serisec

Category: Vulnerability

  • 87,000+ MongoDB Instances Vulnerable to MongoBleed Flaw Exposed Online – PoC Exploit Released

    87,000+ MongoDB Instances Vulnerable to MongoBleed Flaw Exposed Online – PoC Exploit Released A high-severity vulnerability in MongoDB Server that allows unauthenticated remote attackers to siphon sensitive data from database memory. Dubbed “MongoBleed” due to its automated similarities to the infamous Heartbleed bug, the flaw tracks as CVE-2025-14847 and carries a CVSS score of 7.5.…

  • TeamViewer DEX Vulnerabilities Let Attackers Trigger DoS Attack and Expose Sensitive Data

    TeamViewer DEX Vulnerabilities Let Attackers Trigger DoS Attack and Expose Sensitive Data Multiple critical vulnerabilities in TeamViewer DEX Client’s Content Distribution Service (NomadBranch.exe), formerly part of 1E Client. Affecting Windows versions before 25.11 and select older branches, the flaws stem from improper input validation (CWE-20), potentially enabling attackers on the local network to execute code,…

  • M-Files Vulnerability Let Attacker Capture Session Tokens of Other Active Users

    M-Files Vulnerability Let Attacker Capture Session Tokens of Other Active Users An information disclosure vulnerability in M-Files Server enables authenticated attackers to capture and reuse session tokens from active users. Potentially gaining unauthorized access to sensitive document management systems. The flaw, tracked as CVE-2025-13008, affects multiple versions across different release branches and carries a high-severity…

  • Net-SNMP Vulnerability Enables Buffer Overflow and the Daemon to Crash

    Net-SNMP Vulnerability Enables Buffer Overflow and the Daemon to Crash A new critical vulnerability affecting the Net-SNMP software suite has been disclosed, posing a significant risk to network infrastructure worldwide. Tracked as CVE-2025-68615, this security flaw allows remote attackers to trigger a buffer overflow, leading to a service crash or potentially a more severe system compromise.…

  • CISA Adds Digiever Authorization Vulnerability to KEV List Following Active Exploitation

    CISA Adds Digiever Authorization Vulnerability to KEV List Following Active Exploitation A critical vulnerability affecting Digiever DS-2105 Pro network video recorders was added to the Known Exploited Vulnerabilities (KEV) catalog on December 22, 2025, following evidence of active exploitation in the wild. CVE-2023-52163 is a missing authorization vulnerability in Digiever DS-2105 Pro devices. That enables…

  • Cybersecurity Weekly Recap – PornHub Breach, Cisco 0-Day, Amazon Detains DPRK IT Worker, and more

    Cybersecurity Weekly Recap – PornHub Breach, Cisco 0-Day, Amazon Detains DPRK IT Worker, and more In a week that revealed the flaws in digital trust, cybersecurity headlines were filled with high-profile breaches, zero-day exploits, and bold nation-state espionage. Attackers claimed to have swiped usernames, emails, and encrypted passwords from over 1.2 million accounts, underscoring the…

  • Hackers Weaponize SVG Files and Office Documents to Target Windows Users

    Hackers Weaponize SVG Files and Office Documents to Target Windows Users Cybersecurity researchers have uncovered a sophisticated email campaign deploying a commodity loader to distribute Remote Access Trojans and information stealers. The operation primarily targets manufacturing and government organizations across Italy, Finland, and Saudi Arabia, using highly evasive techniques. Infection chain Multi-Vector Attack Strategy The…

  • WatchGuard 0-day Vulnerability Exploited in the Wild to Hijack Firewalls

    WatchGuard 0-day Vulnerability Exploited in the Wild to Hijack Firewalls An urgent security update has been released to fix a critical zero-day vulnerability in WatchGuard Firebox firewalls. With warnings that hackers are already actively exploiting the flaw in the wild to take control of affected devices. The vulnerability, tracked as CVE-2025-14733, carries a critical severity score…

  • Cisco AsyncOS 0-Day Vulnerability Exploited in the Wild to run System-level Commands

    Cisco AsyncOS 0-Day Vulnerability Exploited in the Wild to run System-level Commands An active campaign exploiting a zero-day vulnerability in Cisco AsyncOS Software, targeting Secure Email Gateway (formerly Email Security Appliance, ESA) and Secure Email and Web Manager (formerly Content Security Management Appliance, SMA). The attack, spotted since late November 2025 and publicly disclosed on…

  • Smashing Security podcast #448: The Kindle that got pwned

    Smashing Security podcast #448: The Kindle that got pwned Think your Kindle is harmless? Think again! In this episode, we unpack a Black Hat Europe talk revealing how a boobytrapped audiobook could exploit the Amazon eBook reader – potentially letting an attacker break into your account and seize control of your credit card. Plus a…

  • Critical FortiGate Devices SSO Vulnerabilities Actively Exploited in the Wild

    Critical FortiGate Devices SSO Vulnerabilities Actively Exploited in the Wild An active intrusion is targeting critical authentication bypass vulnerabilities in Fortinet’s FortiGate appliances and related products. Threat actors are exploiting CVE-2025-59718 and CVE-2025-59719 to perform unauthenticated single sign-on (SSO) logins via malicious SAML messages, granting attackers administrative access. Fortinet disclosed the flaws in a PSIRT…

  • Windows Remote Access Connection Manager Vulnerability Enables Arbitrary Code Execution

    Windows Remote Access Connection Manager Vulnerability Enables Arbitrary Code Execution A critical security issue involving the Windows Remote Access Connection Manager (RasMan) that allows local attackers to execute arbitrary code with System privileges. While investigating CVE-2025-59230, the vulnerability that Microsoft addressed in the October 2025 security updates. 0patch security analysts discovered a complex exploit chain that…

  • CISA Adds Sierra Router Vulnerability to KEV Catalogue Following Active Exploitation

