If you read nothing else
Inventory and patch F5 BIG-IP, VMware and Oracle E-Business Suite first. October 2025 put all three under active attack. Then check which of those management interfaces the internet can reach.
These are ten items from October 2025 that matter most to a small defense supplier. Each one names the publisher we checked.
1. F5 BIG-IP source code stolen; CISA emergency directive
F5 disclosed on October 15, 2025 a nation-state intrusion that it first learned of on August 9. The attacker took BIG-IP source code and information about undisclosed vulnerabilities. CISA ordered federal agencies to apply F5's fixes by October 22. Source: The Record.
What this means for you: an F5 device with a management page reachable from the internet is now a more valuable target than it was in August.
Do this: list every BIG-IP device, confirm none of its management interfaces is reachable from the internet, and confirm it has F5's latest fixes.
2. VMware privilege escalation exploited for about a year
CVE-2025-41244 lets a local user on a virtual machine escalate to root in VMware Tools when VMware Aria Operations manages it with SDMP enabled. The rating is CVSS 7.8. NVISO reported exploitation as a zero-day from mid-October 2024. Google Mandiant tracks the activity as UNC5174, a China-linked group, but that attribution to this flaw is reported, not confirmed. CISA added the flaw to its catalog on October 30, 2025. Source: The Hacker News.
What this means for you: any virtual machine where a non-admin user can log in is a path to root on that machine.
Do this: confirm whether you run VMware Aria Operations with SDMP enabled, and patch VMware Tools to the fixed build.
3. Conduent breach affects over 10.5 million people
Business process outsourcer Conduent confirmed a breach that began in October 2024 and was discovered in January 2025. Oregon's filing, the largest reported, listed more than 10.5 million affected people. Source: BleepingComputer.
What this means for you: a vendor that handles records for you can expose your data even when your own systems are clean.
Do this: ask every outsourcing vendor which breaches it reported in the last 12 months and how it notified customers.
4. Qilin runs Linux encryptors inside Windows WSL
Trend Micro told BleepingComputer that the Qilin ransomware group runs Linux encryptors on Windows through the Windows Subsystem for Linux, after gaining access, to avoid tools built for Windows malware. Source: BleepingComputer.
What this means for you: an endpoint tool that only watches Windows programs can miss a Linux program running inside WSL.
Do this: find out whether WSL is enabled on your Windows machines, and turn it off wherever nobody needs it.
5. Clop exploits Oracle E-Business Suite; Harvard confirms it was targeted
CISA's catalog lists Oracle's CVE-2025-61882, which lets an unauthenticated attacker with network access compromise Oracle Concurrent Processing, as added on October 6, 2025 and used in known ransomware campaigns. Harvard confirmed it was targeted, and Clop listed Harvard on its leak site, claiming 1.3 TB. Source: Security Affairs. CISA's catalog is at cisa.gov.
What this means for you: if you run Oracle E-Business Suite, this attack needs no login, so patching comes before anything else on the list.
Do this: confirm the Oracle EBS patch level with whoever administers your ERP, and ask whether its BI Publisher integration is exposed.
6. Akira bypasses MFA on SonicWall VPN accounts, method unconfirmed
Akira operators logged in to SonicWall SSL VPN accounts that had one-time-password MFA turned on, according to reporting dated September 28, 2025. Researchers suspect previously stolen OTP seeds, but the method is not confirmed. Source: BleepingComputer.
What this means for you: MFA is still worth having, but a one-time code that was stolen from a device protects nothing.
Do this: review VPN logs for sign-ins from networks you do not recognize, and renew OTP seeds if you cannot rule out exposure.
7. Ransomware payment rate falls to a historic low of 23%
A Q3 2025 analysis of ransomware cases found that 23% of victims paid, a historical low. Source: SecurityWeek.
What this means for you: fewer victims paying makes backups and tested recovery your real defense.
Do this: restore your most important system from backup this quarter as a test, and write down how long it took.
8. CISA adds a Linux kernel flaw to its catalog
CISA added CVE-2021-22555, a Linux kernel heap out-of-bounds write that can give an attacker elevated privileges through user namespaces, to its Known Exploited Vulnerabilities catalog on October 6, 2025. The catalog does not list known ransomware use for this flaw. Source: CISA KEV catalog.
What this means for you: a Linux server you treat as low risk can still be on the catalog, and an unpatched kernel is an open door.
Do this: confirm your Linux servers take vendor kernel updates, and check the date of the last one.
9. Ribbon Communications hit by a nation-state actor
Ribbon Communications, a major US telecom backbone firm, found unauthorized access to its IT network in early September 2025 and disclosed it in an SEC quarterly report. The company believes a nation-state actor is responsible. Customer files saved on two laptops were accessed, and Ribbon does not expect a material impact. Source: SecurityWeek.
What this means for you: a supplier to your telecom provider can be a path into your data even when the provider itself is not the one breached.
Do this: ask your telecom and cloud vendors whether any incident involved customer files in the last year.
10. Microsoft disrupts a ransomware campaign using fake Teams installers
Microsoft revoked more than 200 code-signing certificates used to sign malicious Teams installers. The late-September campaign used search engine ads and SEO poisoning to push the fake installers, and Microsoft announced the action on October 16, 2025. Source: BleepingComputer.
What this means for you: a valid-looking signature does not prove an installer is safe, because attackers used legitimate certificates to sign these.
Do this: have staff install Teams only from your managed software catalog, never from search results.
Not sure where you stand? Cyber Grants Alliance offers in-kind CMMC Level 1 and CMMC Level 2 gap assessment grants, at no cost to you. See every program on Grant Programs.