Cisco NGOAM flaws expose Nexus switches to root code execution
Enabled NGOAM exposes a packet-processing flaw on standalone Nexus 3000 and 9000 switches; two more flaws require VXLAN overlay or SRv6 features.
Reader edition
The Feed
AhsayCBS Intruders Install Webshells and Hide a Crypto Miner
A backup management server became a SYSTEM-level foothold. Restrict its web interface and hunt for a fake Edge service, JSP shells and miner traffic.
Cisco NX-API flaw exposes switch management to root execution
Enabled NX-API on affected Nexus switches exposes an unauthenticated request path; UCS 6300 fabric interconnects have a separate credential-dependent path.
CISA Flags Exploited BIND Flaw That Knocks DNS Servers Offline
A crafted TKEY query can stop vulnerable BIND DNS servers before access controls run. Check the running build and install the vendor's patched package.
PaperCut Emergency Patch Left a Second Path to Server Code Execution
watchTowr traced a new authentication bypass and Scan-to-Fax code-execution chain through an interim PaperCut build. Check the running version and past access to its web interface.
Citrix NetScaler Intruders Poison Logs to Install a Web Shell
Unit 42 traced an exploited NetScaler command-injection chain through two appliance logs into a disguised PHP shell. Preserve logs and inspect the web-server configuration.
Cisco Fixes Six NX-OS Flaw Groups Across Switches and Fabric Interconnects
Cisco's NX-OS hardening release covers MDS, Nexus and UCS fabric interconnects. Match device family and management mode to the first fixed build.
Cisco Fixes Four License On-Prem Flaw Groups in 10-202609
Cisco groups multiple License On-Prem flaws under four CVEs. Inventory the former SSM On-Prem too, migrate older branches, and verify the fixed release.
CISA Flags Exploited Apache Struts Flaw That Executes Server Code
A remote execution path depends on Dynamic Method Invocation. Identify reachable Struts 2 apps, disable that feature or move to an Apache-listed fix, and triage exposure.
Microsoft FORGE Finds 140 Windows CVEs, Submits 155 Open-Source Reports
Microsoft's research shows how bug volume can overwhelm validation and release work. Check affected dependency builds and carry reproducible findings through a shipped fix.
CISA flags exploited ONLYOFFICE Docs flaw that exposes servers to code execution
CISA lists an exploited image-upload traversal in ONLYOFFICE Document Server before 5.6.3. Find older JWT-enabled servers, update them and check their exposure.
Akira Ransomware Leaves a File-Share Trail After Late EDR Deployment
Huntress reconstructed an Akira attack from Shellbags, ransomware logs and shadow-copy events after its endpoint agent arrived too late to record the launch.
Palo Alto Networks traces blockchain C2 through poisoned dependencies
Unit 42 maps contract reads, transaction data and zero-value transfers used by poisoned packages. Correlate runner processes with blockchain traffic and restrict unneeded egress.