Multiple masked hackers surrounding laptop screen with code and security shield icons displayed

October 15, 2025 - Daily Cybersecurity News

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

October 15, 2025 6:03 AM 5 min read

Microsoft's October 2025 Patch Tuesday Addresses 172 Vulnerabilities, Including Two Zero-Days

High

What happened

Microsoft released security updates addressing 172 vulnerabilities, including two zero-day flaws actively exploited in the wild. One zero-day affects the Agere Modem driver, leading to its removal from Windows systems. The other impacts the Windows Remote Access Connection Manager (RasMan) service.

Who is affected

Users and administrators of Windows operating systems, particularly those utilizing the Agere Modem driver or the RasMan service.

Why it matters

The exploitation of these vulnerabilities could allow attackers to gain elevated privileges or execute arbitrary code, potentially leading to full system compromise. The removal of the Agere Modem driver may also impact legacy hardware functionality.

How it could have been prevented

Regularly updating systems and drivers, deprecating outdated hardware components, and monitoring for unusual network activity can mitigate such vulnerabilities.

Relevant professional terms

Zero-day vulnerability: A security flaw that is exploited by attackers before the software vendor has released a fix.
Elevation of privilege: A type of vulnerability that allows an attacker to gain higher access rights than originally granted.

Recommended reading: CrowdStrike Analysis of October 2025 Patch Tuesday

Source: krebsonsecurity.com

Malicious VSCode Extensions Target Developers via OpenVSX

High

What happened

A threat actor known as TigerJack has been distributing malicious Visual Studio Code (VSCode) extensions through the OpenVSX registry, aiming to steal cryptocurrency and implant backdoors on developers' systems. Despite removal from the official VSCode marketplace, these extensions have resurfaced on OpenVSX and under new names on the VSCode marketplace.

Who is affected

Developers utilizing VSCode-compatible editors that source extensions from OpenVSX, including those using editors like Cursor and Windsurf.

Why it matters

The presence of malicious extensions in widely used code editors poses significant security risks, including unauthorized access to sensitive information, potential system compromise, and the propagation of malware within development environments.

How it could have been prevented

Implementing stricter vetting processes for extensions, maintaining an updated inventory of installed extensions, and regularly reviewing the permissions and behaviors of these extensions can mitigate such risks.

Relevant professional terms

OpenVSX: An open-source, community-driven extension marketplace for VSCode-compatible editors, providing an alternative to Microsoft's official marketplace.
Backdoor: A method by which unauthorized users can gain access to a system, bypassing normal authentication mechanisms.

Source: bleepingcomputer.com

Pixnapping Attack Exploits Android to Steal MFA Codes (CVE-2025-48561)

High

What happened

A newly identified side-channel attack named Pixnapping allows malicious Android applications to extract sensitive on-screen data, such as two-factor authentication (2FA) codes, by capturing and reconstructing individual pixels.

Who is affected

Users of modern Android devices, including Google Pixel 6 through 9 and Samsung Galaxy S25 running Android versions 13 to 16, are vulnerable to this attack.

Why it matters

The Pixnapping attack compromises the confidentiality of sensitive information displayed on-screen, such as 2FA codes, chat messages, and emails, potentially leading to unauthorized access and data breaches.

How it could have been prevented

Implementing stricter controls over app permissions and enhancing the security of the Android intents system could mitigate such side-channel attacks.

Relevant professional terms

Side-channel attack: A method of exploiting information gained from the physical implementation of a computer system, rather than weaknesses in the implemented algorithms themselves.
SurfaceFlinger: The system service in Android responsible for compositing app and system UI surfaces into a single displayable image.

Recommended reading: BleepingComputer

Source: bleepingcomputer.com

Windows 11 KB5066835 and KB5066793 Security Updates Released

High

What happened

Microsoft released cumulative security updates KB5066835 and KB5066793 for Windows 11 versions 25H2/24H2 and 23H2, respectively, addressing multiple vulnerabilities and system issues.