    CISA Adds Sierra Router Vulnerability to KEV Catalogue Following Active Exploitation A critical vulnerability affecting Sierra Wireless routers has been added to its Known Exploited Vulnerabilities (KEV) catalog. This decision comes after evidence emerged that the flaw is being actively exploited in the wild. Posing significant risks to organizations that still utilize these legacy devices.…

  • CISA Warns of Windows Cloud Files Mini Filter 0-Day Vulnerability Exploited in Attacks

    CISA Warns of Windows Cloud Files Mini Filter 0-Day Vulnerability Exploited in Attacks A critical alert regarding an active zero-day vulnerability affecting the Microsoft Windows Cloud Files Mini Filter Driver. The vulnerability poses a significant risk to organizations running affected Windows systems and requires immediate remediation efforts. CISA reports that the vulnerability, tracked as CVE-2025-62221,…

  • Google Warns Multiple Hacker Groups Are Exploiting React2Shell to Spread Malware

    Google Warns Multiple Hacker Groups Are Exploiting React2Shell to Spread Malware Google Threat Intelligence Group (GTIG) has issued a warning regarding the widespread exploitation of a critical security flaw in React Server Components. Known as React2Shell (CVE-2025-55182), this vulnerability allows attackers to take control of servers remotely without needing a password. Since the vulnerability was disclosed…

  • CISA Warns of Google Chromium 0-Day Vulnerability Exploited in Attacks

    CISA Warns of Google Chromium 0-Day Vulnerability Exploited in Attacks The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical zero-day vulnerability in Google Chromium’s ANGLE graphics engine to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2025-14174, the flaw allows remote attackers to trigger out-of-bounds memory access via a malicious HTML page,…

  • Apple 0-Day Vulnerabilities Exploited in Sophisticated Attacks Targeting iPhone Users

    Apple 0-Day Vulnerabilities Exploited in Sophisticated Attacks Targeting iPhone Users Apple patches two WebKit zero-day flaws actively exploited in sophisticated attacks targeting specific iPhone users running iOS versions prior to 26.​ The iOS 26.2 and iPadOS 26.2 updates, released December 12, 2025, address CVE-2025-43529 and CVE-2025-14174 in WebKit. CVE-2025-43529 involves a use-after-free vulnerability enabling arbitrary…

  • Apache Struts 2 DoS Vulnerability Let Attackers Crash Server

    Apache Struts 2 DoS Vulnerability Let Attackers Crash Server A critical denial-of-service vulnerability has been discovered in Apache Struts 2, affecting multiple versions of the popular web application framework. The vulnerability, identified as CVE-2025-64775, exploits a file leak in multipart request processing that can cause disk exhaustion and server crashes. Organizations running affected versions should…

  • CISA Warns of OSGeo GeoServer 0-Day Vulnerability Exploited in Attacks

    CISA Warns of OSGeo GeoServer 0-Day Vulnerability Exploited in Attacks An urgent warning about a critical security flaw in OSGeo GeoServer, a widely used open-source geographic data-sharing server. CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating that threat actors are actively leveraging this zero-day flaw in attacks targeting both public…

  • New Vulnerabilities in React Server Components Allow DoS Attacks and Source Code Leaks

    New Vulnerabilities in React Server Components Allow DoS Attacks and Source Code Leaks Less than a week after addressing a critical Remote Code Execution (RCE) vulnerability, the React team has disclosed three additional security flaws affecting React Server Components (RSC). Security researchers discovered these new issues while attempting to bypass the mitigations for the previous…

  • React2Shell flaw (CVE-2025-55182) exploited for remote code execution

    React2Shell flaw (CVE-2025-55182) exploited for remote code execution The availability of exploit code will likely lead to more widespread opportunistic attacks Mindi McDowell Go to sophos

  • Windows Defender Firewall Service Vulnerability Let Attackers Disclose Sensitive Data

    Windows Defender Firewall Service Vulnerability Let Attackers Disclose Sensitive Data A critical information disclosure vulnerability in Windows Defender Firewall Service, which could allow authorized attackers to access sensitive heap memory on affected systems. The vulnerability, tracked as CVE-2025-62468, was assigned an Important severity rating and released on December 9, 2025. The flaw stems from an…

  • Google Warns of Chrome 0-Day Vulnerability Actively Exploited in the wild

    Google Warns of Chrome 0-Day Vulnerability Actively Exploited in the wild Google has released an urgent security update for the Chrome browser to address a high-severity zero-day vulnerability that is currently being exploited in the wild. This emergency patch is part of the latest Stable channel update, bringing the version to 143.0.7499.109/.110 for Windows and…

  • Smashing Security podcast #447: Grok the stalker, the Louvre heist, and Microsoft 365 mayhem

    Smashing Security podcast #447: Grok the stalker, the Louvre heist, and Microsoft 365 mayhem On this week’s show we learn that AI really can be a stalker’s best friend, as we explore a strange tale that starts with a manatee-shaped mailbox on a millionaire’s lawn and ends with Grok happily doxxing real people, mapping out…

  • Windows PowerShell 0-Day Vulnerability Let Attackers Execute Malicious Code

    Windows PowerShell 0-Day Vulnerability Let Attackers Execute Malicious Code Security update addressing a dangerous Windows PowerShell vulnerability that allows attackers to execute malicious code on affected systems. The vulnerability, tracked as CVE-2025-54100, was publicly disclosed on December 9, 2025, and represents a significant security risk for organizations worldwide. The flaw stems from improper neutralization of…

  • Gemini Zero-Click Vulnerability Let Attackers Access Gmail, Calendar, and Docs

    Gemini Zero-Click Vulnerability Let Attackers Access Gmail, Calendar, and Docs A critical zero-click vulnerability dubbed “GeminiJack” in Google Gemini Enterprise and previously Vertex AI Search that let attackers steal sensitive corporate data from Gmail, Calendar, and Docs with minimal effort. According to Noma Labs, it was considered an architectural flaw rather than merely a bug.…

