Attackers Briefly Hijacked AOMEI Updates to Plant Backdoors
UNC7017 changed two AOMEI configuration files for minutes at a time. Hunt updater-launched files and scheduled tasks even after the vendor restored its servers.
Read article →Page 2 of 16
Latest Articles
ARMORY CASTLE Uses BeyondTrust Zero-Day to Keep Root Access
The actor exploited Remote Support, installed a root backdoor and reached managed endpoints. Patch BT26-05, then investigate appliance persistence and sessions.
Read article →
Fortinet FortiSandbox Flaw Lets Remote Callers Bypass GUI Login
Crafted HTTP requests can bypass FortiSandbox management login. Check appliance and PaaS versions, upgrade affected branches and restrict GUI reachability.
Read article →
TLS Libraries Disagree on Which Signed Certificates Pass Name Restrictions
The same signed certificate can pass one validator and fail another. Test the actual TLS path, update affected libraries and keep issued names explicit.
Read article →
Komodo Log Access Lets Restricted Users Run Commands on Managed Hosts
Komodo Periphery passes some restricted-user requests to a shell on managed servers. Upgrade agents to 2.3.0 and review Logs and Execute grants.
Read article →
Lowcoder Flaw Lets One Tenant Run Another Tenant's Saved Queries
An admin or developer in one organization can reach another's Query Library on a shared instance. Restrict the affected API while a security update is pending.
Read article →
Bisheng SSO Issues Admin Tokens Without Checking the Caller
The legacy SSO route issues a JWT for a supplied username and remains unpatched; separate cross-user assistant and workflow flaws have release-specific fixes.
Read article →
Cisco Email Hardening Fixes Five Flaw Groups, Including Two Exploited Issues
Cisco updates Secure Email Gateway and Secure Email and Web Manager across five weakness groups. Compare each appliance's build with its product-specific fixed release.
Read article →
Palo Alto Networks PAN-OS Flaw Lets Attackers Run Code as Root
Limited exploitation targets authenticated access to PAN-OS management. Compare installed hotfixes, restrict the admin path and inspect three vendor-listed IPs.
Read article →
YAM Store sells Microsoft and Google cloud access to phishing crews
Microsoft traces a broker reselling cloud tenant access and storage to phishing kits. Examine app credentials, privileged grants and hosted files in affected tenants.
Read article →
Microsoft Patches Exploited Windows File Warning Bypass
The October updates address an exploited Windows Shell bypass and separate unauthenticated DHCP Server code execution. Check installed builds on endpoints and DHCP hosts.
Read article →
Fake WatchGuard VPN download takes passwords before serving the real client
A lookalike download page collects the VPN server and credentials twice, then starts a signed WatchGuard installer. Check browser history and VPN logins.
Read article →
Microsoft Windows Shell flaw lands in CISA exploited catalog
CISA flags active exploitation of a Windows Shell security bypass. Compare affected desktop and server builds with Microsoft's CVE record and prioritize updates.
Read article →
Shopware media uploads expose admin tokens to stored XSS
An uploaded HTML file can run in a Shopware administrator's browser. Restrict media creation or block HTML uploads while checking who can reach existing media.
Read article →
Ivanti VPN Zero-Days Let UTA0576 Reach Root and Steal Credentials
A patched-at-the-time Connect Secure VPN fell to a three-flaw chain. Upgrade affected branches and investigate memory, LDAP traffic and movement from the appliance.
Read article →
GitLab fixes CI regex flaw that permits server-side code execution
A crafted CI configuration and UTF-8 repository path can reach a vulnerable regex compiler on self-managed GitLab. Upgrade the affected 19.2, 19.3 and 19.4 branches.
Read article →Showing 14–29 of 246