All news with #patch release tag

🔧 Microsoft has resolved severe lag and stuttering issues affecting NDI streaming on Windows 10 and Windows 11 that appeared after the August 2025 cumulative security updates. The root cause was tied to KB5063878 and KB5063709 and manifested as dropped NDI traffic and degraded performance specifically over RUDP connections, while UDP and Single-TCP streams were unaffected. On September 9, 2025, Microsoft released fixes (KB5065426 and KB5065429) and recommends applying those updates; NDI also published a temporary workaround to switch Receive Mode to Single TCP or UDP in the NDI Tools Access Manager for systems that cannot immediately update.

🔒 Adobe has issued an emergency patch for a critical input-validation vulnerability dubbed SessionReaper in Adobe Commerce and Magento. The flaw, tracked as CVE-2025-542360 with a CVSS score of 9.1, affects multiple 2.4.x releases and earlier. Sansec researchers said the bug can enable session hijacking and, according to the original finder, may allow unauthenticated remote code execution in some circumstances. Administrators are advised to deploy APSB25-88 immediately or enable a WAF as a temporary mitigation.

🔒 SAP on Tuesday released security updates addressing multiple vulnerabilities, including three critical flaws in SAP NetWeaver that could enable remote code execution and arbitrary file uploads (notably CVE-2025-42944, CVE-2025-42922 and CVE-2025-42958). The company also fixed a high-severity input-validation issue in SAP S/4HANA (CVE-2025-42916). Security researchers recommend immediate patching and temporary mitigations such as P4 port filtering to limit exposure.

🔒 Amazon Relational Database Service (RDS) for Microsoft SQL Server now supports the latest General Distribution Release (GDR) updates for SQL Server 2016 SP3, 2017 CU31, 2019 CU32, and 2022 CU20. The supported RDS engine versions map to KB5063762, KB5063759, KB5063757, and KB5063814 respectively. These GDRs address vulnerabilities tracked as CVE-2025-49758, CVE-2025-24999, CVE-2025-49759, CVE-2025-53727, and CVE-2025-47954. We recommend that customers upgrade their RDS instances via the RDS Management Console, AWS SDK, or AWS CLI and follow the RDS SQL Server upgrade guidance.

🔒 CISA has ordered immediate patching of a critical deserialization vulnerability in Sitecore (CVE-2025-53690), rated 9.0, after active exploitation was observed. The flaw arises from exposed ASP.NET machine keys—some copied from older deployment guides—and allows ViewState deserialization that leads to remote code execution. Agencies must rotate machine keys, harden configurations, and scan for compromise indicators by September 25, 2025, to mitigate further intrusions.

🚀 Amazon Aurora PostgreSQL Limitless Database now supports PostgreSQL 16.9 compatibility. This release delivers PostgreSQL community bug fixes and performance improvements along with Aurora-specific additions, including support for the hstore and auto_explain extensions. The serverless, distributed engine transparently scales compute and queries across multiple Aurora Serverless instances while preserving single-database transactional consistency, distributed query planning, and transaction management. Available across multiple AWS regions; review the documentation and pricing for details.

🔔 Amazon RDS Custom for SQL Server now supports the latest Microsoft GDR updates, including SQL Server 2019 CU32 (KB5063757) — RDS version 15.00.4440.1.v1 — and SQL Server 2022 CU20 (KB5063814) — RDS version 16.00.4210.1.v1. These GDRs remediate multiple vulnerabilities (CVE-2025-49758, CVE-2025-24999, CVE-2025-49759, CVE-2025-53727, CVE-2025-47954). We recommend upgrading instances via the Amazon RDS Management Console or programmatically with the AWS SDK/CLI, and following the Amazon RDS Custom User Guide for detailed upgrade instructions.

🔒TP-Link has confirmed an unpatched zero-day in its CWMP implementation that can enable remote code execution on multiple routers. Independent researcher Mehrun (ByteRay) reported the issue to TP-Link on May 11, 2024; the flaw is a stack-based buffer overflow in the SOAP SetParameterValues handler caused by unbounded strncpy calls. TP-Link says a patch exists for some European firmware builds and that fixes for U.S. and other global versions are in development; users should update firmware, change default admin credentials, and disable CWMP if it is not required.

🔒 Mandiant disrupted an active exploitation of a critical zero-day in Sitecore's Experience Manager and Experience Platform that permits remote code execution via ViewState deserialization. Publicly disclosed on September 3 as CVE-2025-53690 (CVSS 9.0), the flaw affects Sitecore versions up to 9.0 when deployments retained the sample ASP.NET machine key published in older deployment guides. Attackers used the vulnerability to deliver WEEPSTEEL and other tooling, harvest credentials and perform lateral movement. Sitecore has issued a security advisory, notified impacted customers and says recent deployments now auto-generate unique machine keys.

🔒 Google has released the September 2025 Android security update addressing 84 vulnerabilities, including two zero-day flaws observed in limited, targeted exploitation: CVE-2025-38352 (Linux kernel) and CVE-2025-48543 (Android Runtime). The bulletin also patches four critical issues — including an RCE in the System component and three Qualcomm vulnerabilities affecting modem and data stacks. Users are urged to install security patch level 2025-09-01 or 2025-09-05 via Settings > System > Software updates > System update.

