SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Microsoft Releases Unscheduled Update to Fully Mitigate Critical WSUS Vulnerability; CISA Adds it to KEV
Late last week, Microsoft released an unscheduled update to address a critical deserialization of untrusted data vulnerability in Windows Server Update Service (WSUS) (CVE-2025-59287). An earlier update did not fully mitigate the existing issue, which affects Windows Server 2012, 2016, 2019, 2022, and 2025, and the vulnerability has been actively exploited. On Friday, October 24, 2025, the US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a mitigation deadline of November 14, 2025 for Federal Civilian Executive Branch (FCEB) agencies. CISA advises taking the following steps: "1. Identify servers that are currently configured to be vulnerable to exploitation (i.e., affected servers with WSUS Server Role enabled and ports open to 8530/8531) for priority mitigation. 2. Apply the out-of-band security update released on October 23, 2025, to all servers identified in Step 1. Reboot WSUS server(s) after installation to complete mitigation. If organizations are unable to apply the update immediately, system administrators should disable the WSUS Server Role and/or block inbound traffic to ports 8530/8531, the default listeners for WSUS, at the host firewall. Of note, do not undo either of these workarounds until after your organization has installed the update. 3. Apply updates to remaining Windows servers. Reboot servers after installation to complete mitigation."
Editor's Notes
- Slide 1 of 2
There is exploit code circulating for CVE-2025-59287, which has a CVSS score of 9.8, and you have to reboot servers after applying the update. You're going to need to apply the update to all your Windows Servers, starting with those that have the WSUS Server role enabled. The update is cumulative, so if you didn't apply the Windows Security Updates from October 14th, you can apply this instead. Make sure the WSUS ports (8530 and 8531) are not Internet accessible. While the KEV has a remediation due date of November 14th, active exploitation suggests it's unwise to wait that long to take action.
- Slide 2 of 2
Exploit code is out for using this vulnerability with calc.exe. It won't be tough to weaponize it to install additional payloads. Since this is the WSUS server, it may have elevated network privileges for some reason. If you can patch now, you should.
Slide 1 of 0- Slide 1 of 2
AWS Outage Post-Event Report
Amazon has published a post-event summary of the AWS outage that impacted the US-EAST-1 region data center on Monday, October 20, 2025, disrupting sites and online services worldwide. Beginning at 2:48 a.m. EDT, there were increased API error rates in DynamoDB; later in the morning the Network Load Balancer (NLB) experienced increased connection errors, EC2 instance launches were failing, and "customers experienced API errors and latencies for Lambda functions." Amazon has determined that "The incident was triggered by a latent defect within the service’s automated DNS management system that caused endpoint resolution failures for DynamoDB." The failure was caused by "a latent race condition in the DynamoDB DNS management system that resulted in an incorrect empty DNS record for the service’s regional endpoint," which triggered cascading disruptions to NLB service, EC2 launches, and Lambda functions. As WIRED writes, "the system was straining under the weight of a backlog of requests." Amazon resolved the outage after nearly 16 hours. The faulty DNS planner and enactor automation that experienced the race condition has been disabled while Amazon fixes the issue and adds additional protections and mechanisms for control and throttling, looking also for "ways to avoid impact from a similar event in the future, and how to further reduce time to recovery."
Editor's Notes
- Slide 1 of 4
In short, the problematic components have been disabled and work is underway to improve them to prevent recurrence. For once, it really was DNS. You may need to summarize the report for management who are asking what happened. Follow that up with a plan for no single points of failure; this means multi-region network designs, diverse dependencies, and incident response readiness to contain, not eliminate, failures.
- Slide 2 of 4
DNS is amazing, but it is still so fragile. Frustratingly, I wonder if things like this will eventually make people reconsider how DNS works. It was designed at a time when you literally used to call a Helpdesk on the phone to ask what the IP address of a site was. Not kidding, look it up. I think we can probably do better than this, but for the love of things, do not recommend blockchain. That is all.