  • Windows Cloud Files Mini Filter Driver 0-Day Vulnerability Exploited in the Wild

    Windows Cloud Files Mini Filter Driver 0-Day Vulnerability Exploited in the Wild Microsoft has released urgent security updates to address a zero-day vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys) that is currently being exploited in the wild. Assigned the identifier CVE-2025-62221, this elevation of privilege flaw affects a wide range of Windows…

  • 500+ Apache Tika Toolkit Instances Vulnerable to Critical XXE Attack Exposed Online

    500+ Apache Tika Toolkit Instances Vulnerable to Critical XXE Attack Exposed Online Over 565 internet-exposed Apache Tika Server instances are vulnerable to a critical XML External Entity (XXE) injection flaw. That could enable attackers to steal sensitive data, launch denial-of-service attacks, or conduct server-side request forgery operations. The vulnerability, tracked as CVE-2025-66516, affects tika-core versions…

  • Researchers Hack Google’s Gemini CLI Through Prompt Injections in GitHub Actions

    Researchers Hack Google’s Gemini CLI Through Prompt Injections in GitHub Actions A critical vulnerability class dubbed “PromptPwnd,” affects AI agents integrated into GitHub Actions and GitLab CI/CD pipelines. This flaw allows attackers to inject malicious prompts via untrusted user inputs like issue titles or pull request bodies, tricking AI models into executing privileged commands that…

  • Cloudflare Outage Hits Internet with 500 Internal Server Error

    Cloudflare Outage Hits Internet with 500 Internal Server Error Cloudflare has confirmed that it is currently experiencing a significant outage that is affecting the Cloudflare Dashboard and several Cloudflare API services. The issue began earlier today and has caused widespread disruptions for users who rely on Cloudflare’s management tools and automation features. According to Cloudflare,…

  • Cacti Command Injection Vulnerability Let Attackers Execute Malicious Code Remotely

    Cacti Command Injection Vulnerability Let Attackers Execute Malicious Code Remotely A critical command injection vulnerability in the open-source network monitoring tool Cacti allows authenticated attackers to execute arbitrary code remotely, potentially compromising the entire monitoring infrastructure. The flaw, tracked as CVE-2025-66399, affects all versions up to 1.2.28 and stems from inadequate input validation in the…

  • Vim for Windows Vulnerability Let Attackers Execute Arbitrary Code

    Vim for Windows Vulnerability Let Attackers Execute Arbitrary Code A critical security vulnerability has been discovered in Vim for Windows that could allow attackers to execute malicious code on users’ computers. The vulnerability, identified as CVE-2025-66476, affects Vim versions before 9.1.1947 and has been rated high severity, with a CVSS score of 7.8. The flaw…

  • Akamai Patches HTTP Request Smuggling Vulnerability in Edge Servers

    Akamai Patches HTTP Request Smuggling Vulnerability in Edge Servers A critical HTTP request smuggling vulnerability in Akamai’s edge server infrastructure has been successfully fixed. The vulnerability, identified as CVE-2025-66373, stemmed from improper processing of HTTP requests containing invalid chunk-encoded bodies, potentially exposing thousands of customers to sophisticated attacks. Understanding HTTP Chunked Transfer Encoding HTTP chunked…

  • Chrome 143 Released With Fix for 13 Vulnerabilities that Enable Arbitrary Code Execution

    Chrome 143 Released With Fix for 13 Vulnerabilities that Enable Arbitrary Code Execution Google has officially promoted Chrome 143 to the Stable channel, rolling out version 143.0.7499.40 for Linux and 143.0.7499.40/41 for Windows and Mac. This significant update addresses 13 security vulnerabilities, including several high-severity flaws that could allow attackers to execute arbitrary code or…

  • OpenVPN Vulnerabilities Let Hackers Triggers Dos Attack and Bypass Security Checks

    OpenVPN Vulnerabilities Let Hackers Triggers Dos Attack and Bypass Security Checks OpenVPN has released critical security updates for its 2.6 stable and 2.7 development branches, addressing three vulnerabilities that could lead to local denial-of-service (DoS), security bypasses, and buffer over-reads. The patches, included in the newly released version 2.6.17 and 2.7_rc3, fix issues ranging from…

  • Tor Adopts Galois Onion Encryption to Strengthen Defense Against Online Attacks

    Tor Adopts Galois Onion Encryption to Strengthen Defense Against Online Attacks The Tor Project has announced a significant cryptographic overhaul, retiring its legacy relay encryption algorithm after decades of service and replacing it with Counter Galois Onion (CGO). This research-backed encryption design defends against a broader class of sophisticated online attackers. Tor’s relay encryption serves…

  • ASUS MyASUS Flaw Lets Hackers Escalate to SYSTEM-Level Access

    ASUS MyASUS Flaw Lets Hackers Escalate to SYSTEM-Level Access ASUS has disclosed a high security vulnerability in its MyASUS application that could allow local attackers to escalate their privileges to SYSTEM-level access on affected Windows devices. The flaw, tracked as CVE-2025-59373, carries a high-severity CVSS 4.0 score of 8.5, indicating a significant risk to millions…

  • The AI Fix #78: The big AI bubble, and robot Grandma in the cloud

    The AI Fix #78: The big AI bubble, and robot Grandma in the cloud In episode 78 of The AI Fix, alien robot spiders invade Antarctica (or Facebook says they do), Mark prepares humanity for AI-powered fighter jets with loyalty issues, and Graham tries to work out why his AI-generated country music career hasn’t yet…

  • Microsoft’s Update Health Tools Configuration Vulnerability Let Attackers Execute Arbitrary Code Remotely

