Digest · Saturday

Security digest: October 4, 2025

1 editorial brief.

All digests · RSS · Markdown

Take stock

Act now: Oracle EBS CVE-2025-61882: Cl0p Zero-Day Data Theft. Organizations running Oracle E-Business Suite 12.2.3 through 12.2.14, especially with the web tier reachable from the internet.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

Oct 4, 2025 · Vulnerability · CVE-2025-61882, CVE-2025-61884

Oracle EBS CVE-2025-61882: Cl0p Zero-Day Data Theft

Any internet-reachable Oracle EBS 12.2.x server that missed the October 2025 alerts should be treated as compromised until a hunt proves otherwise.

Must act: Organizations running Oracle E-Business Suite 12.2.3 through 12.2.14, especially with the web tier reachable from the internet.

Can relax: Organizations that do not run Oracle E-Business Suite, including users of Oracle Fusion Cloud applications, which are a different product.

Apply the CVE-2025-61882 Security Alert patch, after confirming the October 2023 CPU prerequisite is installed
Apply the CVE-2025-61884 Security Alert patch and the latest quarterly CPU
Remove direct internet exposure of the EBS web tier or put it behind a WAF and VPN while you investigate

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.