Breaking News – Cyber Threats – 2025-10-27 08:00 PDT

Breaking News – Cyber Threats (last 6h)

Generated: 2025-10-27 08:00 PDT

• Infocon: green
  SANS ISC Diary (full) • 2025-10-27 07:55 • isc.sans.edu
  Bytes over DNS
  https://isc.sans.edu/diary.html?rss
• CISA orders feds to patch Windows Server WSUS flaw used in attacks
  BleepingComputer • 2025-10-27 06:27 • www.bleepingcomputer.com
  The Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. government agencies to patch a critical-severity Windows Server Update Services (WSUS) vulnerability after adding it to its catalog of security flaws exploited in attacks. […]
  https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-server-wsus-flaw-exploited-in-attacks/
• ⚡ Weekly Recap: WSUS Exploited, LockBit 5.0 Returns, Telegram Backdoor, F5 Breach Widens
  The Hacker News • 2025-10-27 05:51 • thehackernews.com
  Security, trust, and stability — once the pillars of our digital world — are now the tools attackers turn against us. From stolen accounts to fake job offers, cybercriminals keep finding new ways to exploit both system flaws and human behavior.
  Each new breach proves a harsh truth: in cybersecurity, feeling safe can be far more dangerous than being alert.
  Here’s how that false sense of security
  https://thehackernews.com/2025/10/weekly-recap-wsus-exploited-lockbit-50.html
• First Wap: A Surveillance Computer You’ve Never Heard Of
  Schneier on Security • 2025-10-27 04:08 • www.schneier.com

  Mother Jones has a long article on surveillance arms manufacturers, their wares, and how they avoid export control laws:

  Operating from their base in Jakarta, where permissive export laws have allowed their surveillance business to flourish, First Wap’s European founders and executives have quietly built a phone-tracking empire, with a footprint extending from the Vatican to the Middle East to Silicon…
  https://www.schneier.com/blog/archives/2025/10/first-wap-a-surveillance-computer-youve-never-heard-of.html

• Bytes over DNS, (Mon, Oct 27th)
  SANS ISC Diary (full) • 2025-10-27 02:10 • isc.sans.edu

  I was intrigued when Johannes talked about malware that uses BASE64 over DNS to communicate. Take a DNS request like this: label1.label2.tld. Labels in a request like this can only be composed with letters (not case-sensitive), digits and a hyphen character (-). While BASE64 is encoded with letters (uppercase and lowercase), digits and special characters + and /. And also a special padding character: =.

  
  https://isc.sans.edu/diary/rss/32420

• How We (Almost) Found Chromium's Bug via Crash Reports to Report URI
  Troy Hunt • 2025-10-27 02:09 • www.troyhunt.com

  Tracking down bugs in software is a pain that all of us who write code must bear. When we're talking about outright errors in a web page, you typically have something to get you started (such as output in the console), but that wasn't the case

  https://www.troyhunt.com/how-we-almost-found-chromiums-bug-via-crash-reports-to-report-uri/

Sources: BleepingComputer, The Hacker News, KrebsOnSecurity, SANS ISC, CISA.