⚡ Weekly Recap: WSUS Exploited, LockBit 5.0 Returns, Telegram Backdoor, F5 Breach Widens

Summary: Microsoft released out-of-band updates for CVE-2025-59287, a critical-severity (CVSS 9.8) remote code execution flaw in Windows Server Update Service that was originally fixed in the prior week's Patch Tuesday and has since come under active exploitation. According to Eye Security and Huntress, attackers are weaponizing the flaw to drop a .NET executable and Base64-encoded PowerShell payload to run arbitrary commands on infected hosts.
What you should know: A 9.8 flaw in the service that distributes your patches is now being used to push payloads, so the update channel itself is the attack path - and the fix already shipped once before exploitation began.

Read the original at The Hacker News ↗