serisec

Category: Vulnerability

  • MobSF Security Testing Tool Vulnerability Let Attackers Upload Malicious Files

    MobSF Security Testing Tool Vulnerability Let Attackers Upload Malicious Files A critical flaw in the Mobile Security Framework (MobSF) has been discovered, allowing authenticated attackers to upload and execute malicious files by exploiting improper path validation.  The vulnerability, present in version 4.4.0 and patched in 4.4.1, underscores the importance of rigorous sanitization when handling user‐supplied…

  • HashiCorp Vault Vulnerability Let Attackers to Crash Servers

    HashiCorp Vault Vulnerability Let Attackers to Crash Servers A critical denial-of-service vulnerability in HashiCorp Vault could allow malicious actors to overwhelm servers with specially crafted JSON payloads, leading to excessive resource consumption and rendering Vault instances unresponsive.  Tracked as CVE-2025-6203 and published on August 28, 2025, the flaw affects both Vault Community and Enterprise editions…

  • Azure Active Directory Vulnerability Exposes Credentials and Enables Attackers to Deploy Malicious Apps

    Azure Active Directory Vulnerability Exposes Credentials and Enables Attackers to Deploy Malicious Apps A critical security vulnerability has emerged in Azure Active Directory (Azure AD) configurations that exposes sensitive application credentials, providing attackers with unprecedented access to cloud environments.  This vulnerability centers around the exposure of appsettings.json files containing ClientId and ClientSecret credentials, effectively handing…

  • Sitecore CMS Platform Vulnerabilities Enables Remote Code Execution

    Sitecore CMS Platform Vulnerabilities Enables Remote Code Execution Critical vulnerabilities in Sitecore Experience Platform allow attackers to achieve complete system compromise through a sophisticated attack chain combining HTML cache poisoning with remote code execution capabilities. These flaws also enable attackers to enumerate cache keys and configuration details via the exposed ItemServices API, streamlining targeted exploitation.…

  • Citrix Netscaler 0-day RCE Vulnerability Patched – Vulnerable Instances Reduced from 28.2K to 12.4K

    Citrix Netscaler 0-day RCE Vulnerability Patched – Vulnerable Instances Reduced from 28.2K to 12.4K A significant global effort to patch a critical zero-day remote code execution (RCE) vulnerability in Citrix NetScaler devices has seen the number of exposed systems drop from approximately 28,200 to 12,400 in just one week. Data from The Shadowserver Foundation, a…

  • WhatsApp 0-Day Vulnerability Exploited to Hack Mac and iOS Users

    WhatsApp 0-Day Vulnerability Exploited to Hack Mac and iOS Users A sophisticated attack campaign has leveraged a previously unknown zero-day vulnerability in WhatsApp on Apple devices to target specific users, the company has confirmed. The vulnerability, now identified as CVE-2025-55177, was combined with a separate vulnerability in Apple’s operating systems to compromise devices and access…

  • NodeBB Vulnerability Let Attackers Inject Boolean-Based Blind and PostgreSQL Error-Based Payloads

    NodeBB Vulnerability Let Attackers Inject Boolean-Based Blind and PostgreSQL Error-Based Payloads NodeBB, a popular open-source forum platform, has been found vulnerable to a critical SQL injection flaw in version 4.3.0.  The flaw, tracked as CVE-2025-50979, resides in the search-categories API endpoint, allowing unauthenticated, remote attackers to inject both boolean-based blind and PostgreSQL error-based payloads.  Successful…

  • Nagios XSS Vulnerability Let Remote Attackers to Execute Arbitrary JavaScript

    Nagios XSS Vulnerability Let Remote Attackers to Execute Arbitrary JavaScript Nagios XI, a widely-deployed network monitoring solution, has addressed a critical cross-site scripting (XSS) vulnerability in its Graph Explorer feature that could enable remote attackers to execute malicious JavaScript code within users’ browsers.  The security flaw was patched in version 2024R2.1, released on August 12,…

  • PhpSpreadsheet Library Vulnerability Enables Attackers to Feed Malicious HTML Input

    PhpSpreadsheet Library Vulnerability Enables Attackers to Feed Malicious HTML Input A high-severity Server-Side Request Forgery (SSRF) vulnerability has been identified in the widely used PhpSpreadsheet library, potentially allowing attackers to exploit internal network resources and compromise server security.  The vulnerability, tracked as CVE-2025-54370, affects multiple versions of the phpoffice/phpspreadsheet package and carries a CVSS v4.0…

  • CISA Warns of Citrix Netscaler 0-day RCE Vulnerability Exploited in Attacks

    CISA Warns of Citrix Netscaler 0-day RCE Vulnerability Exploited in Attacks CISA has issued an urgent warning regarding a critical zero-day vulnerability affecting Citrix NetScaler systems, designated as CVE-2025-7775.  This memory overflow vulnerability enables remote code execution (RCE) and has been actively exploited by malicious cyber actors, prompting immediate inclusion in CISA’s Known Exploited Vulnerabilities…

  • Kea DHCP Server Vulnerability Let Remote Attacker Crash With a Single Crafted Packet

    Kea DHCP Server Vulnerability Let Remote Attacker Crash With a Single Crafted Packet A newly disclosed vulnerability in the widely used ISC Kea DHCP server poses a significant security risk to network infrastructure worldwide.  The flaw, designated CVE-2025-40779, allows remote attackers to crash DHCP services with just a single maliciously crafted packet, potentially disrupting network…

  • Critical Chrome Use After Free Vulnerability Let Attackers Execute Arbitrary Code

    Critical Chrome Use After Free Vulnerability Let Attackers Execute Arbitrary Code Google has released an emergency security update for Chrome to address a critical use-after-free vulnerability (CVE-2025-9478) in the ANGLE graphics library that could allow attackers to execute arbitrary code on compromised systems.  The vulnerability affects Chrome versions prior to 139.0.7258.154/.155 across Windows, Mac, and…

  • CISA Warns of Citrix RCE and Privilege Escalation Vulnerabilities Exploited in Attacks

