Patch Tuesday Fallout

Vault dwellers, October 2025 is a historic month for two reasons: 172 vulnerabilities — the highest count of the year — and the official end of free Windows 10 security updates. RIP, old friend. On the zero-day front, three are being actively exploited in the wild and all three hit CISA's Known Exploited Vulnerabilities catalog. CVE-2025-24990 lives in the legacy Agere Modem driver (ltmdm64.sys) that shipped with every version of Windows, including Server 2025 — Microsoft's fix is to delete the driver entirely, which will break fax modems. CVE-2025-59230 is the first-ever RasMan (Remote Access Connection Manager) zero-day exploited in the wild — it's been patched 20+ times since 2022 but never as a zero-day until now. CrowdStrike linked active exploitation to at least one threat actor. CVE-2025-47827 is a Secure Boot bypass in IGEL OS (thin clients common in healthcare and retail), weaponized with a public PoC from June 2025. Critical highlights: CVE-2025-59287 is a CVSS 9.8 WSUS RCE allowing unauthenticated attackers to execute code against your update server — your update infrastructure itself. Post-October update, CISA confirmed CVE-2025-59287 was also exploited in the wild. including 2 publicly disclosed zero-days and 9 criticals. The headliner is CVE-2025-55234 — a privilege escalation flaw in Windows SMB Server that enables relay attacks, allowing attackers to impersonate users and escalate privileges. No active exploitation confirmed, but public details are out there, so the clock is ticking. The second zero-day is CVE-2024-21907 — a year-old denial-of-service flaw in Newtonsoft.Json now bundled into SQL Server patches (yes, really — a 2024 CVE finally getting its Microsoft fix in 2025). Critical NTLM flaw CVE-2025-54918 (CVSS 8.8) is flagged as "Exploitation More Likely" — chain it with other bugs and attackers could reach SYSTEM. Office RCE via CVE-2025-54910 is trigged through the Outlook Preview Pane with no user interaction — treat that one as urgent. Windows 10 (KB5065429) and Windows 11 (KB5065426/KB5065431) are this month's deployments. September also fixes the NDI streaming chaos left behind by August's updates. Patch fast, but hold developer machines — there's a big one incoming.