Loading story…
Microsoft, Apple, Qualcomm, and Drupal released security updates in early November 2025 to address multiple vulnerabilities across their product lines. Microsoft issued updates for the Edge browser and prepared for the final security update for Windows 11 23H2 Professional, while also launching the first Extended Security Updates (ESU) for Windows 10 22H2. Apple released patches for iOS and iPadOS versions prior to 18.7.2, and Qualcomm published its monthly security bulletin covering vulnerabilities in its products. Drupal addressed moderately critical vulnerabilities in the Email TFA and Simple Multi Step Form modules, urging administrators to update or apply mitigations.
In addition to these updates, Microsoft announced the end of security support for several products, including older versions of Office and Exchange Server, with guidance for organizations on migration and continued support options. Reports highlighted the ongoing exploitation of new vulnerabilities, such as a critical remote code execution flaw in Microsoft WSUS (CVE-2025-59287), and noted the addition of numerous vulnerabilities to known exploited vulnerability lists. Security agencies like CISA and NSA issued recommendations for protecting end-of-life Exchange servers, emphasizing the importance of timely patching and migration to supported platforms.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
On November 5, 2025, Apple released a security update for iOS and iPadOS, addressing vulnerabilities affecting versions prior to 18.7.2.
Following Microsoft's Exchange Server end-of-support changes, CISA, NSA, and other agencies released joint recommendations to help organizations secure end-of-life Exchange servers while migrating to cloud infrastructure.
During the October 2025 Patch Tuesday cycle, Microsoft fixed CVE-2025-59287 in Windows Server Update Service. The flaw was reported as actively exploited, and proof-of-concept code was publicly available.
As part of the October 2025 patch cycle, Microsoft ended security support for several older Office and Exchange Server versions and delivered final updates for Windows 11 23H2 Pro, while some other editions retained support for another year.
In October 2025, Microsoft released a large Patch Tuesday update addressing many vulnerabilities, especially in Windows 10 and Windows 11, as it moved to patch products nearing end of life.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcecyber.gc.ca
Open sourcecyber.gc.ca
Open sourcecyber.gc.ca
Open sourcecyber.gc.ca
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released its October 2025 Patch Tuesday security updates, addressing a total of 172 vulnerabilities across its product suite, including six zero-day vulnerabilities. The update marks a significant milestone as it is the final free security update for Windows 10, which has now reached its end of support, requiring users and enterprises to enroll in Extended Security Updates (ESU) for continued protection. Among the vulnerabilities patched, eight were rated as 'Critical,' with five being remote code execution flaws and three classified as elevation of privilege vulnerabilities. The breakdown of vulnerabilities includes 80 elevation of privilege, 11 security feature bypass, 31 remote code execution, 28 information disclosure, 11 denial of service, and 10 spoofing vulnerabilities. Notably, two of the zero-day vulnerabilities were publicly disclosed prior to the patch, affecting Windows SMB Server and Microsoft SQL Server, while three zero-days were actively exploited in the wild. One of the exploited zero-days, CVE-2025-24990, involved the Agere Modem driver, which was being abused to gain administrative privileges, prompting Microsoft to remove the vulnerable driver from supported Windows operating systems. The Patch Tuesday release also included updates for a wide range of Microsoft products and components, such as .NET, Visual Studio, Active Directory Federation Services, Microsoft Office suite, Azure services, Windows authentication methods, and various Windows system components. The update was described as the largest Patch Tuesday release to date, with 167 CVEs directly patched according to some sources, excluding additional vulnerabilities in Chromium, MITRE, GitHub, CERT/CC, and cloud services that were addressed separately. The security updates did not include fixes for vulnerabilities in Microsoft Edge, Azure, or Mariner that were released earlier in the month. Microsoft emphasized the importance of these updates, especially for organizations still running Windows 10, as the cessation of free support increases the risk of exposure to unpatched vulnerabilities. The comprehensive nature of the update reflects the ongoing complexity and breadth of the Microsoft ecosystem, with critical patches spanning from core Windows components to cloud and developer tools. Security professionals are advised to prioritize the deployment of these patches, particularly those addressing actively exploited zero-days and critical remote code execution vulnerabilities. The update also highlights the evolving threat landscape, with attackers increasingly targeting third-party drivers and core system components to escalate privileges. Organizations are encouraged to review the full list of patched vulnerabilities and assess their exposure, especially in light of the end of support for Windows 10. The October 2025 Patch Tuesday underscores the necessity of timely patch management and the challenges posed by legacy systems in maintaining a secure enterprise environment.
