10/17/2025 — Tech & Cybersecurity Updates

 

New York Bans AI‑Driven Rent Price Fixing by Landlords

• What happened: On October 16, 2025, New York Governor Kathy Hochul signed into law a first‑of‑its‑kind bill prohibiting landlords from using AI or algorithmic tools to set or collude on rental prices. The Verge

• Why it matters (for non‑tech folks): These AI systems have been criticized for enabling coordinated “algorithmic collusion” — i.e. separate owners using the same software end up raising prices in sync without overt discussion. The law protects tenants from unfair “price inflation by machine.”

• What’s next: The law takes effect in ~60 days. Expect other states or cities to consider similar bans. Landlord software makers may push back or adapt, and there will likely be legal challenges or clarifications about enforcement.

---

Congress Raises Flags Over TikTok Algorithm Licensing Deal

• What happened: On October 16, U.S. Representative John Moolenaar (chair of the House Select Committee on China) publicly criticized a proposed deal giving U.S. owners access to TikTok’s algorithm, warning that retaining Chinese ties or influence over the algorithm would be a security risk. Reuters

• Why it matters: The algorithm is TikTok’s “secret sauce” — how it suggests videos, curates content, and shapes what users see. If foreign influence remains, it could raise concerns about censorship, influence campaigns, or data misuse. Given TikTok’s massive U.S. user base (~170 million), oversight of how the algorithm works is now a national discussion.

• What’s next: Congressional hearings or legislation may require full algorithmic separation (not just “licensed access”). Oversight bodies could demand audits, algorithm transparency, or divestment from Chinese parent influence.

• F5 Breach: Nation‑State Hackers Stole BIG‑IP Source Code; CISA Issues Emergency Directive

  • What happened: On October 16, 2025, U.S. authorities and cybersecurity firms confirmed that F5 — maker of widely used networking gear (via their BIG-IP systems) — was infiltrated by a nation-state actor. Hackers managed to steal portions of F5’s source code and internal vulnerability data. Reuters+3TechRadar+3Axios+3

  • Why it matters (especially for seniors / non‑tech folks): Many large organizations, government agencies, and healthcare systems use F5 gear behind the scenes (for load balancing, firewalls, web traffic routing). If hackers now know how the systems work internally, they may target those organizations more effectively. Even if your personal device isn’t directly affected, your bank, hospital, or local government may become an easier target.

  • What’s next:
      • Federal agencies have been ordered to audit, patch, or replace vulnerable F5 devices. TechRadar+1
      • F5 is releasing patches across its product line. GBHackers+1
      • Cybersecurity firms and attackers will pour over the stolen code — new vulnerabilities or “zero‑days” may surface.
      • Organizations using F5 gear should urgently review their exposure, check for unusual behavior, and apply updates.

  ---

  Microsoft’s “Highest Ever” ASP.NET Core Vulnerability (CVE‑2025‑55315) Cracks 9.9 Severity

  • What happened: On October 17, Microsoft disclosed that a critical flaw in ASP.NET Core — used by many web applications — received a severity score of 9.9 / 10, the highest they’ve ever assigned. The bug (an HTTP request smuggling issue) allows attackers to bypass security controls, leak data, or tamper with requests. SecurityWeek

  • Why it matters: Many websites, government portals, and business apps run on ASP.NET Core in the U.S. If one is vulnerable, an attacker can impersonate users, intercept protected content, or perform unauthorized actions. For a non‑technical user, it means that the sites you use (bank, health portal, social services) might be at elevated risk until they patch.

  • What’s next:
      • Microsoft has released patches for affected .NET / ASP.NET versions. SecurityWeek
      • Website and app operators must update quickly and test for breaks.
      • Security teams will hunt for real-world exploitation now that the severity is public.

  ---

  Critical ConnectWise Flaws Let Attackers Poison Software Updates

  • What happened: Also today (October 17), two severe vulnerabilities — CVE‑2025‑11492 and CVE‑2025‑11493 — were disclosed in ConnectWise Automate (a remote management tool). Attackers could tamper with updates or intercept traffic, letting malicious code slip in as “legitimate” updates. Cyber Security News

  • Why it matters: Many IT support firms and managed service providers use tools like ConnectWise to manage client machines remotely. If attackers can hack the update mechanism, they can infect many systems quickly under the guise of routine maintenance. For seniors / non-technical folks, a trusted “update” from your IT provider could become a vector for malware.

  • What’s next:
      • ConnectWise Automate version 2025.9 (patch) is available; operators should apply it immediately, enforce HTTPS/TLS 1.2. Cyber Security News
      • Organizations should audit their remote‑management tools and confirm they’re not using vulnerable versions.
      • Security teams will watch for attackers abusing this channel in live networks. 

  (AI was used to create this article.)