Bare Metal Cyber

Week ending October seventeen, twenty twenty-five. This week showed how basic security is getting tested again. A big software company got hacked, new zero-day attacks were found, record-breaking denial-of-service traffic hit networks, and regulators fined companies for poor security. Most of the problems came down to identity, remote access, and supplier exposure. In this update, you’ll hear what happened, why it matters for both leaders and defenders, and one simple action to take for each story. Let’s get started.

A nation-state broke into F five’s engineering systems and stole some Big-I-P source code along with notes about unannounced flaws. F five says it contained the breach and is alerting a small set of customers. Big-I-P devices sit in front of many critical applications, so stolen research could speed up attacks on their management interfaces. Leaders should treat this as a supply-chain risk and approve faster patch and vendor reviews, while defenders lock down management access and centralize detailed logs. The immediate action is to upgrade to supported Big-I-P versions and place administrative access behind a jump host. If that’s not possible, geofence it and review for unexplained changes within forty-eight hours.

An exposed Elasticsearch server leaked more than a terabyte of aggregated breach and web-scraped data—roughly six billion records. Though it’s offline now, copies may circulate. Massive data sets like this make fraud and credential stuffing easier. Leaders should default-deny data access and delete personal data without a defined purpose. Defenders should watch for login storms and add multi-factor authentication to risky sign-ins. The clear action is to require authentication on all data stores and enable velocity and impossible-travel checks today.

Phishing campaigns faked password-manager alerts from LastPass and Bitwarden, tricking users into installing remote tools like ScreenConnect. That gave attackers full control of the system. Social engineering continues to outperform malware. Leaders should set a strict rule—never install support tools from unsolicited messages. Defenders should block common remote-admin installers and alert when they appear. The action is to disable self-install paths, allow-list signed vendors only, and confirm no new remote-admin tools appeared within seventy-two hours.

Over thirteen thousand fake “ClickFix” sites lured people to copy and paste commands into their systems, which deployed malware or persistence. The browser itself became the command console. Leaders should evolve awareness training from “don’t click” to “don’t paste.” Defenders should block those lure domains and monitor for PowerShell launched from browsers. The action is to tighten script execution and application control, and to review browser-spawned command histories for abuse.

Researchers found some geostationary satellite links sending voice, text, email, and telemetry without proper encryption. With common gear, they could intercept data. Remote sites, ships, and field teams using these connections may be easy targets for eavesdropping. Leaders should treat satellite paths as untrusted and require end-to-end encryption. Defenders should inventory their satellite gear and enforce modern transport security. The action is to enable full encryption immediately or move sensitive work off those links, then verify modem configurations within forty-eight hours.

Microsoft issued October patches fixing one hundred seventy-two vulnerabilities, including six zero-days, while ending free security updates for Windows ten. That forces organizations to purchase Extended Security Updates or migrate to Windows eleven. Leaders must decide within thirty days whether to pay for E-S-U or move. Defenders should prioritize patching the zero-days within forty-eight hours and watch for post-patch scanning. The action is to deploy those fixes now, and if rollout stalls, enable mitigations and check compliance daily.

The United Kingdom’s National Cyber Security Centre reported major cyber incidents have more than doubled, driven by identity abuse, supplier compromise, and ransomware. The trend shows not just volume but severity rising. Leaders should schedule quarterly board reviews covering identity, vendor, and incident-response results. Defenders should focus detection on identity misuse and supplier-origin changes. The action is to enable conditional access controls and verify high-risk sign-ins every week.

A new Android side-channel attack nicknamed “Pixnapping” can infer what’s on the screen—including one-time passcodes—without special permissions. It abuses how displays render content. The screen itself becomes an attack surface. Leaders should move administrators to hardware security keys and phishing-resistant login flows. Defenders should restrict mobile app installations and look for low-permission utilities with unusual access. The action is to enforce hardware-based multi-factor for administrators and audit for unfamiliar apps added within seventy-two hours.

Microsoft tightened Edge’s Internet Explorer mode after attackers abused an old Chakra-based path. The change could break some legacy intranet apps that relied on silent fallbacks. Real attacks are now hitting those old compatibility paths. The action is to limit IE mode to specific, inventoried apps and monitor every launch. If something breaks, isolate it in a hardened virtual machine while you modernize.

Extortion crews exploited an Oracle E-Business Suite flaw to steal finance data. Oracle released an emergency patch and guidance. This targets procurement, receivables, and general ledger systems—core financials. The action is to patch immediately and remove unnecessary external exposure; if delayed, restrict by I-P, rotate credentials, and monitor for large report exports.

A botnet with over one hundred thousand addresses launched massive brute-force attacks against public Remote Desktop Protocol endpoints. Once inside, it spread laterally. Public R-D-P remains a direct path to ransomware. The action is to close public R-D-P, move access behind a V-P-N with multi-factor, and check for new local admins or Kerberos failures.

North Korean operators flooded the Node Package Manager ecosystem with hundreds of malicious packages aimed at crypto, Web Three, and data developers. The goal was to steal keys, tokens, or deliver second-stage payloads. Developer laptops and build systems are prime gateways. The action is to pin dependencies with lock files, use private registries, and review recent builds for odd network activity or token creation.

The CL zero P ransomware group has exploited Oracle E-Business Suite since July using a new chain of flaws for unauthenticated access to finance, H-R, and supply-chain modules. They mapped systems and staged exfiltration over months. This hits the core finance stack and risks fraud and audit issues. The action is to apply vendor fixes now, remove internet exposure, enforce strict web-application-firewall rules, rotate credentials, and check for staged data jobs within forty-eight hours.

Using valid credentials, attackers accessed SonicWall customer environments and viewed backup job metadata for firewalls and management systems. Those tokens are now invalid, and services were hardened. Backup configurations reveal what matters most and how recovery works—information attackers can weaponize. The action is to rotate all stored secrets, enforce multi-factor authentication everywhere, restrict management by source I-P, and verify a clean test restore.

A critical zero-day in Gladinet CentreStack and Triofox, tracked as C-V-E-twenty twenty-five dash eleven three seven one, allows path traversal and remote code execution. Exploitation began before disclosure, and many instances face the internet. File-sharing gateways aggregate documents and tokens, giving broad access. The action is to patch or mitigate immediately, block external access if delayed, rotate secrets, and confirm no new admins, scheduled tasks, or web shells within forty-eight hours.

The Aisuru botnet hit record-scale distributed denial of service levels near thirty terabits per second, combining high-bandwidth nodes and abused infrastructure to crush gaming, finance, and hosting targets. Even mature defenses struggled. The action is to verify D-D-O-S playbooks today, ensure always-on protection for critical domains, and test automated routing and filtering under simulated load.

Apple doubled its top bug bounty to two million dollars for zero-click remote-code exploits and clarified timelines to attract more researchers amid ongoing spyware campaigns. Bigger rewards can shift exploit economics—but only if patches are deployed fast. High-risk users remain prime targets. The action is to enforce same-day updates on managed Apple devices, enable Lockdown Mode for sensitive roles, and verify device compliance this week.

That wraps up this week’s news. Big vendors were breached, old systems finally broke, and attackers kept finding easy openings. Over the weekend, double-check your backups, make sure remote access needs multi-factor, and confirm patches on your most important systems. When Monday comes, brief your team and leadership on what changed and where you stand. Stay alert, stay patched, and I’ll be back next week.