Vulnerabilities

Chinese Hackers Employ Geo Mapping Tool to Maintain Year Long Persistence

Researchers have discovered that the China-backed advanced persistent threat (APT) group Flax Typhoon maintained long-term access to a geographic information system (ArcGIS) by exploiting trusted software components. Instead of using traditional malware, the attackers converted a legitimate software extension into a persistent backdoor, forcing even the vendor to update its documentation. Turning Legitimate Software into […]

Chinese Hackers Employ Geo Mapping Tool to Maintain Year Long Persistence Read More »

Chrome Use-After-Free Vulnerability Enables Remote Code Execution

Google has released an urgent security update for its Chrome browser after identifying a high-severity use-after-free vulnerability that could allow attackers to execute arbitrary code on users’ devices. This flaw, if exploited, could let hackers take full control of a system simply through a malicious website visit, making it critical for users to update immediately.

Chrome Use-After-Free Vulnerability Enables Remote Code Execution Read More »

Active Exploitation of Windows Remote Access Connection Manager 0-Day Vulnerability

Microsoft has issued a serious warning after confirming that a newly discovered zero-day vulnerability in the Windows Remote Access Connection Manager (RasMan) service is being actively exploited in real-world attacks. The flaw allows threat actors to gain SYSTEM-level privileges, giving them complete control over the targeted machine. This vulnerability, tracked as CVE-2025-59230, is considered a

Active Exploitation of Windows Remote Access Connection Manager 0-Day Vulnerability Read More »

FortiPAM and FortiSwitch Manager Flaws Allow Attackers to Bypass Authentication

Fortinet has released an urgent security advisory about a critical vulnerability affecting FortiPAM and FortiSwitch Manager. The flaw could allow threat actors to completely bypass authentication mechanisms by using brute-force attack methods, giving them potential access to sensitive systems. Technical Details This vulnerability, tracked as CVE-2025-49201, results from a weak authentication mechanism in the Web

FortiPAM and FortiSwitch Manager Flaws Allow Attackers to Bypass Authentication Read More »

RondoDox Botnet Exploits 50+ Vulnerabilities from 30 Vendors in Ongoing Attacks

Cybersecurity researchers have uncovered an ongoing wave of RondoDox botnet campaigns that now exploit more than 50 security vulnerabilities affecting over 30 technology vendors. Trend Micro described this campaign as an “exploit shotgun” strategy, where attackers target a broad spectrum of internet-exposed infrastructure including routers, DVRs, NVRs, CCTV systems, web servers, and other network-connected devices.

RondoDox Botnet Exploits 50+ Vulnerabilities from 30 Vendors in Ongoing Attacks Read More »

Fortra Discloses Full Timeline of CVE-2025-10035 Exploitation, from Detection to Patch

Fortra has officially disclosed the complete timeline of events surrounding the exploitation of CVE-2025-10035, a critical vulnerability in its GoAnywhere Managed File Transfer (MFT) software. The flaw has reportedly been under active attack since at least September 11, 2025. Investigation and Initial Discovery According to Fortra, the investigation began on September 11 after a customer

Fortra Discloses Full Timeline of CVE-2025-10035 Exploitation, from Detection to Patch Read More »

CL0P-Linked Hackers Exploit Oracle Software Flaw to Breach Multiple Organizations

Dozens of organizations may have been impacted after threat actors exploited a zero-day vulnerability in Oracle E-Business Suite, starting around August 9, 2025, researchers from Google Threat Intelligence Group, GTIG, and Mandiant reported. The intrusion campaign, which shows hallmarks associated with the Cl0p ransomware brand, used a chain of vulnerabilities to gain remote code execution,

CL0P-Linked Hackers Exploit Oracle Software Flaw to Breach Multiple Organizations Read More »

Mustang Panda Employs New DLL Side Loading Technique to Deploy Malware

Security researchers have observed a renewed Mustang Panda campaign that uses a fresh DLL side-loading method to deliver malicious payloads, targeting Tibetan advocacy groups with politically themed lures. The operation first appeared in June, 2025, and combines archive-based phishing, hidden library files, dynamic API resolution, and periodic task scheduling to maintain persistence and execute stolen

Mustang Panda Employs New DLL Side Loading Technique to Deploy Malware Read More »

Hackers Abuse Legitimate Database Commands to Actively Compromise Databases

A new wave of sophisticated ransomware attacks is targeting organizations worldwide by abusing legitimate database commands, bypassing traditional security tools through “malware-free” operations. Unlike typical ransomware that relies on malicious binaries to encrypt files, attackers are exploiting exposed database services, using standard database functionality to steal, erase, and demand ransom for critical information. This technique

Hackers Abuse Legitimate Database Commands to Actively Compromise Databases Read More »

FreePBX SQL Injection Flaw Exploited to Alter Database Records

A critical, unauthenticated SQL injection vulnerability in FreePBX is being actively exploited, posing a severe risk to VoIP infrastructures worldwide. Attackers are abusing a web endpoint to inject database entries, create scheduled tasks, and ultimately run arbitrary code on compromised systems. What is affected, and why it matters FreePBX, the web-based administrative interface commonly used

FreePBX SQL Injection Flaw Exploited to Alter Database Records Read More »