Patch Tuesday notes. US and UK seize $15 billion in Bitcoin from alleged scam syndicate.

Summary

By the CyberWire staff

Patch Tuesday notes.

Microsoft yesterday issued patches for 172 vulnerabilities, including six zero-day flaws, BleepingComputer reports. Three of the zero-days are being actively exploited, while the others were publicly disclosed before a patch was available.

KrebsOnSecurity notes that this is the last month that Windows 10 will receive security patches unless customers enroll in the Extended Security Updates program. The operating system has officially reached end-of-life. The cost for the Extended Security Updates program is $30, or free if users register their PCs to a Microsoft account.

The Register reports that Adobe has fixed 36 vulnerabilities in its products, including several critical remote code execution flaws. SAP has issued 13 new security notes and updated four previous security notes. Three of the flaws are deemed critical. Fortinet and Ivanti have also fixed high-severity flaws, SecurityWeek reports.

Control what runs in your environment. Reduce your attack surface.

ThreatLocker helps organizations reduce risk by allowing trusted applications to run while limiting their access to only the resources they need. It’s a straightforward, default deny approach that gives you more control and visibility—without slowing down operations. Explore how ThreatLocker can help simplify your security strategy.

US and UK seize $15 billion in Bitcoin from alleged scam syndicate.

Authorities in the US and UK yesterday took action against a major Cambodian crime organization that was running forced-labor scam compounds across the country, WIRED reports. The US Justice Department charged Chen Zhi, founder and chairman of the Cambodian conglomerate Prince Holding Group, with directing the scam operations. The Justice Department alleges that Zhi "was directly involved in using violence against the individuals within the forced labor camps and possessed images of Prince Group’s violent methods, including photographs depicting beatings and other methods of torture."

Justice says the siezed funds were "proceeds and instrumentalities of the defendant’s fraud and money laundering schemes, and were previously stored in unhosted cryptocurrency wallets whose private keys the defendant had in his possession."

SecAI+: CompTIA’s first AI certification.

CompTIA is developing their first-ever certification focused on artificial intelligence in cybersecurity. The SecAI+certification aims to help mid-career cybersecurity professionals demonstrate competencies with AI tools. Learn how N2K can help you get a jumpstart on preparing for this new certification today.

Vietnam Airlines discloses third-party breach.

Vietnam Airlines has disclosed a data breach involving "a third-party customer service platform operated by a global technology partner." The threat actor may have accessed "certain customer data," but the airline says the breach did not affect "payment information, passwords, travel itineraries, Lotusmiles balances, [or] passport details." The airline is notifying affected individuals, and warns customers to be vigilant for tailored phishing attacks.

VietnamNet reports that the incident involved the airline's Salesforce instance. The data was leaked by the Scattered LAPSUS$ Hunters group. According to Have I Been Pwned, the dataset includes 7.3 million unique email addresses, as well as names, phone numbers, dates of birth, and loyalty program numbers.

Notes.

Today's issue includes events affecting Cambodia, Vietnam, the United Kingdom, and the United States.

Attacks, Threats, and Vulnerabilities

Mango says some customer information exposed in cyber incident (The Record) Spain-based fashion chain Mango reported a data breach that exposed customer information but did not appear to affect internal corporate systems.

Auto giant Stellantis discloses data breach affecting North American customers (Top Class Actions) Automotive giant Stellantis has announced a data breach that compromised the contact information of its North American customers through a third-party service provider's platform.

Marketplace

Spyware maker NSO Group confirms acquisition by US investors (TechCrunch) NSO Group confirmed to TechCrunch that an unnamed group of American investors has taken “controlling ownership” of the surveillance tech maker.

Legislation, Policy, and Regulation

California enacts age verification, chatbot laws (The Record) California's governor signed a bill that requires chatbot operators to set up a system to prevent suicidal ideation — an issue that several federal lawmakers have also focused on in recent months.

Litigation, Investigation, and Law Enforcement

Capita Fined £14m After 2023 Breach that Hit 6.6 Million People (Infosecurity Magazine) Outsourcing giant Capita has been fined £14m by the ICO after a major data breach in 2023

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

AFRL Space Cyber Summit (Albuquerque, New Mexico, USA, Oct 15 - 16, 2025) The AFRL Space Cyber Summit is an annual event hosted by the Air Force Research Laboratory (AFRL) to bring together experts from government, academia, and industry to advance space cyber expertise and technologies, foster community-wide collaboration, and anticipate future technology growth in a cyber-contested space domain. The summit aims to develop cyber-secure systems for space, protect against evolving threats, and identify opportunities for collaboration and innovation.

ISC2 Security Congress 2025 (Nashville + Virtual, Tennessee, USA, Oct 29 - 31, 2025) Join thousands of cybersecurity experts at ISC2 Security Congress 2025 and help lead the future of our connected world. Gain the insights you need to stay ahead of the evolving digital landscape. From innovative software to new security strategies, ISC2 Security Congress 2025 is designed to ensure you can navigate tomorrow’s threats.

Cyber Innovation Day 2025 | Datatribe (Washington, DC, USA, Nov 4, 2025) If you’re raising a seed or pre-seed round and are building the next category-defining company, we want to hear from you! The DataTribe Challenge is the headline event of the afternoon at Cyber Innovation Day 2025, where five finalists take the stage after weeks of hands-on coaching from seasoned startup operators and investors. These five finalists—along with additional promising startups—will exhibit in the Cyber Innovation Expo Hall, gaining high-impact exposure to top investors, cybersecurity leaders, and strategic partners.

CYBERWARCON (Virtual and Arlington, Virginia, USA, Nov 19, 2025) CYBERWARCON is a one-day conference in Arlington, VA focused on the specter of destruction, disruption, and malicious influence on our society through cyber capabilities. CYBERWARCON is not a hacker conference, or an ICS conference, or an international policy conference. The central purpose of this conference is to identify and explore threats. Participants and attendees come from a spectrum of backgrounds, including the military and government, academia, the media, and the private sector.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 10.15.25

Top stories.