Week in review: Several companies affected by the Salesloft Drift breach, Sitecore 0-day vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-24204 | The issue was addressed with improved checks. The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data. NVD description · AI analysis pending | 9.8 | 1% |
| — | ||
| CVE-2025-38352 | Actively Exploited TOCTOU Race Condition in Linux Kernel POSIX CPU Timers CVE-2025-38352 is a time-of-check to time-of-use (TOCTOU) race condition (CWE-367) in the Linux kernel's POSIX CPU timers subsystem: when an exiting non-auto-reaping task has passed exit_notify() and handles CPU timers from interrupt context, it can be reaped by its parent or debugger right after unlock_task_sighand(), so a concurrent posix_cpu_timer_del() cannot detect that the timer is firing (cpu_timer_task_rcu() and/or lock_task_sighand() fail). A local attacker with low privileges who can manipulate POSIX CPU timers on such a task can win this race window, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8, local vector, no user interaction). Any system running an affected Linux kernel is exposed, including Debian GNU/Linux deployments and Android devices built on the kernel; practical reachability is limited where CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y routes timer handling through task work instead of IRQ context. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-09-04 and Google shipped it as an actively exploited fix in the September 2025 Android security update; EPSS currently estimates a 1.3% probability of exploitation within 30 days (68th percentile), and a public proof-of-concept is available. Do: Apply updated kernel packages from your distribution (Debian and other vendors ship the upstream posix-cpu-timers fix) and install Google's September 2025 Android security patch on Android devices; CISA KEV listing requires federal agencies to apply vendor mitigations or discontinue use per BOD 22-01. Because exploitation requires local code execution, prioritize multi-tenant servers, build/CI hosts, and devices where untrusted users or apps run local code. A public proof-of-concept (github.com/farazsth98/chronomaly) is available for validation testing. | 7.8 | 1% | KEV PoC ×2 |
| massbillions of devices (the Linux kernel underpins roughly 3+ billion active Android devices and the majority of server/cloud workloads, though per-bug… | |
| CVE-2025-42957 | SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system. NVD description · AI analysis pending | 9.9 | 2% | — | — | ||
| CVE-2025-48543 | Use-After-Free in Android Runtime Enables Sandbox Escape and Local Privilege Escalation CVE-2025-48543 is a use-after-free (CWE-416) in the Android Runtime that exists in multiple code locations and allows an attacker who has already achieved code execution inside the Chrome sandbox to escape and attack the Android system_server process. The trigger requires only local access to the vulnerable component, with no additional execution privileges and no user interaction needed for exploitation. A successful attacker gains local escalation of privilege in the Android system server, making the bug especially useful as a privilege-escalation link in exploit chains against Android devices. Any Android device from Google's platform is in scope per CISA's listing (vendor: Google, product: Android, component: Android Runtime); specific affected version ranges are not enumerated in the source data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-09-04 and Google's related headlines indicate it is being actively exploited in the wild; EPSS currently estimates only a 0.5% probability of exploitation in the next 30 days, and ransomware use is listed as unknown. Do: Apply Google's Android security updates (September 2025 security bulletin patch level or later) as soon as they are available for your devices, since this flaw is listed in CISA's KEV and reported as exploited in the wild; per KEV required action, federal agencies must follow BOD 22-01 timelines or discontinue use if mitigations are unavailable. Use MDM/EDR tooling to verify device security patch levels, and note that because this is a sandbox-escape-to-system_server bug, it is most dangerous when chained with a browser/renderer exploit, so keeping Chrome/WebView current matters as well. | 8.8 | <1% | KEV |
| masson the order of billions of devices (Android runs on roughly 3 billion+ active devices worldwide, and the Android Runtime/system_server component is present on… | |
