https://drive.google.com/file/d/1qnWarYsTSc5_sV6o8ULv0LBvGfKKXPxn/view

sev:CRIT 9.2 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

A vulnerability classified as critical was found in Comodo Internet Security Premium 12.3.4.8162. This vulnerability affects unknown code of the file cis_update_x64.xml of the component Manifest File Handler. The manipulation leads to improper validation of integrity check value. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

https://nvd.nist.gov/vuln/detail/CVE-2025-7096

https://drive.google.com/file/d/1qnWarYsTSc5_sV6o8ULv0LBvGfKKXPxn/view

sev:CRIT 9.2 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

A vulnerability classified as critical was found in Comodo Internet Security Premium 12.3.4.8162. This vulnerability affects unknown code of the file cis_update_x64.xml of the component Manifest File Handler. The manipulation leads to improper validation of integrity check value. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

https://nvd.nist.gov/vuln/detail/CVE-2025-7096

Fuck Broadcom. I would love to provide more details but I don't have a login. Go hack some Symantec IT Management Suite shit.

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35903

sev:CRIT 9.5 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y/R:I/V:C/RE:L/U:Red

Remote attackers can execute arbitrary code in the context of the vulnerable service process.

https://nvd.nist.gov/vuln/detail/CVE-2025-5333

Fuck Broadcom. I would love to provide more details but I don't have a login. Go hack some Symantec IT Management Suite shit.

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35903

sev:CRIT 9.5 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y/R:I/V:C/RE:L/U:Red

Remote attackers can execute arbitrary code in the context of the vulnerable service process.

https://nvd.nist.gov/vuln/detail/CVE-2025-5333

@cR0w is that the correct CVE link? CVE-2025-7079 seems unrelated to Broadcom

Since the latest release is two years old, I don't expect many people use this. But have another hardcoded JWT secret.

https://github.com/mao888/bluebell-plus/issues/35

A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebell_backend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plus leads to use of hard-coded password. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

https://nvd.nist.gov/vuln/detail/CVE-2025-7079

@cR0w is that the correct CVE link? CVE-2025-7079 seems unrelated to Broadcom

Since the latest release is two years old, I don't expect many people use this. But have another hardcoded JWT secret.

https://github.com/mao888/bluebell-plus/issues/35

A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebell_backend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plus leads to use of hard-coded password. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

https://nvd.nist.gov/vuln/detail/CVE-2025-7079

🔎 High severity buffer overflow (CVSS 8.7) in Shenzhen Libituo LBT-T300-T310 (2.2.3.0–2.2.3.6). Remote exploit via /appy.cgi—no patch yet, public exploit disclosed. Restrict access & monitor now. CVE-2025-7077 https://radar.offseq.com/threat/cve-2025-7077-buffer-overflow-in-shenzhen-libituo--9f728dec #OffSeq #IoTSecurity #BufferOverflow

PrivEsc in Apache APISIX.

https://lists.apache.org/thread/qwxnxolt0j5nvjfpr0mlz6h7nrtvyzng

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner).

Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges.
This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0.

Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.

https://nvd.nist.gov/vuln/detail/CVE-2025-27446

🛡️ HIGH severity: CVE-2025-27446 in Apache APISIX Java Plugin Runner (0.2.0–0.5.0) allows local privilege escalation via incorrect file permissions. Upgrade to 0.6.0+ ASAP. https://radar.offseq.com/threat/cve-2025-27446-cwe-732-incorrect-permission-assign-287204e3 #OffSeq #Apache #Vuln #PrivilegeEscalation

PrivEsc in Apache APISIX.

https://lists.apache.org/thread/qwxnxolt0j5nvjfpr0mlz6h7nrtvyzng

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner).

Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges.
This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0.

Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.

https://nvd.nist.gov/vuln/detail/CVE-2025-27446

🛑 HIGH severity: Alinto SOPE SOGo (2.0.2–5.12.2) is vulnerable to remote DoS (CVE-2025-53603) via NULL pointer dereference in sope-core/NGHashMap.m. No auth required. Patch pending—use WAF/rate limits. More info: https://radar.offseq.com/threat/cve-2025-53603-cwe-476-null-pointer-dereference-in-cea1526a #OffSeq #SOGo #Vuln #InfoSec

⚠️ MCP Python SDK (<1.9.4) has a HIGH severity vuln (CVE-2025-53366): malformed requests can crash services via uncaught exceptions (DoS). Patch by upgrading to 1.9.4+ and boost input validation! https://radar.offseq.com/threat/cve-2025-53366-cwe-248-uncaught-exception-in-model-bed56cf4 #OffSeq #Python #Vuln #DoS

Never had this problem with traceroute. ducks

https://github.com/Homebrew/homebrew-core/issues/35085

sev:HIGH 7.8 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.

https://nvd.nist.gov/vuln/detail/CVE-2025-49809

🔴 CRITICAL: CVE-2025-52833 (CVSS 9.3) hits designthemes LMS ≤9.1. Remote SQL Injection—no patch yet. Protect user data: enable WAFs, validate inputs, monitor queries. More: https://radar.offseq.com/threat/cve-2025-52833-cwe-89-improper-neutralization-of-s-b2058fec #OffSeq #SQLi #infosec

⚠️ CRITICAL: CVE-2025-52831 in thanhtungtnt Video List Manager (≤1.7) enables unauthenticated SQL Injection—data theft risk, no patch yet. Restrict access, use WAF, and monitor traffic! https://radar.offseq.com/threat/cve-2025-52831-cwe-89-improper-neutralization-of-s-08b04f8a #OffSeq #SQLInjection #Vuln #Infosec

🚨 CVE-2025-52832: CRITICAL SQLi in wpo-HR NGG Smart Image Search (≤3.4.1). No patch yet—disable plugin, use WAF, monitor logs. High risk to sensitive data & compliance. https://radar.offseq.com/threat/cve-2025-52832-cwe-89-improper-neutralization-of-s-4745dfce #OffSeq #WordPress #SQLi #ThreatIntel

🛡️ CRITICAL SQL Injection (CVE-2025-52830) in bSecure – Your Universal Checkout ≤1.7.9. Blind SQLi enables remote data exposure—no auth needed. E-commerce risk is high! Mitigate ASAP: WAF, DB least-priv, input validation. https://radar.offseq.com/threat/cve-2025-52830-cwe-89-improper-neutralization-of-s-be7bf20a #OffSeq #SQLi #InfoSec #Ecommerce

🚩 CRITICAL: CVE-2025-49417 in BestWpDeveloper WooCommerce Product Multi-Action (≤1.3) enables unauthenticated object injection via unsafe deserialization. Full site compromise possible—disable plugin now! https://radar.offseq.com/threat/cve-2025-49417-cwe-502-deserialization-of-untruste-ebae4036 #OffSeq #infosec #WordPress #WooCommerce

🚨 CVE-2025-49414: CRITICAL vuln in Fastw3b FW Gallery (<=8.0.0). Unrestricted file upload flaw can lead to full server compromise—no patch yet. Disable uploads & enforce strict validation! https://radar.offseq.com/threat/cve-2025-49414-cwe-434-unrestricted-upload-of-file-2c9acc37 #OffSeq #infosec #cybersecurity #CVE

⚠️ CVE-2025-49867: CRITICAL privilege escalation in InspiryThemes RealHomes ≤4.4.0. Unauthenticated remote attackers can gain admin rights. Restrict admin access, monitor logs, deploy WAF rules until patch. https://radar.offseq.com/threat/cve-2025-49867-cwe-266-incorrect-privilege-assignm-27f695bf #OffSeq #WordPress #Infosec #PrivilegeEscalation

🔴 CRITICAL (CVSS 9.8) SQL Injection in Click & Pledge Connect (v25.04010101–WP6.8) enables unauthenticated privilege escalation & data access. No patch yet—deploy WAF, restrict access, monitor closely. CVE-2025-28983 https://radar.offseq.com/threat/cve-2025-28983-cwe-89-improper-neutralization-of-s-bcae9037 #OffSeq #SQLi #Infosec #Vulnerability

🚨 CVE-2025-49302: CRITICAL code injection in Easy Stripe (≤1.1). Allows unauth RCE—no patch yet. Isolate systems, deploy WAFs, monitor for exploit attempts, & consider disabling. Details: https://radar.offseq.com/threat/cve-2025-49302-cwe-94-improper-control-of-generati-57375efd #OffSeq #Vuln #RCE #CVE202549302

🚨 CVE-2025-30933 (CRITICAL, CVSS 10): LiquidThemes LogisticsHub ≤1.1.6 is vulnerable to unrestricted file uploads. Remote attackers can deploy web shells for total server compromise. Disable uploads & monitor now! https://radar.offseq.com/threat/cve-2025-30933-cwe-434-unrestricted-upload-of-file-6d6f85e5 #OffSeq #Vuln #WebAppSec #BlueTeam

CVE-2025-23970: CRITICAL flaw in Service Finder Booking (≤6.0) allows unauth’d privilege escalation 🚨. No patch yet—restrict access, deploy WAF, monitor logs. Major risk for EU orgs handling bookings! https://radar.offseq.com/threat/cve-2025-23970-cwe-266-incorrect-privilege-assignm-247631f8 #OffSeq #vuln #cybersecurity #CVE202523970

Okay, this one's kind of funny. 1s and 0s are hard.

https://access.redhat.com/security/cve/CVE-2025-5372

sev:MED 5.0 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

https://nvd.nist.gov/vuln/detail/CVE-2025-5372

sev:HIGH cache poisoning vuln in next dot js.

https://github.com/vercel/next.js/security/advisories/GHSA-67rr-84xm-4c7r

A vulnerability affecting Next.js has been addressed. It impacted versions >=15.1.0 <15.1.8 and involved a cache poisoning bug leading to a Denial of Service (DoS) condition.

Edit to add the CVE: https://www.cve.org/CVERecord?id=CVE-2025-49826

https://www.asna.com/en/kb/security-update

This vulnerability affects only our Windows-based products. DataGate for IBM i is not affected. Our Visual RPG (for .NET and Classic), Wings, Mobile RPG, and DataGate for SQL Server are affected by this vulnerability and need to be updated.

The vulnerability exists only on the network where Windows machines are running the affected ASNA Assist or ASNA Registrar services. The threat is present only when these vulnerable services are running and an untrusted user has Windows network access (e.g., via a malicious intruder or a disgruntled employee).