    CISA Warns of Citrix RCE and Privilege Escalation Vulnerabilities Exploited in Attacks CISA has issued a critical alert regarding three newly identified vulnerabilities being actively exploited by threat actors. On August 25, 2025, CISA added these high-risk Common Vulnerabilities and Exposures (CVEs) to its Known Exploited Vulnerabilities (KEV) Catalog, signaling immediate concern for federal agencies…

  • CISA Warns of Apple iOS, iPadOS, and macOS 0-day Vulnerability Exploited in Attacks

    CISA Warns of Apple iOS, iPadOS, and macOS 0-day Vulnerability Exploited in Attacks CISA has issued an urgent warning regarding a critical zero-day vulnerability affecting Apple’s iOS, iPadOS, and macOS operating systems that threat actors are actively exploiting.  The vulnerability, tracked as CVE-2025-43300, has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, signaling that…

  • ChatGPT-5 Downgrade Attack Let Hackers Bypass AI Security With Just a Few Words

    ChatGPT-5 Downgrade Attack Let Hackers Bypass AI Security With Just a Few Words A critical vulnerability in OpenAI’s latest flagship model, ChatGPT-5, allows attackers to sidestep its advanced safety features using simple phrases. The flaw, dubbed “PROMISQROUTE” by researchers at Adversa AI, exploits the cost-saving architecture that major AI vendors use to manage the immense…

  • AI Systems Can Generate Working Exploits for Published CVEs in 10-15 Minutes

    AI Systems Can Generate Working Exploits for Published CVEs in 10-15 Minutes Artificial intelligence systems can automatically generate functional exploits for newly published Common Vulnerabilities and Exposures (CVEs) in just 10-15 minutes at approximately $1 per exploit.  This breakthrough significantly compresses the traditional “grace period” that defenders typically rely on to patch vulnerabilities before working…

  • CISA Releases Four ICS Advisories Surrounding Vulnerabilities, and Exploits

    CISA Releases Four ICS Advisories Surrounding Vulnerabilities, and Exploits CISA issued four comprehensive Industrial Control Systems (ICS) advisories on August 19, 2025, highlighting serious vulnerabilities affecting critical infrastructure sectors including energy and manufacturing. These advisories detail exploitable vulnerabilities with CVSS scores ranging from 5.8 to 9.8, requiring immediate attention from system administrators and security professionals.…

  • Microsoft VS Code Remote-SSH Extension Hacked to Execute Malicious Code on Developer’s Machine

    Microsoft VS Code Remote-SSH Extension Hacked to Execute Malicious Code on Developer’s Machine A critical security vulnerability has been discovered in Microsoft’s VS Code Remote-SSH extension that allows attackers to execute malicious code on developers’ local machines through compromised remote servers.  Security researchers have demonstrated how this attack, dubbed “Vibe Hacking,” exploits the inherent trust…

  • Critical Apache Tika PDF Parser Vulnerability Allow Attackers to Access Sensitive Data

    Critical Apache Tika PDF Parser Vulnerability Allow Attackers to Access Sensitive Data A critical security vulnerability has been discovered in Apache Tika’s PDF parser module that could enable attackers to access sensitive data and trigger malicious requests to internal systems.  The flaw, designated as CVE-2025-54988, affects multiple versions of the widely used document parsing library…

  • Smashing Security podcast #431: How to mine millions without paying the bill

    Smashing Security podcast #431: How to mine millions without paying the bill In episode 431 of the “Smashing Security” podcast, a self-proclaimed crypto-influencer calling himself CP3O thought he had found a shortcut to riches — by racking up millions in unpaid cloud bills. Meanwhile, we look at the growing threat of EDR-killer tools that can…

  • Hackers Exploiting Apache ActiveMQ Vulnerability to Gain Access to Cloud Linux Systems

    Hackers Exploiting Apache ActiveMQ Vulnerability to Gain Access to Cloud Linux Systems A sophisticated campaign uncovered where adversaries are exploiting CVE-2023-46604, a critical remote code execution vulnerability in Apache ActiveMQ, to compromise cloud-based Linux systems. In this case, attackers are patching the very vulnerability they exploited to maintain exclusive access and evade detection, demonstrating advanced…

  • CodeRabbit’s Production Servers RCE Vulnerability Enables Write Access on 1M Repositories

    CodeRabbit’s Production Servers RCE Vulnerability Enables Write Access on 1M Repositories A critical remote code execution (RCE) vulnerability in CodeRabbit’s production infrastructure that provided unauthorized access to over one million code repositories, including private ones.  The vulnerability, discovered in December 2024 and responsibly disclosed in January 2025, exploited the platform’s static analysis tool integration to…

  • Speed cameras knocked out after cyber attack

    Speed cameras knocked out after cyber attack A hack of the Netherlands’ Public Prosecution Service has had an unusual side effect – causing some speed cameras to be no longer capturing evidence of motorists breaking the rules of the road. Read more in my article on the Hot for Security blog. Graham Cluley Go to…

  • PipeMagic Malware Mimic as ChatGPT App Exploits Windows Vulnerability to Deploy Ransomware

    PipeMagic Malware Mimic as ChatGPT App Exploits Windows Vulnerability to Deploy Ransomware A sophisticated malware campaign has been identified, utilizing PipeMagic, a highly modular backdoor deployed by the financially motivated threat actor Storm-2460.  This advanced malware masquerades as a legitimate open-source ChatGPT Desktop Application while exploiting the zero-day vulnerability CVE-2025-29824 in Windows Common Log File…

  • CISA Warns of Trend Micro Apex One OS Command Injection Vulnerability Exploited in Attacks

    CISA Warns of Trend Micro Apex One OS Command Injection Vulnerability Exploited in Attacks CISA has issued a critical warning regarding a high-severity OS command injection vulnerability in Trend Micro Apex One Management Console that threat actors are actively exploiting in the wild.  The vulnerability, tracked as CVE-2025-54948 and classified under CWE-78, poses significant risks…