    Microsoft’s Update Health Tools Configuration Vulnerability Let Attackers Execute Arbitrary Code Remotely A critical remote code execution (RCE) vulnerability in Microsoft’s Update Health Tools (KB4023057). A widely deployed Windows component designed to expedite security updates through Intune. The flaw stems from the tool connecting to dropped Azure Blob storage accounts that attackers could register and control.​ How…

  • Wireshark Vulnerabilities Let Attackers Crash by Injecting a Malformed Packet

    Wireshark Vulnerabilities Let Attackers Crash by Injecting a Malformed Packet The Wireshark Foundation has rolled out a crucial security update for its widely used network protocol analyzer, addressing multiple vulnerabilities that could lead to denial-of-service conditions. The latest release, version 4.6.1, specifically targets flaws discovered in the Bundle Protocol version 7 (BPv7) and Kafka dissectors.…

  • SonicOS SSLVPN Vulnerability Let Attackers Crash the Firewall Remotely

    SonicOS SSLVPN Vulnerability Let Attackers Crash the Firewall Remotely SonicWall has disclosed a critical stack-based buffer overflow vulnerability in its SonicOS SSLVPN service. That allows remote unauthenticated attackers to crash firewalls through denial-of-service attacks. The vulnerability was internally discovered and reported by SonicWall’s security team. The flaw, tracked as CVE-2025-40601, carries a CVSS score of 7.5…

  • CISA Warns of Critical Lynx+ Gateway Vulnerability Exposes Data in Cleartext

    CISA Warns of Critical Lynx+ Gateway Vulnerability Exposes Data in Cleartext The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning about a severe vulnerability in Lynx+ Gateway devices that could expose sensitive information in clear text during transmission. The flaw allows attackers to catch network traffic and obtain plaintext credentials and other…

  • Critical pgAdmin4 Vulnerability Lets Attackers Execute Remote Code on Servers

    Critical pgAdmin4 Vulnerability Lets Attackers Execute Remote Code on Servers A severe remote code execution (RCE) flaw has been uncovered in pgAdmin4, the popular open-source interface for PostgreSQL databases. Dubbed CVE-2025-12762, the vulnerability affects versions up to 9.9 and could allow attackers to run arbitrary commands on the hosting server, potentially compromising entire database infrastructures.…

  • OpenAI Sora 2 Vulnerability Exposes System Prompts via Audio Transcripts

    OpenAI Sora 2 Vulnerability Exposes System Prompts via Audio Transcripts A vulnerability in OpenAI’s advanced video generation model, Sora 2, that enables the extraction of its hidden system prompt through audio transcripts, raising concerns about the security of multimodal AI systems. This vulnerability, detailed in a blog post by AI security firm Mindgard, demonstrates how…

  • ChatGPT Hacked Using Custom GPTs Exploiting SSRF Vulnerability to Expose Secrets

    ChatGPT Hacked Using Custom GPTs Exploiting SSRF Vulnerability to Expose Secrets A Server-Side Request Forgery (SSRF) vulnerability in OpenAI’s ChatGPT. The flaw, lurking in the Custom GPT “Actions” feature, allowed attackers to trick the system into accessing internal cloud metadata, potentially exposing sensitive Azure credentials. The bug, discovered by Open Security during casual experimentation, highlights…

  • SecureVibes – AI Tool Scans for Vulnerabilities in 11 Languages with Claude AI Agents

    SecureVibes – AI Tool Scans for Vulnerabilities in 11 Languages with Claude AI Agents In the fast-paced world of “vibecoding,” where developers use AI to build applications rapidly, a new open-source tool is stepping up to tackle security risks. SecureVibes, created by developer Anshuman Bhartiya, leverages Anthropic’s Claude AI through a multi-agent system to detect…

  • Windows Remote Desktop Services Vulnerability Let Attackers Escalate Privileges

    Windows Remote Desktop Services Vulnerability Let Attackers Escalate Privileges Microsoft has disclosed a significant vulnerability in Windows Remote Desktop Services (RDS) that could allow authorized attackers to escalate their privileges on affected systems. Tracked as CVE-2025-60703, the flaw stems from an untrusted pointer dereference, a classic memory safety issue that has plagued software for years, and…

  • Zoom Vulnerabilities Let Attackers Bypass Access Controls to Access Session Data

    Zoom Vulnerabilities Let Attackers Bypass Access Controls to Access Session Data Zoom has issued multiple security bulletins detailing patches for several vulnerabilities affecting its Workplace applications. The disclosures, published today, highlight two high-severity issues alongside medium-rated flaws, underscoring the ongoing challenges in securing video conferencing tools used by millions in hybrid work environments. These updates…

  • SAP Security Update – Patch for Critical Vulnerabilities Allowing Code Execution and Injection Attacks

    SAP Security Update – Patch for Critical Vulnerabilities Allowing Code Execution and Injection Attacks SAP released its monthly Security Patch Day updates, addressing 18 new security notes and providing two updates to existing ones, focusing on vulnerabilities that could enable remote code execution and various injection attacks across its product ecosystem. These patches are crucial…

  • CISA Warns of Samsung Mobile Devices 0-Day RCE Vulnerability Exploited in Attacks

    CISA Warns of Samsung Mobile Devices 0-Day RCE Vulnerability Exploited in Attacks CISA has added a critical zero-day vulnerability affecting Samsung mobile devices to its Known Exploited Vulnerabilities catalog. Warning that threat actors are actively exploiting the flaw in real-world attacks. The vulnerability, tracked as CVE-2025-21042, is an out-of-bounds write vulnerability in the libimagecodec.quram.so library on…

  • Critical runc Vulnerabilities Put Docker and Kubernetes Container Isolation at Risk