| CVE-2025-53690 | Unauthenticated ViewState Deserialization RCE in Sitecore XM/XP CVE-2025-53690 is a critical (CVSS 9.0) deserialization-of-untrusted-data flaw (CWE-502) in Sitecore Experience Manager (XM) and Experience Platform (XP) through version 9.0 that enables unauthenticated code injection. Public threat reporting (Google Cloud/Mandiant) and news coverage tie the flaw to ASP.NET ViewState deserialization performed using exposed (default or leaked) ASP.NET machine keys, so a remote attacker who can reach a Sitecore site can submit a crafted, signed ViewState payload that is deserialized server-side, resulting in remote code execution. A successful unauthenticated attacker gains arbitrary code execution on the web server with the scope-changed (S:C) impact of high confidentiality, integrity and availability loss. Organizations running internet-facing Sitecore XM/XP deployments — including Experience Commerce and Managed Cloud deployments — are in scope. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-09-04, and reporting links the activity to a China-linked APT (UAT-8837) targeting North American critical infrastructure. Do: Apply Sitecore's security updates to all affected XM/XP deployments (through 9.0) and follow the vendor's mitigations as required by CISA KEV/BOD 22-01, or discontinue use if patching is not possible. Per the public reporting, rotate any exposed or default ASP.NET machineKey values (e.g., in web.config) on internet-facing Sitecore servers, since exposed machine keys enable the ViewState deserialization attacks. Inventory internet-exposed Sitecore instances and review them for signs of compromise. | 9.0 | 51% | KEV PoC |
| largetens of thousands of internet-exposed Sitecore deployments (order of magnitude ~10^4–10^5) |
Full article1,316 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:
Zscaler, Palo Alto Networks, SpyCloud among the affected by Salesloft Drift breach
In the wake of last week’s revelation of a breach at Salesloft by a group tracked by Google as UNC6395, several companies – including Zscaler, Palo Alto Networks, PagerDuty, Tanium, and SpyCloud – have confirmed their Salesforce instances were accessed.
Sitecore zero-day vulnerability exploited by attackers (CVE-2025-53690)
A threat actor is leveraging a zero-day vulnerability (CVE-2025-53690) and an exposed sample ASP.NET machine key to breach internet-facing, on-premises deployments of several Sitecore solutions, Mandiant has revealed.
macOS vulnerability allowed Keychain and iOS app decryption without a password
At Nullcon Berlin, a researcher disclosed a macOS vulnerability (CVE-2025-24204) that allowed attackers to read the memory of any process, even with System Integrity Protection (SIP) enabled.
Can AI agents catch what your SOC misses?
A new research project called NetMoniAI shows how AI agents might reshape network monitoring and security. Developed by a team at Texas Tech University, the framework brings together two ideas: distributed monitoring at the edge and AI-driven analysis at the center.
BruteForceAI: Free AI-powered login brute force tool
BruteForceAI is a penetration testing tool that uses LLMs to improve the way brute-force attacks are carried out. Instead of relying on manual setup, the tool can analyze HTML content, detect login form selectors, and prepare the attack process automatically.
LinkedIn expands company verification, mandates workplace checks for certain roles
LinkedIn is rolling out new verification rules to make it easier to confirm that people and companies are who they claim to be. The company will now require workplace verification when someone adds or updates a leadership or recruiter role on their profile. The goal is to cut down on fake accounts and scams while helping businesses, recruiters, and professionals build credibility.
Cloudflare confirms data breach linked to Salesloft Drift supply chain compromise
Cloudflare has also been affected by the Salesloft Drift breach, the US web infrastructure and security company confirmed on Tuesday, and the attackers got their hands on 104 Cloudflare API tokens.
Google fixes actively exploited Android vulnerabilities (CVE-2025-48543, CVE-2025-38352)
Google has provided fixes for over 100 Android vulnerabilities, including CVE-2025-48543 and CVE-2025-38352, which “may be under limited, targeted exploitation.”
Stealthy attack serves poisoned web pages only to AI agents
AI agents can be tricked into covertly performing malicious actions by websites that are hidden from regular users’ view, JFrog AI architect Shaked Zychlinski has found.
Attackers are exploiting critical SAP S/4HANA vulnerability (CVE-2025-42957)
A critical vulnerability (CVE-2025-42957) in SAP S/4HANA enterprise resource planning software is being exploited by attackers “to a limited extent”, the Dutch National Cyber Security Center (NCSC NL) has warned on Friday.
How gaming experience can help with a cybersecurity career
Many people might not think that playing video games could help build a career in cybersecurity. Yet the skills gained through gaming, even if they don’t seem relevant at first, can be useful in the field.
How to reclaim control over your online shopping data
Online shopping is convenient, saves time, and everything is just a click away. But how often do we stop to think about what happens to the data we leave behind, or the risks that might come with it?