ASNA Assist and ASNA Registrar before 2025-03-31 allow deserialization attacks against .NET remoting. These are Windows system services that support license key management and deprecated Windows network authentication. The services are implemented with .NET remoting and can be exploited via well-known deserialization techniques inherent in the technology. Because the services run with SYSTEM-level rights, exploits can be crafted to achieve escalation of privilege and arbitrary code execution. This affects DataGate for SQL Server 17.0.36.0 and 16.0.89.0, DataGate Component Suite 17.0.36.0 and 16.0.89.0, DataGate Monitor 17.0.26.0 and 16.0.65.0, DataGate WebPak 17.0.37.0 and 16.0.90.0, Monarch for .NET 11.4.50.0 and 10.0.62.0, Encore RPG 4.1.36.0, Visual RPG .NET FW 17.0.37.0 and 16.0.90.0, Visual RPG .NET FW Windows Deployment 17.0.36.0 and 16.0.89.0, WingsRPG 11.0.38.0 and 10.0.95.0, Mobile RPG 11.0.35.0 and 10.0.94.0, Monarch Framework for .NET FW 11.0.36.0 and 10.0.89.0, Browser Terminal 17.0.37.0 and 16.0.90.0, Visual RPG Classic 5.2.7.0 and 5.1.17.0, Visual RPG Deployment 5.2.7.0 and 5.1.17.0, and DataGate Studio 17.0.38.0 and 16.0.104.0.

https://nvd.nist.gov/vuln/detail/CVE-2025-43713

Oh my.

https://www.linkedin.com/posts/gaetano-cesano-976420200_qualche-giorno-fa-stavo-testando-plesk-obsidian-activity-7341794923198709761-by9G

sev:MED 5.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.

https://nvd.nist.gov/vuln/detail/CVE-2025-49618

Wow, this sudo priv escalation bug works perfectly on Fedora 42.

Woops! No distro patch available atm :/

https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot

Linux – Obtenez un accès root avec ces deux failles dans sudo : CVE-2025-32462 et CVE-2025-32463 https://www.it-connect.fr/linux-acces-root-avec-deux-failles-dans-sudo-cve-2025-32462-et-cve-2025-32463/ #ActuCybersécurité #Vulnérabilités #Cybersécurité #Linux

A critical Linux vulnerability (CVE-2025-32463) in Sudo lets any local unprivileged user gain root via the --chroot (-R) option

🔒 Affects default configs on Ubuntu, Fedora & others — no Sudo rules needed

🛠️ Fix: Update to Sudo 1.9.17p1+ (no workarounds)
👀 CVSS: 9.8 (Critical)

Highlights persistent risks in open-source privilege handling 🧩

https://cybersecuritynews.com/linux-sudo-chroot-vulnerability/

#Linux #Sudo #FOSS #CyberSecurity #InfoSec #OpenSource #Vulnerability #Root #Exploit #SysAdmin #DevSecOps

It is important you make sure you keep your software up to date on all devices where you can.

In this case, the core tool "sudo" found on most Linux systems had a bug with CVSS severity score 9.3 (where 10 is worst) was found, allowing local users to become "root" (the most, fully privileged user) and has fixed versions being distributed as part of operating system updates.
https://www.sudo.ws/security/advisories/chroot_bug/
https://www.cve.org/CVERecord?id=CVE-2025-32463
https://thehackernews.com/2025/07/critical-sudo-vulnerabilities-let-local.html

CVE-2025-32463 and CVE-2025-32462: Sudo Local Privilege Escalation Vulnerabilities Threaten Linux Environments – Source: socprime.com https://ciso2ciso.com/cve-2025-32463-and-cve-2025-32462-sudo-local-privilege-escalation-vulnerabilities-threaten-linux-environments-source-socprime-com/ #rssfeedpostgeneratorecho #PrivilageEscalation #CyberSecurityNews #CVE-2025-32462 #CVE-2025-32463 #Latestthreats #Vulnerability #socprimecom #socprime #Blog #CVE

Local Privilege Escalation to Root via Sudo Chroot in Linux https://github.com/kh4sh3i/CVE-2025-32463

Vulnerability Advisory: Sudo chroot Elevation of Privilege https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot

#linux #unix

Kurzer Check bei mir, welche Distros die kritische #sudo Lücke CVE-2025-32463 bis jetzt behoben haben:

- Alpine 3.22: OK
- Arch Linux: OK
- Debian 12 / Devuan 5: OK
- Fedora 42: FAIL
- Void Linux: OK

#itsec

I think I boosted information about these sudo EoP vulns yesterday but in case I didn't, here's some basic info on them.

https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host

sev:LOW 2.8 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.

https://nvd.nist.gov/vuln/detail/CVE-2025-32462

https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot

sev:CRIT 9.3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

https://nvd.nist.gov/vuln/detail/CVE-2025-32463

Sudo local privilege escalation vulnerabilities fixed (CVE-2025-32462, CVE-2025-32463) https://www.helpnetsecurity.com/2025/07/01/sudo-local-privilege-escalation-vulnerabilities-fixed-cve-2025-32462-cve-2025-32463/ #vulnerability #Stratascale #Don'tmiss #Hotstuff #Debian #Ubuntu #Linux #macOS #News #SUSE

Critical Sudo vulnerabilities enable local privilege escalation to root

The Stratascale Cyber Research Unit are reporting two vulnerabilities in the Sudo utility, including a critical flaw (CVE-2025-32463) that allows unprivileged users to escalate to root privileges through the chroot option by exploiting NSS library loading mechanisms.

**This is a nasty flaw. If you have multiple user roles on your linux systems or are running services as non-root, make sure to update your Linux systems' Sudo utility to version 1.9.17p1 or later. The exploit vector is possible if someone already has local access to the system, which can either be through direct credentials or through breaching a vulnerable service that's running as non-root.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-sudo-vulnerabilities-enable-local-privilege-escalation-to-root-o-x-8-6-q/gD2P6Ple2L

Maybe controversial, but I think it is bad to do this
https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot

Turns out sudo -f was implemented as sudo -R...
https://leahneukirchen.org/blog/archive/2011/04/sudo-f.html

https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot

CVE-2025-32463 Vulnerability Advisory: Sudo chroot Elevation of Privilege https://lobste.rs/s/srcfxn #linux #security
https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot

Sudo versions 1.9.14 to 1.9.17 (inclusive) have two critical vulnerabilities:
- local privilege escalation via chroot option (CVE-2025-32463) https://www.openwall.com/lists/oss-security/2025/06/30/3
- local privilege escalation via host option (CVE-2025-32462) https://www.openwall.com/lists/oss-security/2025/06/30/2

#cve_2025_32463 #cve_2025_32462 #infosec #cybersecurity

EUVD: Critical CVE-2024-13786: the education theme for WordPress is vulnerable to PHP Object Injection in all versions https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-54721

- CVE-2025-4689: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to RCE Local File Inclusion https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19688 @euvdfeed #cybersecurity #infosec #WordPress

Go hack more MCP shit.

https://github.com/cyanheads/git-mcp-server/security/advisories/GHSA-3q26-f695-pp76

sev:HIGH 7.5 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

@cyanheads/git-mcp-server is an MCP server designed to interact with Git repositories. Prior to version 2.1.5, there is a command injection vulnerability caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (|, >, &&, etc.). An MCP Client can be instructed to execute additional actions for example via indirect prompt injection when asked to read git logs. This issue has been patched in version 2.1.5.

https://nvd.nist.gov/vuln/detail/CVE-2025-53107

Go hack more MCP shit.

https://github.com/RestDB/codehooks-mcp-server/security/advisories/GHSA-fhq6-jf5q-qxvq

sev:HIGH 8.6 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

RestDB's Codehooks.io MCP Server is an MCP server on the Codehooks.io platform. Prior to version 0.2.2, the MCP server is written in a way that is vulnerable to command injection attacks as part of some of its MCP Server tools definition and implementation. This could result in a user initiated remote command injection attack on a running MCP Server. This issue has been patched in version 0.2.2.

https://nvd.nist.gov/vuln/detail/CVE-2025-53100

Go hack more remote support shit.

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04878en_us&docLocale=en_US

Multiple security vulnerabilities have been identified in HPE Insight Remote Support. These vulnerabilities could remotely allow a directory traversal, disclosure of information, or code execution.

CVE-2025-37097 ( sev:MED 7.5 - :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H )

CVE-2025-37098 ( sev:MED 6.5 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVE-2025-37099 ( sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )

Perfect 10 in Monero forums. 🥳

https://swap.gs/posts/monero-forums/

https://github.com/monero-project/monero-forum

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to file_get_contents() without validation. MIME type checks using PHP’s finfo can be bypassed via crafted stream filter chains that prepend spoofed headers, allowing access to internal Laravel configuration files. An attacker can extract the APP_KEY from config/app.php, forge encrypted cookies, and trigger unsafe unserialize() calls, leading to reliable remote code execution.

https://nvd.nist.gov/vuln/detail/CVE-2025-34060

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

https://www.asrmicro.com/en/goods/psirt?cid=40

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

https://www.asrmicro.com/en/goods/psirt?cid=40

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

https://www.asrmicro.com/en/goods/psirt?cid=40

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

Post-auth sev:HIGH code injection and argument injection vulns in Ansible Automation Platform.

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.

https://bugzilla.redhat.com/show_bug.cgi?id=2370812

https://nvd.nist.gov/vuln/detail/CVE-2025-49520

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.

https://bugzilla.redhat.com/show_bug.cgi?id=2370817

https://nvd.nist.gov/vuln/detail/CVE-2025-49521

🟥𝐋𝐂𝐒𝐂-𝐈𝐄 𝐃𝐚𝐢𝐥𝐲 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐅𝐢𝐧𝐝𝐢𝐧𝐠𝐬-𝟑 𝐉𝐮𝐥𝐲 𝟐𝟎𝟐𝟓🟥

𝐍𝐞𝐰𝐬:

1. Microsoft to Lay Off 9,000 Employees, Affecting 4% of Workforce

https://www.reuters.com/business/world-at-work/microsoft-lay-off-many-9000-employees-seattle-times-reports-2025-07-02/

2. Hunters International Ransomware Shuts Down, Offers Free Decryptors to Victims

https://cyberinsider.com/hunters-international-ransomware-shuts-down-offers-free-decryptors-to-victims/

3. UK charity bank branded a 'disaster' after platform migration goes wrong

https://www.theregister.com/2025/07/03/uk_charity_bank_migration_disaster/

4. Police warn of SMS scams following prison sentence for criminal who conducted smishing campaign

https://www.ukfinance.org.uk/news-and-insight/press-release/police-warn-sms-scams-following-prison-sentence-criminal-who

5. Large Language Models (LLMs) Are Falling for Phishing Scams: What Happens When AI Gives You the Wrong URL?

https://www.netcraft.com/blog/large-language-models-are-falling-for-phishing-scams

6. Russia’s Cyber Warriors Assail NATO-Linked Private Companies

https://cepa.org/article/russias-cyber-warriors-assail-nato-linked-private-companies/

7. US probes negotiator suspected of taking crypto ransomware money

https://cointelegraph.com/news/digitalmint-employee-under-investigation-by-us-justice-department

8. Cyberattacks Disrupt Iran’s Bread Distribution, Payments Remain Frozen

https://iranwire.com/en/news/142915-cyberattacks-disrupt-irans-bread-distribution-payments-remain-frozen/

9. Spain arrests hackers who targeted politicians and journalists

https://policia.es/_es/comunicacion_prensa_detalle.php?ID=16602

10. A third of organisations take more than 90 days to remediate threats

https://www.itsecurityguru.org/2025/07/02/a-third-of-organisations-take-more-than-90-days-to-remediate-threats/?utm_source=rss&utm_medium=rss&utm_campaign=a-third-of-organisations-take-more-than-90-days-to-remediate-threats