  • New Elastic EDR 0-Day Vulnerability Allows Attackers to Bypass Detection, Execute Malware, and Cause BSOD

    New Elastic EDR 0-Day Vulnerability Allows Attackers to Bypass Detection, Execute Malware, and Cause BSOD A newly discovered zero-day vulnerability in Elastic’s Endpoint Detection and Response (EDR) solution allows attackers to bypass security measures, execute malicious code, and trigger a BSOD system crash, according to the Ashes Cybersecurity research. The vulnerability resides in a core…

  • Google Awards $250,000 Bounty for Chrome RCE Vulnerability Discovery

    Google Awards $250,000 Bounty for Chrome RCE Vulnerability Discovery Google has awarded a record-breaking $250,000 bounty to security researcher “Micky” for discovering a critical remote code execution vulnerability in Chrome’s browser architecture.  The vulnerability allowed malicious websites to escape Chrome’s sandbox protection and execute arbitrary code on victim systems.  Key Takeaways1.Google paid researcher “Micky” a…

  • Microsoft IIS Web Deploy Vulnerability Let Attackers Execute Remote Code

    Microsoft IIS Web Deploy Vulnerability Let Attackers Execute Remote Code A critical vulnerability in the Microsoft Web Deploy tool could allow authenticated attackers to execute remote code on affected systems.  The vulnerability, tracked as CVE-2025-53772, was disclosed on August 12, 2025, and carries a CVSS score of 8.8, indicating high severity. The flaw stems from…

  • Fortinet FortiSIEM Command Injection Vulnerability (CVE-2025-25256) – Technical Details Revealed

    Fortinet FortiSIEM Command Injection Vulnerability (CVE-2025-25256) – Technical Details Revealed Cybersecurity researchers from watchTowr Labs have published a comprehensive technical analysis of a critical pre-authentication command injection vulnerability affecting Fortinet FortiSIEM systems, designated as CVE-2025-25256. The vulnerability carries a maximum CVSS score of 9.8 and has already been exploited in the wild, making it one…

  • Cisco Secure Firewall Snort 3 Detection Engine Vulnerability Enables DoS Attacks

    Cisco Secure Firewall Snort 3 Detection Engine Vulnerability Enables DoS Attacks Critical security flaw CVE-2025-20217 allows unauthenticated attackers to trigger denial-of-service conditions in Cisco’s widely deployed firewall systems Cisco has disclosed a high-severity vulnerability in its Secure Firewall Threat Defense (FTD) Software that could allow remote attackers to cause denial-of-service conditions through the Snort 3…

  • What Is Out-of-Bounds Read and Write Vulnerability?

    What Is Out-of-Bounds Read and Write Vulnerability? Out-of-bounds read and write vulnerabilities represent critical security vulnerabilities that occur when software accesses memory locations beyond the allocated boundaries of data structures such as arrays, buffers, or other memory regions. These vulnerabilities can lead to information disclosure, system crashes, and in severe cases, arbitrary code execution that…

  • The MedusaLocker ransomware gang is hiring penetration testers

    The MedusaLocker ransomware gang is hiring penetration testers MedusaLocker, the ransomware-as-a-service group that has been active since 2019 is openly recruiting for penetration testers to help it compromise more businesses. Read more in my article on the Fortra blog. Graham Cluley Go to grahamcluley

  • New Windows 0-Click NTLM Credential Leakage Vulnerability Bypasses Microsoft’s Patch

    New Windows 0-Click NTLM Credential Leakage Vulnerability Bypasses Microsoft’s Patch A critical zero-click NTLM credential leakage vulnerability that circumvents Microsoft’s recent patch for CVE-2025-24054.  The newly identified flaw, assigned CVE-2025-50154, allows attackers to extract NTLM hashes from fully patched Windows systems without any user interaction, demonstrating that Microsoft’s April security update was incomplete. Key Takeaways1.…

  • FortiOS, FortiProxy, and FortiPAM Auth Bypass Vulnerability Allows Attackers to Gain Full Control

    FortiOS, FortiProxy, and FortiPAM Auth Bypass Vulnerability Allows Attackers to Gain Full Control A high-severity authentication bypass vulnerability affecting multiple Fortinet security products, including FortiOS, FortiProxy, and FortiPAM systems.  The flaw, designated as CVE-2024-26009 with a CVSS score of 7.9, enables unauthenticated attackers to seize complete control of managed devices through exploitation of the FortiGate-to-FortiManager…

  • Multiple Chrome High-Severity Vulnerabilities Let Attackers Execute Arbitrary Code

    Multiple Chrome High-Severity Vulnerabilities Let Attackers Execute Arbitrary Code Google Chrome has released a critical security update addressing six vulnerabilities that could potentially enable arbitrary code execution on affected systems.  The stable channel update to version 139.0.7258.127/.128 for Windows and Mac, and 139.0.7258.127 for Linux, contains patches for multiple high-severity security flaws that pose significant…

  • Apache bRPC Vulnerability Allows Attackers to Crash the Service via Network

    Apache bRPC Vulnerability Allows Attackers to Crash the Service via Network A severe vulnerability in Apache bRPC has been discovered that allows attackers to crash services through network exploitation, affecting all versions prior to 1.14.1.  The vulnerability, identified as CVE-2025-54472 with “important” severity classification, stems from unlimited memory allocation in the Redis protocol parser component.…

  • WinRAR 0-Day in Phishing Attacks to Deploy RomCom Malware

    WinRAR 0-Day in Phishing Attacks to Deploy RomCom Malware A critical zero-day vulnerability has been identified in WinRAR that cybercriminals are actively exploiting through sophisticated phishing campaigns to distribute RomCom malware.  The flaw, designated as CVE-2025-8088, represents a significant security threat with a CVSS v3.1 score of 8.4, enabling attackers to execute arbitrary code on…

