Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 25-Oct-2025 04:57:46 JST Kevin Beaumont

   Since posting the thread, people are now using this vuln in the wild.

   So far, people aren’t using it to hit downstream client PCs and servers. I’d urge defenders not to detail how to do this yet as ransomware operators basically don’t know yet, it gives orgs more time to patch.

   There are a lot of WSUS servers on the internet and from sample scanning, I can’t find any that are patched.

   https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability

   • GreenSkyOverMe (Monika) and Steve's Place repeated this.
   • Embed this notice
     James Forshaw :donor: (tiraniddo@infosec.exchange)'s status on Saturday, 25-Oct-2025 03:46:15 JST James Forshaw :donor:

     @GossiTheDog honestly, just calling the bug RCE almost undersells the damage this bug can do. Such as stupid bug as well.

   • Embed this notice
     James Forshaw :donor: (tiraniddo@infosec.exchange)'s status on Saturday, 25-Oct-2025 03:56:32 JST James Forshaw :donor:

     @GossiTheDog unsafe BinaryFormatter usage has been on the shit list for at least a decade, this should have been found in less than a hour with grep. This should never have been in the code so long, it should have been audited out.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 25-Oct-2025 05:03:17 JST Kevin Beaumont

     in reply to

     I don’t think Microsoft have done a good job on commsing this one, events are going to overtake them.

     Also they really need to get on top of this class of vuln — it’s incredibly easy to find and they not only own the product and .net product, they also own the vuln class and the teams who are supposed to find these vulns.

   • Embed this notice
     Cat 🐈🥗 (D.Burch) (catsalad@infosec.exchange)'s status on Saturday, 25-Oct-2025 05:18:28 JST Cat 🐈🥗 (D.Burch)

     in reply to

     @GossiTheDog At least it's almost the weekend. Ransomware operators take weekend breaks, right?

   • Embed this notice
     Just_Patch_It (just_patch_it@cyberplace.social)'s status on Saturday, 25-Oct-2025 05:28:27 JST Just_Patch_It

     @GossiTheDog WTF would anyone have this internet facing anyway? Please tell.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 25-Oct-2025 06:25:52 JST Kevin Beaumont

     in reply to

     Also, although Windows Server 2008 isn’t listed as vulnerable I think it is. MS doesn’t test or list EOL products.

   • Embed this notice
     RecklessPush38671 (recklesspush38671@infosec.exchange)'s status on Saturday, 25-Oct-2025 07:29:02 JST RecklessPush38671

     in reply to

     @GossiTheDog Hey! If you've got the exploit working could you test whether it just affects native WSUS servers or can it also be used to exploit SCCM servers that have the WSUS functionality enabled?

     I'm seeing some pretty strong evidence the SCCM+WSUS combo setup is getting pwned in the wild too.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 25-Oct-2025 07:29:02 JST Kevin Beaumont

     in reply to

     • RecklessPush38671

     @RecklessPush38671 I haven’t yet tested SCCM end to end but I believe this is the case - they piggy back off the config

   • Embed this notice
     Onkel Hotte ¯\_(ツ)_/¯ (onkelhotte@metalhead.club)'s status on Sunday, 26-Oct-2025 05:14:15 JST Onkel Hotte ¯\_(ツ)_/¯

     in reply to

     @GossiTheDog even 2008 got an Update. .

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 27-Oct-2025 03:41:53 JST Kevin Beaumont

     in reply to

     I've seen a few media reports that only 25 WSUS servers are on the internet. You're missing a few zeros. https://infosec.exchange/@shadowserver/115441925070452573

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 27-Oct-2025 03:43:37 JST Kevin Beaumont

     in reply to

     There's also a few media reports which say I said the WSUS patch doesn't fix the issue. I never said that. Everything I said is in this thread. The latest patch fixes the issue (it actually removes the vuln function from WSUS entirely, which breaks reporting stats).

   • Embed this notice
     V4N4D1S (v4n4d1s@mastodon.social)'s status on Monday, 27-Oct-2025 04:07:36 JST V4N4D1S

     in reply to

     @GossiTheDog https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability the 25 could be from this huntress post