60
30
47
42
U.S. CISA adds Ivanti CSA and Fortinet bugs to its Known Exploited Vulnerabilities catalog
60
Critical Ghostscript flaw exploited in the wild. Patch it now!
60
42
47
Re: Retrospective by 'gpg.fail' authors
GnuPG's Werner Koch says gpg.fail samples only crash GnuPG via DER-as-printf format string in --debug x509; RCE claim remains unproven.
Werner Koch replied to the gpg.fail retrospective, noting that GnuPG versions above 2.2 produce garbled stderr or crash when the project's certificates are used with --debug x509 because DER data is passed as a printf format string. Testing the certificates from the researchers' Git repo yielded only a segfault, not demonstrated code execution. Koch states how remote code execution would be achieved is unclear and asks for a real reproducer.
20
42
47
47
30
U.S. CISA adds Fortinet products and Ivanti CSA bugs to its Known Exploited Vulnerabilities catalog
60
30
60
TuxBot v3: Inside an IoT Botnet Framework With LLM
Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.
Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.
45
45
60
60
30
60
47
47
47
47
35
60
57
CISA Adds Four Critical Vulnerabilities to KEV Catalog Due to Active Exploitation
60
57
42
55
60
60
60
30
30
42
42