At a glance.
- Microsoft issues out-of-band updates to fix reset and recovery problems.
- Unsecured database exposes information on people seeking medical marijuana cards.
- Criminals abuse website generator to create phishing sites.
Microsoft issues out-of-band updates to fix reset and recovery issue.
Microsoft has released emergency out-of-band updates for Windows to fix an issue in the August 2025 security updates that broke reset and recovery operations, BleepingComputer reports. The issue affects Windows 10 and older versions of Windows 11.
Microsoft stated, "Since this is a cumulative update, you do not need to apply any previous update before installing KB5066189, as it supersedes all previous updates for affected versions. This update does not contain any additional security updates from those available in the August 2025 security update. Installation of this OOB will require a device restart. If your organization uses the affected platforms and hasn’t yet deployed the August 2025 security update yet, we recommend you apply this OOB update instead."
Unsecured database exposes information on people seeking medical marijuana cards.
Security researcher Jeremiah Fowler discovered a publicly accessible database containing 323 GB of sensitive medical and personal information belonging to people seeking medical marijuana cards, WIRED reports. The database stored nearly a million records, including names, Social Security numbers, email addresses, physical addresses, and dates of birth, as well as medical records, mental health evaluations, physician reports, and images of IDs.
The apparent owner of the database was Ohio Medical Alliance LLC, which operates under the name "Ohio Marijuana Card." Fowler notified the company but didn't receive a response. The database was taken offline shortly after he sent the notification, however.
Criminals abuse website generator to create phishing sites.
Proofpoint warns that threat actors are abusing AI website generation platform Lovable to craft phishing sites. Proofpoint has observed "tens of thousands of Lovable URLs detected as threats each month in email data since February 2025." The company notes, "With automatic web creation tools, threat actors can spend more time on the attack chain and tooling capabilities and incorporate AI-generated social engineering into their toolkit. Creators of such tools should be mindful of opportunities for abuse and implement safeguards to prevent exploitation."
Lovable said it added improved security measures to block abuse last month, and the company plans to introduce additional safeguards this fall.
