erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: October 23, 2025

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Patch this week: Microsoft WSUS CVE-2025-59287: Unauthenticated SYSTEM RCE. Admins of Windows servers with the WSUS Server Role enabled, especially any reachable from the internet or from untrusted network segments.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

· Vulnerability · CVE-2025-59287

Microsoft WSUS CVE-2025-59287: Unauthenticated SYSTEM RCE

Only servers with the WSUS role are at risk, but on those it is unauthenticated SYSTEM code execution: patch them now, and treat any WSUS server exposed on 8530/8531 to the internet as a likely incident.

Must act: Admins of Windows servers with the WSUS Server Role enabled, especially any reachable from the internet or from untrusted network segments.

Can relax: Windows servers and clients without the WSUS role, and organizations that get updates directly from Windows Update or Intune, are not exposed to this bug.

  1. Inventory WSUS servers with Get-WindowsFeature -Name UpdateServices
  2. Install the October 23, 2025 out-of-band update (or a later cumulative update) and reboot
  3. If you cannot patch yet, disable the WSUS role or block inbound TCP 8530/8531 at the host firewall, and leave the workaround in place until patched

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.