

🔧 Microsoft has resolved a known issue that caused Windows updates to fail with error code 0x800F081F on Windows 11 24H2 devices. The problem affected systems that installed the KB5050094 January 2025 preview cumulative update and subsequent updates, and Microsoft traced the failures to missing language packs and feature payloads removed by ACR/MCR cleanup. Microsoft acknowledged the issue on October 15 and fixed it in the KB5067036 October 2025 preview update. Administrators who cannot install the optional preview immediately can perform an In‑Place Upgrade via Windows installation media or the Settings > System > Recovery workflow to restore missing components without losing files or apps.

Measuring TCP Connection Characteristics at Scale Globally

📊 Cloudflare shares aggregate measurements of TCP connections observed across its global CDN from a uniformly sampled 1% snapshot (Oct 7–15, 2025). The dataset records socket-level metadata via TCP_INFO, SNI, and request counts, limited to gracefully closed connections with at least one HTTP request. Results highlight strong heavy-tailed behavior: most connections are short and small while a minority carry massive volumes, and HTTP/2 shows higher reuse and larger responses than HTTP/1.x.

Preparing for the Digital Battlefield of Identity Risk

🔒 BeyondTrust's 2026 predictions argue that the next major breaches will stem from unmanaged identity debt rather than simple phishing. The report highlights three identity-driven threats: agentic AI acting as privileged deputies vulnerable to prompt manipulation, automated "account poisoning" in financial systems, and long-dormant "ghost" identities surfacing in legacy IAM. The authors recommend an identity-first posture with strict least-privilege, context-aware controls, real-time auditing, and stronger identity governance.

BSI Warns of Growing AI Governance Gap in Business

⚠️ The British Standards Institution warns of a widening AI governance gap as many organisations accelerate AI adoption without adequate controls. An AI-assisted review of 100+ annual reports and two polls of 850+ senior leaders found strong investment intent but sparse governance: only 24% have a formal AI program and 47% use formal processes. The report highlights weaknesses in incident management, training-data oversight and inconsistent approaches across markets.

Notable Post-Quantum Cryptography Initiatives 2023

🔐 The article surveys major post‑quantum cryptography (PQC) initiatives from 2023–2025 that aim to prepare governments and industry for an eventual Q‑Day. It highlights NIST's standardization of ML‑KEM, ML‑DSA and SLH‑DSA (with HQC later selected) and vendor adoption by Google, AWS, Microsoft and others, including Chrome's default hybrid key exchange. Collaborative efforts such as the Linux Foundation's PQCA, the PQC Coalition and IETF's PQUIP are creating tooling, guidance and implementations, while agencies and standards bodies provide migration roadmaps and practical advice on crypto agility and hybrid strategies to mitigate "harvest now, decrypt later" risks.

Amazon EC2 High-Memory U7i-8tb Instances in London

🚀 AWS has launched Amazon EC2 U7i-8tb (u7i-8tb.112xlarge) instances in the Europe (London) region, offering 8 TiB of DDR5 memory and 448 vCPUs for memory-intensive workloads. Powered by custom fourth-generation Intel Xeon Scalable processors (Sapphire Rapids), these 7th-generation instances deliver up to 135% more compute than prior U-1 instances and support up to 100 Gbps for EBS and networking with ENA Express. They are aimed at mission-critical in-memory databases like SAP HANA, Oracle, and SQL Server.

Defending QUIC Against Acknowledgement-Based DDoS Attacks

🔒 Cloudflare patched two QUIC ACK-handling vulnerabilities (CVE-2025-4820, CVE-2025-4821) affecting its open-source quiche library and services using it. The flaws—missing ACK range validation and an Optimistic ACK attack—could let a malicious peer inflate server send rates, driving CPU and network amplification. Cloudflare implemented ACK range enforcement and a dynamic, CWND-aware skip frequency; quiche versions prior to 0.24.4 were affected.

Lower Your TCO with Check Point's SASE Platform

🔒 Check Point’s SASE offering and its TCO savings calculator explain how consolidating security and networking into a cloud-delivered SASE reduces operational complexity and costs compared with traditional VPN-based architectures. The article explains product, operational and performance savings and quantifies ROI improvements when replacing hardware-heavy VPN backhauling. It highlights benefits such as simplified management, faster time-to-value, improved throughput and reduced exposure to risk for distributed users.

SBOM Implementation: Eight Best Tools for Supply Chains

🔍 To secure modern software you must know what's inside it, and a Software Bill of Materials (SBOM) provides that transparency. An SBOM should be machine-readable, include component, version, license and patch data, and be generated automatically in CI/CD using standards like SPDX, CycloneDX or SWID. The article reviews eight tools — including Anchore, FOSSA, GitLab and Mend — that generate, analyze and manage SBOMs across the build, registry and runtime lifecycles.

AI Literacy Is Critical for Cybersecurity Readiness

🔒 Artificial intelligence is reshaping cybersecurity, creating both enhanced defensive capabilities and new risks that require broad AI literacy. The White House's America’s AI Action Plan and Fortinet’s 2025 Cybersecurity Global Skills Gap Report show strong adoption—97% of organizations use or plan AI in security—yet 48% cite lack of staff expertise as a major barrier. Fortinet recommends targeted training, policies for generative AI use, and its Security Awareness modules to help close the gap and reduce threat exposure.