---

𝐆𝐥𝐨𝐛𝐚𝐥 𝐁𝐫𝐞𝐚𝐜𝐡 𝐍𝐞𝐰𝐬 𝐚𝐧𝐝 𝐃𝐚𝐭𝐚 𝐋𝐞𝐚𝐤𝐬:

1. Irish Eyecare software firm Ocuco investigating cyber-attack

https://thecurrency.news/articles/194653/eyecare-software-firm-ocuco-investigating-cyber-attack/

---

𝐓𝐚𝐜𝐭𝐢𝐜𝐚𝐥 𝐑𝐞𝐩𝐨𝐫𝐭𝐬 𝐰𝐢𝐭𝐡 𝐈𝐎𝐂𝐬:

1. Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack

https://unit42.paloaltonetworks.com/apache-cve-2025-24813-cve-2025-27636-cve-2025-29891/

2. Snake Keyloggers Exploit Java Tools to Bypass Security – Active IOCs

https://rewterz.com/threat-advisory/snake-keyloggers-exploit-java-tools-to-bypass-security-active-iocs

3. Who are DragonForce Ransomware Group?

https://www.bridewell.com/insights/blogs/detail/who-are-dragonforce-ransomware-group

4. Silent Push Uncovers Chinese Fake Marketplace e-Commerce Phishing Campaign Using Thousands of Websites to Spoof Popular Retail Brands

https://www.silentpush.com/blog/fake-marketplace/#Google-Pay-Widget-Integrated-Into-Sites-to-Take-Real-Payments

5. Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open

https://www.wiz.io/blog/exposed-jdwp-exploited-in-the-wild

6. Malvertising Campaign Delivers Oyster/Broomstick Backdoor via SEO Poisoning and Trojanized Tools

https://arcticwolf.com/resources/blog/malvertising-campaign-delivers-oyster-broomstick-backdoor-via-seo-poisoning-trojanized-tools/

7. North Korean APT Kimsuky aka Black Banshee – Active IOCs

https://rewterz.com/threat-advisory/north-korean-apt-kimsuky-aka-black-banshee-active-iocs-52

8. DarkTortilla Malware – Active IOCs

https://rewterz.com/threat-advisory/darktortilla-malware-active-iocs-2

---

𝐀𝐏𝐓 𝐈𝐎𝐂𝐬:

1. Lazarus: Source VT
yourdomainhost[.]store
api[.]yourdomainhost[.]store

2. Kimsuky: Source Validin
Accounts-mysticete[.]servepics[.]com
freedrive[.]servehttp[.]com
login-accounts[.]servehttp[.]com
myaccounts-profile[.]servehttp[.]com
mydocs[.]onthewifi[.]com
securedrive-mofa[.]servehttp[.]com
translate[.]onthewifi[.]com
undocs[.]ddns[.]net
undocs[.]myvnc[.]com
undocs[.]servehttp[.]com

---

𝐓𝐡𝐫𝐞𝐚𝐭 𝐇𝐮𝐧𝐭𝐢𝐧𝐠 / 𝐃𝐅𝐈𝐑 / 𝐌𝐚𝐥𝐰𝐚𝐫𝐞:

1. Automating macOS Incident Response: DFIR-as-Code in Action Against AppleProcessHub

https://www.abstract.security/blog/automating-macos-incident-response-dfir-as-code-in-action-against-appleprocesshub

2. Using Staging Folders For Threat Hunting

https://www.knowyouradversary.ru/2025/07/183-using-staging-folders-for-threat.html

3. PDFs: Portable documents, or perfect deliveries for phish?

https://blog.talosintelligence.com/pdfs-portable-documents-or-perfect-deliveries-for-phish/

4. EscapeRoute: Breaking the Scope of Anthropic’s Filesystem MCP Server
(CVE-2025-53109 & CVE-2025-53110)

https://cymulate.com/blog/cve-2025-53109-53110-escaperoute-anthropic/?utm_source=linkedin&utm_medium=social&utm_campaign=2025-q3-cve-2025-53109-53110-escaperoute-anthropic-blog&utm_term=blog

5. Yet another ZIP trick

https://hackarcana.com/article/yet-another-zip-trick

6. Malware development trick 48: leveraging Office macros for malware. Simple VBA example.

https://cocomelonc.github.io/malware/2025/07/01/malware-tricks-48.html

7. Hijacked by a Text: Understanding and Preventing SIM Swapping Attack

https://www.bitsight.com/blog/what-is-sim-swapping

8. CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries

https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/

9. DanaBot Lab Analysis

https://omer-secure.medium.com/danabot-lab-analysis-7dbaa179f3e4

10. ClickFix Campaign: How Clipboard Injection Leads to RAT Infection (Part 1)

https://h3xstone.medium.com/clickfix-campaign-how-clipboard-injection-leads-to-rat-infection-part-1-069e77d3cad1

11. Release Notes: Detonation Actions, Enhanced QR Extraction, and 1,400+ New Detection Rules

https://any.run/cybersecurity-blog/release-notes-june-2025/

12. Inside Android Malware Development: Building a C2 Exfiltrator from the UI to the Network

https://medium.com/@lord_murak/inside-android-malware-development-building-a-c2-exfiltrator-from-the-ui-to-the-network-7ec2d9a3d58e

---

𝐋𝐢𝐠𝐡𝐭 𝐑𝐞𝐚𝐝𝐢𝐧𝐠:

1. Pro-Russian hacktivism: Shifting alliances, new groups and risks

https://intel471.com/blog/pro-russian-hacktivism-shifting-alliances-new-groups-and-risks

2. Insider Risk Lessons from the DPRK IT Worker Crackdown

https://www.dtexsystems.com/blog/insider-risk-lessons-from-dprk-crackdown/

3. Calling Out Russia: France’s Shift on Public Attribution

https://warontherocks.com/2025/07/calling-out-russia-frances-shift-on-public-attribution/

4. Outsourced Trust: How Coinbase's $400M Problem Started in an Indian Call Center

https://www.reco.ai/blog/coinbase-breach

---

EscapeRoute: How we found 2 vulnerabilities in Anthropic’s Filesystem MCP Server (CVE-2025-53109 & CVE-2025-53110) https://cymulate.com/blog/cve-2025-53109-53110-escaperoute-anthropic/?utm_source=linkedin&amp;utm_medium=social&amp;utm_campaign=2025-q3-cve-2025-53109-53110-escaperoute-anthropic-blog&amp;utm_term=blog

New.

CVE-2025-20309 (critical): Cisco Unified Communications Manager Static SSH Credentials Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7

- Cisco Spaces Connector Privilege Escalation Vulnerability - CVE-2025-20308 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spaces-conn-privesc-kgD2CcDU

- Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability - CVE-2025-20310 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CbtKtEYc

- Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability - CVE-2025-20307 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-xss-O696ymRA @TalosSecurity #cybersecurity #infosec #Cisco

That one is a sev:CRIT 9.3 in case you're wondering: https://nvd.nist.gov/vuln/detail/CVE-2025-34072

A bunch of Infinera and Nokia vulns got published today. Could be worth checking out based on where these specific systems tend to sit.

Infinera G42:

https://nvd.nist.gov/vuln/detail/CVE-2025-27021

https://nvd.nist.gov/vuln/detail/CVE-2025-27022

https://nvd.nist.gov/vuln/detail/CVE-2025-27023

https://nvd.nist.gov/vuln/detail/CVE-2025-27024

https://nvd.nist.gov/vuln/detail/CVE-2025-27025

Nokia Single RAN:

https://nvd.nist.gov/vuln/detail/CVE-2025-24328

https://nvd.nist.gov/vuln/detail/CVE-2025-24329

https://nvd.nist.gov/vuln/detail/CVE-2025-24330

https://nvd.nist.gov/vuln/detail/CVE-2025-24331

https://nvd.nist.gov/vuln/detail/CVE-2025-24332

https://nvd.nist.gov/vuln/detail/CVE-2025-24333

https://nvd.nist.gov/vuln/detail/CVE-2025-24334

https://nvd.nist.gov/vuln/detail/CVE-2025-24335

A bunch of Infinera and Nokia vulns got published today. Could be worth checking out based on where these specific systems tend to sit.

Infinera G42:

https://nvd.nist.gov/vuln/detail/CVE-2025-27021

https://nvd.nist.gov/vuln/detail/CVE-2025-27022

https://nvd.nist.gov/vuln/detail/CVE-2025-27023

https://nvd.nist.gov/vuln/detail/CVE-2025-27024

https://nvd.nist.gov/vuln/detail/CVE-2025-27025

Nokia Single RAN:

https://nvd.nist.gov/vuln/detail/CVE-2025-24328

https://nvd.nist.gov/vuln/detail/CVE-2025-24329

https://nvd.nist.gov/vuln/detail/CVE-2025-24330

https://nvd.nist.gov/vuln/detail/CVE-2025-24331

https://nvd.nist.gov/vuln/detail/CVE-2025-24332

https://nvd.nist.gov/vuln/detail/CVE-2025-24333

https://nvd.nist.gov/vuln/detail/CVE-2025-24334

https://nvd.nist.gov/vuln/detail/CVE-2025-24335

A bunch of Infinera and Nokia vulns got published today. Could be worth checking out based on where these specific systems tend to sit.

Infinera G42:

https://nvd.nist.gov/vuln/detail/CVE-2025-27021

https://nvd.nist.gov/vuln/detail/CVE-2025-27022

https://nvd.nist.gov/vuln/detail/CVE-2025-27023

https://nvd.nist.gov/vuln/detail/CVE-2025-27024

https://nvd.nist.gov/vuln/detail/CVE-2025-27025

Nokia Single RAN:

https://nvd.nist.gov/vuln/detail/CVE-2025-24328

https://nvd.nist.gov/vuln/detail/CVE-2025-24329

https://nvd.nist.gov/vuln/detail/CVE-2025-24330

https://nvd.nist.gov/vuln/detail/CVE-2025-24331

https://nvd.nist.gov/vuln/detail/CVE-2025-24332

https://nvd.nist.gov/vuln/detail/CVE-2025-24333

https://nvd.nist.gov/vuln/detail/CVE-2025-24334

https://nvd.nist.gov/vuln/detail/CVE-2025-24335

A bunch of Infinera and Nokia vulns got published today. Could be worth checking out based on where these specific systems tend to sit.

