Attackers Briefly Hijacked AOMEI Updates to Plant Backdoors
UNC7017 changed two AOMEI configuration files for minutes at a time. Hunt updater-launched files and scheduled tasks even after the vendor restored its servers.
Reader edition
The Feed
ARMORY CASTLE Uses BeyondTrust Zero-Day to Keep Root Access
The actor exploited Remote Support, installed a root backdoor and reached managed endpoints. Patch BT26-05, then investigate appliance persistence and sessions.
Fortinet FortiSandbox Flaw Lets Remote Callers Bypass GUI Login
Crafted HTTP requests can bypass FortiSandbox management login. Check appliance and PaaS versions, upgrade affected branches and restrict GUI reachability.
TLS Libraries Disagree on Which Signed Certificates Pass Name Restrictions
The same signed certificate can pass one validator and fail another. Test the actual TLS path, update affected libraries and keep issued names explicit.
Komodo Log Access Lets Restricted Users Run Commands on Managed Hosts
Komodo Periphery passes some restricted-user requests to a shell on managed servers. Upgrade agents to 2.3.0 and review Logs and Execute grants.
Lowcoder Flaw Lets One Tenant Run Another Tenant's Saved Queries
An admin or developer in one organization can reach another's Query Library on a shared instance. Restrict the affected API while a security update is pending.
Bisheng SSO Issues Admin Tokens Without Checking the Caller
The legacy SSO route issues a JWT for a supplied username and remains unpatched; separate cross-user assistant and workflow flaws have release-specific fixes.
Cisco Email Hardening Fixes Five Flaw Groups, Including Two Exploited Issues
Cisco updates Secure Email Gateway and Secure Email and Web Manager across five weakness groups. Compare each appliance's build with its product-specific fixed release.
Palo Alto Networks PAN-OS Flaw Lets Attackers Run Code as Root
Limited exploitation targets authenticated access to PAN-OS management. Compare installed hotfixes, restrict the admin path and inspect three vendor-listed IPs.
YAM Store sells Microsoft and Google cloud access to phishing crews
Microsoft traces a broker reselling cloud tenant access and storage to phishing kits. Examine app credentials, privileged grants and hosted files in affected tenants.
Microsoft Patches Exploited Windows File Warning Bypass
The October updates address an exploited Windows Shell bypass and separate unauthenticated DHCP Server code execution. Check installed builds on endpoints and DHCP hosts.
Fake WatchGuard VPN download takes passwords before serving the real client
A lookalike download page collects the VPN server and credentials twice, then starts a signed WatchGuard installer. Check browser history and VPN logins.
Microsoft Windows Shell flaw lands in CISA exploited catalog
CISA flags active exploitation of a Windows Shell security bypass. Compare affected desktop and server builds with Microsoft's CVE record and prioritize updates.