Microsoft's Windows users are under attack from two separate vulnerabilities, one of which is a previously known zero-day exploit that has been in use for years. The other vulnerability, recently patched by Microsoft, has been exploited by multiple threat groups worldwide.
Security researchers at Trend Micro have confirmed that the zero-day vulnerability, tracking designation ZDI-CAN-25373, was being actively used since 2017 by advanced persistent threats (APTs) from various nation-states to install malware on infrastructure in nearly 60 countries. The most commonly targeted countries included the US, Canada, Russia, and Korea.
However, it's not just the zero-day exploit that's causing concern – another critical vulnerability was initially left unpatched for months, until Microsoft released an unscheduled update last week. CVE-2025-59287 is a wormable remote code execution vulnerability in Windows Server Update Services (WSUS), which allows attackers to execute arbitrary code on servers.
Security firms Arctic Wolf, Eye, and Sophos have all reported observing the exploitation of this vulnerability since October 23rd. The exploit is used to install PlugX, a widely used remote access trojan. Researchers believe that threat actors may be using publicly available proof-of-concept (PoC) code for the exploit or developing their own custom exploits.
Microsoft has yet to release a patch for CVE-2025-9491, leaving users vulnerable to attacks by multiple APT groups. The severity rating for this vulnerability is 7 out of 10.
To mitigate these risks, administrators are advised to block or restrict .lnk file usage from untrusted origins and set the Windows Explorer to disable automatic resolution of such files. In addition, the latest patch for CVE-2025-59287 has been applied, providing some protection against WSUS exploitation.
Security researchers at Trend Micro have confirmed that the zero-day vulnerability, tracking designation ZDI-CAN-25373, was being actively used since 2017 by advanced persistent threats (APTs) from various nation-states to install malware on infrastructure in nearly 60 countries. The most commonly targeted countries included the US, Canada, Russia, and Korea.
However, it's not just the zero-day exploit that's causing concern – another critical vulnerability was initially left unpatched for months, until Microsoft released an unscheduled update last week. CVE-2025-59287 is a wormable remote code execution vulnerability in Windows Server Update Services (WSUS), which allows attackers to execute arbitrary code on servers.
Security firms Arctic Wolf, Eye, and Sophos have all reported observing the exploitation of this vulnerability since October 23rd. The exploit is used to install PlugX, a widely used remote access trojan. Researchers believe that threat actors may be using publicly available proof-of-concept (PoC) code for the exploit or developing their own custom exploits.
Microsoft has yet to release a patch for CVE-2025-9491, leaving users vulnerable to attacks by multiple APT groups. The severity rating for this vulnerability is 7 out of 10.
To mitigate these risks, administrators are advised to block or restrict .lnk file usage from untrusted origins and set the Windows Explorer to disable automatic resolution of such files. In addition, the latest patch for CVE-2025-59287 has been applied, providing some protection against WSUS exploitation.
think its crazy that msft knew about these vuls for years & didnt act on it. like, what took em so long to release patches? 
especially with the zero-day one - 2017 already?! thats ages. shouldnt be a national sec issue or smthin
... Microsoft's supposed security team drops two major vulnerabilities in one go and it's like they're begging to be exploited! I mean, a zero-day exploit that's been around since 2017? Come on, guys, get it together 
. And now we've got a wormable remote code execution vulnerability in WSUS that's being used by APTs left and right... it's like a never-ending nightmare for security folks 
.
. Can't they just prioritize these patches already? 
.
. I get that security is a top priority and all, but shouldn't they be able to anticipate these kinds of attacks?
It's just so crazy how these threat actors are using publicly available PoC code for the exploit or developing their own custom ones 
. I mean, can't we just get some decent security software already?
. Blocking .lnk file usage and disabling automatic resolution might seem like a hassle, but it's better than being hacked, right? 
.
! I mean, I knew Microsoft was due for a security check-up, but two separate vulnerabilities in one month? That's just not cool. The zero-day exploit that's been around since 2017 is already giving me anxiety 
. And now that it's been exploited since October, I'm sure we'll be seeing more and more reports of PlugX infections coming out of it.
. Can't they just give us a heads up on when those patches are going to drop? And what's with the 7/10 severity rating for CVE-2025-9491? That's like, super serious stuff...
i'm like super worried about my laptop lol. how did these zero-day exploits even go unnoticed for so long?! 
it's like, i get that security is a never-ending battle, but can't microsoft just patch everything already?! 
anyway, guess we'll just have to keep an eye on our laptops and update our os regularly 
I'm not exactly a tech whiz, but even I know that's gotta be stressful for those security researchers at Trend Micro 
. Like, 60 countries affected? That's insane! 
How do these hackers not get caught yet? It's like they're playing a never-ending game of cat and mouse with Microsoft 
, and the other is a more recent vulnerability that was left unpatched for months 
.
and patch these vulnerabilities ASAP 
. I mean, who wants their Windows Server Update Services (WSUS) exploited by APT groups? 
and set the Windows Explorer to disable automatic resolution of such files 
. And kudos to Microsoft for releasing an unscheduled update for CVE-2025-59287 
and hope that these vulnerabilities get patched soon 
. I'm all for getting something done ASAP, but let's get the root cause fixed too, you know? 
.
. Anyway, if you're a windows user, make sure to block those .lnk files from untrusted origins ASAP 
. Your computer is literally begging for help 
so yeah be careful w/ ur updates & dont even think about clickin on suspicious links from untrusted origins 
so yeah, just be careful when clicking on weird links and stuff, k? 
. And I'll make sure to keep my Windows up-to-date 
. And now we've got users worldwide dealing with the fallout - poor show, MS! 
.
.
. Now let's hope Microsoft can step up their game and patch these vulnerabilities ASAP 
!
but honestly, this should never happen 
Security firms are already seeing exploitation, and no patch yet? That's just unacceptable. 
And Microsoft is supposed to be the one protecting us, right?