Who is affected

Users and administrators of Windows 11 versions 25H2, 24H2, and 23H2.

Why it matters

These updates are mandatory as they contain critical security patches for vulnerabilities discovered in previous months, ensuring system integrity and protection against potential exploits.

How it could have been prevented

Regularly applying security updates and patches as they are released to mitigate known vulnerabilities.

Relevant professional terms

Cumulative Update: A package of updates that includes both new fixes and all previous updates.
Patch Tuesday: The second Tuesday of each month when Microsoft releases security patches for its software products.

Recommended reading: Microsoft Update Catalog

Source: bleepingcomputer.com

Oracle E-Business Suite Zero-Day Exploit (CVE-2025-61884) Patched

Critical

What happened

Oracle released an out-of-band security update to address a zero-day vulnerability (CVE-2025-61884) in its E-Business Suite, which was actively exploited using a proof-of-concept exploit leaked by the ShinyHunters extortion group.

Who is affected

Organizations utilizing Oracle E-Business Suite are at risk, especially those with internet-facing instances that have not applied the latest security patches.

Why it matters

The vulnerability allows unauthenticated remote exploitation, potentially granting attackers access to sensitive resources. The public availability of the exploit increases the risk of widespread attacks.

How it could have been prevented

Regularly applying security patches and updates promptly upon release can mitigate the risk of exploitation. Additionally, limiting internet exposure of critical systems and implementing robust access controls are essential preventive measures.

Relevant professional terms

Zero-Day Vulnerability: A software flaw unknown to the vendor, leaving systems vulnerable until a patch is developed.
Server-Side Request Forgery (SSRF): An attack that tricks a server into making unintended requests, potentially leading to unauthorized access to internal resources.

Recommended reading: Oracle Security Alert for CVE-2025-61884

Source: bleepingcomputer.com

Security Implications of Autonomous AI Agents in Enterprises

High

What happened

Organizations are increasingly deploying autonomous AI agents capable of independent decision-making and actions, such as managing accounts and resolving incidents, without comprehensive security oversight.

Who is affected

Enterprises integrating autonomous AI systems into their operations without established security protocols.

Why it matters

The rapid adoption of autonomous AI agents introduces new security risks, including unauthorized access and actions, due to their ability to operate across multiple systems without adequate monitoring.

How it could have been prevented

Implementing strict governance frameworks for AI agents, including assigning ownership, defining clear permissions, and establishing lifecycle management protocols.

Relevant professional terms

Agentic AI: AI systems capable of autonomous decision-making and actions without human intervention.
Non-Human Identities (NHIs): Digital identities assigned to non-human entities, such as service accounts or AI agents, within an organization's IT infrastructure.

Recommended reading: The Hidden Cyber Risks of Deploying Generative AI

Source: bleepingcomputer.com

Secure Boot Vulnerability in Framework Linux Laptops

High

What happened

Approximately 200,000 Linux laptops from Framework were shipped with signed UEFI shell components containing a 'memory modify' (mm) command. This command can be exploited to bypass Secure Boot protections, allowing attackers to load persistent bootkits that evade operating system-level security controls.

Who is affected

Owners of Framework Linux laptops across various models, including Framework 13 and Framework 16 series, are impacted by this vulnerability.

Why it matters

Exploiting this vulnerability enables attackers to install bootkits that can persist across OS re-installations and evade standard security measures, posing a significant risk to system integrity and data security.

How it could have been prevented

Implementing stricter controls over UEFI shell components to exclude commands like 'mm' that can modify critical security variables. Regular security audits and timely firmware updates are essential to mitigate such risks.

Relevant professional terms

UEFI (Unified Extensible Firmware Interface): A modern firmware interface that initializes hardware components and starts the operating system.
Secure Boot: A security feature that ensures only trusted software is loaded during the boot process to prevent unauthorized code execution.

Source: bleepingcomputer.com