  • 7-Zip Arbitrary File Write Vulnerability Let Attackers Execute Arbitrary Code

    7-Zip Arbitrary File Write Vulnerability Let Attackers Execute Arbitrary Code A newly disclosed security vulnerability in the popular 7-Zip file compression software has raised significant concerns in the cybersecurity community. CVE-2025-55188, discovered and reported by security researcher Landon on August 9, 2025, allows attackers to perform arbitrary file writes during archive extraction, potentially leading to…

  • ChatGPT Connectors ‘0-click’ Vulnerability Let Attackers Exfiltrate Data From Google Drive

    ChatGPT Connectors ‘0-click’ Vulnerability Let Attackers Exfiltrate Data From Google Drive A critical vulnerability in OpenAI’s ChatGPT Connectors feature allows attackers to exfiltrate sensitive data from connected Google Drive accounts without any user interaction beyond the initial file sharing. The attack, dubbed “AgentFlayer,” represents a new class of zero-click exploits targeting AI-powered enterprise tools. The…

  • ECScape: Exploiting ECS Protocol on EC2 to Exfiltrate Cross-Task IAM and Execution Role Credentials

    ECScape: Exploiting ECS Protocol on EC2 to Exfiltrate Cross-Task IAM and Execution Role Credentials A sophisticated technique dubbed “ECScape” that allows malicious containers running on Amazon Elastic Container Service (ECS) to steal AWS credentials from other containers sharing the same EC2 instance. The discovery highlights critical isolation weaknesses in multi-tenant ECS deployments and underscores the…

  • CISA Releases Emergency Advisory Urges Feds to Patch Exchange Server Vulnerability by Monday

    CISA Releases Emergency Advisory Urges Feds to Patch Exchange Server Vulnerability by Monday CISA has issued an emergency advisory directing all Federal Civilian Executive Branch agencies to mitigate a newly disclosed Microsoft Exchange urgently hybrid-joined vulnerability, tracked as CVE-2025-53786, by 9:00 AM EDT on Monday, August 11, 2025. The flaw enables attackers who have already…

  • HTTP/1.1 Fatal Vulnerability Exposes Millions of Websites to Hostile Takeover

    HTTP/1.1 Fatal Vulnerability Exposes Millions of Websites to Hostile Takeover A critical vulnerability in the HTTP/1.1 protocol threatens tens of millions of websites with potential hostile takeovers through sophisticated desynchronization attacks.  This fundamental flaw in the decades-old protocol creates extreme ambiguity about where one request ends and the next begins, enabling attackers to manipulate web…

  • Gemini Exploited via Prompt Injection in Google Calendar Invite to Steal Emails, and Control Smart Devices

    Gemini Exploited via Prompt Injection in Google Calendar Invite to Steal Emails, and Control Smart Devices A sophisticated attack method exploits Google’s Gemini AI assistant through seemingly innocent calendar invitations and emails.  The attack, dubbed “Targeted Promptware Attacks,” demonstrates how indirect prompt injection can compromise users’ digital privacy and even control physical devices in their…

  • Critical Trend Micro Apex One Management RCE Vulnerability Actively Exploited in the wild

    Critical Trend Micro Apex One Management RCE Vulnerability Actively Exploited in the wild Critical command injection remote code execution (RCE) vulnerabilities in Trend Micro Apex One Management Console are currently being actively exploited by threat actors.  The company confirmed observing at least one instance of attempted exploitation in production environments, prompting the immediate release of…

  • CISA Releases Two Advisories Covering Vulnerabilities, and Exploits Surrounding ICS

    CISA Releases Two Advisories Covering Vulnerabilities, and Exploits Surrounding ICS CISA released two urgent Industrial Control Systems (ICS) advisories on August 5, 2025, addressing significant security vulnerabilities in critical manufacturing and energy sector systems.  These advisories detail exploitable flaws that could compromise industrial operations and potentially disrupt essential services across multiple sectors. Key Takeaways1. CISA…

  • Millions of Dell Laptops Vulnerable to Device Takeover and Persistent Malware Attacks

    Millions of Dell Laptops Vulnerable to Device Takeover and Persistent Malware Attacks A wide range of vulnerabilities affects millions of Dell laptops used by government agencies, cybersecurity professionals, and enterprises worldwide. The vulnerabilities, collectively dubbed “ReVault,” target the Broadcom BCM5820X security chip embedded in Dell’s ControlVault3 firmware, creating opportunities for attackers to steal passwords, biometric…

  • Critical Android System Component Vulnerability Allows Remote Code Execution Without User Interaction

    Critical Android System Component Vulnerability Allows Remote Code Execution Without User Interaction Google released its August 2025 Android Security Bulletin on August 4, revealing a critical vulnerability that poses significant risks to Android device users worldwide.  The most severe flaw, designated CVE-2025-48530, affects the core System component and could enable remote code execution without requiring…

  • WAFs protection Bypassed to Execute XSS Payloads Using JS Injection with Parameter Pollution

    WAFs protection Bypassed to Execute XSS Payloads Using JS Injection with Parameter Pollution A sophisticated method to bypass Web Application Firewall (WAF) protections using HTTP Parameter Pollution techniques combined with JavaScript injection.  The research, conducted by Bruno Mendes across 17 different WAF configurations from major vendors including AWS, Google Cloud, Azure, and Cloudflare, revealed alarming…

  • AI-Powered Code Editor Cursor IDE Vulnerability Enables Remote Code Without User Interaction

    AI-Powered Code Editor Cursor IDE Vulnerability Enables Remote Code Without User Interaction A severe vulnerability in the popular AI-powered code editor Cursor IDE, dubbed “CurXecute,” allows attackers to execute arbitrary code on developers’ machines without any user interaction.  The vulnerability, tracked as CVE-2025-54135 with a high severity score of 8.6, affects all Cursor IDE versions prior to…

  • NestJS Framework Vulnerability Let Attackers Execute Arbitrary Code in Developers Machine

    NestJS Framework Vulnerability Let Attackers Execute Arbitrary Code in Developers Machine A critical security vulnerability has been discovered in the NestJS framework’s development tools that enables remote code execution (RCE) attacks against JavaScript developers.  The flaw, identified as CVE-2025-54782, affects the @nestjs/devtools-integration package and allows malicious websites to execute arbitrary code on developers’ local machines…

