👁️🗨️At a Glance
- This week saw emergency patching and confirmed exploitation across widely deployed platforms.
- Microsoft issued out-of-band updates for a critical WSUS remote code execution flaw (CVE-2025-59287), with CISA adding it to the KEV catalog and multiple researchers observing in-the-wild exploitation within hours.
- Oracle E-Business Suite remained a prime target: organizations continued remediation for CVE-2025-61882 (pre-auth RCE) and CVE-2025-61884 (pre-auth SSRF), the latter also added to CISA’s KEV.
- Kaspersky linked a March Chrome sandbox-escape zero-day (CVE-2025-2783) to toolsets associated with Memento Labs (ex-Hacking Team), highlighting ongoing risks from commercial spyware vendors.
- Beyond zero-days, sector impacts included CISA’s Emergency Directive on F5 devices after theft of BIG-IP source code, a still-costly ripple effect from Jaguar Land Rover’s September cyberattack, and a healthcare breach in Montana exposing up to 462,000 individuals via a business associate.
🔦Breach Spotlight: BCBS of Montana
📈Current Cyberthreat Trends
⚠️Priority Incidents & Exploited Vulnerabilities
- Microsoft WSUS RCE — CVE-2025-59287
- Microsoft released out-of-band cumulative updates on Oct 23–24 for all supported Windows Server versions to fully address a WSUS reporting services pre-auth RCE. CISA added the CVE to KEV Oct 24 and urged immediate patching or temporary mitigations (disable WSUS role or block ports 8530/8531) with a reboot requirement post-install. Public PoC and active exploitation were reported within hours by multiple vendors.
- Operational risk: a compromised WSUS can be weaponized as an internal supply chain to push malicious updates downstream; several responders warn the flaw is potentially wormable between WSUS servers.Oracle E-Business Suite — CVE-2025-61882 & CVE-2025-61884 )
- Oracle E-Business Suite — CVE-2025-61882 & CVE-2025-61884 )
- CVE‑2025‑61882 (RCE,
Oracle issued emergency fixes for two pre-auth issues targeting EBS: a BI Publisher Integration RCE (61882) exploited in August data-theft extortion attributed to Cl0p, and an Oracle Configurator SSRF (61884) linked to a leaked exploit and confirmed by CISA as actively exploited. Integrigy notes additional MOS patches and configuration hardening updates beyond the initial alert.
- CVE‑2025‑61882 (RCE,
- Chrome Sandbox Escape — CVE-2025-2783
- Kaspersky’s new analysis connects Operation ForumTroll’s Chrome sandbox-escape (patched in March) to the LeetAgent loader and Dante spyware from Memento Labs (formerly Hacking Team). The campaign used short-lived phishing links and exploited a Windows pseudo-handle quirk to achieve code execution and persistence via COM hijacking. Firefox fixed a related issue (CVE-2025-2857).
- F5 Emergency Directive (ED 26-01)
-
Following disclosure that a nation-state actor stole portions of BIG-IP source code and undisclosed vulnerability information, CISA mandated federal agencies inventory and update F5 products by strict October deadlines, harden public interfaces, and disconnect end-of-support devices. External analyses describe significant enterprise risk given BIG-IP’s position at the network edge.
-
- Healthcare Breach — Blue Cross Blue Shield of Montana
-
Independent modeling by the UK Cyber Monitoring Centre estimates the JLR cyberattack’s UK economic impact at ~£1.9B, affecting over 5,000 organizations through supply-chain disruption; production restarts remained phased through October. Government support included a £1.5B loan guarantee to stabilize suppliers.
-
- Jaguar Land Rover — Macroeconomic Fallout
🖥️AI-Enabled Phishing & Social Engineering
-
KnowBe4’s early-2025 data shows 82.6% of phishing emails exhibited some use of AI, with a rise in polymorphic campaigns and ransomware payloads; top abused platforms for lures include Microsoft, DocuSign, Google, PayPal, and Salesforce.
🚩Insider Threat Indicators
- Ransomware crews increasingly recruit insiders to sell access. Indicators: sudden privilege escalations, anomalous data staging to non‑production shares, unusual after‑hours authentication from on‑prem to cloud, and DLP alerts on HR/Finance exports.
🛡️Recommended Actions— Next 7 days
- Prioritize WSUS patching; confirm WSUS role scope; block 8530/8531 or disable role until patched; reboot post-update.
- Oracle EBS: apply latest CPU plus CVE-2025-61882/61884 patches; enforce URL allowlists for Oracle Configurator; block legacy endpoints; hunt using published IOCs.
- F5: complete inventory, harden management interfaces, fast-track to latest images, validate checksums, and disconnect EOS devices; monitor for cookie leakage per CISA ED.
- Chrome/Browser fleet: confirm versions with March 26 (or later) patches; review EDR telemetry for COM-hijack persistence and unusual Fastly-hosted C2.
- Healthcare/PHI handling: verify BAAs and vendor monitoring; enable abnormal exfiltration alerts; prepare member-notification playbooks and identity protection support.
- Phishing controls: enforce phishing-resistant MFA, DMARC/ARC, and adaptive banners; simulate polymorphic phishing; retrain high-risk roles (help desk, HR, finance).
🗂️Resources & References
- State of Montana; HIPAA Journal; Daily Montanan (Oct 22-24, 2025)
- CISA WSUS OOB/KEV (Oct 24, 2025); CISA Advisories Portal
- Microsoft KB5070883 (Windows Server 2019 OOB) and related KBs
- BleepingComputer, The Hacker News, SecurityWeek reporting on CVE-2025-59287 exploitation
- Oracle Security Alerts CVE-2025-61882, CVE-2025-61884; Integrigy guidance; CISA KEV update
- Google Threat Intelligence/Mandiant blog on Oracle EBS campaign
- Kaspersky/THN/SecurityWeek on Chrome CVE-2025-2783 & Memento Labs “Dante”
- CISA Emergency Directive 26-01 for F5; CBS News; Ars Technica; FedRAMP blog
- CMC Statement on JLR; Ars Technica; CNBC; The Register; The Independent
- Montana Commissioner announcement; HIPAA Journal; Daily Montanan
- KnowBe4 Phishing Threat Trends (82.6% AI)