    Critical runc Vulnerabilities Put Docker and Kubernetes Container Isolation at Risk Three critical vulnerabilities in runc, the container runtime powering Docker, Kubernetes, and other containerization platforms. These flaws could allow attackers to escape container isolation and gain root access to host systems. However, no active exploits have been detected yet. The vulnerabilities leverage race mount…

  • Monsta web-based FTP Remote Code Execution Vulnerability Exploited

    Monsta web-based FTP Remote Code Execution Vulnerability Exploited A critical remote code execution vulnerability in Monsta FTP, a popular web-based FTP client used by financial institutions and enterprises worldwide. The flaw, now tracked as CVE-2025-34299, affects multiple versions of the software and has been exploited in the wild. Monsta FTP is a browser-based file transfer client…

  • Seven QNAP Zero-Day Vulnerabilities Exploited at Pwn2Own 2025 Now Patched

    Seven QNAP Zero-Day Vulnerabilities Exploited at Pwn2Own 2025 Now Patched QNAP has addressed seven critical zero-day vulnerabilities in its network-attached storage (NAS) operating systems, following their successful exploitation by security researchers at Pwn2Own Ireland 2025. These flaws, identified as CVE-2025-62847, CVE-2025-62848, CVE-2025-62849, and associated ZDI canonical entries ZDI-CAN-28353, ZDI-CAN-28435, ZDI-CAN-28436, enable remote code execution (RCE)…

  • Hackers Hijack Samsung Galaxy Phones via 0-Day Exploit Using a Single WhatsApp Image

    Hackers Hijack Samsung Galaxy Phones via 0-Day Exploit Using a Single WhatsApp Image A sophisticated spyware operation targeting Samsung Galaxy devices, dubbed LANDFALL, which exploited a zero-day vulnerability to infiltrate phones through seemingly innocuous images shared on WhatsApp. This campaign, active since mid-2024, allowed attackers to deploy commercial-grade Android malware capable of full device surveillance…

  • NVIDIA NVApp for Windows Vulnerability Let Attackers Execute Malicious Code

    NVIDIA NVApp for Windows Vulnerability Let Attackers Execute Malicious Code NVIDIA has patched a critical vulnerability in its App for Windows that could allow local attackers to execute arbitrary code and escalate privileges on affected systems. Tracked as CVE-2025-23358, the flaw exists in the installer component. It poses a significant security risk to Windows users…

  • Chrome Emergency Update to Patch Multiple Vulnerabilities that Enable Remote Code Execution

    Chrome Emergency Update to Patch Multiple Vulnerabilities that Enable Remote Code Execution Google has rolled out an urgent security patch for its Chrome browser, addressing five vulnerabilities that could enable attackers to execute malicious code remotely. The update, version 142.0.7444.134/.135 for Windows, 142.0.7444.135 for macOS, and 142.0.7444.134 for Linux, targets critical flaws in core components…

  • Windows Cloud Files Mini Filter Driver Vulnerability Exploited to Escalate Privileges

    Windows Cloud Files Mini Filter Driver Vulnerability Exploited to Escalate Privileges A privilege escalation flaw in Windows Cloud Files Mini Filter Driver has been discovered, allowing local attackers to bypass file write protections and inject malicious code into system processes. Security researchers have uncovered CVE-2025-55680, a high-severity privilege-escalation vulnerability in the Windows Cloud Files Mini…

  • AMD Zen 5 Processors RDSEED Vulnerability Breaks Integrity With Randomness

    AMD Zen 5 Processors RDSEED Vulnerability Breaks Integrity With Randomness AMD has disclosed a critical vulnerability affecting its Zen 5 processor lineup that compromises the reliability of random number generation, a fundamental security feature in modern computing. The flaw, tracked as CVE-2025-62626, impacts the RDSEED instruction used by systems to generate cryptographically secure random numbers…

  • Apple Patches Multiple Critical Vulnerabilities in iOS 26.1 and iPadOS 26.1

    Apple Patches Multiple Critical Vulnerabilities in iOS 26.1 and iPadOS 26.1 Apple released iOS 26.1 and iPadOS 26.1, addressing multiple vulnerabilities that could lead to privacy breaches, app crashes, and potential data leaks for iPhone and iPad users. The update targets devices starting from the iPhone 11 series and various iPad models, including the iPad…

  • Hackers Actively Scanning for TCP Port 8530/8531 Linked to WSUS Vulnerability CVE-2025-59287

    Hackers Actively Scanning for TCP Port 8530/8531 Linked to WSUS Vulnerability CVE-2025-59287 Cybersecurity researchers and firewall monitoring services have detected a dramatic surge in reconnaissance activity targeting Windows Server Update Services (WSUS) infrastructure. Network sensors collected from security organizations, including data from Shadowserver, show a significant increase in scans directed at TCP ports 8530 and…

  • Windows Graphics Vulnerabilities Allow Remote Attackers to Execute Arbitrary Code

    Windows Graphics Vulnerabilities Allow Remote Attackers to Execute Arbitrary Code Multiple vulnerabilities in Microsoft’s Graphics Device Interface (GDI), a core component of the Windows operating system responsible for rendering graphics. These flaws, discovered by Check Point through an intensive fuzzing campaign targeting Enhanced Metafile (EMF) formats, could enable remote attackers to execute arbitrary code or…

  • OpenAI’s New Aardvark GPT-5 Agent that Detects and Fixes Vulnerabilities Automatically

    OpenAI’s New Aardvark GPT-5 Agent that Detects and Fixes Vulnerabilities Automatically OpenAI has unveiled Aardvark, an autonomous AI agent powered by its cutting-edge GPT-5 model, designed to detect software vulnerabilities and automatically propose fixes. This tool aims to entrust developers and security teams by scaling human-like analysis across vast codebases, addressing the escalating challenge of…

  • CISA Warns of Linux Kernel Use-After-Free Vulnerability Exploited in Attacks to Deploy Ransomware