  • SonicWall Firewall Devices 0-day Vulnerability Actively Exploited by Akira Ransomware

    SonicWall Firewall Devices 0-day Vulnerability Actively Exploited by Akira Ransomware A suspected zero-day vulnerability in SonicWall firewall devices that the Akira ransomware group is actively exploiting. The flaw allows attackers to gain initial access to corporate networks through SonicWall’s SSL VPN feature, leading to subsequent ransomware deployment. In late July 2025, security researchers observed a…

  • Critical CrushFTP 0-Day RCE Vulnerability Technical Details and PoC Released

    Critical CrushFTP 0-Day RCE Vulnerability Technical Details and PoC Released A significant zero-day vulnerability in CrushFTP has been disclosed, allowing unauthenticated attackers to achieve complete remote code execution on vulnerable servers.  The flaw, tracked as CVE-2025-54309 and scoring a critical 9.8 on the CVSS scale, stems from a fundamental breakdown in security checks within CrushFTP’s…

  • OAuth2-Proxy Vulnerability Enables Authentication Bypass by Manipulating Query Parameters

    OAuth2-Proxy Vulnerability Enables Authentication Bypass by Manipulating Query Parameters A critical security vulnerability has been identified in OAuth2-Proxy, a widely-used reverse proxy that provides authentication services for Google, Azure, OpenID Connect, and numerous other identity providers.  The vulnerability, designated as CVE-2025-54576, enables attackers to bypass authentication mechanisms by manipulating query parameters in crafted URLs, potentially…

  • Hackers Exploiting SAP NetWeaver Vulnerability to Deploy Auto-Color Linux Malware

    Hackers Exploiting SAP NetWeaver Vulnerability to Deploy Auto-Color Linux Malware A sophisticated cyberattack targeting a US-based chemicals company has revealed the first observed pairing of SAP NetWeaver exploitation with Auto-Color malware, demonstrating how threat actors are leveraging critical vulnerabilities to deploy advanced persistent threats on Linux systems.  In April 2025, cybersecurity firm Darktrace successfully detected…

  • 200,000 WordPress websites at risk of being hijacked due to vulnerable Post SMTP plugin

    200,000 WordPress websites at risk of being hijacked due to vulnerable Post SMTP plugin Over 200,000 websites running a vulnerable version of a popular WordPress plugin could be at risk of being hijacked by hackers. Read more in my article on the Hot for Security blog. Graham Cluley Go to grahamcluley

  • CISA Warns of PaperCut RCE Vulnerability Exploited in Attacks

    CISA Warns of PaperCut RCE Vulnerability Exploited in Attacks CISA has issued an urgent warning regarding a critical vulnerability in PaperCut NG/MF print management software that threat actors are actively exploiting in ransomware campaigns.  The vulnerability, tracked as CVE-2023-2533, represents a significant security risk to organizations worldwide using the affected software versions. Key Takeaways1. CVE-2023-2533…

  • Critical macOS ‘Sploitlight’ Vulnerability Let Attackers Steal Private Data of Files Bypassing TCC

    Critical macOS ‘Sploitlight’ Vulnerability Let Attackers Steal Private Data of Files Bypassing TCC A critical macOS vulnerability enables attackers to bypass Transparency, Consent, and Control (TCC) protections and steal sensitive user data, including files from protected directories and Apple Intelligence caches.  The vulnerability, dubbed “Sploitlight,” exploits Spotlight plugins to access normally protected information without user consent,…

  • LG Innotek Camera Vulnerabilities Let Attackers Gain Administrative Access

    LG Innotek Camera Vulnerabilities Let Attackers Gain Administrative Access A serious security vulnerability has been discovered in LG Innotek’s LNV5110R camera model that could allow cybercriminals to gain complete administrative control over affected devices.  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory on July 24, 2025, warning of a remotely exploitable flaw…

  • CISA Warns of Microsoft SharePoint Code Injection and Authentication Vulnerability Exploited in Wild

    CISA Warns of Microsoft SharePoint Code Injection and Authentication Vulnerability Exploited in Wild CISA has issued an urgent warning regarding two critical Microsoft SharePoint vulnerabilities that threat actors are actively exploiting in the wild.  The vulnerabilities, designated as CVE-2025-49704 and CVE-2025-49706, pose significant risks to organizations running on-premises SharePoint servers and have been added to…

  • Chrome High-Severity Vulnerabilities Allow Attackers to Execute Arbitrary Code

    Chrome High-Severity Vulnerabilities Allow Attackers to Execute Arbitrary Code Google has released an urgent security update for its Chrome browser, addressing three critical vulnerabilities that could enable attackers to execute arbitrary code on users’ systems. The Stable channel update to version 138.0.7204.168/.169 for Windows and Mac, and 138.0.7204.168 for Linux, is currently rolling out to…

  • Microsoft Releases Mitigations and Threat Hunting Queries for SharePoint Zero-Day

    Microsoft Releases Mitigations and Threat Hunting Queries for SharePoint Zero-Day Thousands of organizations worldwide face active cyberattacks targeting Microsoft SharePoint servers through two critical vulnerabilities, prompting urgent government warnings and emergency patches. Microsoft confirmed over the weekend that threat actors are actively exploiting two zero-day vulnerabilities in on-premises SharePoint servers, designated CVE-2025-53770 and CVE-2025-53771. The…

  • New PoisonSeed Attack Let Attackers Trick Users into Scanning a QR Code with an MFA Authenticator

    New PoisonSeed Attack Let Attackers Trick Users into Scanning a QR Code with an MFA Authenticator A sophisticated new attack technique compromises Fast IDentity Online (FIDO) key authentication by exploiting cross-device sign-in features.  The PoisonSeed attack group has developed a method to downgrade FIDO key protections through adversary-in-the-middle (AitM) phishing campaigns that trick users into…