Infinera G42:

https://nvd.nist.gov/vuln/detail/CVE-2025-27021

https://nvd.nist.gov/vuln/detail/CVE-2025-27022

https://nvd.nist.gov/vuln/detail/CVE-2025-27023

https://nvd.nist.gov/vuln/detail/CVE-2025-27024

https://nvd.nist.gov/vuln/detail/CVE-2025-27025

Nokia Single RAN:

https://nvd.nist.gov/vuln/detail/CVE-2025-24328

https://nvd.nist.gov/vuln/detail/CVE-2025-24329

https://nvd.nist.gov/vuln/detail/CVE-2025-24330

https://nvd.nist.gov/vuln/detail/CVE-2025-24331

https://nvd.nist.gov/vuln/detail/CVE-2025-24332

https://nvd.nist.gov/vuln/detail/CVE-2025-24333

https://nvd.nist.gov/vuln/detail/CVE-2025-24334

https://nvd.nist.gov/vuln/detail/CVE-2025-24335

🟥𝐋𝐂𝐒𝐂-𝐈𝐄 𝐃𝐚𝐢𝐥𝐲 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐅𝐢𝐧𝐝𝐢𝐧𝐠𝐬-𝟑 𝐉𝐮𝐥𝐲 𝟐𝟎𝟐𝟓🟥

𝐍𝐞𝐰𝐬:

1. Microsoft to Lay Off 9,000 Employees, Affecting 4% of Workforce

https://www.reuters.com/business/world-at-work/microsoft-lay-off-many-9000-employees-seattle-times-reports-2025-07-02/

2. Hunters International Ransomware Shuts Down, Offers Free Decryptors to Victims

https://cyberinsider.com/hunters-international-ransomware-shuts-down-offers-free-decryptors-to-victims/

3. UK charity bank branded a 'disaster' after platform migration goes wrong

https://www.theregister.com/2025/07/03/uk_charity_bank_migration_disaster/

4. Police warn of SMS scams following prison sentence for criminal who conducted smishing campaign

https://www.ukfinance.org.uk/news-and-insight/press-release/police-warn-sms-scams-following-prison-sentence-criminal-who

5. Large Language Models (LLMs) Are Falling for Phishing Scams: What Happens When AI Gives You the Wrong URL?

https://www.netcraft.com/blog/large-language-models-are-falling-for-phishing-scams

6. Russia’s Cyber Warriors Assail NATO-Linked Private Companies

https://cepa.org/article/russias-cyber-warriors-assail-nato-linked-private-companies/

7. US probes negotiator suspected of taking crypto ransomware money

https://cointelegraph.com/news/digitalmint-employee-under-investigation-by-us-justice-department

8. Cyberattacks Disrupt Iran’s Bread Distribution, Payments Remain Frozen

https://iranwire.com/en/news/142915-cyberattacks-disrupt-irans-bread-distribution-payments-remain-frozen/

9. Spain arrests hackers who targeted politicians and journalists

https://policia.es/_es/comunicacion_prensa_detalle.php?ID=16602

10. A third of organisations take more than 90 days to remediate threats

https://www.itsecurityguru.org/2025/07/02/a-third-of-organisations-take-more-than-90-days-to-remediate-threats/?utm_source=rss&utm_medium=rss&utm_campaign=a-third-of-organisations-take-more-than-90-days-to-remediate-threats

---

𝐆𝐥𝐨𝐛𝐚𝐥 𝐁𝐫𝐞𝐚𝐜𝐡 𝐍𝐞𝐰𝐬 𝐚𝐧𝐝 𝐃𝐚𝐭𝐚 𝐋𝐞𝐚𝐤𝐬:

1. Irish Eyecare software firm Ocuco investigating cyber-attack

https://thecurrency.news/articles/194653/eyecare-software-firm-ocuco-investigating-cyber-attack/

---

𝐓𝐚𝐜𝐭𝐢𝐜𝐚𝐥 𝐑𝐞𝐩𝐨𝐫𝐭𝐬 𝐰𝐢𝐭𝐡 𝐈𝐎𝐂𝐬:

1. Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack

https://unit42.paloaltonetworks.com/apache-cve-2025-24813-cve-2025-27636-cve-2025-29891/

2. Snake Keyloggers Exploit Java Tools to Bypass Security – Active IOCs

https://rewterz.com/threat-advisory/snake-keyloggers-exploit-java-tools-to-bypass-security-active-iocs

3. Who are DragonForce Ransomware Group?

https://www.bridewell.com/insights/blogs/detail/who-are-dragonforce-ransomware-group

4. Silent Push Uncovers Chinese Fake Marketplace e-Commerce Phishing Campaign Using Thousands of Websites to Spoof Popular Retail Brands

https://www.silentpush.com/blog/fake-marketplace/#Google-Pay-Widget-Integrated-Into-Sites-to-Take-Real-Payments

5. Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open

https://www.wiz.io/blog/exposed-jdwp-exploited-in-the-wild

6. Malvertising Campaign Delivers Oyster/Broomstick Backdoor via SEO Poisoning and Trojanized Tools

https://arcticwolf.com/resources/blog/malvertising-campaign-delivers-oyster-broomstick-backdoor-via-seo-poisoning-trojanized-tools/

7. North Korean APT Kimsuky aka Black Banshee – Active IOCs

https://rewterz.com/threat-advisory/north-korean-apt-kimsuky-aka-black-banshee-active-iocs-52

8. DarkTortilla Malware – Active IOCs

https://rewterz.com/threat-advisory/darktortilla-malware-active-iocs-2

---

𝐀𝐏𝐓 𝐈𝐎𝐂𝐬:

1. Lazarus: Source VT
yourdomainhost[.]store
api[.]yourdomainhost[.]store

2. Kimsuky: Source Validin
Accounts-mysticete[.]servepics[.]com
freedrive[.]servehttp[.]com
login-accounts[.]servehttp[.]com
myaccounts-profile[.]servehttp[.]com
mydocs[.]onthewifi[.]com
securedrive-mofa[.]servehttp[.]com
translate[.]onthewifi[.]com
undocs[.]ddns[.]net
undocs[.]myvnc[.]com
undocs[.]servehttp[.]com

---

𝐓𝐡𝐫𝐞𝐚𝐭 𝐇𝐮𝐧𝐭𝐢𝐧𝐠 / 𝐃𝐅𝐈𝐑 / 𝐌𝐚𝐥𝐰𝐚𝐫𝐞:

1. Automating macOS Incident Response: DFIR-as-Code in Action Against AppleProcessHub

https://www.abstract.security/blog/automating-macos-incident-response-dfir-as-code-in-action-against-appleprocesshub

2. Using Staging Folders For Threat Hunting

https://www.knowyouradversary.ru/2025/07/183-using-staging-folders-for-threat.html

3. PDFs: Portable documents, or perfect deliveries for phish?

https://blog.talosintelligence.com/pdfs-portable-documents-or-perfect-deliveries-for-phish/

4. EscapeRoute: Breaking the Scope of Anthropic’s Filesystem MCP Server
(CVE-2025-53109 & CVE-2025-53110)

https://cymulate.com/blog/cve-2025-53109-53110-escaperoute-anthropic/?utm_source=linkedin&utm_medium=social&utm_campaign=2025-q3-cve-2025-53109-53110-escaperoute-anthropic-blog&utm_term=blog

5. Yet another ZIP trick

https://hackarcana.com/article/yet-another-zip-trick

6. Malware development trick 48: leveraging Office macros for malware. Simple VBA example.

https://cocomelonc.github.io/malware/2025/07/01/malware-tricks-48.html

7. Hijacked by a Text: Understanding and Preventing SIM Swapping Attack

https://www.bitsight.com/blog/what-is-sim-swapping

8. CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries

https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/

9. DanaBot Lab Analysis

https://omer-secure.medium.com/danabot-lab-analysis-7dbaa179f3e4

10. ClickFix Campaign: How Clipboard Injection Leads to RAT Infection (Part 1)

https://h3xstone.medium.com/clickfix-campaign-how-clipboard-injection-leads-to-rat-infection-part-1-069e77d3cad1

11. Release Notes: Detonation Actions, Enhanced QR Extraction, and 1,400+ New Detection Rules

https://any.run/cybersecurity-blog/release-notes-june-2025/

12. Inside Android Malware Development: Building a C2 Exfiltrator from the UI to the Network

https://medium.com/@lord_murak/inside-android-malware-development-building-a-c2-exfiltrator-from-the-ui-to-the-network-7ec2d9a3d58e

---

𝐋𝐢𝐠𝐡𝐭 𝐑𝐞𝐚𝐝𝐢𝐧𝐠:

1. Pro-Russian hacktivism: Shifting alliances, new groups and risks

https://intel471.com/blog/pro-russian-hacktivism-shifting-alliances-new-groups-and-risks

2. Insider Risk Lessons from the DPRK IT Worker Crackdown

https://www.dtexsystems.com/blog/insider-risk-lessons-from-dprk-crackdown/

3. Calling Out Russia: France’s Shift on Public Attribution

https://warontherocks.com/2025/07/calling-out-russia-frances-shift-on-public-attribution/

4. Outsourced Trust: How Coinbase's $400M Problem Started in an Indian Call Center

https://www.reco.ai/blog/coinbase-breach

---

EscapeRoute: How we found 2 vulnerabilities in Anthropic’s Filesystem MCP Server (CVE-2025-53109 & CVE-2025-53110) https://cymulate.com/blog/cve-2025-53109-53110-escaperoute-anthropic/?utm_source=linkedin&amp;utm_medium=social&amp;utm_campaign=2025-q3-cve-2025-53109-53110-escaperoute-anthropic-blog&amp;utm_term=blog

PrivEsc in Graylog.

https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-3m86-c9x3-vwm9

sev:HIGH 8.8 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation. This issue has been patched in versions 6.2.4 and 6.3.0-rc.2. A workaround involves disabling the respective configuration found in System > Configuration > Users > "Allow users to create personal access tokens".

https://nvd.nist.gov/vuln/detail/CVE-2025-53106

🟥𝐋𝐂𝐒𝐂-𝐈𝐄 𝐃𝐚𝐢𝐥𝐲 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐅𝐢𝐧𝐝𝐢𝐧𝐠𝐬-𝟒 𝐉𝐮𝐥𝐲 𝟐𝟎𝟐𝟓🟥

𝐍𝐞𝐰𝐬:

1. Ekco Ireland grows headcount to more than 1,000 with Adapt IT acquisition

https://www.siliconrepublic.com/business/ekco-adapt-it-acquisition-growth-expansion-cybersecurity

2. Estonia’s cyber ambassador on digitalization, punching upwards and outing GRU spies

https://therecord.media/estonia-cyber-ambassador-interview

3. Why cybersecurity should be seen as a business enabler, not a blocker

https://www.siliconrepublic.com/enterprise/bitdefender-leadership-cybersecurity-tech-ai

4. South Korea penalises 'negligent' SK Telecom over major data leak

https://www.reuters.com/sustainability/boards-policy-regulation/south-korea-orders-sk-telecom-strengthen-data-security-after-leak-2025-07-04/

5. Russia jails man for 16 years over pro-Ukraine cyberattacks on critical infrastructure

https://therecord.media/russia-jails-man-over-pro-ukraine-cyberattacks

6. CVE-2025-20309: Cisco Unified Communications Manager Static SSH Credentials Maximum Severity Vulnerability

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7

7. Criminals Sending QR Codes in Phishing, Malware Campaigns

https://www.darkreading.com/endpoint-security/criminals-send-qr-codes-phishing

8. Interpol identifies West Africa as potential new hotspot for cybercrime compounds

https://therecord.media/interpol-west-africa-cybercrime-compounds

---

𝐆𝐥𝐨𝐛𝐚𝐥 𝐁𝐫𝐞𝐚𝐜𝐡 𝐍𝐞𝐰𝐬 𝐚𝐧𝐝 𝐃𝐚𝐭𝐚 𝐋𝐞𝐚𝐤𝐬:

