Serial number:AV25-650
Date:October 8, 2025
On October 8, 2025, GitLab published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number:AV25-649
Date:October 8, 2025
On October 7, 2025, Google published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.
Serial number:AV25-648
Date:October 7, 2025
On October 7, 2025, ABB published a security advisory to address a vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.
Serial number:AV25-647
Date:October 6, 2025
On October 6, 2025, Android published a security bulletin to address vulnerabilities affecting Android devices.
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Number: AL25-013
Date: October 7, 2025
This Alert is intended for IT professionals and managers.
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.
On October 4, 2025, Oracle released a security alert advisory for Oracle E-Business Suite addressing a critical vulnerability that allows attackers to perform an unauthenticated remote code execution (CVE-2025-61882) affecting the following productFootnote1:
The vulnerability is within the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration) and has been assigned a CVSS severity rating of 9.8 out of 10Footnote2.
In response to this vulnerability, the Cyber Centre released AV25-640 on October 6, 2025Footnote3. CISA has added CVE-2025-61882 to their Known Exploited Vulnerabilities (KEV) catalogFootnote4 on October 6, 2025.
The Cyber Centre strongly recommends that organizations patch the affected Oracle instances to the vendor recommended versionsFootnote1.
You should also review and implement our Top 10 IT Security ActionsFootnote5 with an emphasis on the following topics:
Should activity matching the content of this alert be discovered, recipients are encouraged to report via the My Cyber Portal, or email contact@cyber.gc.ca.
Information provided by organizations not subject to the Official Languages Act is in the language(s) provided.
Serial number:AV25-646
Date:October 6, 2025
On October 3, 2025, Redis published a security advisory to address a critical vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.