    CISA Warns of Linux Kernel Use-After-Free Vulnerability Exploited in Attacks to Deploy Ransomware The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert about a critical use-after-free vulnerability in the Linux kernel, tracked as CVE-2024-1086. This vulnerability, hidden within the netfilter: nf_tables component, allows local attackers to escalate their privileges and potentially…

  • Hackers Exploiting Cisco IOS XE Vulnerability in the Wild to Deploy BADCANDY Web Shell

    Hackers Exploiting Cisco IOS XE Vulnerability in the Wild to Deploy BADCANDY Web Shell Cybercriminals and state-sponsored actors are ramping up attacks on unpatched Cisco IOS XE devices across Australia, deploying a persistent Lua-based web shell known as BADCANDY to maintain unauthorized access. This implant, first spotted in variations since October 2023, has seen renewed…

  • Hackers Exploiting Windows Server Update Services Flaw to Steal Sensitive Data from Organizations

    Hackers Exploiting Windows Server Update Services Flaw to Steal Sensitive Data from Organizations Windows Server Update Services (WSUS) vulnerability is actively exploited in the wild. Criminals are using this vulnerability to steal sensitive data from organizations in various industries. The vulnerability, tracked as CVE-2025-59287, was patched by Microsoft on October 14, 2025, but attackers quickly…

  • CISA Warns of XWiki Platform Injection vulnerability Exploited to Execute Remote Code

    CISA Warns of XWiki Platform Injection vulnerability Exploited to Execute Remote Code The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about a severe injection vulnerability in the XWiki Platform, designated as CVE-2025-24893. This flaw allows unauthenticated attackers to execute arbitrary remote code, posing significant risks to organizations using the open-source…

  • CISA Shares New Threat Detections for Actively Exploited WSUS Vulnerability

    CISA Shares New Threat Detections for Actively Exploited WSUS Vulnerability In a critical update issued on October 29, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) has provided organizations with enhanced guidance on detecting and mitigating threat activity related to the actively exploited CVE-2025-59287 vulnerability in Microsoft’s Windows Server Update Services (WSUS). This remote code…

  • Chrome 142 Released With Fix for 20 Vulnerabilities that Allows Malicious Code Execution

    Chrome 142 Released With Fix for 20 Vulnerabilities that Allows Malicious Code Execution Google has officially promoted Chrome 142 to the stable channel, delivering critical security updates for Windows, Mac, and Linux users. The rollout begins immediately and will continue over the next few days or weeks, ensuring widespread protection against newly discovered threats. This…

  • Windows Server Update Services (WSUS) vulnerability abused to harvest sensitive data

    Windows Server Update Services (WSUS) vulnerability abused to harvest sensitive data Exploitation of CVE-2025-59287 began after public disclosure and the release of proof-of-concept code mindimcdowell Go to sophos

  • Smashing Security podcast #441: Inside the mob’s million-dollar poker hack, and a Formula 1 fumble

    Smashing Security podcast #441: Inside the mob’s million-dollar poker hack, and a Formula 1 fumble Basketball stars have allegedly joined forces with the mafia to fleece high-rollers in a poker scam involving hacked shufflers, covert cameras, and an X-ray card table. Meanwhile, researchers have found they could poke around an FIA driver portal to pull…

  • Google Wear OS Message App Vulnerability Let Any Installed App To Send SMS Behalf Of User

    Google Wear OS Message App Vulnerability Let Any Installed App To Send SMS Behalf Of User A vulnerability in Google Messages on Wear OS devices allows any installed app to silently send SMS, MMS, or RCS messages on behalf of the user. Dubbed CVE-2025-12080, the issue stems from improper handling of ACTION_SENDTO intents using URI…

  • Microsoft Details ASP.NET Vulnerability That Enables Attackers To Smuggle HTTP Requests

    Microsoft Details ASP.NET Vulnerability That Enables Attackers To Smuggle HTTP Requests Microsoft has issued a critical security update for ASP.NET Core to address CVE-2025-55315, a high-severity flaw that enables HTTP request smuggling and could allow attackers to bypass key security controls. Disclosed on October 14, 2025, this vulnerability has a CVSS v3.1 score of 9.9,…

  • Magento Input Validation Vulnerability Exploited In Wild To Hijack Session And Execute Malicious Codes

    Magento Input Validation Vulnerability Exploited In Wild To Hijack Session And Execute Malicious Codes A critical vulnerability in Magento, the popular e-commerce platform, is now rebranded as Adobe Commerce. Dubbed SessionReaper and tracked as CVE-2025-54236, this improper input validation flaw allows attackers to hijack user sessions and, in some cases, execute malicious code remotely. The…

  • The AI Fix #74: AGI, LLM brain rot, and how to scam an AI browser

    The AI Fix #74: AGI, LLM brain rot, and how to scam an AI browser In episode 74 of The AI Fix, we meet Amazon’s AI-powered delivery glasses, an AI TV presenter who doesn’t exist, and an Ohio lawmaker who wants to stop people from marrying their chatbot. Also, we learn how Geoffrey Hinton and…

  • Apache Tomcat Security Vulnerabilities Expose Servers to Remote Code Execution Attacks

    Apache Tomcat Security Vulnerabilities Expose Servers to Remote Code Execution Attacks The Apache Software Foundation has highlighted critical flaws in Apache Tomcat, a widely used open-source Java servlet container that powers numerous web applications. On October 27, 2025, Apache disclosed two vulnerabilities, CVE-2025-55752 and CVE-2025-55754, affecting multiple versions of Tomcat. While the first poses a…

  • OpenVPN Vulnerability Exposes Linux, macOS Systems to Script Injection Attacks

    OpenVPN Vulnerability Exposes Linux, macOS Systems to Script Injection Attacks A new vulnerability in early versions of OpenVPN has been disclosed, potentially allowing malicious servers to execute arbitrary commands on client machines. The flaw affects OpenVPN releases from 2.7_alpha1 to 2.7_beta1, enabling script-injection attacks on POSIX-based systems such as Linux, macOS, and BSD variants. The…