1. Allianz Seguros Spain Allegedly Breached – Database of 4.6 Million Offered for Sale

https://dailydarkweb.net/allianz-seguros-spain-allegedly-breached-database-of-4-6-million-offered-for-sale/

---

𝐓𝐚𝐜𝐭𝐢𝐜𝐚𝐥 𝐑𝐞𝐩𝐨𝐫𝐭𝐬 𝐰𝐢𝐭𝐡 𝐈𝐎𝐂𝐬:

1. Taking SHELLTER: a commercial evasion framework abused in- the- wild

https://www.elastic.co/security-labs/taking-shellter

2. Threat Actors Recompile SonicWall's NetExtender to Include SilentRoute Backdoor

https://www.esentire.com/blog/threat-actors-recompile-sonicwalls-netextender-to-include-silentroute-backdoor

3. RondoDox Unveiled: Breaking Down a New Botnet Threat

https://www.fortinet.com/blog/threat-research/rondobox-unveiled-breaking-down-a-botnet-threat

4. Hpingbot: A New Botnet Family Based on Pastebin Payload Delivery Chain and Hping3 DDoS Module

https://nsfocusglobal.com/hpingbot-a-new-botnet-family-based-on-pastebin-payload-delivery-chain-and-hping3-ddos-module/

5. 8 More Malicious Firefox Extensions: Exploiting Popular Game Recognition, Hijacking User Sessions, and Stealing OAuth Credentials

https://socket.dev/blog/8-more-malicious-firefox-extensions

6. Satori Threat Intelligence Alert: IconAds Conceals Source of Ad Fraud from Users

https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-iconads/

7. When Installers Turn Evil: The Pascal Script Behind Inno Setup Malware Campaign

https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html

---

𝐓𝐡𝐫𝐞𝐚𝐭 𝐇𝐮𝐧𝐭𝐢𝐧𝐠 / 𝐃𝐅𝐈𝐑 / 𝐌𝐚𝐥𝐰𝐚𝐫𝐞:

1. The Future of Threat Hunting and Investigation : ELK MCP Server

https://f0xypr0xy.medium.com/the-future-of-threat-hunting-and-investigation-elk-mcp-server-caef1c184024

2. Data breach reveals Catwatchful ‘stalkerware’ is spying on thousands of phones

https://techcrunch.com/2025/07/02/data-breach-reveals-catwatchful-stalkerware-spying-on-thousands-android-phones/

3. Researchers Defeat Content Security Policy Protections via HTML Injection

https://jorianwoltjer.com/blog/p/research/nonce-csp-bypass-using-disk-cache

4. Cl0p Ransomware’s Exfiltration Process Exposes RCE Vulnerability

https://infosec.exchange/@adulau/114777339291449811

5. Identifying and abusing Azure Arc for hybrid escalation and persistence

https://www.ibm.com/think/x-force/identifying-abusing-azure-arc-for-hybrid-escalation-persistence

6. Detecting Attacks in Real-Time with Falco and Grafana: A Beginner’s Guide

https://medium.com/@lavanyabhargava05/detecting-attacks-in-real-time-with-falco-and-grafana-a-beginners-guide-070a2e428f20

7. How I Bypassed a WAF | Why Documentation matters | RGHX

https://rghx.medium.com/how-i-bypassed-a-waf-why-documentation-matters-rghx-62dc301e39f1

8. One attack, one alert: From thousands of signals to one clear story

https://www.group-ib.com/blog/one-attack-one-alert/

9. Azure Honeypot with Live Traffic

https://medium.com/@rajesh.p3807/azure-honeypot-with-live-traffic-6de04990e651

10. dnSpy—Static Analysis of a .NET Malware

https://medium.com/@tarunrd77/dnspy-static-analysis-of-a-net-malware-012806424acf

11. Part 3: In-Memory Execution Methods — How Malware Lives Rent-Free in Your System

https://medium.com/@cybertooths/part-3-in-memory-execution-methods-how-malware-lives-rent-free-in-your-system-42adcfbfd50a

12. Using Process Parent and Children Relationships for Detection and Hunting

https://www.knowyouradversary.ru/2025/07/185-using-process-parent-and-children.html

13. Taking over 60k spyware user accounts with SQL injection

https://ericdaigle.ca/posts/taking-over-60k-spyware-user-accounts/

14. Logwatcher’s Zenit #05: Beginner Mistakes in KQL

https://threathunter-chronicles.medium.com/logwatchers-zenit-05-beginner-mistakes-in-kql-05d9cc92609f

15. Custom AnyDesk Abuse: A Stealthy Way Adversaries Take Over Your System

https://medium.com/@dgtrivedi4646/custom-anydesk-abuse-a-stealthy-way-adversaries-take-over-your-system-14a2b675d398

---

𝐋𝐢𝐠𝐡𝐭 𝐑𝐞𝐚𝐝𝐢𝐧𝐠:

1. The Evolving Threat Landscape: A Comprehensive Report on Scattered Spider

https://falconfeeds.io/blogs/scattered-spider-evolving-cyber-threat-report

2. Exclusive disclosure of the attack activities of the APT group NightEagle

https://github.com/RedDrip7/NightEagle_Disclose/blob/main/Exclusive%20disclosure%20of%20the%20attack%20activities%20of%20the%20APT%20group%20NightEagle.pdf

3. Iran's Intelligence Group 13

https://dti.domaintools.com/irans-intelligence-group-13/

4. Beneath the Waves and Beyond: How Cybersecurity and Undersea Defense Stocks Are Rising to Meet Russia's Hybrid Threats

https://www.ainvest.com/news/beneath-waves-cybersecurity-undersea-defense-stocks-rising-meet-russia-hybrid-threats-2507/

5. PLA’s Multi-Domain Reorganization: Cyberspace, Aerospace, and Information Support Forces Reshape the Threat Landscape

https://blog.alphahunt.io/plas-multi-domain-reorganization-cyberspace-aerospace-and-information-support-forces-reshape-the-threat-landscape/

6. First Quarter 2025 Ransomware Trends

https://www.optiv.com/insights/discover/blog/first-quarter-2025-ransomware-trends

---

Another static, unchangable root password in Cisco gear. In 2025.

https://www.cve.org/cverecord?id=CVE-2025-20309

#SecureByDesign

Cisco fixes maximum-severity flaw in enterprise unified comms platform (CVE-2025-20309) https://www.helpnetsecurity.com/2025/07/03/cisco-fixes-maximum-severity-flaw-in-enterprise-unified-comms-platform-cve-2025-20309/ #communication #vulnerability #enterprise #Don'tmiss #Hotstuff #Cisco #News #SMBs

Cisco patches critical hardcoded credentials vulnerability in Unified Communications Manager

Cisco reports a maximum-severity vulnerability (CVE-2025-20309) in its Unified Communications Manager platforms caused by hardcoded static SSH credentials for the root account. The flaw allows unauthenticated remote attackers to gain complete administrative control over enterprise IP telephony networks.

**Obvious first step - isolate the SSH port of your CUCM and make it accessible from trusted networks only. Then VERY QUICLY update to versions 15.0.1.13010-1 through 15.0.1.13017-1, or apply the patches. Just isolating the CUCM isn't enough - the hardcoded password can be abused by malicious insiders, or other devices with access to trusted networks can be breached and the attackers can then breach CUCM.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/cisco-patches-critical-hardcoded-credentials-vulnerability-in-unified-communications-manager-i-k-5-m-e/gD2P6Ple2L

Cisco Issues Urgent Patch for Critical Unified CM Vulnerability (CVE-2025-20309) https://thecyberexpress.com/cisco-patches-cve-2025-20309-vulnerability/ #TheCyberExpressNews #Ciscovulnerability #Vulnerabilities #TheCyberExpress #FirewallDaily #CVE202520309 #UnifiedCMSME #CyberNews #UnifiedCM

A note on the security advisory for CVE-2025-20309 in Cisco Unified Communications Manager which covers hard coded credentials - as I understand it this only impacts a special version of the product that users would have to contact TAC to get. If that is a correct understanding then I would expect this to limit the likelihood that organizations are running the impacted versions.

Quoting from the advisory:

This vulnerability affects Cisco Unified CM and Unified CM SME Engineering Special (ES) releases 15.0.1.13010-1 through 15.0.1.13017-1, regardless of device configuration.

Note: ES releases are limited fix releases that are distributed only by the Cisco Technical Assistance Center (TAC).

Reference: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7

#Security #CVE_2025_20309 #CVE202520309

@_newick NIST hasn't published it then. It's also available here: https://www.cve.org/CVERecord?id=CVE-2025-20309

New.

CVE-2025-20309 (critical): Cisco Unified Communications Manager Static SSH Credentials Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7

- Cisco Spaces Connector Privilege Escalation Vulnerability - CVE-2025-20308 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spaces-conn-privesc-kgD2CcDU

- Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability - CVE-2025-20310 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CbtKtEYc

- Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability - CVE-2025-20307 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-xss-O696ymRA @TalosSecurity #cybersecurity #infosec #Cisco

Are you fucking kidding me Cisco? Again?

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7

sev:CRIT 10.0 🥳

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted.

https://nvd.nist.gov/vuln/detail/CVE-2025-20309

New.

CVE-2025-20309 (critical): Cisco Unified Communications Manager Static SSH Credentials Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7

- Cisco Spaces Connector Privilege Escalation Vulnerability - CVE-2025-20308 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spaces-conn-privesc-kgD2CcDU

- Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability - CVE-2025-20310 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CbtKtEYc

- Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability - CVE-2025-20307 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-xss-O696ymRA @TalosSecurity #cybersecurity #infosec #Cisco

New.

CVE-2025-20309 (critical): Cisco Unified Communications Manager Static SSH Credentials Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7

- Cisco Spaces Connector Privilege Escalation Vulnerability - CVE-2025-20308 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spaces-conn-privesc-kgD2CcDU

- Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability - CVE-2025-20310 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CbtKtEYc

- Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability - CVE-2025-20307 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-xss-O696ymRA @TalosSecurity #cybersecurity #infosec #Cisco

CISA warns of active attacks on Signal clone TeleMessage

CISA has issued a warning about two actively exploited vulnerabilities in TeleMessage TM SGNL, a Signal clone used by national security staffers and government officials, including a Spring Boot Actuator misconfiguration (CVE-2025-48927) that exposes memory dumps and a local access vulnerability (CVE-2025-48928) enabling password extraction.

**If you're using TeleMessage TM SGNL, start patching it today, because it's being actively exploited. Alternatively, stop using the software entirely. Switch back to standard Signal or another approved properly encrypted messaging app since TM SGNL has already been breached and continues to be attacked.**
#cybersecurity #infosec #attack #activeattack
https://beyondmachines.net/event_details/cisa-warns-of-active-attacks-on-signal-clone-telemessage-6-j-0-0-k/gD2P6Ple2L

CISA has added to the KEV catalogue:

- CVE-2025-48927: TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-48927

- CVE-2025-48928: TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-48928

From yesterday:

- CVE-2025-6543: Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-6543 #CISA #cybersecurity #infosec

CVE ID: CVE-2025-48928
Vendor: TeleMessage
Product: TM SGNL
Date Added: 2025-07-01
Notes: It is recommended that mitigations be applied per vendor instructions if available. If these instructions cannot be located or if mitigations are unavailable, discontinue use of the product. ; https://nvd.nist.gov/vuln/detail/CVE-2025-48928
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-48928

A bunch of Infinera and Nokia vulns got published today. Could be worth checking out based on where these specific systems tend to sit.