  • PoC Exploit Released for Critical NVIDIA AI Container Toolkit Vulnerability

    PoC Exploit Released for Critical NVIDIA AI Container Toolkit Vulnerability A critical container escape vulnerability has emerged in the NVIDIA Container Toolkit, threatening the security foundation of AI infrastructure worldwide. Dubbed “NVIDIAScape” and tracked as CVE-2025-23266, this flaw carries a maximum CVSS score of 9.0, representing one of the most severe threats to cloud-based AI…

  • SharePoint 0-Day RCE Vulnerability Actively Exploited in the Wild to Gain Full Server Access

    SharePoint 0-Day RCE Vulnerability Actively Exploited in the Wild to Gain Full Server Access A sophisticated cyberattack campaign targeting Microsoft SharePoint servers has been discovered exploiting a newly weaponized vulnerability chain dubbed “ToolShell,” enabling attackers to gain complete remote control over vulnerable systems without authentication. Eye Security, a Dutch cybersecurity firm, identified the active exploitation…

  • Grafana Vulnerabilities Allow User Redirection to Malicious Sites and Code Execution in Dashboards

    Grafana Vulnerabilities Allow User Redirection to Malicious Sites and Code Execution in Dashboards Two significant Grafana vulnerabilities that could allow attackers to redirect users to malicious websites and execute arbitrary JavaScript code.  The vulnerabilities, identified as CVE-2025-6023 and CVE-2025-6197, affect multiple versions of Grafana, including 12.0.x, 11.6.x, 11.5.x, 11.4.x, and 11.3.x branches.  Both security flaws…

  • CISA Warns of Fortinet FortiWeb SQL Injection Vulnerability Exploited in Attacks

    CISA Warns of Fortinet FortiWeb SQL Injection Vulnerability Exploited in Attacks The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Fortinet FortiWeb vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation of the SQL injection flaw in cyberattacks worldwide. The vulnerability, tracked as CVE-2025-25257, affects Fortinet’s FortiWeb web application firewall…

  • Microsoft Entra ID Vulnerability Let Attackers Escalate Privileges to Global Admin Role

    Microsoft Entra ID Vulnerability Let Attackers Escalate Privileges to Global Admin Role A critical vulnerability in Microsoft Entra ID allows attackers to escalate privileges to the Global Administrator role through the exploitation of first-party applications.  The vulnerability, reported to Microsoft Security Response Center (MSRC) in January 2025, affects organizations using hybrid Active Directory environments with…

  • Smashing Security podcast #426: Choo Choo Choose to ignore the vulnerability

    Smashing Security podcast #426: Choo Choo Choose to ignore the vulnerability In episode 426 of the “Smashing Security” podcast, Graham reveals how you can hijack a train’s brakes from 150 miles away using kit cheaper than a second-hand PlayStation. Meanwhile, Carole investigates how Grok went berserk, which didn’t stop the Department of Defense signing a…

  • Cisco Unified Intelligence Center Vulnerability Allows Remote Attackers to Upload Arbitrary Files

    Cisco Unified Intelligence Center Vulnerability Allows Remote Attackers to Upload Arbitrary Files A critical vulnerability in Cisco’s Unified Intelligence Center (CUIC) web-based management interface has been classified with high severity, allowing authenticated remote attackers with Report Designer privileges to upload arbitrary files to affected systems.  Tracked as CVE-2025-20274 and assigned a CVSS Base Score of…

  • SonicWall SMA Devices 0-Day RCE Vulnerability Exploited to Deploy OVERSTEP Ransomware

    SonicWall SMA Devices 0-Day RCE Vulnerability Exploited to Deploy OVERSTEP Ransomware SonicWall’s end-of-life SMA 100 series appliances are again on the front line after investigators unearthed a covert campaign that couples a suspected zero-day remote-code-execution flaw with a sophisticated backdoor called OVERSTEP. The operation, attributed to the financially motivated group UNC6148, first steals administrator credentials…

  • Node.js Vulnerabilities Exposes Windows App to Path Traversal and HashDoS Attacks

    Node.js Vulnerabilities Exposes Windows App to Path Traversal and HashDoS Attacks The Node.js project has released critical security updates across multiple release lines to address two high-severity vulnerabilities affecting Windows applications and V8 engine implementations.  Security releases are now available for Node.js versions 20.x, 22.x, and 24.x, with patches addressing a path traversal bypass and…

  • Meta’s Llama Firewall Bypassed Using Prompt Injection Vulnerability

    Meta’s Llama Firewall Bypassed Using Prompt Injection Vulnerability Trendyol’s application security team uncovered a series of bypasses that render Meta’s Llama Firewall protections unreliable against sophisticated prompt injection attacks. The findings raise fresh concerns about the readiness of existing LLM security measures and underscore the urgent need for more robust defenses as enterprises increasingly embed…

  • GPUHammer – First Rowhammer Attack Targeting NVIDIA GPUs

    GPUHammer – First Rowhammer Attack Targeting NVIDIA GPUs Cybersecurity researchers at the University of Toronto have achieved a breakthrough in hardware-level attacks by successfully demonstrating GPUHammer, the first Rowhammer attack specifically targeting discrete NVIDIA GPUs. The research, which focuses on the popular NVIDIA A6000 GPU with GDDR6 memory, represents a significant expansion of the decade-old…

  • Hackers Actively Exploiting CitrixBleed 2 Vulnerability in the Wild

    Hackers Actively Exploiting CitrixBleed 2 Vulnerability in the Wild Researchers have observed widespread exploitation attempts targeting a critical memory disclosure vulnerability in Citrix NetScaler devices, designated as CVE-2025-5777 and dubbed “CitrixBleed 2.”  This pre-authentication flaw enables attackers to craft malicious requests that leak uninitialized memory from affected NetScaler ADC and Gateway devices, potentially exposing sensitive…

  • Laravel APP_KEY Vulnerability Allows Remote Code Execution – Hundreds of Apps Affected

