👁️ InfoSec.Watch — Issue # 109

A critical WSUS remote code execution bug is being exploited in the wild, putting the very systems that patch Windows fleets at risk. At the same time, new enterprise and OT advisories show attackers targeting the management plane—from update servers to HMIs—where one foothold can cascade across environments.

Microsoft shipped an emergency, out-of-band security update on October 24 for a critical Windows Server Update Services (WSUS) flaw now tracked as CVE-2025-59287. The bug is an unsafe deserialization issue in WSUS’s reporting web services that lets an unauthenticated remote attacker send crafted requests and execute arbitrary code as SYSTEM on vulnerable WSUS servers. A proof-of-concept exploit is public, and national CERTs (including the Dutch NCSC) reported in-the-wild abuse as of October 24. Affected systems include Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 if the WSUS role is enabled. Microsoft says orgs that cannot immediately apply the patch can temporarily disable WSUS or block inbound traffic to WSUS ports, but doing so pauses normal patch distribution to endpoints.The Hacker News
💡 Key Takeaway: WSUS is often treated as “internal plumbing,” not Tier 0. Treat it like domain admin. Patch immediately, hunt for suspicious child processes spawned by WSUS/IIS, and assume full AD compromise is on the table if WSUS is owned.

Heywood Hospital (134 beds, Gardner, MA) and Athol Hospital (25 beds, Athol, MA) lost networked clinical systems starting October 13. By October 15, the regional EMS agency declared a “Code Black,” meaning emergency patients had to be diverted to other facilities because the hospitals could not safely accept new ambulance arrivals. CT scanning, radiology, lab, email, phone, and other systems were disrupted. On October 16, Heywood Healthcare confirmed it was a “cybersecurity incident,” took affected systems offline, and brought in third-party IR. By October 17, Code Black was lifted, but the hospitals were still operating with “limited capabilities.” The organization has not yet said whether patient data was exposed. The HIPAA Journal💡 Key Takeaway: Ransomware-style outages are directly impacting patient routing and diagnostic imaging in under 48 hours. This is no longer “data theft only” for healthcare — it’s care delivery disruption with real clinical risk.

Researchers at Trend Micro’s Zero Day Initiative Pwn2Own event in Cork earned roughly $522,500 in a single day by demonstrating working exploits against 34 previously unknown vulnerabilities across consumer IoT and office gear — printers, NAS devices, smart lighting bridges, smart speakers, even Home Assistant appliances. Teams repeatedly achieved code execution and, in at least one case, full root on a Sonos smart speaker. Meanwhile, a hyped $1M “zero-click WhatsApp exploit” bid fizzled; Meta ultimately received only low-risk bugs after the contestant withdrew. SecurityWeek
💡 Key Takeaway: The stuff sitting on office Wi‑Fi and in conference rooms is getting owned reliably, at scale, and for cash. Assume printers, smart displays, and “shadow IoT” are viable footholds — segment them or they will become an internal pivot point.

Kaspersky-linked reporting says a Chrome sandbox escape (CVE-2025-2783) was exploited in a live cyberespionage campaign (“Operation ForumTroll”) delivering a loader that ultimately installs LeetAgent spyware. The attackers used highly targeted phishing emails with short-lived, victim-specific links, then persisted via Windows registry hijacks and COM search-order abuse. Researchers connect the toolset to “Dante,” surveillance malware attributed to Memento Labs (the successor to Hacking Team). Mozilla addressed a related Firefox issue (CVE-2025-2857). SecurityWeek
💡 Key Takeaway: Patch Chrome/Chromium- and Firefox-based browsers now and monitor endpoints for unusual COM hijacks or new persistence keys — these are not theoretical bugs, they’re already part of state-linked tradecraft.

