Malwarecritical
⚡ Weekly Recap: USB Malware, React2Shell, WhatsApp Worms, AI IDE Bugs & More
- CVEs
- CVE-2025-55182CVE-2025-6389CVE-2025-66516CVE-2025-9491CVE-2025-10155CVE-2025-10156CVE-2025-10157CVE-2025-48633CVE-2025-48572CVE-2025-11699CVE-2025-64775CVE-2025-59789CVE-2025-13751CVE-2025-13086CVE-2025-12106CVE-2025-13658CVE-2024-36424CVE-2025-66412CVE-2025-13510CVE-2025-13372CVE-2025-64460CVE-2025-13486
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-36424 | K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of a NULL pointer dereference | 5.5 | <1% | ||
CVE-2025-10156+2 related CVEs | An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass… | 9.3 | 1% | PoC | |
| CVE-2025-11699 | nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a… | 7.1 | <1% | ||
| CVE-2025-12106 | Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses | 9.1 | <1% | ||
CVE-2025-13086+1 related CVE | Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a… | 4.6 group max | <1% | ||
CVE-2025-64460+1 related CVE | An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27 | 7.5 group max | 2% | ||
| CVE-2025-13486 | Unauthenticated RCE in WordPress Advanced Custom Fields: Extended Plugin | 9.8 | 68% | ||
| CVE-2025-13510 | The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to… | 9.3 | <1% | ||
| CVE-2025-13658 | A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code… | 9.3 | <1% | ||
CVE-2025-48572+1 related CVE | Local Privilege Escalation in Android Framework Under Active Exploitation | 7.8 group max | <1% | KEV | KEV |
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) | 10.0 | 100% | KEVRansomwarePoC ×13 | KEV |
| CVE-2025-59789 | Uncontrolled recursion in the json2pb component in Apache bRPC (version < 1.15.0) on all platforms allows remote attackers to make the server crash via sending… | 7.5 | 2% | ||
| CVE-2025-6389 | Unauthenticated Remote Code Execution in Sneeit Framework WordPress Plugin | 9.8 | 76% | ||
| CVE-2025-64775 | Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion | 7.5 | 2% | ||
| CVE-2025-66412 | Angular: 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It… | 8.5 | <1% | ||
| CVE-2025-66516 | Critical XXE in Apache Tika PDF parsing via crafted XFA forms | 9.8 | 80% | ||
| CVE-2025-9491 | LNK File UI Misrepresentation RCE in Microsoft Windows | 4.6 | 69% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | tickmilleas.com | Department of Justice's (DoJ) Scam Center Task Force seized Tickmilleas[.]com, a website used by scammers located at the Tai Chang scam |
From the original article
13 min read at thehackernews.com
It’s been a week of chaos in code and calm in headlines. A bug that broke the internet’s favorite framework, hackers chasing AI tools, fake apps stealing cash, and record-breaking cyberattacks — all within days. If you blink, you’ll miss how fast the threat map is changing.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.