Detecting danger: EASM in the modern security stack
The challenge for security professionals isn’t just defeating threats, it’s finding your vulnerabilities in the first place. That’s where External Attack Surface Management (EASM) tools come in.
September 2025 Patch Tuesday forecast: The CVE matrix
The CVE has become not only the designator around which we organize and rally, but also the resolution of the CVE is the standard against which we are measured.
What the GitGuardian secrets sprawl report reveals about leaked credentials
In this Help Net Security video, Dwayne McDaniel, Senior Developer Advocate at GitGuardian, presents findings from The State of Secrets Sprawl 2025.
Five habits of highly secure development teams
In this Help Net Security video, Brendon Collins, Principal Consultant at Optiv, explores how organizations can embed security and privacy into the software development lifecycle (SDLC) from the very start.
CyberFlex: Flexible Pen testing as a Service with EASM
CyberFlex is an Outpost24 solution that combines the strengths of its Pen-testing-as-a-Service (PTaaS) and External Attack Surface Management (EASM) solutions. Customers benefit from continuous coverage of their entire attack application attack surface, while enjoying a flexible consumption model.
Smart ways CISOs can do more with less
In this Help Net Security video, Jill Knesek, CISO at BlackLine, shares practical strategies for CISOs navigating tighter budgets. From maximizing existing tools and vendor partnerships to leveraging AI and making smart investments, she offers actionable advice for maintaining strong security without overspending.
GenAI is fueling smarter fraud, but broken teamwork is the real problem
More than 80 percent of large U.S. companies were targeted by socially engineered fraud in the past year, according to Trustmi’s 2025 Socially Engineered Fraud & Risk Report. Nearly half of those organizations reported a direct financial loss, with many incidents costing more than $500,000.
Cybersecurity signals: Connecting controls and incident outcomes
There is constant pressure on security leaders to decide which controls deserve the most attention and budget. A new study offers evidence on which measures are most closely linked to lower breach risk and how organizations should think about deploying them.
Boards are being told to rethink their role in cybersecurity
A new report from Google Cloud’s Office of the CISO lays out three areas where board oversight is becoming especially important: ransomware, cyber-enabled fraud, and the intersection of innovation and cybersecurity.
Complexity and AI put identity protection to the test
Identity has become a core pillar of cybersecurity strategy. Remote work, cloud-first adoption, and distributed supply chains have moved identity from “a tactical IT consideration to a strategic pillar of cybersecurity,” according to Cisco Duo’s 2025 State of Identity Security report.
Attackers are turning Salesforce trust into their biggest weapon
Salesforce has become a major target for attackers in 2025, according to new WithSecure research into threats affecting customer relationship management (CRM) platforms.
Cutting through CVE noise with real-world threat signals
CISOs are dealing with an overload of vulnerability data. Each year brings tens of thousands of new CVEs, yet only a small fraction ever become weaponized. Teams often fall back on CVSS scores, which label thousands of flaws as “high” or “critical” but fail to show which ones actually matter. The result is wasted effort, long patch backlogs, and exploitable weaknesses left in production.
New threat group uses custom tools to hijack search results
ESET Research has identified a new threat group called GhostRedirector. In June 2025, this group broke into at least 65 Windows servers, mostly in Brazil, Thailand, Vietnam, and the United States.
File security risks rise as insiders, malware, and AI challenges converge
Breaches tied to file access are happening often, and the costs add up quickly. Many organizations have faced multiple file-related incidents over the last two years, with financial losses stretching into the millions. The fallout often includes stolen customer data, reduced productivity, and exposure of intellectual property.
AIDEFEND: Free AI defense framework
AIDEFEND (Artificial Intelligence Defense Framework) is an open knowledge base dedicated to AI security, providing defensive countermeasures and best practices to help security pros safeguard AI and machine learning systems.
KillChainGraph: Researchers test machine learning framework for mapping attacker behavior
A team of researchers from Frondeur Labs, DistributedApps.ai, and OWASP has developed a new machine learning framework designed to help defenders anticipate attacker behavior across the stages of the Cyber Kill Chain. The work explores how machine learning models can forecast adversary techniques and generate structured attack paths.
Cybersecurity jobs available right now: September 2, 2025
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/09/07/week-in-review-several-companies-affected-by-the-salesloft-drift-breach-sitecore-0-day-vulnerability/