All news with #patch release tag

ℹ️ Windows 11 25H2 (2025 Update) is now generally available. The minor release shares the same platform as 24H2 and is rolled out gradually, with devices on 24H2 updated via small enablement packages (<200 KB) while systems on 23H2 receive a full OS swap. Enterprise-focused changes include Wi‑Fi 7 support, improved vulnerability detection, and an optional Group Policy to remove select preinstalled Store apps. Microsoft also removed legacy tools such as PowerShell 2.0 and WMIC.

🔒 Western Digital issued firmware 5.31.108 to fix a critical OS command injection (CVE-2025-30247) in the My Cloud web UI that allows remote execution via crafted HTTP POST requests. The update addresses multiple consumer and small-business NAS models, though My Cloud DL2100 and DL4100 have reached end of support and may not receive fixes. WD urges immediate patching; affected owners should apply the firmware or disconnect devices from the internet until updated.

🛠 Microsoft released the optional preview cumulative update KB5065789 for Windows 11 24H2 (build 26100.6725), delivering 41 non-security changes and fixes. Highlights include new AI actions in File Explorer, an updated Click to Do menu, an Administrator Protection Preview, and passkey plugin integration. The update addresses high CPU usage in Windows Sandbox (VmmemCMFirstBoot), WSUS-related update failures, Windows Hello 0x80090010 errors on Entra ID–joined devices, HDR and Hyper-V TPM issues, and gaming performance with overlays. Microsoft lists a known DRM-related playback issue; install via Settings > Windows Update or the Microsoft Update Catalog.

🔒 Amazon RDS for PostgreSQL now provides Extended Support minor versions 12.22-rds.20250814 and 11.22-rds.20250814, delivering critical security patches and bug fixes for affected instances. We recommend upgrading RDS instances to these releases to maintain security and performance. Extended Support offers up to three years of additional fixes after community support ends. Use automatic minor upgrades or RDS Blue/Green deployments to apply updates during maintenance windows.

🔧 Microsoft released the final non-security preview update for Windows 10 22H2 (KB5066198), delivering fixes for the out-of-box experience and SMBv1 connectivity over NetBIOS over TCP/IP (NetBT). This optional cumulative update lets administrators test improvements before they roll into the next month’s Patch Tuesday and raises systems to build 19045.6396. KB5066198 also resolves an Autopilot Enrollment Status Page (ESP) OOBE loading issue and includes prior fixes for unexpected UAC prompts and NDI streaming performance regressions. Install via Windows Update by choosing 'Download and install' for optional updates or obtain the package from the Microsoft Update Catalog.

🛡️ Microsoft will provide no-cost Extended Security Updates (ESU) for Windows 10 consumer users across the European Economic Area (EEA). The company adjusted enrollment so consumers can access critical patches without tying updates to Windows Backup or Microsoft Rewards, following pressure from Euroconsumers. Microsoft says the change aims to support customers transitioning to Windows 11 before Windows 10 reaches end of support on October 14, 2025.

🔒SolarWinds has issued a third patch for a critical Java deserialization vulnerability in its Web Help Desk product. The vendor describes the new advisory as a patch bypass of CVE-2024-28988, which itself bypassed CVE-2024-28986, and has designated the latest issue CVE-2025-26399. The underlying unsafe Java deserialization flaw in the AjaxProxy component can permit unauthenticated remote code execution and is rated 9.8/10 on the CVSS scale.

⚠ Libraesva issued an emergency update for ESG to fix a command injection vulnerability (CVE-2025-59689) triggered by a specially crafted compressed email attachment. The flaw allowed arbitrary shell commands to run as a non-privileged user and was confirmed exploited by actors believed to be state-sponsored. Fixed releases were auto-deployed to cloud and on-premise customers; end-of-life versions require manual upgrades.

🔒 SolarWinds has released a hotfix addressing a critical unauthenticated remote code execution vulnerability in Web Help Desk tracked as CVE-2025-26399. The flaw affects WHD 12.8.7 and is caused by unsafe deserialization in the AjaxProxy component, described as a patch bypass of earlier CVE-2024-28986/28988 fixes. Administrators should obtain the hotfix from the SolarWinds Customer Portal and follow the vendor’s JAR replacement steps promptly.

🛡️ SonicWall has released firmware 10.2.2.2-92sv for the SMA 100 series that adds additional file checking and the ability to remove known user‑mode rootkit malware. The update targets the OVERSTEP rootkit observed by Google's GTIG and is recommended for SMA 210, 410, and 500v customers. SonicWall urges immediate upgrade and adherence to earlier mitigations, including credential resets and forensic review.

