Top stories.
- Attackers are exploiting critical WSUS flaw.
- Schneider Electric and Emerson were allegedly breached via Oracle EBS flaw.
- Swedish power grid operator discloses breach.
Attackers are exploiting critical WSUS flaw.
Threat actors are actively exploiting a critical remote code execution vulnerability (CVE-2025-59287) affecting Windows Server Update Services (WSUS), the Register reports. Microsoft issued an emergency patch for the flaw last Thursday. Palo Alto Networks' Unit 42 observed exploitation of the flaw within hours of Microsoft's patch.
Dustin Childs, Head of Threat Awareness at Trend Micro's Zero Day Initiative, told the Register, "We are seeing about 100,000 hits for exploitation of this bug within the last seven days based on our telemetry," Dustin Childs, Trend Micro's Zero Day Initiative head of threat awareness, told the Register, "Our scans show that there are just under 500,000 internet-facing servers with the WSUS service enabled. Due to the nature of the bug, we expect just about every affected server to be hit at some point."
Google's Threat Intelligence Group added in a statement to the Register, "We are actively investigating the exploitation of CVE-2025-59287 by a newly identified threat actor we are tracking as UNC6512, across multiple victim organizations. Following initial access, the actor has been observed executing a series of commands to conduct reconnaissance on the compromised host and the associated environment. We have also observed exfiltration from impacted hosts."