60
Search: “trusted execution environment”
213 stories
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild
Attackers actively exploit CVE-2025-32433, a CVSS 10.0 unauthenticated RCE in Erlang/OTP SSH, heavily targeting OT and critical infrastructure networks.
CVE-2025-32433 enables unauthenticated RCE in Erlang/OTP's SSH daemon via SSH connection protocol messages (codes >= 80) processed before authentication, affecting versions before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20. Unit 42 recorded a spike in exploitation between May 1-9, 2025, with 70% of detections on firewalls protecting OT networks, disproportionately affecting healthcare, agriculture, media and high technology. Observed payloads bind TCP-connected shells or launch Bash reverse shells to hosts like 146.103.40.203:6667, with randomized DNS lookups under dns.outbound.watchtowr.com indicating OAST-driven blind RCE validation.
90
CISA Warns of Critical ScreenConnect Vulnerability Actively Exploited in Attacks
CISA added actively exploited ConnectWise ScreenConnect flaw CVE-2026-84869 to the KEV catalog, setting a September 14 patch deadline.
CISA added CVE-2026-84869, a critical improper privilege management and missing authorization flaw (CWE-269, CWE-862) in ConnectWise ScreenConnect, to its Known Exploited Vulnerabilities Catalog on September 11, 2026, confirming active exploitation. The flaw lets attackers transfer files to a device and execute them during an active remote ScreenConnect session without authorization or host-user confirmation, enabling payload delivery, unauthorized tools, and persistence while blending into legitimate remote-management traffic. CISA set a September 14 remediation deadline under BOD 26-04 and flagged the vulnerability as requiring forensic triage. ConnectWise has published a security bulletin, and defenders are urged to review exposure, sessions, file-transfer records, and outbound connections.
85
60
Largest Patch Tuesday since July includes two exploited in the wild, three critical vulnerabilities
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60