Saturday, October 18, 2025 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Saturday's security landscape maintains steady vulnerability pressure with 22 critical vulnerabilities (CVSS 9.0+) and 28 high-priority issues (CVSS 7.0-8.9), unchanged from Friday's levels as weekend disclosure patterns stabilize. Twenty-five actively exploited CISA KEV vulnerabilities demand immediate weekend attention, with five critical federal deadlines expiring Monday, October 19 (just 1 day away). The vulnerability landscape features a maximum-severity Squid caching proxy flaw (CVE-2025-62168, CVSS 10.0) enabling credential disclosure, alongside critical Apache ActiveMQ deserialization and WordPress plugin vulnerabilities. Weekend patch availability improves to 44% (up from Friday's 16%), providing organizations with deployment opportunities, though 56% of critical and high-priority vulnerabilities still lack vendor fixes entering the workweek. Enterprise systems across Sudo, Cisco IOS, Fortra GoAnywhere MFT, and Libraesva email gateways remain at elevated risk from active exploitation with Monday's compliance deadline imminent.

  • Critical CVEs: 22 vulnerabilities (unchanged from Friday, 0% change)
  • High-Priority CVEs: 28 vulnerabilities (unchanged from Friday, 0% change)
  • Weekend Patch Improvement: 44% - Nearly half of vulnerabilities now have vendor patches (up from 16%)
  • Maximum Severity Alert: CVE-2025-62168 - Squid proxy CVSS 10.0 credential disclosure vulnerability
  • Enterprise Systems at Risk: Apache ActiveMQ, Squid, WSO2, ConnectWise Automate, OPEXUS FOIAXpress
  • CISA KEV: 25 actively exploited vulnerabilities with 5 federal deadlines expiring October 19 (MONDAY - 1 DAY)

Immediate action: Immediate action: Deploy emergency patches for CVE-2025-32463 (Sudo), CVE-2025-59689 (Libraesva), CVE-2025-10035 (Fortra GoAnywhere), CVE-2025-20352 (Cisco IOS), and CVE-2021-21311 (Adminer) before Monday's October 19 federal deadline (1 day remaining). Prioritize weekend deployment of CVSS 10.0 Squid proxy patch (CVE-2025-62168) to prevent credential leakage. Implement compensating controls for Apache ActiveMQ NMS AMQP deserialization vulnerability (CVE-2025-54539) and WordPress Truelysell/Felan Framework authentication flaws. Organizations should leverage weekend maintenance windows to address the 56% of vulnerabilities lacking patches through network segmentation, access restrictions, and enhanced monitoring before Monday's business operations resume.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation