Hello and welcome to the Monday, October 13th, 2025 edition of the Sands International

Center's Stormcast. My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the Sands.edu, graduate certificate program in cloud security.

Oracle e-business suites users be aware there is yet another update for you to apply.

This update was released on Sunday and it doesn't state in Oracle's notice whether or not this particular vulnerability is already being exploited.

It's only an information leakage vulnerability, so an unauthenticated user may have access to information that they're not supposed to have access to.

However, given that there's really no

statement whether or not it's being exploited, it's released on a Sunday, it's released just a

week after we had that major already exploited vulnerability, and it's about a week before

the normal Oracle Critical Patch update, the quarterly update they're releasing

for all of their products. I would assume that this vulnerability is already being exploited,

maybe a follow-on to the initial attack that vulnerability was patched last weekend, or maybe

just part of that attack that wasn't really patched

in Sunday's update. Not much here from Oracle to go by other than conjecture, and I would

err on the side of caution in the sense that you probably want to apply this patch as soon as possible before the critical patch update

for the quarter comes out in a week, just so you got it off your plate and then can focus on

whatever that critical patch update fixes. But yeah, really not a lot to go by here from Oracle's site. So really just

making some assumptions here. And Hunter's Lab is reporting in the blog post that they're seeing

the widespread exploitation of Sonic Wall VPN devices. What they're noting here is that the attacker is rapidly logging in to a number

of different accounts. This, of course, comes a couple days after Sonic Wall. Let it be known that

all configurations uploaded to its My Sonic Wall cloud storage had been compromised.

Best guess is that whatever actor got a hold of these configurations is now as quickly as possible,

...