Infinera G42:

https://nvd.nist.gov/vuln/detail/CVE-2025-27021

https://nvd.nist.gov/vuln/detail/CVE-2025-27022

https://nvd.nist.gov/vuln/detail/CVE-2025-27023

https://nvd.nist.gov/vuln/detail/CVE-2025-27024

https://nvd.nist.gov/vuln/detail/CVE-2025-27025

Nokia Single RAN:

https://nvd.nist.gov/vuln/detail/CVE-2025-24328

https://nvd.nist.gov/vuln/detail/CVE-2025-24329

https://nvd.nist.gov/vuln/detail/CVE-2025-24330

https://nvd.nist.gov/vuln/detail/CVE-2025-24331

https://nvd.nist.gov/vuln/detail/CVE-2025-24332

https://nvd.nist.gov/vuln/detail/CVE-2025-24333

https://nvd.nist.gov/vuln/detail/CVE-2025-24334

https://nvd.nist.gov/vuln/detail/CVE-2025-24335

A bunch of Infinera and Nokia vulns got published today. Could be worth checking out based on where these specific systems tend to sit.

Infinera G42:

https://nvd.nist.gov/vuln/detail/CVE-2025-27021

https://nvd.nist.gov/vuln/detail/CVE-2025-27022

https://nvd.nist.gov/vuln/detail/CVE-2025-27023

https://nvd.nist.gov/vuln/detail/CVE-2025-27024

https://nvd.nist.gov/vuln/detail/CVE-2025-27025

Nokia Single RAN:

https://nvd.nist.gov/vuln/detail/CVE-2025-24328

https://nvd.nist.gov/vuln/detail/CVE-2025-24329

https://nvd.nist.gov/vuln/detail/CVE-2025-24330

https://nvd.nist.gov/vuln/detail/CVE-2025-24331

https://nvd.nist.gov/vuln/detail/CVE-2025-24332

https://nvd.nist.gov/vuln/detail/CVE-2025-24333

https://nvd.nist.gov/vuln/detail/CVE-2025-24334

https://nvd.nist.gov/vuln/detail/CVE-2025-24335

A bunch of Infinera and Nokia vulns got published today. Could be worth checking out based on where these specific systems tend to sit.

Infinera G42:

https://nvd.nist.gov/vuln/detail/CVE-2025-27021

https://nvd.nist.gov/vuln/detail/CVE-2025-27022

https://nvd.nist.gov/vuln/detail/CVE-2025-27023

https://nvd.nist.gov/vuln/detail/CVE-2025-27024

https://nvd.nist.gov/vuln/detail/CVE-2025-27025

Nokia Single RAN:

https://nvd.nist.gov/vuln/detail/CVE-2025-24328

https://nvd.nist.gov/vuln/detail/CVE-2025-24329

https://nvd.nist.gov/vuln/detail/CVE-2025-24330

https://nvd.nist.gov/vuln/detail/CVE-2025-24331

https://nvd.nist.gov/vuln/detail/CVE-2025-24332

https://nvd.nist.gov/vuln/detail/CVE-2025-24333

https://nvd.nist.gov/vuln/detail/CVE-2025-24334

https://nvd.nist.gov/vuln/detail/CVE-2025-24335

A bunch of Infinera and Nokia vulns got published today. Could be worth checking out based on where these specific systems tend to sit.

Infinera G42:

https://nvd.nist.gov/vuln/detail/CVE-2025-27021

https://nvd.nist.gov/vuln/detail/CVE-2025-27022

https://nvd.nist.gov/vuln/detail/CVE-2025-27023

https://nvd.nist.gov/vuln/detail/CVE-2025-27024

https://nvd.nist.gov/vuln/detail/CVE-2025-27025

Nokia Single RAN:

https://nvd.nist.gov/vuln/detail/CVE-2025-24328

https://nvd.nist.gov/vuln/detail/CVE-2025-24329

https://nvd.nist.gov/vuln/detail/CVE-2025-24330

https://nvd.nist.gov/vuln/detail/CVE-2025-24331

https://nvd.nist.gov/vuln/detail/CVE-2025-24332

https://nvd.nist.gov/vuln/detail/CVE-2025-24333

https://nvd.nist.gov/vuln/detail/CVE-2025-24334

https://nvd.nist.gov/vuln/detail/CVE-2025-24335

A bunch of Infinera and Nokia vulns got published today. Could be worth checking out based on where these specific systems tend to sit.

Infinera G42:

https://nvd.nist.gov/vuln/detail/CVE-2025-27021

https://nvd.nist.gov/vuln/detail/CVE-2025-27022

https://nvd.nist.gov/vuln/detail/CVE-2025-27023

https://nvd.nist.gov/vuln/detail/CVE-2025-27024

https://nvd.nist.gov/vuln/detail/CVE-2025-27025

Nokia Single RAN:

https://nvd.nist.gov/vuln/detail/CVE-2025-24328

https://nvd.nist.gov/vuln/detail/CVE-2025-24329

https://nvd.nist.gov/vuln/detail/CVE-2025-24330

https://nvd.nist.gov/vuln/detail/CVE-2025-24331

https://nvd.nist.gov/vuln/detail/CVE-2025-24332

https://nvd.nist.gov/vuln/detail/CVE-2025-24333

https://nvd.nist.gov/vuln/detail/CVE-2025-24334

https://nvd.nist.gov/vuln/detail/CVE-2025-24335

A bunch of Infinera and Nokia vulns got published today. Could be worth checking out based on where these specific systems tend to sit.

Infinera G42:

https://nvd.nist.gov/vuln/detail/CVE-2025-27021

https://nvd.nist.gov/vuln/detail/CVE-2025-27022

https://nvd.nist.gov/vuln/detail/CVE-2025-27023

https://nvd.nist.gov/vuln/detail/CVE-2025-27024

https://nvd.nist.gov/vuln/detail/CVE-2025-27025

Nokia Single RAN:

https://nvd.nist.gov/vuln/detail/CVE-2025-24328

https://nvd.nist.gov/vuln/detail/CVE-2025-24329

https://nvd.nist.gov/vuln/detail/CVE-2025-24330

https://nvd.nist.gov/vuln/detail/CVE-2025-24331

https://nvd.nist.gov/vuln/detail/CVE-2025-24332

https://nvd.nist.gov/vuln/detail/CVE-2025-24333

https://nvd.nist.gov/vuln/detail/CVE-2025-24334

https://nvd.nist.gov/vuln/detail/CVE-2025-24335

Remote code execution flaw reported in HIKVISION Security Management Platforms

HIKVISION reports a maximum-severity vulnerability (CVE-2025-34067) in its applyCT security management platform that allows unauthenticated remote code execution through a vulnerable Fastjson library, enabling attackers arbitrary code execution.

**If you have HIKVISION HikCentral security management systems, make sure it's isolated it from the internet and accessible only from trusted networks. Also block outbound LDAP connections, and then plan a quick patch cycle. Because isolation will never be enough with maximum severity flaw.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/remote-code-execution-flaw-reported-in-hikvision-security-management-platforms-6-d-6-l-l/gD2P6Ple2L

Remote code execution flaw reported in HIKVISION Security Management Platforms

HIKVISION reports a maximum-severity vulnerability (CVE-2025-34067) in its applyCT security management platform that allows unauthenticated remote code execution through a vulnerable Fastjson library, enabling attackers arbitrary code execution.

**If you have HIKVISION HikCentral security management systems, make sure it's isolated it from the internet and accessible only from trusted networks. Also block outbound LDAP connections, and then plan a quick patch cycle. Because isolation will never be enough with maximum severity flaw.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/remote-code-execution-flaw-reported-in-hikvision-security-management-platforms-6-d-6-l-l/gD2P6Ple2L

IDK how old this disclosure is because once again, there's no date on the post. But the CVEs were just published today. Happy hacking.

https://ssd-disclosure.com/ssd-advisory-kerio-control-authentication-bypass-and-rce/

An analysis primarily of Kerio Control revealed a design flaw in the implementation of the communication with GFI AppManager, leading to an authentication bypass vulnerability in the product under audit. Once the authentication bypass is achieved, the attacker can cause the execution of arbitrary code and commands.

sev:CRIT 9.5 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - https://nvd.nist.gov/vuln/detail/CVE-2025-34069

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - https://nvd.nist.gov/vuln/detail/CVE-2025-34070

sev:CRIT 9.4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - https://nvd.nist.gov/vuln/detail/CVE-2025-34071

IDK how old this disclosure is because once again, there's no date on the post. But the CVEs were just published today. Happy hacking.

https://ssd-disclosure.com/ssd-advisory-kerio-control-authentication-bypass-and-rce/

An analysis primarily of Kerio Control revealed a design flaw in the implementation of the communication with GFI AppManager, leading to an authentication bypass vulnerability in the product under audit. Once the authentication bypass is achieved, the attacker can cause the execution of arbitrary code and commands.

sev:CRIT 9.5 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - https://nvd.nist.gov/vuln/detail/CVE-2025-34069

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - https://nvd.nist.gov/vuln/detail/CVE-2025-34070

sev:CRIT 9.4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - https://nvd.nist.gov/vuln/detail/CVE-2025-34071

IDK how old this disclosure is because once again, there's no date on the post. But the CVEs were just published today. Happy hacking.

https://ssd-disclosure.com/ssd-advisory-kerio-control-authentication-bypass-and-rce/

An analysis primarily of Kerio Control revealed a design flaw in the implementation of the communication with GFI AppManager, leading to an authentication bypass vulnerability in the product under audit. Once the authentication bypass is achieved, the attacker can cause the execution of arbitrary code and commands.

sev:CRIT 9.5 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - https://nvd.nist.gov/vuln/detail/CVE-2025-34069

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - https://nvd.nist.gov/vuln/detail/CVE-2025-34070

sev:CRIT 9.4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - https://nvd.nist.gov/vuln/detail/CVE-2025-34071

BoF in Python Pillow.

https://github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952

sev:HIGH 7.1 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.

https://nvd.nist.gov/vuln/detail/CVE-2025-48379

A bunch of Infinera and Nokia vulns got published today. Could be worth checking out based on where these specific systems tend to sit.

