Daily brief: Sunday 25 October 2026

A Chinese-linked bootkit is getting past Secure Boot on fully patched Windows, HPE patches eight maximum-severity ArubaOS flaws, Teams gets AI phishing detection, and fake iPhone Duo shops are harvesting personal details.

Cybersecurity

BlackX bootkit bypasses Secure Boot on fully patched Windows

Kaspersky has analysed a UEFI bootkit called BlackX, which it links to APT41 with medium confidence. It abuses the old Baton Drop flaw, CVE-2022-21894, with an exploit very similar to BlackLotus, so it can load its own EFI files and get past Secure Boot. Kaspersky says every victim was running fully patched Windows. It worked because the extra Secure Boot revocations that Microsoft's fix relies on had not been switched on by hand. The victims seen so far are diplomatic bodies in Central Asia.

Why it matters for IT: Installing the update is not enough for Baton Drop: the boot manager revocation has to be applied manually. Check Microsoft's guidance on revoking vulnerable Windows boot managers and plan the change carefully, as it touches boot media and recovery.

Source: BleepingComputer

Networking

HPE patches 72 ArubaOS flaws, eight of them maximum severity

HPE has released updates for 72 vulnerabilities in ArubaOS (AOS-8 and AOS-10), which runs Aruba wireless controllers, gateways, mobility conductors and access points. Eight are rated maximum severity, including authentication bypasses, command injection, SQL injection and buffer overflows that can lead to remote code execution without logging in. HPE said it was not aware of public exploit code or attacks at the time of the advisory.

Why it matters for IT: If you look after Aruba kit, check the HPE advisory (hpesbnw05162en_us) for fixed versions and patch soon. Until then, keep the CLI and web management interfaces on a separate management VLAN or behind firewall rules.

Source: BleepingComputer

Microsoft

Microsoft Teams is getting AI phishing detection that reads context

Microsoft says Teams will use AI to spot phishing, impersonation and social engineering in chats, even when a message has no bad link or file. It focuses on higher-risk cases such as first contact from external users. Microsoft says message content is not kept for model training or other uses. Targeted release is due to start in early November 2026, with general availability expected between early and mid-December. Admins don't need to do anything to turn it on.

Why it matters for IT: Useful extra cover, as Teams is now a common route for fake helpdesk attacks. Keep your external access settings tight anyway, and tell users that a warning in Teams is worth taking seriously. Roadmap ID 575288, message centre MC1519866.

Source: BleepingComputer

AI scams & spam

Fake iPhone Duo shops collect names, numbers and addresses

Kaspersky warns of fake sites copying Apple's store and offering up to 25% off the iPhone Duo. Some use a 30-minute countdown to rush people. They collect contact and delivery details and say a 'manager' will be in touch about payment. One Portuguese-language site asks for an email address and WhatsApp number just to 'check availability'.

Why it matters for IT: Expect follow-up calls and messages to staff who handed over details. Remind users to buy only from Apple or authorised retailers, and to call their bank straight away if they entered card details.

Source: Beebom

Weather

Live forecast

Loading the forecast…

Fact of the day

All facts

← All daily briefs