- Slide 3 of 4
By using cloud IaaS services, even larger companies can spin up close to full production workloads on a development environment and detect many, if not all, scale-related flaws like this race condition. But obviously the “hyperscale” cloud providers can’t do that — this type of outage will happen again, and the key is knowing where you have “concentration” risk with you and a high percentage of your suppliers relying on one common provider or process. I’d still like to see a large amount of the electricity being wasted on AI get rerouted to more thorough testing of critical infrastructure…
- Slide 4 of 4
While not much more can be said about the cause of the outage, it does serve as a reminder to reduce dependencies on a single service provider. Security staff should revisit their network architecture and look to enable a multicloud tenant environment. Yes, there are complexities in enabling this type of architecture, but it will keep business operations going. The alternative is to factor planning for single point failures into your risk assessment.
Slide 1 of 0- Slide 1 of 4
New Firefox Extensions Required to Disclose Data Collection and Sharing
Mozilla has announced a new policy requiring Firefox extensions to disclose whether they collect and/or transmit personal data. Starting Monday, November 3, 2025, "all new Firefox extensions will be required to specify if they collect or transmit personal data in their manifest.json file using the browser_specific_settings.gecko.data_collection_permissions key." While the requirement applies only to new extensions at first, the policy will be rolled out to all extensions during the first half of 2026. Mozilla notes that "extensions that do not collect or transmit any personal data are required to specify this by setting the none required data collection permission in this property." The data gathering and sharing information will be displayed in the installation dialog along with the extension's permissions.
Editor's Notes
- Slide 1 of 4
Initially only new extensions, not updates to existing ones, are required to implement the new consent. As this rolls out, eventually being required by all extensions, those extensions which don't properly implement the data_collection_permssions key will be prevented from being submitted to addons.mozilla.org for signing with a message explaining why. Your data collection settings will be viewable on the Firefox about:addons page permissions tab for each extension.
- Slide 2 of 4
Putting nutrition and calorie data on food didn’t change everyone’s behavior but did enable motived munchers to make better decisions and improve their health. The same is true with “privacy health” — at least provide enough information for the motivated, and ideally force opt-in to exposing personal data vs. allowing opt-out trickery. I haven’t eaten a scone since Starbucks put calories on the bakery case. Who knew they had more calories than those butter-dripping croissants??
- Slide 3 of 4
A prudent privacy requirement enacted by Mozilla. It gives the user increased say over what data is allowed to be collected by the application. It also moves Mozilla in the direction of supporting California’s “Opt Me Out Act” privacy requirement.
- Slide 4 of 4
This is probably a great move, although at this point, I’m not sure what the Firefox market share is.
Slide 1 of 0- Slide 1 of 4
The Rest of the Week's News
QNAP: ASP.NET Core Vulnerability May Affect NetBak PC Agent
QNAP has published a security advisory describing the how a critical ASP.NET Core vulnerability (CVE-2025-55315) recently disclosed by Microsoft may affect QNAP's NetBak PC Agent, which "installs and depends on Microsoft ASP.NET Core components during setup." QNAP urges users to make sure they have installed the most up-to-date version of ASP.NET Core on their Windows systems. CVE-2025-55315 is a security bypass issue that was detected in the Kestrel ASP.NET Core web server, and "allows an authorized attacker to bypass a security feature over a network" via "HTTP Request/Response Smuggling." In mid-October Microsoft addressed the vulnerability, which has the highest known severity rating for an ASP.NET Core vulnerability.
Editor's Notes
In addition to applying the update from Microsoft which addressed CVE-2025-55315, you need to update the ASP.NET Core Runtime on systems running NetBak PC Agent. You can do that either by reinstalling the NetBak PC Agent or by downloading/installing the latest ASP.NET Core Runtime from the .NET 8.0 download page.
iOS 26 Purges Spyware IoCs
Researchers at iVerify have observed that iOS 26 purges evidence of Pegasus and Predator spyware infections due to the way the shutdown.log file is managed. iVerify writes, "For years, the shutdown.log file has been an invaluable, yet often overlooked, artifact in the detection of iOS malware. Located within the Sysdiagnoses in the Unified Logs section (specifically, Sysdiagnose Folder -> system_logs.logarchive -> Extra -> shutdown.log), it has served as a silent witness to the activities occurring on an iOS device, even during its shutdown sequence." Certain types of spyware have been found to leave "subtle traces" in this file, which then serves as an indicator of compromise. With the introduction of iOS 26, the operating system now overwrites the shutdown.log file on every device reboot. Earlier versions of iOS appended new entries, preserving older data.