Jun 29, 2026
Microsoft has announced the end-of-life (EOL) for several widely used software products, including Windows 10, Office 2016, Office 2019, Exchange Server 2016, and Exchange Server 2019, marking a significant transition for organizations relying on these platforms. The final security updates for Office 2016 and Office 2019 will be released this month, after which these products will no longer receive security patches or technical support. Organizations are strongly encouraged to migrate to newer versions such as Office 2024 or Office LTSC 2024, which will be supported through October 2029, or to adopt Microsoft 365 Apps for ongoing feature and security updates. The end of support for Exchange Server 2016 and 2019 is closely linked to Office upgrades, with Microsoft recommending migration to Exchange Online or the subscription edition for continued security and compliance. For Windows 11, Microsoft has issued reminders that the Home and Pro editions of version 23H2 will reach end of servicing on November 11, 2025, after which they will no longer receive monthly security or preview updates. Enterprise, Education, and IoT Enterprise editions of Windows 11 23H2 will remain supported until November 2026, providing organizations with additional time to plan migrations. Users are advised to upgrade to Windows 11 24H2 or later, with automatic updates available for unmanaged devices, though some systems may be held back due to compatibility issues such as the presence of SenseShield Technology code-obfuscation drivers. The transition to newer software versions is critical to maintaining security, as unsupported products become increasingly vulnerable to emerging threats. Microsoft has also introduced new tools, such as Windows Backup for Organizations, to facilitate smoother migrations and ensure business continuity. The company emphasizes the importance of timely upgrades to minimize operational and security risks associated with unsupported software. These EOL milestones represent the culmination of nearly a decade of service for several Microsoft products, underscoring the need for proactive IT planning. Organizations that have not yet migrated are urged to act quickly to avoid exposure to unpatched vulnerabilities. The coordinated end-of-support for multiple products may require significant resource allocation and careful scheduling to ensure seamless transitions. Microsoft’s guidance and new migration tools are designed to support enterprises through this period of change, but the responsibility for timely action rests with IT leaders. Failure to upgrade could result in compliance issues, increased attack surface, and potential business disruptions. The end-of-life announcements serve as a critical reminder of the ongoing lifecycle management required for enterprise software environments.
Jun 29, 2026
Security researchers identified a significant drop in the number of critical vulnerabilities in November 2025, with only 10 high-impact CVEs requiring immediate attention, compared to 32 in October. Notable threats included two actively exploited FortiWeb vulnerabilities (CVE-2025-64446 and CVE-2025-58034), a Samsung image processing flaw (CVE-2025-21042) weaponized for zero-click Android attacks, and several vulnerabilities with public proof-of-concept code available. The vulnerabilities spanned products from Microsoft, Google, Oracle, WatchGuard, and others, with exploitation campaigns favoring quality over quantity. In December 2025, Adobe and Microsoft released their final security updates of the year, addressing a large number of vulnerabilities across products such as Adobe Reader, ColdFusion, Experience Manager, and Creative Cloud Desktop. While Adobe patched 139 CVEs, most were cross-site scripting issues, and none were known to be under active attack at the time of release. Microsoft’s updates were also part of the regular Patch Tuesday cycle, emphasizing the ongoing need for organizations to remain vigilant and promptly apply security patches to mitigate risk from both newly disclosed and actively exploited vulnerabilities.
Jun 29, 2026