    Laravel APP_KEY Vulnerability Allows Remote Code Execution – Hundreds of Apps Affected A critical vulnerability in Laravel applications exposes APP_KEY configuration values, enabling attackers to achieve remote code execution (RCE).  Collaborative research between GitGuardian and Synacktiv revealed that approximately 260,000 APP_KEYs have been exposed on GitHub since 2018, with over 600 applications confirmed vulnerable to…

  • Best SOC 2 Type 2 Certified Complaint Solutions – 2025

    Best SOC 2 Type 2 Certified Complaint Solutions – 2025 In today’s digital-first business landscape, SOC 2 Type 2 compliance is no longer optional for organizations handling sensitive customer data. As cyber threats escalate and regulatory scrutiny intensifies, demonstrating robust security controls and continuous monitoring is essential for trust, growth, and competitive advantage. This comprehensive…

  • Smashing Security podcast #425: Call of Duty: From pew-pew to pwned

    Smashing Security podcast #425: Call of Duty: From pew-pew to pwned In episode 425 of “Smashing Security”, Graham reveals how “Call of Duty: WWII” has been weaponised – allowing hackers to hijack your entire PC during online matches, thanks to ancient code and Microsoft’s Game Pass. Meanwhile, Carole digs into a con targeting the recently…

  • Microsoft SQL Server 0-Day Vulnerability Exposes Sensitive Data Over Network

    Microsoft SQL Server 0-Day Vulnerability Exposes Sensitive Data Over Network A critical information disclosure vulnerability in Microsoft SQL Server, designated as CVE-2025-49719, allows unauthorized attackers to access sensitive data over network connections.  This vulnerability stems from improper input validation within SQL Server’s processing mechanisms, enabling attackers to disclose uninitialized memory contents without requiring authentication or…

  • Microsoft Remote Desktop Client Vulnerability Let Attackers Execute Remote Code

    Microsoft Remote Desktop Client Vulnerability Let Attackers Execute Remote Code A critical security vulnerability in Microsoft Remote Desktop Client could allow attackers to execute arbitrary code on victim systems.  The vulnerability, designated as CVE-2025-48817, affects multiple versions of Windows and poses significant security risks for organizations that rely on Remote Desktop Protocol (RDP) connections. Key…

  • ScriptCase Vulnerabilities Let Attackers Execute Remote Code and Gain Server Access

    ScriptCase Vulnerabilities Let Attackers Execute Remote Code and Gain Server Access Two critical vulnerabilities in ScriptCase’s Production Environment module can be chained together to achieve pre-authenticated remote command execution on affected servers.  The vulnerabilities, tracked as CVE-2025-47227 and CVE-2025-47228, affect version 1.0.003-build-2 of the Production Environment module included in ScriptCase version 9.12.006 (23), with previous…

  • “CitrixBleed 2” Vulnerability PoC Released – Warns of Potential Widespread Exploitation

    “CitrixBleed 2” Vulnerability PoC Released – Warns of Potential Widespread Exploitation Critical flaw in Citrix NetScaler devices echoes infamous 2023 security breach that crippled major organizations worldwide. The new critical vulnerability in Citrix NetScaler devices has security experts warning of potential widespread exploitation, drawing alarming parallels to the devastating “CitrixBleed” attacks that plagued organizations in…

  • Writable File in Lenovo’s Windows Directory Enables a Stealthy AppLocker Bypass

    Writable File in Lenovo’s Windows Directory Enables a Stealthy AppLocker Bypass A significant security vulnerability has been discovered in Lenovo’s preloaded Windows operating systems, where a writable file in the Windows directory enables attackers to bypass Microsoft’s AppLocker security framework.  The issue affects all variants of Lenovo machines running default Windows installations and poses serious…

  • Next.js Cache Poisoning Vulnerability Let Attackers Trigger DoS Condition

    Next.js Cache Poisoning Vulnerability Let Attackers Trigger DoS Condition Key Takeaways1. Next.js versions 15.1.0-15.1.8 have a cache poisoning bug causing DoS attacks through blank page delivery.2. Needs affected Next.js version + ISR with cache revalidation + SSR with CDN caching 204 responses.3. Race condition allows HTTP 204 responses to be cached for static pages, serving…

  • Critical HIKVISION applyCT Vulnerability Exposes Devices to Code Execution Attacks

    Critical HIKVISION applyCT Vulnerability Exposes Devices to Code Execution Attacks A critical security vulnerability has been discovered in HIKVISION’s applyCT component, part of the HikCentral Integrated Security Management Platform, that allows attackers to execute arbitrary code remotely without authentication.  Assigned CVE-2025-34067 with a maximum CVSS score of 10.0, this vulnerability stems from the platform’s use…

  • Catwatchful stalkerware app spills secrets of 62,000 users – including its own admin

    Catwatchful stalkerware app spills secrets of 62,000 users – including its own admin Another scummy stalkerware app has spilled its guts, revealing the details of its 62,000 users – and data from thousands of victims’ infected devices. Graham Cluley Go to grahamcluley

  • New Sophisticated Attack ypasses Content Security Policy Using HTML-Injection Technique

    New Sophisticated Attack ypasses Content Security Policy Using HTML-Injection Technique A sophisticated technique to bypass Content Security Policy (CSP) protections using a combination of HTML injection and browser cache manipulation.  The method exploits the interaction between nonce-based CSP implementations and browser caching mechanisms, specifically targeting the back/forward cache (bfcache) and disk cache systems.  Key Takeaways1.…

  • Cisco Unified CM Vulnerability Allows Remote Attacker to Login As Root User

    Cisco Unified CM Vulnerability Allows Remote Attacker to Login As Root User A severe vulnerability in Cisco Unified Communications Manager (Unified CM) systems could allow remote attackers to gain root-level access to affected devices.  The vulnerability, designated CVE-2025-20309 with a maximum CVSS score of 10.0, affects Engineering Special releases and stems from hardcoded SSH credentials…

