⚡ Weekly Recap: WSUS Exploited, LockBit 5.0 Returns, Telegram Backdoor, F5 Breach Widens
- CVEs
- CVE-2025-59287CVE-2025-54957CVE-2025-6950CVE-2025-6893CVE-2025-36727CVE-2025-36728CVE-2025-8078CVE-2025-9133CVE-2025-61932CVE-2025-61928CVE-2025-57738CVE-2025-40778CVE-2025-40780CVE-2025-8677CVE-2025-11411CVE-2025-61865CVE-2025-53072CVE-2025-62481CVE-2025-11702CVE-2025-10497CVE-2025-11447CVE-2025-22167CVE-2025-54918CVE-2025-52882
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-11447+1 related CVE | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have… | 7.5 | <1% | ||
| CVE-2025-11411 | NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks | 5.7 | <1% | ||
| CVE-2025-11702 | GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an… | 8.8 | <1% | ||
| CVE-2025-22167 | This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions | 8.7 | <1% | ||
CVE-2025-36727+1 related CVE | Inclusion of Functionality from Untrusted Control Sphere vulnerability in Simplehelp.This issue affects Simplehelp | 8.8 | <1% | ||
| CVE-2025-40778 | Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache | 8.6 | <1% | ||
| CVE-2025-40780 | In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source… | 8.6 | <1% | ||
| CVE-2025-52882 | Claude Code: Claude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm… | 8.8 | <1% | ||
CVE-2025-53072+1 related CVE | Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component | 9.8 | <1% | ||
| CVE-2025-54918 | Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network | 8.8 | 19% | ||
| CVE-2025-54957 | An issue was discovered in Dolby UDC 4.5 through 4.13 | 9.8 | 2% | ||
| CVE-2025-57738 | Groovy Code Injection RCE in Apache Syncope Core | 7.2 | 23% | ||
| CVE-2025-59287 | Deserialization RCE in Microsoft WSUS (Windows Server) | 9.8 | 100% | KEVPoC | KEV |
| CVE-2025-61865 | Multiple NAS management applications provided by I-O DATA DEVICE, INC | 8.4 | <1% | ||
| CVE-2025-61928 | Better Auth: Unauthenticated attackers can create or modify API keys for any user by passing that user's id in the request body to the… | 9.3 | 18% | ||
| CVE-2025-61932 | Unauthenticated RCE via spoofed packets in Motex LANSCOPE Endpoint Manager agents | 9.3 | 3% | KEV | KEV |
| CVE-2025-6893 | An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers | 9.3 | <1% | ||
| CVE-2025-6950 | An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers | 9.9 | <1% | ||
CVE-2025-9133+1 related CVE | A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through… | 8.1 group max | 5% | ||
| CVE-2025-8677 | Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion | 7.5 | 11% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | staffvirtual.website | ke LinkedIn (or their own fake job posting websites such as staffvirtual[.]website) to target individuals in the digital advertising and mar |
From the original article
13 min read at thehackernews.com
Ravie Lakshmanan Oct 27, 2025 Cybersecurity / Hacking News Security, trust, and stability — once the pillars of our digital world — are now the tools attackers turn against us. From stolen accounts to fake job offers, cybercriminals keep finding new ways to exploit both system flaws and human behavior. Each new breach proves a harsh truth: in cybersecurity, feeling safe can be far more dangerous than being alert.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.