Week of October 27, 2025: CISA's Exchange Hardening Push and WSUS Exploitation

Security leaders watched CISA and the NSA issue new Microsoft Exchange Server hardening guidance, CISA add four actively exploited vulnerabilities to its KEV catalog across two separate alerts, and researchers confirm in-the-wild exploitation of a patched WSUS flaw dropping the Skuld infostealer. The week also brought a BayFirst Financial SEC disclosure tied to a third-party vendor incident, a published PoC for a critical BIND 9 DNS flaw, Kaspersky's attribution of Dante spyware to a Chrome zero-day campaign, and the signing of the UN's first global Convention against Cybercrime by 72 states.

CISA and NSA Unveil Exchange Server Hardening Blueprint

CISA, the National Security Agency, and international partners released new Microsoft Exchange Server Security Best Practices guidance on October 30, 2025, aimed at helping network defenders harden on-premises Exchange servers. The guidance built on an earlier emergency directive addressing Exchange vulnerabilities and recommended restricting administrative access, enforcing multifactor authentication, and adopting zero trust principles. CISA urged organizations to decommission any remaining end-of-life on-premises or hybrid Exchange servers after moving to Microsoft 365, warning that retaining a last Exchange server continued to expose networks to persistent threat activity. (CISA)

CISA Adds Dassault DELMIA Apriso Flaws to Exploited Vulnerabilities List

On October 28, 2025, CISA added two Dassault Systemes DELMIA Apriso vulnerabilities, CVE-2025-6204 and CVE-2025-6205, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The code injection and missing authorization flaws triggered Binding Operational Directive 22-01 remediation deadlines for federal civilian agencies. CISA again urged all organizations, not just federal entities, to prioritize patching catalog vulnerabilities as part of routine vulnerability management, noting that such flaws remain frequent attack vectors for malicious cyber actors targeting enterprise networks. (CISA)

XWiki and VMware Aria Flaws Added to CISA's Exploited Vulnerabilities Catalog

CISA added two more vulnerabilities to its Known Exploited Vulnerabilities Catalog on October 30, 2025: CVE-2025-24893, an eval injection flaw in the XWiki Platform, and CVE-2025-41244, a privilege-escalation issue affecting Broadcom VMware Aria Operations and VMware Tools. Both were added based on evidence of active exploitation. Federal civilian agencies were required to remediate the flaws under Binding Operational Directive 22-01, and CISA encouraged other organizations to treat catalog additions as a prioritization signal for patching efforts. (CISA)

BayFirst Financial Discloses Third-Party Marketing Vendor Breach

BayFirst Financial Corp. disclosed in an SEC Form 8-K that on October 28, 2025 a third-party marketing services provider confirmed that some BayFirst National Bank customer information had been exposed in a cybersecurity incident first reported in August 2025. Exposed data reportedly included names, dates of birth, and Social Security or tax identification numbers for some customers. BayFirst said the incident was limited to the vendor's environment, reported no evidence of misuse of the data, and could not yet quantify any material financial impact. (SEC EDGAR)

Attackers Exploit Patched WSUS Flaw to Drop Skuld Infostealer

Security researchers reported that attackers began exploiting CVE-2025-59287, a Windows Server Update Services remote code execution flaw patched days earlier, to compromise unpatched, internet-facing Windows servers. Firms including Eye Security, Huntress, Sophos, and Darktrace documented exfiltration of domain and system data via webhook.site URLs and, in at least one case, deployment of the open-source Skuld infostealer capable of harvesting crypto wallets and browser data. CISA updated its alert on the flaw and urged organizations to apply the out-of-band patch and investigate for signs of compromise. (Help Net Security)

PoC Exploit Published for Remotely Exploitable BIND 9 DNS Flaw

Proof-of-concept exploit code was published for CVE-2025-40778, a high-severity BIND 9 DNS resolver vulnerability that unauthenticated remote attackers could use for cache poisoning to redirect traffic or intercept communications. The flaw was fixed in BIND 9 versions 9.18.41, 9.20.15, and 9.21.14, alongside two other cache-poisoning and denial-of-service issues. The German Federal Office for Information Security advised operators to restrict recursion to trusted clients, enable DNSSEC validation, and reduce maximum cache times, since the vulnerabilities had no available workarounds. (Help Net Security)

72 States Sign First UN Convention Against Cybercrime

The United Nations opened its first global Convention against Cybercrime for signature in Hanoi, Vietnam, with 72 states signing on October 27, 2025. The treaty, adopted by the General Assembly in December 2024, will enter into force 90 days after its 40th ratification and establishes the first global framework for sharing electronic evidence and a 24/7 cooperation network among member states. UN Secretary-General Antonio Guterres called it "a powerful, legally binding instrument to strengthen our collective defences against cybercrime." (Help Net Security)

Kaspersky Links Italian Dante Spyware to Chrome Zero-Day Campaign

Kaspersky researchers published findings on October 28, 2025 tying commercial spyware called Dante, developed by Italy's Memento Labs, to a campaign that exploited a Chrome zero-day, CVE-2025-2783, to deliver LeetAgent spyware against organizations and individuals in Russia and Belarus. The campaign, dubbed Operation ForumTroll, used fake forum invitations and a sandbox-escape exploit tied to a Windows quirk. Memento Labs' chief executive later told reporters the Windows spyware belonged to the company but said it would stop supporting it by year's end. (Help Net Security)