Infinera G42:

https://nvd.nist.gov/vuln/detail/CVE-2025-27021

https://nvd.nist.gov/vuln/detail/CVE-2025-27022

https://nvd.nist.gov/vuln/detail/CVE-2025-27023

https://nvd.nist.gov/vuln/detail/CVE-2025-27024

https://nvd.nist.gov/vuln/detail/CVE-2025-27025

Nokia Single RAN:

https://nvd.nist.gov/vuln/detail/CVE-2025-24328

https://nvd.nist.gov/vuln/detail/CVE-2025-24329

https://nvd.nist.gov/vuln/detail/CVE-2025-24330

https://nvd.nist.gov/vuln/detail/CVE-2025-24331

https://nvd.nist.gov/vuln/detail/CVE-2025-24332

https://nvd.nist.gov/vuln/detail/CVE-2025-24333

https://nvd.nist.gov/vuln/detail/CVE-2025-24334

https://nvd.nist.gov/vuln/detail/CVE-2025-24335

Vulnerability in Synology Active Backup for Microsoft 365 exposes credentials, enables unauthorized access to Teams chats

Security researchers discovered a vulnerability (CVE-2025-4679) in Synology's Active Backup for Microsoft 365 that exposed a master credential in HTTP redirects, allowing attackers to gain unauthorized access to sensitive Microsoft 365 data across all organizations using the popular backup solution with over 1.2 million installations.

**If you use Synology's Active Backup for Microsoft 365, be aware that a critical flaw exposed your Microsoft 365 data to potential unauthorized access until recently. Even though Synology says they've fixed it, check your Microsoft 365 audit logs for any suspicious access and ensure your Synology system is fully updated. If developing applications, check if any of your responses contains secrets that shouldn't be there.**
#cybersecurity #infosec #advisory #databreach
https://beyondmachines.net/event_details/vulnerability-in-synology-active-backup-for-microsoft-365-exposes-credentials-enables-unauthorized-access-to-teams-chats-k-0-f-g-g/gD2P6Ple2L

A bunch of Infinera and Nokia vulns got published today. Could be worth checking out based on where these specific systems tend to sit.

Infinera G42:

https://nvd.nist.gov/vuln/detail/CVE-2025-27021

https://nvd.nist.gov/vuln/detail/CVE-2025-27022

https://nvd.nist.gov/vuln/detail/CVE-2025-27023

https://nvd.nist.gov/vuln/detail/CVE-2025-27024

https://nvd.nist.gov/vuln/detail/CVE-2025-27025

Nokia Single RAN:

https://nvd.nist.gov/vuln/detail/CVE-2025-24328

https://nvd.nist.gov/vuln/detail/CVE-2025-24329

https://nvd.nist.gov/vuln/detail/CVE-2025-24330

https://nvd.nist.gov/vuln/detail/CVE-2025-24331

https://nvd.nist.gov/vuln/detail/CVE-2025-24332

https://nvd.nist.gov/vuln/detail/CVE-2025-24333

https://nvd.nist.gov/vuln/detail/CVE-2025-24334

https://nvd.nist.gov/vuln/detail/CVE-2025-24335

A bunch of Infinera and Nokia vulns got published today. Could be worth checking out based on where these specific systems tend to sit.

Infinera G42:

https://nvd.nist.gov/vuln/detail/CVE-2025-27021

https://nvd.nist.gov/vuln/detail/CVE-2025-27022

https://nvd.nist.gov/vuln/detail/CVE-2025-27023

https://nvd.nist.gov/vuln/detail/CVE-2025-27024

https://nvd.nist.gov/vuln/detail/CVE-2025-27025

Nokia Single RAN:

https://nvd.nist.gov/vuln/detail/CVE-2025-24328

https://nvd.nist.gov/vuln/detail/CVE-2025-24329

https://nvd.nist.gov/vuln/detail/CVE-2025-24330

https://nvd.nist.gov/vuln/detail/CVE-2025-24331

https://nvd.nist.gov/vuln/detail/CVE-2025-24332

https://nvd.nist.gov/vuln/detail/CVE-2025-24333

https://nvd.nist.gov/vuln/detail/CVE-2025-24334

https://nvd.nist.gov/vuln/detail/CVE-2025-24335

EUVD: Critical CVE-2024-13786: the education theme for WordPress is vulnerable to PHP Object Injection in all versions https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-54721

- CVE-2025-4689: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to RCE Local File Inclusion https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19688 @euvdfeed #cybersecurity #infosec #WordPress

Grave vulnerabilità di un plugin WordPress: oltre 600.000 siti a rischio.

Una grave vulnerabilità sta mettendo in allarme la comunità di WordPress, con oltre 600.000 siti web a rischio a causa di una falla nel plugin Forminator. L’exploit, identificato con il codice CVE-2025-6463, è stato classificato con un indice di gravità di 8.8 su 10 secondo il sistema CVSS, evidenziando il suo elevato grado di pericolosità.

#wordpress #vulnerabilita #wordpressplugin

https://www.ilsoftware.it/grave-vulnerabilita-di-un-plugin-wordpress-oltre-600-000-siti-a-rischio/

WordPress – CVE-2025-6463 : cette faille dans le plugin Forminator menace plus de 400 000 sites Web ! https://www.it-connect.fr/wordpress-cve-2025-6463-cette-faille-dans-le-plugin-forminator-menace-plus-de-400-000-sites-web/ #ActuCybersécurité #Cybersécurité #Wordpress #Web

WordPress Plugin flaw exposes over 600,000 websites to potential remote takeover

A critical vulnerability (CVE-2025-6463) in the Forminator WordPress plugin affecting over 600,000 installations allows unauthenticated attackers to delete arbitrary files, including critical WordPress files like wp-config.php. The flaw enable site takeover by forcing installations into setup mode after deleting wp-config.php and then connecting to a database they control.

**If you're using the Forminator WordPress plugin, immediately update to version 1.44.3 or later. Your WordPress site is exposed to the internet by design, so attackers will find it very quickly. Don't delay, updating a plugin in WordPress is quite easy. Then check your form submission logs for any suspicious entries that might indicate your site was already targeted.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/wordpress-plugin-flaw-exposes-over-600000-websites-to-potential-remote-takeover-l-f-1-0-v/gD2P6Ple2L

Go hack more remote support shit.

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04878en_us&docLocale=en_US

Multiple security vulnerabilities have been identified in HPE Insight Remote Support. These vulnerabilities could remotely allow a directory traversal, disclosure of information, or code execution.

CVE-2025-37097 ( sev:MED 7.5 - :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H )

CVE-2025-37098 ( sev:MED 6.5 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVE-2025-37099 ( sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )

CISA has added to the KEV catalogue:

- CVE-2025-48927: TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-48927

- CVE-2025-48928: TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-48928

From yesterday:

- CVE-2025-6543: Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-6543 #CISA #cybersecurity #infosec

Citrix blog on CVE-2025-5777 and some other ones https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/

CVE ID: CVE-2025-6543
Vendor: Citrix
Product: NetScaler ADC and Gateway
Date Added: 2025-06-30
Notes: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788 ; https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-6543
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-6543

CVE-2025-6543 (citrix 🩸) hit KEV. that means confirmed exploitation with receipts. will wash dishes for payloads. bob [@] greynoise [.] io (some mastodon clients really bork email addresses) if you have'm.

PoC for last month's ../ in Outlook.

https://attackerkb.com/topics/yoOo1Y9702/cve-2025-47176

https://www.nu11secur1ty.com/2025/07/cve-2025-47176-microsoft-outlook-remote.html

PoC for last month's ../ in Outlook.

https://attackerkb.com/topics/yoOo1Y9702/cve-2025-47176

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

https://www.exploit-db.com/exploits/31683

https://nvd.nist.gov/vuln/detail/CVE-2025-34037

https://github.com/CH13hh/tmp_store_cc/blob/main/E8450/1.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6751

https://github.com/feiwuxingxie/cve/blob/main/linksys/vul01/1.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6752

D-Link:

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_74/74.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6374

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_73/73.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6373

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_72/72.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6372

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_71/71.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6371

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_70/70.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6370

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_69/69.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6369

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_68/68.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6368

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_67/67.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6367

https://github.com/2664521593/mycve/blob/main/D-Link_DI/CJ_IN_DLink_3_en.pdf

https://nvd.nist.gov/vuln/detail/CVE-2025-6898

https://github.com/2664521593/mycve/blob/main/D-Link_DI/CJ_IN_DLink_2_en.pdf

https://nvd.nist.gov/vuln/detail/CVE-2025-6897

https://github.com/2664521593/mycve/blob/main/D-Link_DI/CJ_IN_DLink_1_en.pdf

https://nvd.nist.gov/vuln/detail/CVE-2025-6896

https://vuldb.com/?submit.603693

https://nvd.nist.gov/vuln/detail/CVE-2025-6882

https://github.com/Synmac05/CVE-advisories/blob/main/CVE-2025-45931.md

https://nvd.nist.gov/vuln/detail/CVE-2025-45931

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_77/77.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6616

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_76/76.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6615

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_75/75.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6614

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_78/78.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6617

https://github.com/threat9/routersploit/blob/master/routersploit/modules/exploits/routers/dlink/dsl_2730_2750_path_traversal.py

https://nvd.nist.gov/vuln/detail/CVE-2025-34048

https://www.kdev.site/2025/04/02/d-link-823_pro-unauthorized-telnet-access/

https://nvd.nist.gov/vuln/detail/CVE-2025-45729

https://github.com/2664521593/mycve/blob/main/D-Link_DI/CJ_IN_DLink_1_en.pdf

https://nvd.nist.gov/vuln/detail/CVE-2025-6896

https://vuldb.com/?submit.603693

https://nvd.nist.gov/vuln/detail/CVE-2025-6882

https://vuldb.com/?submit.603692

https://nvd.nist.gov/vuln/detail/CVE-2025-6881

https://github.com/2664521593/mycve/blob/main/D-Link_DI/CJ_IN_DLink_4_en.pdf

https://nvd.nist.gov/vuln/detail/CVE-2025-6899

https://github.com/2664521593/mycve/blob/main/D-Link_DI/CJ_IN_DLink_3_en.pdf

https://nvd.nist.gov/vuln/detail/CVE-2025-6898

https://github.com/2664521593/mycve/blob/main/D-Link_DI/CJ_IN_DLink_2_en.pdf

https://nvd.nist.gov/vuln/detail/CVE-2025-6897

Netgear:

https://github.com/xiaobor123/vul-finds/tree/main/vul-find-ex6150-netgear

https://nvd.nist.gov/vuln/detail/CVE-2025-6511

https://github.com/xiaobor123/vul-finds/tree/main/vul-find-ex6100-netgear

https://nvd.nist.gov/vuln/detail/CVE-2025-6510

https://github.com/xiaobor123/vul-finds/tree/main/vul-find-wnce3001-netgear

https://nvd.nist.gov/vuln/detail/CVE-2025-6565

TOTOLINK:

https://github.com/wudipjq/my_vuln/blob/main/totolink3/vuln_36/36.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6487

https://github.com/wudipjq/my_vuln/blob/main/totolink3/vuln_35/35.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6486

https://github.com/d2pq/cve/blob/main/616/22.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6402

https://github.com/d2pq/cve/blob/main/616/20.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6400

https://github.com/d2pq/cve/blob/main/616/19.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6399

https://github.com/awindog/cve/blob/main/688/16.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6393

https://github.com/c0nyy/IoT_vuln/blob/main/TOTOLINK%20T6%20Vuln.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6916

https://github.com/d2pq/cve/blob/main/616/23.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6568

https://github.com/d2pq/cve/blob/main/616/24.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6627

https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_47/47.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6621

https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_46/46.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6620

https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_45/45.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6619

https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_44/44.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6618

https://github.com/awindog/cve/blob/main/688/29.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6825

https://github.com/awindog/cve/blob/main/688/28.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6824

