May 2024 Patch Tuesday: Microsoft fixes exploited zero-days (CVE-2024-30051, CVE-2024-30040)
60
CISA adds Cisco ASA and FTD and CrushFTP VFS flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
Hackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memory
Sophos analyzed a Linux rootkit, tracked as PoisonedRefresh, on hacked F5 BIG-IP APM devices hiding an in-memory web shell linked to exploited CVE-2025-53521.
Sophos and ESET analyzed an implant (named PoisonedRefresh by ESET) deployed on compromised F5 BIG-IP APM appliances, which serves enterprise, financial, government, and public sector deployments. The second-stage payload intercepts __libc_start_main, hooks Apache's APR module loader (apr_dso_load), RC4-encodes key strings, and rewrites PHP file reads in memory to embed a web shell inside legitimate scripts like apm_css.php3, full_wt.php3, and webtop_popup_css.php3, leaving on-disk files unchanged. A related installer component infects /usr/sbin/httpd, persists across BIG-IP upgrade images, modifies SELinux configuration, and deploys the payload. The malware also creates a Unix domain socket at /run/bigtlog.pipe that hands authenticated local connections to /bin/bash; F5 links the activity to CVE-2025-53521, an unauthenticated RCE in BIG-IP APM already exploited in the wild.
78
60
60
60
60
60
60
60
60
60
CVE-2022-30190 (Follina) vulnerability in MSDT: description and counteraction
60
60
60
U.S. CISA adds MRLG, PHPMailer, Rails Ruby on Rails, and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero
60
60
Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
Attackers chained JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 for admin control, planting Rust backdoors; CVE-2026-82329 also mass-exploited.
Wiz observed attackers chaining CVE-2026-42018 (anonymous-token leak) and CVE-2026-42016 (token escalation) in self-hosted JFrog Artifactory between August 15 and September 8, gaining admin control, creating admin accounts, and installing malicious Groovy plugins and a custom Rust backdoor. Separately, critical authentication bypass CVE-2026-82329 (CVSS 9.8) was mass-exploited starting September 1, drawing ~406,000 exploitation attempts on September 2 per Fastly. CISA added CVE-2026-82329 to KEV on September 2 with a September 5 federal deadline. Patching does not revoke minted tokens or rotate stolen join keys; admins must review accounts and rotate credentials.
92
60
UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications
60
CVE-2026-50522: Microsoft SharePoint Server RCE Vulnerability
CVE-2026-50522 is an unauthenticated .NET deserialization RCE in SharePoint Server Subscription, 2019, and 2016; Microsoft patched it July 14, 2026.
CVE-2026-50522 (CWE-502) lets unauthenticated attackers send crafted serialized .NET payloads to network-accessible SharePoint endpoints, triggering gadget-chain deserialization and remote code execution under the privileged SharePoint service account. It affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise; Microsoft published the advisory on July 14, 2026. The EPSS score is 20.346%, but no public PoC exists and the flaw is not in CISA's KEV catalog at publication. Mitigations include applying Microsoft updates, rotating SharePoint machine keys, enabling AMSI, and restricting internet exposure.
74
60
60
60
60
60
60
60
60
60
60