🔒 Google has released its September 2025 Android security updates addressing 120 vulnerabilities, including two issues that Google says have been exploited in limited, targeted attacks. The two highlighted flaws are CVE-2025-38352 (CVSS 7.4), affecting the Linux Kernel, and CVE-2025-48543, impacting the Android Runtime; both can enable local privilege escalation with no user interaction. Google issued patch levels 2025-09-01 and 2025-09-05 to let partners deploy common fixes more quickly and credited Benoît Sevens of TAG with reporting the kernel issue.

🚨 This weekly recap highlights multiple cross-cutting incidents, from an actively exploited WhatsApp 0‑day to a critical Docker Desktop bug and a Salesforce data-exfiltration campaign. It shows how attackers combine stolen OAuth tokens, unpatched software, and deceptive web content to escalate access. Vendors issued patches and advisories for numerous CVEs; defenders should prioritize patching, token hygiene, and targeted monitoring. Practical steps include auditing MCP integrations, enforcing zero-trust controls, and hunting for chained compromises.

🔒 WhatsApp has issued emergency updates for iOS and macOS to fix CVE-2025-55177, a high-severity authorization flaw that may have been exploited alongside an Apple ImageIO zero-day (CVE-2025-43300). The bug could allow processing of content from an arbitrary URL on a target device and affects specific iOS, Business iOS, and Mac app versions. Users are urged to update immediately; confirmed targets were advised to perform a full factory reset.

🔧 Microsoft published the optional KB5064081 preview cumulative update for Windows 11 24H2, moving affected systems to build 26100.5074 and rolling out thirty-six new features and fixes. The update standardizes CPU reporting in Task Manager so the Processes tab now uses the same calculation as Performance and Users: (Δ Process CPU Time) ÷ (Δ Elapsed Time × Logical Processors), making metrics consistent and aligning them with third‑party monitors. Users who want the legacy view can enable an optional CPU Utility column in the Details tab. The release also bundles UI, File Explorer, Taskbar, Windows Hello, backup, and numerous bug fixes, while Microsoft lists two known issues (CertEnroll errors and NDI streaming lag).

🔧 Microsoft has addressed a known issue that produced false CertificateServicesClient (CertEnroll) error events after the July 2025 non-security preview (KB5062660) and subsequent Windows 11 24H2 updates. The events referenced the Microsoft Pluton Cryptographic Provider not being loaded but were benign and caused by a partially integrated feature still under development. The fix is rolling out automatically and requires no user action.

🔒 WhatsApp has patched a zero-click vulnerability (CVE-2025-55177) impacting WhatsApp for iOS prior to 2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78. The flaw involved incomplete authorization of linked-device synchronization messages that could trigger processing of content from an arbitrary URL on a target device. WhatsApp said the bug may have been chained with an Apple OS-level zero-day (CVE-2025-43300) and exploited in targeted, sophisticated attacks. Potentially impacted users have been urged to perform a factory reset and keep their operating systems and apps up to date.

🔍 Microsoft says its August 2025 security update, KB5063878, is not connected to recent reports of SSD and HDD failures. After internal testing and telemetry analysis, Redmond said it could not reproduce the corruption or drive losses and found no increase in disk failures following the Windows 11 24H2 update. Microsoft is working with storage partners and controller vendors and will continue to monitor customer feedback while investigating any new reports.

🔒 Click Studios released Passwordstate 9.9 (Build 9972) on August 28, 2025, to remediate a high-severity authentication bypass that could be triggered via a carefully crafted URL against the product's Emergency Access page. The update also introduces enhanced safeguards in the web interface and browser extension to mitigate DOM-based clickjacking attacks. The company noted that no CVE has been assigned yet and emphasized that customers should apply the update promptly. Passwordstate is used by thousands of organizations globally, increasing the urgency of patching.

🔔 Amazon RDS Custom for SQL Server now supports new General Distribution Releases for Microsoft SQL Server 2019 (RDS version 15.00.4435.7.v1) and 2022 (RDS version 16.00.4200.1.v1). The new GDRs address vulnerabilities tracked as CVE-2025-49717, CVE-2025-49718, and CVE-2025-49719 and correspond to Microsoft's KB5058722 and KB5058721 release notes. AWS recommends upgrading affected Amazon RDS Custom for SQL Server instances using the Amazon RDS Management Console, or programmatically via the AWS SDK or CLI, and consulting the Amazon RDS Custom User Guide for upgrade procedures.

🚀 Amazon Web Services has designated Aurora MySQL 3.10 (compatible with MySQL 8.0.42) as a long-term support (LTS) minor release, effective immediately. Clusters that choose the LTS minor version can remain on that release for at least three years or until the major engine’s standard support ends, whichever is sooner. During the LTS lifecycle, AWS will publish only targeted patches addressing select high-severity security and operational issues and will not introduce new features. This LTS designation is available in all regions where Aurora MySQL is offered.