Editor's Notes
You should be testing iOS 26 and filing feedback/bug reports with Apple. Check behavior in both the released version and the public beta. iOS 26.1 Public Beta 4 is available today. Beyond the overwrite of this log, which is likely unintended, some UI changes, such as relocation of search boxes, or changes to message filtering, may be frustrating to users, but without feedback Apple cannot address them.
Wordfence Blocked 8.7 Million Attempts to Exploit Known Vulnerabilities in Two WordPress Plugins
Wordfence says that on October 8 and 9, 2025, it blocked 8.7 million attempts to exploit known critical vulnerabilities affecting the GutenKit and Hunk Companion WordPress plugins. The vulnerabilities, CVE-2024-9234, CVE-2024-9707, and CVE-2024-11972, can all be exploited to achieve remote code execution. CVE-2024-9234, "a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint)" issue, allows arbitrary file uploads; it affects the GutenKit plugin up through version 2.1.0. CVE-2024-9707 and CVE-2024-11972 are missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint issues that could lead to unauthorized plugin installation/activation in the Hunk Companion WordPress plugin. CVE-2024-9707 affects Hunk Companion up through version 1.8.4; CVE-2024-11972 affects Hunk Companion up through version 1.8.5. Users are urged to update to the most recent version of both the GutenKit and Hunk Companion plugins, which have 40,000 and 8,000 active installations, respectively.
Editor's Notes
- Slide 1 of 2
WordPress plugin flaws continue to be blood in the water for attackers. Make sure that you're stacking the deck in your favor by not only automatically updating plugins, WordPress, and Themes, but also by having a WAF which is being updated to keep abreast of attacks. Follow up on any reported issues and watch for plugins which only update when licensed. Take it as a given the license cost will be less than the cost of recovery from an incident.
- Slide 2 of 2
That’s impressive: well over eight and half million exploit attempts in just two days. If true, the bad guys have definitely automated their exploit pipeline. What we don’t know is if the affected plugins were already patched. If they weren’t, that’s equally impressive but in a bad way, as patches have been available for both plugins for about a year.
Slide 1 of 0- Slide 1 of 2
UN Cybercrime Convention Signed Amid Criticism
On Saturday, October 25, 2025, officials from 72 countries signed the United Nations Convention against Cybercrime, a treaty first proposed by Russia in 2017 to succeed 2001's Budapest Convention, and adopted by the UN in December 2024. The Convention's stated scope is "to prevent and combat the offences established by the Convention, recover the proceeds of these offences, and strengthen international cooperation, particularly in sharing electronic evidence across borders for both Convention-related offences and for other serious crimes.” The Convention enumerates and criminalizes ten types of cyber-dependent and cyber-enabled conduct; it requires establishment of jurisdiction and cooperation among signatory States; it mandates that States "empower their authorities to rapidly secure and obtain electronic data for any criminal investigation" provided that "law enforcement officers must respect fundamental human rights;" it establishes frameworks for investigative assistance, data acquisition, and information sharing between States; it requires a variety of "preventive measures" across all sectors; and it requires that States report on Convention implementation to a newly-created oversight conference. Tech industry companies and human rights groups have criticized the treaty since its inception, citing potential abuses of broad powers of surveillance, criminalization, and information sharing as threats to human rights without adequate protections, possibly empowering authoritarian governments and putting "security researchers, whistleblowers, activists, … journalists," and vulnerable populations at risk. The US has not signed the Convention, which will only become legally binding 90 days after at least 40 States have "deposit[ed] their instruments of ratification, acceptance, approval or accession."
