Patch/Configuration Management

Malicious actors have escalated intrusions exploiting the critical untrusted data flaw in Windows Server Update Service, tracked as CVE-2025-59287, following the release of a proof-of-concept flaw last week, Cybersecurity Dive reports.

BleepingComputer reports that QNAP has urged users to patch a critical ASP.NET Core vulnerability tracked as CVE-2025-55315, which also affects its NetBak PC Agent software for Windows.

Vulnerabilities in GutenKit and Hunk Companion plug-ins could lead to remote code execution (RCE).

Microsoft released an out-of-band update for the critical deserialization flaw.

Security pros say teams that build apps in python-socket.io should patch right away.

Updates have been issued by TP-Link for four serious vulnerabilities impacting its Omada gateway devices, according to BleepingComputer.

Five new security flaws impacting Oracle, Microsoft, Apple, and Kentico offerings have been included in the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, with federal agencies urged to remediate the issues by Nov. 10, The Hacker News reports.