Tenda:

https://lavender-bicycle-a5a.notion.site/Tenda-AC5-fromSetSysTime_time-21d53a41781f8002bdb3fe8344d6fd8c

https://nvd.nist.gov/vuln/detail/CVE-2025-6887

https://lavender-bicycle-a5a.notion.site/Tenda-AC5-setSchedWifi_schedEndTime-21d53a41781f80fb8a90f08898e8d404

https://nvd.nist.gov/vuln/detail/CVE-2025-6886

https://lavender-bicycle-a5a.notion.site/Tenda-AC5-fromSetSysTime_time-21d53a41781f8002bdb3fe8344d6fd8c

https://nvd.nist.gov/vuln/detail/CVE-2025-6887

https://lavender-bicycle-a5a.notion.site/Tenda-AC5-setSchedWifi_schedEndTime-21d53a41781f80fb8a90f08898e8d404

https://nvd.nist.gov/vuln/detail/CVE-2025-6886

Edimax:

https://www.exploit-db.com/exploits/48377

https://nvd.nist.gov/vuln/detail/CVE-2025-34029

https://www.exploit-db.com/exploits/48377

https://nvd.nist.gov/vuln/detail/CVE-2025-34024

UTT:

https://github.com/d2pq/cve/blob/main/616/1.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6732

https://github.com/d2pq/cve/blob/main/616/3.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6734

Advantech:

https://jro.sg/CVEs/CVE-2025-48469/

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061

https://nvd.nist.gov/vuln/detail/CVE-2025-6732

OptiLink:

https://www.exploit-db.com/exploits/49955

https://nvd.nist.gov/vuln/detail/CVE-2025-34049

Sapidio:

https://www.twcert.org.tw/tw/cp-132-10197-524ea-1.html

https://nvd.nist.gov/vuln/detail/CVE-2025-6560

https://www.twcert.org.tw/tw/cp-132-10196-898d3-1.html

https://nvd.nist.gov/vuln/detail/CVE-2025-6559

WIFISKY:

https://s4e.io/tools/wifisky-7-layer-flow-control-router-remote-code-execution

https://nvd.nist.gov/vuln/detail/CVE-2025-34044

Vacron NVR:

https://ssd-disclosure.com/ssd-advisory-vacron-nvr-remote-command-execution/

https://nvd.nist.gov/vuln/detail/CVE-2025-34043

Beward IP Camera:

https://cxsecurity.com/issue/WLB-2019020042

https://nvd.nist.gov/vuln/detail/CVE-2025-34042

Selea Targa IP Cameras:

https://cxsecurity.com/issue/WLB-2021010165

https://nvd.nist.gov/vuln/detail/CVE-2025-34022

https://cxsecurity.com/issue/WLB-2021010170

https://nvd.nist.gov/vuln/detail/CVE-2025-34021

cc: @Dio9sys @da_667

🚨 The Cyber Intel Brief is live! 🚨

This week, suspected nation-state threat actors wasted no time exploiting a Chrome zero-day (CVE-2025-6554). Iranian cyber operations are escalating, AI-enhanced malware evasion techniques emerge and Scattered Spider is hitting aviation.

Check out the full breakdown and analysis 👇
https://bit.ly/3Tnumh3

#zeroday #Iran #cyberthreats #cyberthreatintelligence #cybersecurity

CVE-2025-6554 is the fourth Chrome zero-day patched by Google in 2025 – Source: securityaffairs.com https://ciso2ciso.com/cve-2025-6554-is-the-fourth-chrome-zero-day-patched-by-google-in-2025-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #SecurityNews #hacking #Chrome

Supposed PoC: https://github.com/DarkNavySecurity/PoC/blob/main/CVE-2025-6554/poc.js

CVE ID: CVE-2025-6554
Vendor: Google
Product: Chromium V8
Date Added: 2025-07-02
Notes: https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html?m=1 ; https://nvd.nist.gov/vuln/detail/CVE-2025-6554
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-6554

CISA has added to the KEV catalogue.

- CVE-2025-6554: Google Chromium V8 Type Confusion Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-6554 #CISA #Google #cybersecurity #infosec

Chrome Zero-Day CVE-2025-6554 Under Active Attack — Google Issues Security Update https://thehackernews.com/2025/07/google-patches-critical-zero-day-flaw.html

CVE-2025-6554
该漏洞潜藏于Chrome核心引擎中，只需访问恶意网页，攻击者就能远程控制你的电脑。   
网络安全研究人员证实，该漏洞正在真实攻击中被利用，企业数据和个人隐私面临裸奔风险。
@board

Chrome Zero-Day CVE-2025-6554 Under Active Attack — Google Issues Security Update – Source:thehackernews.com https://ciso2ciso.com/chrome-zero-day-cve-2025-6554-under-active-attack-google-issues-security-update-sourcethehackernews-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #TheHackerNews #Chrome

@beyondmachines1 I know it's pedantic, but the Chrome advisory does not state that it is in fact EITW. It says that there is an exploit in the wild, but not that it's known to have been used successfully.

Google is aware that an exploit for CVE-2025-6554 exists in the wild.

Google patches actively exploited flaw in Chrome

Google has patched an actively exploited zero-day vulnerability (CVE-2025-6554) in Chrome's V8 JavaScript engine that allows remote attackers to perform arbitrary read/write operations through malicious HTML pages. The flaw was reported by Google's Threat Analysis Group, which typically investigates government-backed attacks, suggesting potential state-sponsored exploitation.

**One more urgent patch for Chrome - Google is again patching an actively exploited flaw in Chrome, and exploitation is just a visit to a malicious site. DONT WAIT! Patch all your Chrome and Chromium browsers (Edge, Opera, Brave, Vivaldi...). Updating the browser is easy, all your tabs reopen after the patch.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/google-patches-actively-exploited-flaw-in-chrome-1-1-a-i-r/gD2P6Ple2L

Google Chrome 138 – CVE-2025-6554 : patchez pour vous protéger de cette nouvelle faille zero-day https://www.it-connect.fr/google-chrome-138-zero-day-cve-2025-6554/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #googlechrome

Updated today:

NIST: High severity CVE-2025-6554 https://nvd.nist.gov/vuln/detail/CVE-2025-6554

The Hacker New: Chrome Zero-Day CVE-2025-6554 Under Active Attack — Google Issues Security Update https://thehackernews.com/2025/07/google-patches-critical-zero-day-flaw.html @thehackernews #Google #cybersecurity #Infosec #Chrome #zeroday

"Google is aware that an exploit for CVE-2025-6554 exists in the wild," the browser vendor said in a security advisory issued on Monday. https://www.bleepingcomputer.com/news/security/google-fixes-fourth-actively-exploited-chrome-zero-day-of-2025/

Google patches actively exploited Chrome (CVE‑2025‑6554) https://www.helpnetsecurity.com/2025/07/01/google-patches-actively-exploited-chrome-cve-2025-6554/ #securityupdate #MicrosoftEdge #Don'tmiss #Hotstuff #Vivaldi #Chrome #0-day #Brave #Opera #News

Chrome patched a sev:HIGH CVE with an ITW exploit.

Google is aware that an exploit for CVE-2025-6554 exists in the wild.

https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html

I don't understand the issue here. It's literally in the name of the company. 🥳

https://specterops.io/blog/2025/06/10/onelogin-many-issues-how-i-pivoted-from-a-trial-tenant-to-compromising-customer-signing-keys/

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary users within a OneLogin tenant. The tokens allow authentication to the OneLogin SSO portal and all downstream applications federated via SAML or OIDC. This allows full unauthorized access across the victim’s SaaS environment.

https://nvd.nist.gov/vuln/detail/CVE-2025-34063

sev:CRIT 9.0 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially allowing JWT signing key recovery and user impersonation.

https://nvd.nist.gov/vuln/detail/CVE-2025-34064

Go hack more remote support shit.

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04878en_us&docLocale=en_US

Multiple security vulnerabilities have been identified in HPE Insight Remote Support. These vulnerabilities could remotely allow a directory traversal, disclosure of information, or code execution.

CVE-2025-37097 ( sev:MED 7.5 - :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H )

CVE-2025-37098 ( sev:MED 6.5 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVE-2025-37099 ( sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )

I don't understand the issue here. It's literally in the name of the company. 🥳

https://specterops.io/blog/2025/06/10/onelogin-many-issues-how-i-pivoted-from-a-trial-tenant-to-compromising-customer-signing-keys/

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary users within a OneLogin tenant. The tokens allow authentication to the OneLogin SSO portal and all downstream applications federated via SAML or OIDC. This allows full unauthorized access across the victim’s SaaS environment.

https://nvd.nist.gov/vuln/detail/CVE-2025-34063

sev:CRIT 9.0 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially allowing JWT signing key recovery and user impersonation.

https://nvd.nist.gov/vuln/detail/CVE-2025-34064

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

https://www.asrmicro.com/en/goods/psirt?cid=40

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

https://www.asrmicro.com/en/goods/psirt?cid=40

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

https://www.asrmicro.com/en/goods/psirt?cid=40

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

https://www.asrmicro.com/en/goods/psirt?cid=40

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

https://www.asrmicro.com/en/goods/psirt?cid=40

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

https://www.asrmicro.com/en/goods/psirt?cid=40

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

https://www.asrmicro.com/en/goods/psirt?cid=40

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

July is starting off with a perfect 10 in some OT kit. 🥳

https://certvde.com/en/advisories/VDE-2025-045/

sev:CRIT 10.0 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by default.

https://nvd.nist.gov/vuln/detail/CVE-2025-41656

https://certvde.com/en/advisories/VDE-2025-039/

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.

https://nvd.nist.gov/vuln/detail/CVE-2025-41648

July is starting off with a perfect 10 in some OT kit. 🥳

https://certvde.com/en/advisories/VDE-2025-045/

sev:CRIT 10.0 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by default.

https://nvd.nist.gov/vuln/detail/CVE-2025-41656

https://certvde.com/en/advisories/VDE-2025-039/

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.

https://nvd.nist.gov/vuln/detail/CVE-2025-41648

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

https://www.exploit-db.com/exploits/31683

https://nvd.nist.gov/vuln/detail/CVE-2025-34037

https://github.com/CH13hh/tmp_store_cc/blob/main/E8450/1.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6751

https://github.com/feiwuxingxie/cve/blob/main/linksys/vul01/1.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6752

D-Link:

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_74/74.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6374

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_73/73.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6373

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_72/72.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6372

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_71/71.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6371

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_70/70.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6370

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_69/69.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6369

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_68/68.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6368

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_67/67.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6367

https://github.com/2664521593/mycve/blob/main/D-Link_DI/CJ_IN_DLink_3_en.pdf

https://nvd.nist.gov/vuln/detail/CVE-2025-6898

https://github.com/2664521593/mycve/blob/main/D-Link_DI/CJ_IN_DLink_2_en.pdf

https://nvd.nist.gov/vuln/detail/CVE-2025-6897

https://github.com/2664521593/mycve/blob/main/D-Link_DI/CJ_IN_DLink_1_en.pdf