Plugin Flaw Lets Subscribers Read Any Server File Now

⚠️ The Anti-Malware Security and Brute-Force Firewall WordPress plugin (versions up to 4.23.81) contains a vulnerability (CVE-2025-11705) that allows low-privileged subscribers to read arbitrary files on the server. The issue is caused by missing capability checks in the GOTMLS_ajax_scan() AJAX handler, enabling attackers who can obtain a nonce to access sensitive files like wp-config.php. The developer released v4.23.83 on October 15, which adds a proper capability check via a new GOTMLS_kill_invalid_user() function; administrators of membership sites should update immediately.

How We Escaped the Linux Networking Stack for Soft-Unicast

🐟 Cloudflare describes building "fish" (SLATFATF), a service to egress packets using soft-unicast address space and the challenges encountered with the Linux networking stack. They found that conntrack and Netfilter interactions can silently rewrite source ports and break connections, so they evaluated several approaches including Netlink manipulation, TCP_FASTOPEN_CONNECT sockets, and routing fixes. Ultimately they preferred terminating and proxying TCP locally to avoid fragile kernel workarounds, after testing that disabling early demux produced only modest CPU effects.

Top 7 Agentic AI Use Cases Transforming Cybersecurity

🔐 Agentic AI is presented as a practical cybersecurity capability that can operate without direct human supervision, handling high-volume, time-sensitive tasks at machine speed. Industry leaders from Zoom to Dell Technologies and Deloitte highlight seven priority use cases — from autonomous threat detection and SOC augmentation to real-time zero‑trust enforcement — that capitalize on AI's scale and speed. The technology aims to reduce alert fatigue, accelerate mitigation, and free human teams for strategic work.

Social Media Privacy Ranking 2025: Platforms Compared

🔒 Incogni’s Social Media Privacy Ranking 2025 evaluates 15 major platforms across data collection, resale, AI training, privacy settings, and regulatory fines. The analysis identifies Pinterest and Quora as the most privacy-conscious, while TikTok and Facebook rank lowest, driven by extensive data use and historical penalties. The report highlights practical differences in opt-outs, data-sharing, and default settings and recommends users review privacy controls and use Kaspersky’s Privacy Checker.

Visibility Gaps in Patching and Vulnerability Remediation

🔍 Modern patch management demands centralized visibility, faster prioritization, and accountable remediation to close growing exposure gaps. The article highlights how legacy systems such as WSUS and SCCM struggle with mixed environments, remote endpoints, and third-party applications, producing inconsistent patch states and unnoticed failures. Action1 is presented as a cloud-native platform that inventories endpoints, maps missing updates to CVEs, automates targeted deployments and retries failures, and provides audit-ready reporting to unify security and IT workflows.

Building a High-Performance VPN with Linux for WARP

🛡️ Cloudflare explains how it initially implemented WARP as a Layer‑3 VPN by leveraging the Linux networking stack to egress arbitrary user packets from edge machines. They used a TUN device, nftables/Netfilter rules and the conntrack module to perform NAT, mark flows, and distinguish client traffic from locally‑originated traffic. Core tunnel handling was written in Rust (boringtun/WireGuard) and paired with MASQUE and defense‑in‑depth controls. The approach worked but required one IPv4 address per server, creating a scalability and cost challenge that led them to explore IP sharing.

Practical AI Tactics for GRC: Opportunities and Risks

🔍 Join a free expert webinar that translates rapid AI advances into practical, actionable tactics for Governance, Risk, and Compliance (GRC) teams. The session will showcase real-world examples of AI improving compliance workflows, early lessons from agentic AI deployments, and the common risks teams often overlook. Expect clear guidance on mitigation strategies, regulatory gaps, and how to prepare your team to make AI a competitive compliance advantage.

CrowdStrike Falcon Achieves 100% in SE Labs EPS Evaluation

🛡️ In SE Labs’ September 2025 Enterprise Endpoint Security evaluation, CrowdStrike Falcon earned the AAA EPS certification and recorded 100% Protection Accuracy, 100% Legitimate Accuracy and 100% Total Accuracy with zero false positives. SE Labs tested 75 targeted and 25 general attacks across full kill chains; Falcon detected and blocked or neutralized every attempt. The platform also won three SE Labs awards, including Enterprise Endpoint (Windows), Enterprise Ransomware, and Falcon Go for Small Business New Endpoint.

Cybersecurity on a Budget: Strategies for Downturn

🔒 During economic downturns, organizations must preserve cybersecurity with constrained budgets by prioritizing risk-based controls, hardening existing systems, and blending open- and closed-source tools. The blog recommends defense-in-depth, isolating legacy hardware, disabling unnecessary features, and tuning EDR/AV, logging, and network filters to reduce exposure. It also advises retaining skilled incident response partners and investing selectively in early-to-mid career talent to maintain long-term resilience.

Cybersecurity Awareness Month 2025: Deepfakes and Trust

🔍 Advances in AI and deepfake technology make it increasingly difficult to tell what’s real online, enabling convincingly fake videos, images and audio that scammers exploit to deceive individuals and organizations. Threat actors use deepfakes of public figures to promote bogus investments, create synthetic nudes to extort victims and deploy fake voices and videos to trick employees into wiring corporate funds. Watch ESET Chief Security Evangelist Tony Anscombe outline practical defenses to recognize and resist deepfakes, and explore other Cybersecurity Awareness Month videos on authentication, patching, ransomware and shadow IT.