In today’s cybersecurity news…
Azure outage blocks access to Microsoft 365 services and admin portals
This outage affected the Microsoft Azure Front Door content delivery network (CDN) and prevented customers from accessing some Microsoft 365 services. Delays and timeouts were observed across Europe, Africa, and the Middle East yesterday for users connecting to the Azure and Entra portals. Since then, Microsoft engineering teams have been “restarting Kubernetes instances that were causing capacity loss across AFD instances to bring them back online.” As of this recording, 96% of impacted resources have been successfully recovered.
Major U.S. law firm suffers cyberattack
Williams & Connolly, a firm that includes some high-profile politicians on its client list, said on Tuesday that on Tuesday said that “suspected nation-state hackers used a zero-day attack to break into email accounts belonging to a small number of attorneys.” The firm did not say which nation-state, but it is believed to be the same that has recently attacked other law firms and companies. The New York Times claims its sources identify this as China. The Google Threat Intelligence Group and Mandiant concur, stating that “China-nexus threat clusters” have been leading a campaign which exploits zero-day vulnerabilities to target the U.S. legal sector and collect information related to U.S. national security and international trade.” Spokespeople for Williams & Connolly emphasized that “it does not have evidence that confidential client data was taken from central databases where files are kept.”
Hacktivists aiming for critical infrastructure get pwned
A pro-Russian hacktivist group called TwoNet recently changed tack, moving from launching DDoS attacks to targeting critical infrastructure. A report from enterprise IT security firm ForeScout describes how the group attacked what it thought was a water treatment plant but was instead a decoy set up to observe the activities of such groups. The full story is available at BleepingComputer – the link is in the show notes – and it describes the various steps the group took, believing this to be a real target. ForeScout recommends that organizations in the critical infrastructure sector ensure that systems have strong authentication and are not exposed to the public web.
Hackers Access SonicWall Cloud Firewall Backups
SonicWall stated on Wednesday that “an unauthorized party accessed firewall configuration backup files for all customers who have used the cloud backup service. The files contain encrypted credentials and configuration data; while encryption remains in place, possession of these files could increase the risk of targeted attacks.” A list of impacted devices is available on the MySonicWall portal along with a priority level to help customers prioritize their remediation efforts. Devices with internet-facing services enabled are listed as highest priority.(The Hacker News)
Huge thanks to our sponsor, ThreatLocker
Hundreds of millions of business PCs are still on Windows 10 as end day nears
Following up on a story we have been covering throughout this year, some interesting statistics around the expiry of support for Windows 10 which occurs next Tuesday, October 14. According to analyst Kieren Jessop of Omdia, speaking to The Register, there are 1.4 billion Windows devices running worldwide among individual consumers and businesses. 550 million of these machines are running in corporations and around half of those will not meet the end-of-life deadline to switch to Windows 11, in many cases because the devices do not meet the minimum requirements for the upgrade. On October 14, Microsoft will issue the final updates and security fixes, after which business customers will have to pay for extended security updates at $61 for the first 12 months, doubling to $122 for the second year and doubling again for year three.
WordPress plugin flaw gives hackers access to admin accounts
The flaw has a CVE number (CVE-2025-5947) and a CVSS score of 9.8 and exists within the Service Finder Bookings plugin. According to Wordfence, versions of this plugin up to and including version 6.0 have an “authentication bypass issue allowing attackers to log in as any user, including admins, due to improper cookie validation.” The plugin is a built-in component designed to let businesses and professionals offer service listings and online booking functionality on their WordPress websites.
Arrests made in UK nursery ransomware attack
Following up on a story we covered in late September, two individuals, both 17-year-old boys, have been arrested in connection with the ransomware attack on the Kido chain of children’s nurseries. The attack, which had been claimed by a group named Radiant, exposed data such as names, home addresses, parent’s work locations, and images of the children. The hackers had been calling parents directly about their hack in order to pressure Kido into paying the £600,000 ransom.
(BBC News)
ChatGPT image and prompts used as evidence in arrest of Pacific Palisade Eaton fire suspect
U.S. prosecutors have charged Jonathan Rinderknecht with arson for allegedly starting the 2025 Palisades wildfire in California, which destroyed homes and forced mass evacuations. Investigators say digital evidence links him to the fire, including a ChatGPT-generated image of a burning city found on his phone, which they argue reflects premeditation. Additional data from his phone, online activity, and physical evidence allegedly connect him to the blaze’s origin. The defense disputes the interpretation, noting that an AI-created image is circumstantial and not proof of action. The case highlights growing challenges in using generative AI content as criminal evidence.
(BBC News)