Week of October 20, 2025: A DNS race condition takes down AWS us-east-1, and WSUS gets an emergency patch

What mattered to security leaders in the week of October 20, 2025? A race condition in DynamoDB's automated DNS management knocked out a wide swath of AWS services in the us-east-1 region on October 20, and Microsoft shipped an out-of-band fix for a Windows Server Update Services flaw that was being exploited. CISA also listed actively exploited bugs in Oracle E-Business Suite and Adobe Commerce, and Jewett-Cameron Trading Company described a data extortion attempt in an 8-K.

A DynamoDB DNS fault cascades into a day-long AWS outage

The disruption began at 11:48 PM PDT on October 19 with rising DynamoDB API errors in Amazon's Northern Virginia region. According to The Register's reading of Amazon's postmortem, published October 23, a race condition between two components of DynamoDB's DNS automation left the regional endpoint with an empty DNS record, and the failure spread to other AWS services and to major websites. For resilience planning, it was a live test of how many supposedly multi-region architectures still depend on one region's control plane. (The Register)

Microsoft reissues its WSUS fix as exploitation begins

Microsoft released an out-of-band update for CVE-2025-59287, a critical deserialization flaw in Windows Server Update Services, because its October Patch Tuesday fix had not fully closed it. Proof-of-concept code was already public, and the Dutch National Cyber Security Centre said abuse was observed on October 24. Where patching must wait, admins can disable the WSUS role or block inbound traffic on ports 8530 and 8531. CISA added the flaw to its KEV catalog the same day. A compromised update server can push malicious updates to every client that trusts it. (Help Net Security, CISA)

Oracle E-Business Suite SSRF and a Windows SMB flaw join the KEV list

On October 20 CISA added five exploited vulnerabilities to its catalog, among them CVE-2025-61884, a server-side request forgery flaw in Oracle E-Business Suite, and CVE-2025-33073, an improper access control bug in the Windows SMB client. The batch also included two authentication bypass flaws in Kentico Xperience's Staging Sync Server and an unspecified Apple bug, CVE-2022-48503. Organizations running internet-facing Oracle EBS instances had particular reason to move quickly. (CISA)

SessionReaper attacks hit Magento stores

Sansec said it blocked more than 250 attempts to exploit CVE-2025-54236, nicknamed SessionReaper, against multiple Adobe Commerce and Magento stores on Wednesday, October 22, after a researcher published a technical analysis of the patch. Adobe had shipped a hotfix on September 9. Sansec warned that stores using file-based session storage are open to unauthenticated remote code execution and estimated that only 38% of online Magento stores were patched. E-commerce teams that deferred the September hotfix were the exposed group. (Help Net Security)

Jewett-Cameron files an 8-K over encryption and an extortion demand

Jewett-Cameron Trading Company reported a material cybersecurity incident under Item 1.05 in an 8-K filed October 21. It learned on October 15 that an attacker had accessed parts of its IT environment and deployed encryption and monitoring software; the attackers took images of video meetings and computer screens and threatened to publish them unless paid. The company took some business applications offline and warned that its fiscal first-quarter results could be affected, though it expects insurance to cover most response costs. The screen captures show why meeting platforms belong in data classification plans. (SEC EDGAR)

Veeam agrees to buy Securiti AI for $1.725 billion

Veeam Software signed a definitive agreement to acquire Securiti AI for $1.725 billion, pairing its backup and recovery business with Securiti's data security posture management, privacy and AI governance tools. Securiti AI chief executive Rehan Jalil is set to join Veeam as President of Security and AI once the transaction closes. The deal, reported on October 21, is another sign that data protection and data security budgets are being pitched as one line item. (Help Net Security)