Industrial HMI panels from Taiwan-based Novakon contain multiple severe, unauthenticated flaws — including buffer overflows, directory traversal, weak/absent auth, and over‑privileged processes — that can let a remote attacker gain root, run arbitrary code, and potentially manipulate plant-floor control logic. Public reporting as of October 23 says Novakon has not issued patches or even acknowledged the findings. These HMIs are deployed globally in data centers and industrial/OT environments. SecurityWeek
💡 Key Takeaway: Treat unpatched HMIs like exposed PLCs: isolate them from corporate/Internet-facing networks, enforce strict ACLs, and watch for unexpected commands to controllers. You cannot assume the vendor will bail you out quickly.

Legacy Cognex In-Sight industrial vision systems — widely used to guide robots, inspect quality, and track items on production lines — suffer multiple high-severity flaws. Researchers showed an adjacent attacker can intercept and reuse “encrypted” credentials because the same key material is reused, and can potentially hijack camera control. CISA warned critical infrastructure operators in September, and updates on October 26 note that for some camera models, there is still no vendor patch. SecurityWeek
💡 Key Takeaway: Vision systems and smart sensors are OT assets. Put them on protected VLANs, rotate any shared creds, and log access just like you would for PLCs or safety controllers.

In the past week, we saw:

💡 Key Takeaway: Adversaries increasingly skip “workstation phish → EDR alert.” They’re jumping straight to the systems that manage everything (WSUS, endpoint managers, perimeter firewalls, OT HMIs). Those assets need Tier 0 treatment: dedicated network segments, MFA/just-in-time admin, continuous logging, and accelerated patch SLAs.

CISA added CVE-2025-61932 — a critical remote code execution flaw in Motex/Kyocera’s LANSCOPE Endpoint Manager (on-prem) — to the Known Exploited Vulnerabilities (KEV) catalog on October 22 after confirming active exploitation. The bug (CVSS ~9.3/9.8) stems from improper verification of request origin, allowing arbitrary code execution over the network against vulnerable versions (9.4.7.2 and earlier). Federal Civilian Executive Branch agencies must either patch or remove affected instances by November 12, or stop using the product entirely. Private-sector orgs are strongly urged to do the same, especially given indications that ransomware crews (including Qilin) have probed Japanese/Asian enterprises using this tooling. [CISA KEV: cisa.gov/known-exploited-vulnerabilities-catalog] TechRadar
💡 Key Takeaway: Endpoint management consoles are now regulated like perimeter devices. If your endpoint/asset inventory platform is internet-reachable, assume it’s already being sprayed and bring it behind a firewall immediately.

Huntress published hands-on guidance and telemetry for spotting active abuse of CVE-2025-59287 in WSUS: what the malicious requests look like, where to look for rogue .NET payloads, and which spawned processes are red flags. The post also summarizes Microsoft’s out-of-band fixes and offers short-term containment steps if you cannot patch instantly.
Resource: https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
💡 Key Takeaway: Use this to build targeted detections around WSUS-hosted IIS sites and to validate (not assume) that your WSUS servers are clean after patching.

Do a focused 48-hour review of every system that deploys updates, manages endpoints, or sits at the edge — WSUS servers, endpoint management consoles, firewalls/VPN gateways, OT HMIs, and similar “single pane of glass” tools.

💡 Key Takeaway: If an attacker owns your update server or OT HMI, they own everything downstream. Treat these boxes like crown jewels, not IT utilities.

Attackers are skipping the front door and heading straight for the control room: WSUS, endpoint managers, hospital networks, smart cameras, even smart speakers. The fastest risk reduction you can deliver this week is brutally simple — patch the management plane, isolate it, and prove it’s clean.

Stay vigilant.

Quarterzip delivers realtime, AI-led onboarding for every user with zero engineering effort.

✨ Dynamic Voice guides users in the moment
✨ Picture-in-Picture stay visible across your site and others
✨ Guardrails keep things accurate with smooth handoffs if needed

No code. No engineering. Just onboarding that adapts as you grow.

See how it works