Editor's Notes
- Slide 1 of 3
This is the first global treaty to criminalize crimes dependent on the internet and recognize the non-consensual distribution of intimate images as an offense. It seeks to create a cross-border regime to monitor, store, and share information and evidence needed to thwart cybercrime. The risks are that cybersecurity research could be criminalized and that the level of surveillance will be capturing both illegal and legal activity, driving a need for governance and protection of individual freedoms. The US is still reviewing the treat and has not signed yet.
- Slide 2 of 3
The goals of the treaty are hard to oppose. As it is today, countries must negotiate the sharing of information on crimes individually. It is slow and burdensome. Critics are right: some countries will use the treaty for their own benefit, but then, they were going to do that anyway. All in all, a reasonable convention.
- Slide 3 of 3
If I read this correctly, for signatories, new expanded surveillance powers are enacted requiring you to “retain evidence for 4 years,” which means… I think they will need to capture packet traces of their Internet connections for 4 years. I’m not sure how this will be done. Either way, it doesn’t sound like a free and open internet. Like everything else, if you try to “fix” things randomly, that may be a big issue.
Slide 1 of 0- Slide 1 of 3
Counter Ransomware Initiative Publishes Guidance for Supply Chain Resilience
The International Counter Ransomware Initiative (CRI) has published "Guidance for organisations to build supply chain resilience against ransomware," following the group's 2025 summit. Last year's summit called for insurance companies to stop paying ransom demands. The new supply chain guidance was developed by CRI's policy leads, the UK and Singapore. "The guidance aims to reduce the likelihood of a ransomware incident having a critical effect on an organisation by: a. Raising awareness of the ransomware threat across an organisation’s supply chain; b. Promoting good cyber hygiene to protect supply chains, [and] c. Ensuring supply chain vulnerabilities are factored into an organisation’s risk assessment and decisions, including on procurement." The guidance aims to "improve [organizations’] supply chain security posture against ransomware risks" by understanding the importance of supply chain security; identifying supply chain partners, the level of access those partners have to data, and the partners' security posture; developing a supply chain security strategy and implementation plan; and reviewing and refining their approach to supply chain security. CRI has 61 member countries and six member international organizations.
Editor's Notes
- Slide 1 of 2
Supply chain security requires third-party security as well as an ongoing understanding of your software, hardware, and firmware bill of materials so you know what risks are involved. Start with third-party security, knowing and verifying their access and security posture, and how that ties to your systems, then move on to components you use and trust. Don't forget to review this regularly, particularly after a merger or acquisition. As Paul Asadoorian said, "The most dangerous vulnerabilities often hide in components we trust the most."
- Slide 2 of 2
It’s good to remind folks that an organization's supply chain is also at risk of cyberattack. That said, the guidance published is already well-established cybersecurity best practices, especially when it comes to ransomware. Competent security teams have already factored supply chain disruption into their risk assessment and it’s likely on the risk register. If they haven’t, well, I’m not sure the guidance is going to help them.
Slide 1 of 0- Slide 1 of 2
Swedish Power Grid Operator Suffers Cyber Attack
Swedish electricity transmission system operator Svenska Kraftnäts has confirmed that they suffered a data breach resulting in the theft of information. The organization is investigating what information was compromised. According to a company statement, "the breach involved a limited, external file transfer solution." Svenska Kraftnäts Head of Information Security Cem Göcgoren said the incident did not affect electricity supply. While a group of threat actors has claimed responsibility for the attack, Göcgoren said, “At this time, we are not commenting on perpetrators or motives until we have confirmed information.” The company is working with law enforcement and national cybersecurity authorities on the investigation.
Editor's Notes
External file transfer systems are an integral part of moving to hosted and cloud services and should be considered critical infrastructure which threat actors won’t hesitate to leverage to exfiltrate your data. Make sure that you are not only implementing security best practices with your file transfer systems but also actively monitoring for malfeasance. Verify that unencrypted protocols cannot be enabled or fallen back to. Investigate the practicality of additionally encrypting the transferred files themselves, and don't store or transfer the keys in the transfer system.