F5 confirmed a sophisticated intrusion that resulted in theft of BIG-IP source code and information about still-undisclosed vulnerabilities. Governments have issued alerts, warning that the stolen data could accelerate exploit development and enable supply-chain attacks against organizations running BIG-IP. Teams should immediately apply F5’s latest updates, restrict management access, rotate credentials and tokens tied to F5 systems, and increase monitoring for anomalous device behavior.
Source: SecurityWeek
CISA issues emergency directive to patch F5 devices amid “significant” threat
Following the F5 breach, CISA ordered federal agencies to urgently apply updates to at-risk BIG-IP devices and software, citing an imminent threat. The directive, which sets near-term patch deadlines, underscores risks ranging from credential theft to exploitation of previously unknown bugs. Private-sector operators should mirror this posture: patch immediately, isolate management interfaces, and hunt for indicators of compromise.
Source: The Record by Recorded Future
Microsoft Patch Tuesday: 175+ fixes and three actively exploited zero-days
Microsoft’s October updates address more than 175 vulnerabilities, including three zero-days under active attack: CVE-2025-24990, CVE-2025-59230, and CVE-2025-47827. One bug involves a third-party modem driver historically shipped with Windows that attackers have abused for privilege escalation; this release also marks Windows 10’s final free security update. Prioritize patching, validate driver blocks, and review mitigations for legacy components.
Source: Help Net Security
VS Code extension ecosystems exposed to supply-chain tampering via leaked tokens
Researchers found 500+ leaked secrets across VS Code and Open VSX extensions, putting roughly 150,000 installs at risk of malicious updates if attackers abused exposed publisher tokens. The issue highlights extension marketplace attack surface and the need for strict publisher hygiene. Organizations should rotate affected tokens, enforce extension allowlists, and monitor for unexpected extension updates in developer environments.
Source: Wiz Research
Satcom shock: geostationary satellites still leaking unencrypted voice, texts, and data
Scientists using low-cost gear intercepted sensitive personal and business communications from multiple geostationary satellites, revealing widespread lack of encryption across satcom links. The findings pose serious risks for enterprises relying on satellite backhaul in remote operations. Use end-to-end encryption over satellite links, review provider security controls, and segment networks to limit exposure.
Source: Malwarebytes
Critical SAP NetWeaver flaw (CVSS 10) allows remote code execution
SAP patched 13 issues, including CVE-2025-42944, a maximum-severity insecure deserialization vulnerability in NetWeaver that can lead to arbitrary command execution. Given NetWeaver’s prevalence in core business processes, exploitation could yield high-impact compromise. Patch immediately, audit exposed interfaces, and tighten deserialization and input-handling controls.
Source: Security Affairs
China-linked hackers quietly breached Russian tech firm’s build systems
A Symantec report details a rare China-attributed intrusion into a Russian IT provider, with months-long access to software build and code repositories—suggesting a staged software supply-chain attack. The incident underscores the strategic value of CI/CD pipelines to state actors. Lock down build servers, enforce code-signing integrity, and monitor for anomalous repository activity and build artifacts.
Source: The Record by Recorded Future
You May Also Be Interested In...
CISA adds actively exploited Adobe AEM flaw (CVSS 10) to KEV catalog
Humanoid robot found vulnerable to Bluetooth takeover; data exfil risks flagged
Cisco Talos discloses OpenPLC and Planet router vulnerabilities with Snort coverage