  • Hackers Exploiting Microsoft WSUS Vulnerability In The Wild – 2800 Instances Exposed Online

    Hackers Exploiting Microsoft WSUS Vulnerability In The Wild – 2800 Instances Exposed Online Hackers are actively exploiting a critical flaw in Microsoft’s Windows Server Update Services (WSUS), with security researchers reporting widespread attempts in the wild. The vulnerability, tracked as CVE-2025-59287, allows remote code execution on unpatched WSUS servers, potentially granting attackers full control over…

  • Critical Dell Storage Manager Vulnerabilities Let Attackers Compromise System

    Critical Dell Storage Manager Vulnerabilities Let Attackers Compromise System Dell Technologies has disclosed three critical vulnerabilities in its Storage Manager software that could allow attackers to bypass authentication, disclose sensitive information, and gain unauthorized access to systems. Announced on October 24, 2025, these flaws affect versions of Dell Storage Manager up to 20.1.21 and pose…

  • New EDR-Redir Tool Breaks EDR Exploiting Bind Filter and Cloud Filter Driver

    New EDR-Redir Tool Breaks EDR Exploiting Bind Filter and Cloud Filter Driver A new tool called EDR-Redir has emerged, allowing attackers to redirect or isolate the executable folders of popular Endpoint Detection and Response (EDR) solutions. Demonstrated by cybersecurity researcher TwoSevenOneT, the technique leverages Windows’ Bind Filter driver (bindflt.sys) and Cloud Filter driver (cldflt.sys) to…

  • 706,000+ BIND 9 Resolver Instances Vulnerable to Cache Poisoning Exposed Online – PoC Released

    706,000+ BIND 9 Resolver Instances Vulnerable to Cache Poisoning Exposed Online – PoC Released A high-severity vulnerability in BIND 9 resolvers has been disclosed, potentially allowing attackers to poison caches and redirect internet traffic to malicious sites. Tracked as CVE-2025-40778, the flaw affects over 706,000 exposed instances worldwide, as identified by internet scanning firm Censys.…

  • CISA Warns of Hackers Actively Exploiting Windows Server Update Services RCE Vulnerability in the Wild

    CISA Warns of Hackers Actively Exploiting Windows Server Update Services RCE Vulnerability in the Wild The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned organizations worldwide about active exploitation of a critical remote code execution (RCE) vulnerability in Microsoft’s Windows Server Update Services (WSUS). Tracked as CVE-2025-59287, the flaw carries a CVSS score of…

  • HP OneAgent Update Brokes Trust And Disconnect Devices From Entra ID

    HP OneAgent Update Brokes Trust And Disconnect Devices From Entra ID The HP OneAgent software update has disconnected Windows devices from Microsoft Entra ID. As a result, users can no longer access their corporate identities. Version 1.2.50.9581 of the agent, pushed silently to HP’s Next Gen AI systems like the EliteBook X Flip G1i, deleted…

  • Microsoft Releases Emergency Patch For Windows Server Update Service RCE Vulnerability

    Microsoft Releases Emergency Patch For Windows Server Update Service RCE Vulnerability Microsoft has rolled out an out-of-band emergency patch for a remote code execution (RCE) vulnerability affecting the Windows Server Update Services (WSUS). Identified as CVE-2025-59287, the issue stems from the deserialization of untrusted data in a legacy serialization mechanism, allowing unauthorized attackers to execute…

  • Multiple BIND 9 DNS Vulnerabilities Enable Cache Poisoning and Denial of Service Attacks

    Multiple BIND 9 DNS Vulnerabilities Enable Cache Poisoning and Denial of Service Attacks The Internet Systems Consortium (ISC) disclosed three high-severity vulnerabilities in BIND 9 on October 22, 2025, potentially allowing remote attackers to conduct cache poisoning attacks or cause denial-of-service (DoS) conditions on affected DNS resolvers. These flaws, tracked as CVE-2025-8677, CVE-2025-40778, and CVE-2025-40780,…

  • Multiple Oracle VM VirtualBox Vulnerabilities Enables Complete Takeover Of VirtualBox

    Multiple Oracle VM VirtualBox Vulnerabilities Enables Complete Takeover Of VirtualBox Oracle has disclosed multiple critical vulnerabilities in its Oracle VM VirtualBox virtualization software, potentially allowing attackers to achieve complete control over the VirtualBox environment. These flaws, detailed in the October 2025 Critical Patch Update (CPU), affect the Core component of VirtualBox versions 7.1.12 and 7.2.2,…

  • TARmageddon Vulnerability In Rust Library Let Attackers Replace Config Files And Execute Remote Codes

    TARmageddon Vulnerability In Rust Library Let Attackers Replace Config Files And Execute Remote Codes A severe vulnerability in the async-tar Rust library and its popular forks, including the widely used tokio-tar. Dubbed TARmageddon and tracked as CVE-2025-62518, the bug carries a CVSS score of 8.1, classifying it as high severity. It allows attackers to manipulate…

  • Smashing Security podcast #440: How to hack a prison, and the hidden threat of online checkouts

    Smashing Security podcast #440: How to hack a prison, and the hidden threat of online checkouts A literal insider threat: we head to a Romanian prison where “self-service” web kiosks allowed inmates to run wild. Then we head to the checkout aisle to ask why JavaScript on payment pages went feral, and how new PCI…

  • Chrome V8 JavaScript Engine Vulnerability Let Attackers Execute Remote Code

    Chrome V8 JavaScript Engine Vulnerability Let Attackers Execute Remote Code Google has swiftly addressed a high-severity flaw in its Chrome browser’s V8 JavaScript engine, releasing an emergency update to thwart potential remote code execution attacks. The vulnerability, tracked as CVE-2025-12036, stems from an inappropriate implementation within V8, the open-source JavaScript and WebAssembly engine powering Chrome’s…

