Tonnage Tsunami: Can Ports Withstand the Ultra-Large Containership Surge?

Shoosh! no comment

 

Fall Out Boy - We Didn't Start the Fire (Lyric Video)

LIFTOFF! . . .Blastoff! SpaceX launches 100th Starlink mission of year, nails landing

Map Showing Gun Deaths In North & Central America | Brilliant Maps

 

Cartoon Carousel The nation’s cartoonists on the week in politics | By POLITICO STAFF 10/31/2025 05:00 AM EDT

 Every week political cartoonists throughout the country and across the political spectrum apply their ink-stained skills to capture the foibles, memes, hypocrisies and other head-slapping events in the world of politics. The fruits of these labors are hundreds of cartoons that entertain and enrage readers of all political stripes. Here's an offering of the best of this week's crop, picked fresh off the Toonosphere. Edited by Matt Wuerker.

CARTOON CAROUSEL

The nation’s cartoonists on the week in politics

By POLITICO Staff 

 

 

 

 

 

 

 

 

 

 

ZERO-DAYS ‘R US: Two Windows vulnerabilities, one a 0-day, are under active exploitation

HEADS UP: 

A critical Windows shortcut vulnerability is enabling advanced persistent threat actors to execute covert malware deployment campaigns against diplomatic and government entities worldwide.

Two Windows vulnerabilities—one a zero-day that has been known to attackers since 2017 and the other a critical flaw that Microsoft initially tried and failed to patch recently—are under active exploitation in widespread attacks targeting a swath of the Internet, researchers say.

Two Windows vulnerabilities, one a 0-day, are under active exploitation 

 

Both vulnerabilities are being exploited in wide-scale operations.

Dan Goodin – Oct 31, 2025 2:03 PM 

 The zero-day went undiscovered until March, when security firm Trend Micro said it had been under active exploitation since 2017, by as many as 11 separate advanced persistent threats (APTs). 

New Windows zero-day exploited by 11 state hacking groups since 2017

 

 

These APT groups, often with ties to nation-states, relentlessly attack specific individuals or groups of interest. 

Trend Micro went on to say that the groups were exploiting the vulnerability, then tracked as ZDI-CAN-25373, to install various known post-exploitation payloads on infrastructure located in nearly 60 countries, with the US, Canada, Russia, and Korea being the most common. 

A large-scale, coordinated operation 
Seven months later, Microsoft still hasn’t patched the vulnerability, which stems from a bug in the Windows Shortcut binary format. 

 

• The Windows component makes opening apps or accessing files easier and faster by allowing a single binary file to invoke them without having to navigate to their locations. 

• In recent months, the ZDI-CAN-25373 tracking designation has been changed to CVE-2025-9491.

 

On Thursday, security firm Arctic Wolf reported that it observed a China-aligned threat group, tracked as UNC-6384, exploiting CVE-2025-9491 in attacks against various European nations. The final payload is a widely used remote access trojan known as PlugX. To better conceal the malware, the exploit keeps the binary file encrypted in the RC4 format until the final step in the attack.

 

 

“The breadth of targeting across multiple European nations within a condensed timeframe suggests either a large-scale coordinated intelligence collection operation or deployment of multiple parallel operational teams with shared tooling but independent targeting,”  --- Arctic Wolf said. 

 

“The consistency in tradecraft across disparate targets indicates centralized tool development and operational security standards even if execution is distributed across multiple teams.”

 

== 

With no patch available, Windows users are left with a limited number of options for fending off attacks. The most effective countermeasure is locking down .lnk functions by blocking or restricting the usage of .lnk files from untrusted origins. This can be done by setting the Windows Explorer to disable the automatic resolution of such files. The severity rating for CVE-2025-9491 is 7 out of 10.

The other Windows vulnerability was patched last week, when Microsoft issued an unscheduled update. 

• CVE-2025-59287 carries a severity rating of 9.8. 
• It resides in the Windows Server Update Services, which administrators use to install, patch, or delete apps on vast fleets of servers. 
• Microsoft previously attempted to patch the potentially wormable remote code execution vulnerability, caused by a serialization flaw, a week earlier in its October Patch Tuesday release. 
• Publicly released proof-of-concept code quickly proved that the attempted fix was incomplete

> Around the same time that Microsoft released its second fix, security firm Huntress said it had observed the WSUS flaw being exploited starting on October 23. Security firm Eye reported the same finding shortly after.

> Security firm Sophos said Wednesday that it has also observed CVE-2025-59287 being exploited “in multiple customer environments” since October 24.

“The wave of activity, which spanned several hours and targeted internet-facing WSUS servers, impacted customers across a range of industries and did not appear to be targeted attacks,” Sophos said. 

“It is unclear if the threat actors behind this activity leveraged the public PoC or developed their own exploit.”

Administrators should investigate immediately if their devices are vulnerable to either of the ongoing attacks. 

There’s no indication when Microsoft will release a patch for CVE-2025-9491.

 

 

RELATED 

The Hacker News

21 hours ago

China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats 

 

Cyber Press

20 hours ago

Windows LNK File UI Misrepresentation Enables Remote Code Execution Attacks

 

 

Arctic Wolf

UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities 

 

Arctic Wolf Labs has identified an active cyber espionage campaign by Chinese-affiliated threat actor UNC6384 targeting European diplomatic...

1 day ago 

 

Help Net Security

Unpatched Windows vulnerability continues to be exploited by APTs (CVE-2025-9491)

A Windows vulnerability (CVE-2025-9491, aka ZDI-CAN-25373) that state-sponsored threat actors and cybercrime groups have been quietly...

20 hours ago

 

SOC Prime

17 hours ago

Seashell Blizzard Attack Detection: A Long-Running Cyber-Espionage “BadPilot” Campaign by russian-linked Hacking Group 

CyberWire

18 hours ago

CISA warns of actively exploited Linux kernel flaw.