Friday Wrap Up: 24 October 2025
Another week, another reminder that cybersecurity never takes a coffee break! ☕
From botnet malware targeting your router to smart beds that won’t lie flat during cloud outages (yes, really), this week had everything. We’re talking billion-dollar breaches, quantum leaps, AI agents surfing the web, and Microsoft patches that caused more problems than they solved. Plus, ransomware victims learning the hard way that paying up doesn’t guarantee getting your data back.
Whether you’re dealing with Iranian nation-state actors, malicious Chrome extensions, or just trying to figure out why your $2,449 bed won’t recline, this week’s security landscape was... eventful.
Check out the full roundup for all the details. Your security posture will thank you. 🛡️
Major Cyberattacks & Incidents
High-profile breaches and ransomware attacks dominated headlines this week, with significant financial and operational impacts.
💰 Jaguar Land Rover cyber attack is projected to cost the UK £1.9 billion, according to the country’s Cyber Monitoring Centre calculations. (Published on 22-Oct-2025, Computer Weekly). Read More
🎄 Jingle Thief cybercriminal group targets retail and consumer cloud environments through phishing and smishing to steal credentials and commit gift card fraud. (Published on 23-Oct-2025, The Hacker News). Read More
🔐 Medusa ransomware leaked 186 GB of Comcast data after the company reportedly didn’t pay a $1.2 million ransom demand, with attackers claiming 834 GB stolen. (Published on 23-Oct-2025, Hackread). Read More
Malware & Vulnerabilities
From browser extensions to mobile malware, threat actors deployed sophisticated tools to compromise systems worldwide.
📉 Lumma Stealer activity dropped significantly after core members of the group were exposed in an underground doxxing campaign targeting the malware operation. (Published on 20-Oct-2025, SecurityWeek). Read More
🌐 131 Chrome extensions hijacked WhatsApp Web to spam Brazilian users at scale, sharing identical codebase and infrastructure with 20,905 active users collectively affected. (Published on 20-Oct-2025, The Hacker News). Read More
🤖 PolarEdge botnet malware targets routers from Cisco, ASUS, QNAP, and Synology to corral devices into a network for undetermined purposes. (Published on 21-Oct-2025, The Hacker News). Read More
🎭 AI Sidebar Spoofing attack discovered by SquareX reveals malicious browser extensions impersonating AI browser sidebars to compromise users. (Published on 23-Oct-2025, Hackread). Read More
📱 Baohuo Android malware hijacks Telegram X accounts to steal data and control chats, infecting over 58,000 devices primarily in India and Brazil. (Published on 24-Oct-2025, Hackread). Read More
DDoS, Outages & Infrastructure
Major cloud infrastructure disruptions reminded everyone about the risks of centralized dependencies.
☁️ AWS outage crashed millions of websites including Amazon.com, Prime Video, Perplexity AI, Canva, and Fortnite due to infrastructure failures. (Published on 20-Oct-2025, BleepingComputer). Read More
🛏️ Internet-dependent smart beds remained stuck in inclined positions during AWS outage, highlighting absurdity of cloud-connected furniture costing $2,449. (Published on 22-Oct-2025, Ars Technica). Read More
Espionage & Data Extraction
Nation-state actors continued sophisticated campaigns targeting government and enterprise systems.
🎯 Iran-linked MuddyWater group targeted over 100 government entities across Middle East and North Africa using Phoenix backdoor distributed via compromised email accounts. (Published on 22-Oct-2025, The Hacker News). Read More
🚫 NSO Group permanently barred from targeting WhatsApp users with Pegasus spyware, with court ruling that defeating end-to-end encryption harms Meta’s business. (Published on 20-Oct-2025, Ars Technica). Read More
Vulnerability Research & Industry Analysis
Critical flaws and problematic patches created widespread challenges for enterprise security teams.
⚠️ Oracle E-Business Suite customers received conflicting WAF deployment guidance, leaving enterprises exposed to a recent zero-day flaw exploited in ransomware attacks. (Published on 20-Oct-2025, Dark Reading). Read More
🔧 Microsoft’s October 2025 Windows security update KB5066835 caused widespread enterprise disruptions including smartcard authentication failures, USB device malfunctions, and IIS website loading issues. (Published on 21-Oct-2025, CSO Online). Read More
🏆 Security researchers exploited 34 unique zero-days on the first day of Pwn2Own Ireland 2025, collectively earning $522,500 in cash awards. (Published on 21-Oct-2025, BleepingComputer). Read More
🛒 Hackers actively exploit critical SessionReaper vulnerability CVE-2025-54236 in Adobe Commerce (Magento) platforms with hundreds of recorded attempts. (Published on 22-Oct-2025, BleepingComputer). Read More
💸 40% of ransomware victims who pay ransom still lose their data due to flawed encryption, unreliable decryptors, and compromised backups. (Published on 24-Oct-2025, CSO Online). Read More
🔒 Microsoft disabled downloaded file previews to block NTLM hash leaks exploiting HTML tags referencing external paths during file preview operations. (Published on 24-Oct-2025, SecurityWeek). Read More
🚨 Microsoft released out-of-band security updates for critical Windows Server Update Service vulnerability with publicly available proof-of-concept exploit code. (Published on 24-Oct-2025, BleepingComputer). Read More
Cybersecurity Tools & Techniques
Industry experts shared insights on protecting against supply chain threats through better identity management.
🔗 Mismanaged identities and insufficient access policies expose organizations to supply chain attacks, requiring end-to-end Identity Lifecycle Protection as solution. (Published on 22-Oct-2025, Malware Analysis). Read More
AI & Policy
Quantum computing advances and AI agent capabilities marked significant technology developments.
⚛️ Google’s quantum algorithm using “quantum echoes” approach outperforms supercomputers, taking 13,000 times longer to complete on traditional computing infrastructure. (Published on 22-Oct-2025, Ars Technica). Read More
🤖 OpenAI’s “Agent Mode” Atlas demonstrated ability to automate web-based tasks from scanning emails to building fansites during comprehensive testing. (Published on 23-Oct-2025, Ars Technica). Read More
Stay informed and secure in the tech and cybersecurity world. Have a great weekend, and remember to patch and protect your systems!