Corrections and updates

Added ConnectWise's 17:00 UTC update, that the shared credentials previously used for Cloud Backup are no longer valid, and Huntress's update that three Cloud Management apps were also abused, which ConnectWise's statement does not match. The diagram was redrawn.

Added that Microsoft's release notes now count 1,453 CVEs after late additions on 15 and 16 October, 30 of them Office CVEs it says were inadvertently omitted. The one exploited CVE was unchanged.

Added the Ombudsman's statement of 16 October: it is investigating unauthorised access to data in a case management system provided by a third-party supplier. It still gave no count, supplier name or date.

Added that the government's algorithmic transparency hub now shows a second Home Office record, a Disclosure and Barring Service AI summary tool published on 14 October. There is still none for the asylum tools.

Added that Palo Alto's advisory said build 11.2.16 was published on 15 October, so all 20 affected version ranges named a fixed build. Its other statements on exploitation were unchanged.

Added that CISA listed the flaw in its exploited catalogue on 15 October, due 18 October, and that Previdian's honeypot count rose to 616 attempts from 67 addresses in 21 countries.

Added that CISA listed CVE-2025-61624 in its exploited catalogue on 16 October, due 19 October, and that The Hacker News covered the Unit 42 report, overtaking the line that no independent coverage was found.

Added a section on probation data: the Legal Aid Agency's 14 October update and data FAQ said names, dates of birth, nationalities and case reference numbers of some offenders on probation between 2010 and 2017 were also taken.

Added that CISA listed the flaw in its exploited catalogue on 14 October with a three-day deadline, and that a Cisco spokesperson told The Register a limited number of customers were affected.

Added that CISA listed both flaws on 14 October, due 17 October, and that Ahsay's notice also named a hotfix, v9.15.2.70, for the version 7 to 9 line.

Added that Ledger asked resellers and distributors in seven Asian jurisdictions to suspend sales, and said inspections of its stock in Germany found no sign of tampering.

Added Previdian's honeypot count of 108 exploitation attempts from 51 addresses in three countries, all on 14 October and none in the six days before. Ivanti's advisory and CISA's catalogue were unchanged.

Added a section setting September's release beside October's, using Microsoft's release data: volume grew by about half, the exploited count fell from two to one, and CISA's catalogue deadline shortened from 14 to 3 days.

Added, per TV 2, that about 14 million searches were made through the company's lawful access, that a very high invoice revealed it, and that the company said it did not make the lookups.

Added CISA's alert, which listed the recovery steps the briefing had said were behind a sign-in, and Ivanti's statement to CyberScoop that it found part of the flaw internally in June.

Added Previdian's count of 380 attempts from 58 addresses in 19 countries, peaking on 7 and 8 October, and watchTowr's statement to The Hacker News that most attempts were fingerprinting.

Added Previdian's own figures, which sized the exploitation reports: 135 attempts from 2 addresses in one country, seen by one sensor on 9 and 10 October.

Added that a second honeypot operator, Defused, reported attempts against its SonicWall decoys from 8 October, per BleepingComputer and SecurityWeek. SonicWall's advisory still said there was no evidence of exploitation.

Added that the company confirmed to TV 2 it was the firm whose access was abused, the attack dates TV 2 reported, and a six-character password reported by Politiken, which no authority had confirmed.

Added statements from AWS to Dark Reading and from Amazon to The Register, both saying the research described documented behaviour, not a vulnerability. This overtook the line that Dark Reading carried no AWS statement.

Added that Previdian's honeypot sensors first recorded exploitation attempts on 9 October, as BleepingComputer reported, while SonicWall's advisory still said there was no evidence of exploitation.

Added four changed records, including CISA's forensic triage flag, now No, NVD's 7.5 score and Citrix's 8 October bulletin listing the 3 October fix builds as affected on SAML identity providers.

Added that CISA's catalogue, updated on 8 October after Splunk's advisories, still listed none of the 83 CVEs, and that CISA's coordinator had added readings to more of the records.

Added Previdian's updated count of 248 attempts from 42 addresses in 14 countries, and that CISA's catalogue had been updated on 8 October without listing the flaw.

Added Previdian's own page, which showed 193 honeypot attempts from 33 addresses in 11 countries. CISA's catalogue still did not list the flaw.

Added, per the Guardian, extracts of OpenAI's first email to Services Australia, which said there was no evidence a model accessed credentials. OpenAI's 28 September post had said credentials were retrieved.

Added that, per Infosecurity Magazine, VulnCheck put the flaw on its commercial known-exploited list on 7 October, while CISA's catalogue did not list it.

Added, per the BBC, that ASOS emailed customers saying data profiles were taken after an employee account was reached by impersonation, and that the group behind the notification sent the BBC a sample.

Added Snowflake's statement to the BBC that it had so far found no compromise of its platform, and the BBC's report that ASOS emailed customers to apologise and urge them not to engage.

Added a KrebsOnSecurity report, citing two unnamed sources, that a navigation unit Boeing had sold was among the group's extortion targets. Boeing's statement, as Krebs quoted it, was narrower than the report.

Added reports of honeypot attempts to exploit the flaw after watchTowr published its technical write-up, and that CISA's exploited catalogue still did not list it.

Added LevelBlue's report that it reproduced the update-blocking tool and Microsoft's statement to Dark Reading that Defender had detections. Sentences these reports overtook were marked as such.

Added, per BleepingComputer, ASOS's in-app notice telling customers to ignore the unauthorised alert, and the group's "final statement" claiming, without evidence, that it had stolen customer information.

Added the Guardian's account of the Australian parliamentary committee hearing, where OpenAI's chief strategy officer apologised again and said OpenAI should have handled its response better.

Added the FBI's statement, per Reuters, that a contractor failed to apply a security patch to a third-party platform and was removed. Later that day, noted two more outlets carrying the quotation, both citing Reuters.

Added Reuters' report, from anonymous sources, that a suspected ShinyHunters member was detained in Jordan and was cooperating with the FBI. The briefing does not name him.

Added CISA's listing of both Zammad flaws in its exploited catalogue on 2 October, Zammad's statement of 1 October on the two flaws, and NVD's change of both records to Analyzed.

Changed the record table after CISA's exploitation reading moved from none to active and NVD's status moved to Analyzed, both after publication, and added a dated note explaining when.

Added that the "agentic" label was borrowed: Microsoft linked the activity to JADEPUFFER, which Sysdig called agentic ransomware, through shared infrastructure, and said only that the timing strongly indicated automated or scripted execution.