🔧 SolarWinds has released a hotfix to address a critical deserialization vulnerability in Web Help Desk that affects versions up to 12.8.7, tracked as CVE-2025-26399 (CVSS 9.8). The unauthenticated AjaxProxy flaw can enable remote command execution on vulnerable hosts if exploited. An anonymous researcher working with the Trend Micro Zero Day Initiative reported the issue. SolarWinds recommends immediate upgrade to 12.8.7 HF1 to mitigate risk.

⚠️ CISA has added CVE-2025-10585, a Google Chromium V8 type confusion vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. This class of flaw is a common browser attack vector and poses substantial risk to browsers and systems that embed V8. Under BOD 22-01, Federal Civilian Executive Branch agencies must remediate cataloged vulnerabilities by required due dates; CISA strongly urges all organizations to prioritize timely remediation and continued vigilance.

🔐 GitHub said it will change npm authentication and publishing practices in the near future to address recent supply-chain attacks, including the Shai-Hulud incident. The company will require 2FA for local publishes, deprecate legacy tokens and TOTP in favor of FIDO, introduce seven-day granular publishing tokens, and enable OIDC-based trusted publishing. The npm CLI will also auto-generate provenance attestations to prove source and build environment.

🔧 Microsoft removed a compatibility hold that prevented devices with integrated cameras from installing Windows 11, version 24H2 after fixing a face/object detection bug that could cause the Camera app, Windows Hello facial sign-in, and other camera-using apps to freeze. The safeguard (ID 53340062) has been lifted; eligible devices with no other holds should be offered the update via Windows Update within 48 hours, and restarting may speed the offer. Microsoft recommends installing the latest security update, which includes the fix.

🔁 Mozilla now allows Firefox extension developers to roll back recently approved versions to a previously approved release, enabling fast mitigation of critical bugs and regressions. When reverted, users cannot install the problematic version, and browsers with automatic updates will revert affected installations within 24 hours. Developers can republish a prior build via the Developer Hub or the Add-on Submission API. Rollbacks require at least two approved versions on addons.mozilla.org, while self-distributed extensions may revert to any approved version.

⚠ Users of GoAnywhere MFT are urged to install an urgent patch for a critical insecure deserialization vulnerability tracked as CVE-2025-10035, rated CVSS 10. The flaw resides in the License Servlet and can allow an attacker with access to the Admin Console to submit a forged license response that deserializes an arbitrary, actor-controlled object, enabling remote command execution. Fortra released fixes in versions 7.8.4 and 7.6.3 and advises customers not to expose the Admin Console directly to the internet. The issue closely mirrors a 2023 vulnerability that was widely exploited by ransomware groups, elevating the risk of rapid exploitation.

🔒 Fortra has released security updates to address a maximum-severity deserialization vulnerability in the License Servlet of GoAnywhere MFT (CVE-2025-10035) that can lead to command injection when a forged license response is accepted. The vendor issued patched builds — GoAnywhere MFT 7.8.4 and Sustain Release 7.6.3 — and advised administrators to remove public access to the Admin Console if immediate patching is not possible. Shadowserver is monitoring over 470 instances, and Fortra emphasized that exploitation is highly dependent on the Admin Console being internet-exposed.

🔒 Fortra has released an urgent patch for GoAnywhere MFT to address a critical deserialization flaw (CVE-2025-10035, CVSS 10.0) in the License Servlet that can allow execution of arbitrary commands when an attacker supplies a forged license response signature. The vendor recommends updating to v7.8.4 or the Sustain Release 7.6.3. If patching cannot be applied immediately, ensure the Admin Console is not publicly accessible. No active exploitation has been reported.

🔒 WatchGuard has patched a critical IKEv2 "iked out of bounds write" vulnerability (CVE-2025-9242) that affects nearly three dozen current and legacy Firebox models. The flaw can enable remote code execution and authentication bypass via VPN ports UDP 500 and UDP 4500 and carries a CVSS score of 9.3, making prompt updates essential. Administrators should update to the vendor-supplied Fireware releases or apply the provided mitigations for environments that cannot upgrade immediately.

🔔 A vulnerability in Westermo WeOS 5 when IPSec is enabled can allow a specially crafted ESP packet to trigger an immediate device reboot. Westermo reported the flaw and released WeOS 5 version 5.24.0 to address the issue. CISA rates the vulnerability as remotely exploitable with a CVSS v4 score of 8.2 and notes high attack complexity.