  • Critical ASP.NET Vulnerability Allows Attacker To Bypass Security Feature Remotely

    Critical ASP.NET Vulnerability Allows Attacker To Bypass Security Feature Remotely Microsoft has disclosed a serious security flaw in ASP.NET Core that enables authenticated attackers to smuggle HTTP requests and evade critical protections. Tracked as CVE-2025-55315, the vulnerability stems from inconsistent handling of HTTP requests, a classic issue known as HTTP request/response smuggling. Released on October…

  • ZYXEL Authorization Bypass Vulnerability Let Attackers View and Download System Configuration

    ZYXEL Authorization Bypass Vulnerability Let Attackers View and Download System Configuration A critical vulnerability in Zyxel’s ATP and USG series firewalls that allows attackers to bypass authorization controls and access sensitive system configurations. Dubbed CVE-2025-9133, this flaw affects devices running firmware versions up to V5.40(ABPS.0) and enables unauthorized viewing and downloading of configs even during…

  • Dolby Digital Plus 0-Click Vulnerability Enables RCE Attack via Malicious Audio on Android

    Dolby Digital Plus 0-Click Vulnerability Enables RCE Attack via Malicious Audio on Android A critical zero-click vulnerability in Dolby Digital Plus (DDP) audio decoding software has been disclosed, allowing attackers to execute malicious code remotely via seemingly innocuous audio messages. Google Project Zero’s Ivan Fratric and Natalie Silvanovich have identified an out-of-bounds write flaw in…

  • PoC Exploit for 7-Zip Vulnerabilities that Allows Remote Code Execution

    PoC Exploit for 7-Zip Vulnerabilities that Allows Remote Code Execution A proof-of-concept exploit for two critical vulnerabilities in the popular file archiver 7-Zip, potentially allowing attackers to execute arbitrary code remotely through malicious ZIP files. The flaws, tracked as CVE-2025-11001 and CVE-2025-11002, were disclosed by the Zero Day Initiative (ZDI) on October 7, 2025, and…

  • Critical Zimbra SSRF Vulnerability Let Attackers Access Sensitive Data

    Critical Zimbra SSRF Vulnerability Let Attackers Access Sensitive Data A newly disclosed Server-Side Request Forgery (SSRF) flaw in Zimbra Collaboration Suite has raised major security concerns, prompting administrators to patch systems immediately. The issue, identified in the chat proxy configuration component, could allow attackers to gain unauthorized access to internal resources and sensitive user data.…

  • Cisco IOS and IOS XE Software Vulnerabilities Let Attackers Execute Remote Code

    Cisco IOS and IOS XE Software Vulnerabilities Let Attackers Execute Remote Code Cisco has disclosed a severe vulnerability in its widely used IOS and IOS XE Software, potentially allowing attackers to crash devices or seize full control through remote code execution. The flaw, rooted in the Simple Network Management Protocol (SNMP) subsystem, stems from a…

  • F5 Released Security Updates Covering Multiple Products Following Recent Hack

    F5 Released Security Updates Covering Multiple Products Following Recent Hack F5 Networks, a leading provider of application security and delivery solutions, has disclosed a significant security breach involving a nation-state threat actor, prompting the release of critical updates for its core products. Detected in August 2025, the incident exposed internal systems to prolonged unauthorized access,…

  • Critical Samba RCE Vulnerability Enables Arbitrary Code Execution

    Critical Samba RCE Vulnerability Enables Arbitrary Code Execution Samba has disclosed a severe remote code execution (RCE) flaw that could allow attackers to hijack Active Directory domain controllers. Tracked as CVE-2025-10230, the vulnerability stems from improper validation in the Windows Internet Name Service (WINS) hook mechanism, earning a perfect CVSS 3.1 score of 10.0 for…

  • Windows BitLocker Vulnerabilities Let Attackers Bypass Security Feature

    Windows BitLocker Vulnerabilities Let Attackers Bypass Security Feature Microsoft has disclosed two critical vulnerabilities in its Windows BitLocker encryption feature, allowing attackers with physical access to bypass security protections and access encrypted data. Released on October 14, 2025, as part of the latest Patch Tuesday updates, these flaws, tracked as CVE-2025-55338 and CVE-2025-55333, pose a…

  • CISA Warns Of Adobe Experience Manager Forms 0-Day Vulnerability Exploited In Attacks

    CISA Warns Of Adobe Experience Manager Forms 0-Day Vulnerability Exploited In Attacks The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding a severe code execution vulnerability in Adobe Experience Manager Forms, urging organizations to patch immediately. Tracked as CVE-2025-54253, this flaw affects the Java Enterprise Edition (JEE) version of the software…

  • Microsoft IIS Vulnerability Allows Unauthorized Attacker To execute Malicious Code

    Microsoft IIS Vulnerability Allows Unauthorized Attacker To execute Malicious Code Microsoft has disclosed a critical remote code execution flaw in its Internet Information Services (IIS) platform, posing risks to organizations relying on Windows servers for web hosting. Tracked as CVE-2025-59282, the vulnerability affects the Inbox COM Objects handling global memory, stemming from a race condition…

  • Windows Agere Modem Driver 0-Day Vulnerabilities Actively Exploited To Escalate Privileges

    Windows Agere Modem Driver 0-Day Vulnerabilities Actively Exploited To Escalate Privileges Microsoft has disclosed two critical zero-day vulnerabilities in the Agere Modem driver bundled with Windows operating systems, confirming active exploitation to escalate privileges. The flaws, tracked as CVE-2025-24990 and CVE-2025-24052, affect the ltmdm64.sys driver and could allow low-privileged attackers to gain full administrator access.…