  • CISA Warns of Chrome 0-Day Vulnerability Exploited in Attacks

    CISA Warns of Chrome 0-Day Vulnerability Exploited in Attacks CISA has issued an urgent warning about a critical zero-day vulnerability in Google Chrome that attackers are actively exploiting in the wild.  The vulnerability, designated CVE-2025-6554, affects the Chromium V8 JavaScript engine and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, marking it as…

  • FileFix Attack Exploits Windows Browser Features to Bypass Mark-of-the-Web Protection

    FileFix Attack Exploits Windows Browser Features to Bypass Mark-of-the-Web Protection A sophisticated new variation of cyberattacks emerged in July 2025, exploiting a critical vulnerability in how Chrome and Microsoft Edge handle webpage saving functionality. The attack, dubbed “FileFix 2.0,” bypasses Windows’ Mark of the Web (MOTW) security feature by leveraging legitimate browser saving mechanisms combined…

  • The AI Fix #57: AI is the best hacker in the USA, and self-learning AI

    The AI Fix #57: AI is the best hacker in the USA, and self-learning AI In episode 57 of The AI Fix, our hosts discover an AI “dream recorder”, Mark Zuckerberg tantalises OpenAI staff with $100 million signing bonuses, Graham finds out why robot butlers sit in chairs, Wikipedia holds the line against AI slop,…

  • CISA Warns of Citrix NetScaler ADC and Gateway Vulnerability Actively Exploited in Attacks

    CISA Warns of Citrix NetScaler ADC and Gateway Vulnerability Actively Exploited in Attacks CISA has issued an urgent warning regarding a critical buffer overflow vulnerability in Citrix NetScaler ADC and Gateway products, designated as CVE-2025-6543.  Added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on June 30, 2025, threat actors are actively exploiting this high-severity flaw…

  • CISA Warns of FortiOS Hard-Coded Credentials Vulnerability Exploited in Attacks

    CISA Warns of FortiOS Hard-Coded Credentials Vulnerability Exploited in Attacks CISA has issued a critical warning regarding a Fortinet FortiOS vulnerability that poses significant risks to network security infrastructure.  On June 25, 2025, CISA added CVE-2019-6693 to its Known Exploited Vulnerabilities (KEV) catalog, indicating that this hard-coded credentials flaw is being actively exploited in real-world…

  • Firefox 140 Released With Fix for Code Execution Vulnerability – Update Now

    Firefox 140 Released With Fix for Code Execution Vulnerability – Update Now Mozilla has released Firefox 140, addressing multiple critical security vulnerabilities, including a high-impact use-after-free vulnerability that could lead to code execution.  The update patches twelve distinct security flaws ranging from memory safety issues to platform-specific vulnerabilities affecting both desktop and mobile versions of…

  • Realtek Vulnerability Let Attackers Trigger DoS Attack via Bluetooth Secure Connections Pairing Process

    Realtek Vulnerability Let Attackers Trigger DoS Attack via Bluetooth Secure Connections Pairing Process A significant security vulnerability has been identified in Realtek’s RTL8762E SDK v1.4.0 that allows attackers to exploit the Bluetooth Low Energy (BLE) Secure Connections pairing process to launch denial-of-service attacks.  The vulnerability, discovered in the RTL8762EKF-EVB development platform, stems from improper validation…

  • WinRAR Directory Vulnerability Allows Arbitrary Code Execution Using a Malicious File

    WinRAR Directory Vulnerability Allows Arbitrary Code Execution Using a Malicious File Summary 1. A high-severity flaw (CVE-2025-6218) in WinRAR allows attackers to execute arbitrary code by exploiting how the software handles file paths within archives. 2. The vulnerability enables attackers to use specially crafted archive files with directory traversal sequences, leading to remote code execution.…

  • WhatsApp Banned on U.S. House Staffers Devices Due to Potential Security Risks

    WhatsApp Banned on U.S. House Staffers Devices Due to Potential Security Risks Summary 1. The U.S. House Chief Administrative Officer banned WhatsApp from all government-issued devices used by congressional staffers, including mobile, desktop, and web browser versions. 2. The ban was implemented due to concerns about lack of transparency in data protection, absence of stored…

  • Amazon EKS Vulnerabilities Expose Sensitive AWS Credentials and Escalate Privileges

    Amazon EKS Vulnerabilities Expose Sensitive AWS Credentials and Escalate Privileges Summary 1.  Overprivileged containers can steal AWS credentials by targeting the 169.254.170.23:80 endpoint through packet sniffing and API spoofing attacks. 2. Attackers use tcpdump to intercept plaintext traffic or manipulate network settings to deploy fake HTTP servers that capture authorization tokens. 3.  Amazon considers this…

  • Threat Actor Allegedly Selling FortiGate API Exploit Tool Targeting FortiOS

    Threat Actor Allegedly Selling FortiGate API Exploit Tool Targeting FortiOS A threat actor has reportedly put up for sale a sophisticated FortiGate API exploit tool on a dark web marketplace, igniting significant concern within the cybersecurity community. The tool, which is being marketed for a price of $12,000 and comes with escrow services to facilitate…

  • Critical OpenVPN Driver Vulnerability Allows Attackers to Crash Windows Systems

    Critical OpenVPN Driver Vulnerability Allows Attackers to Crash Windows Systems Summary 1. A critical OpenVPN Windows driver flaw (CVE-2025-50054) allowed local attackers to crash systems. 2. The vulnerability enabled denial-of-service attacks but did not expose user data. 3. OpenVPN 2.7_alpha2 fixes the issue and improves Windows support. 4. Users should update promptly and restrict driver…

  • Record Breaking 7.3 Tbps DDoS Attack Blasting 37.4 Terabytes in Just 45 Seconds

    Record Breaking 7.3 Tbps DDoS Attack Blasting 37.4 Terabytes in Just 45 Seconds The largest distributed denial-of-service (DDoS) attack ever documented was successfully stopped by Cloudflare in mid-May 2025, with attackers unleashing a devastating 7.3 terabits per second (Tbps) attack that delivered 37.4 terabytes of malicious traffic in just 45 seconds.  Summary 1. Cloudflare blocked…