30
30
45
30
45
30
30
30
30
30
30
45
30
30
30
30
Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies
Huntress details intruders using PsExec and VSSAdmin on domain controllers to steal NTDS.dit credentials and delete shadow copies before ransomware.
Huntress analysts identified attackers launching SYSTEM-level command shells via PsExec on a domain controller, then running 'vssadmin create shadow' to snapshot and copy the NTDS.dit Active Directory database. Shadow copies were later deleted to destroy local recovery options ahead of a likely ransomware stage. Huntress recommends correlating VSS creation/deletion events with remote execution, DNS enumeration, and lateral movement rather than alerting on any single VSS event.
55
Jellyfin 12.0 Released With Security Fixes for Unauthorized File Access and XSS Flaws
Jellyfin 12.0 fixes unauthorized file access and web client XSS flaws, but requires careful upgrades due to breaking database migrations and plugin changes.
The open-source media server release prevents crafted requests from reading files outside designated directories, blocks unauthorized re-runs of the setup wizard, rejects plugin packages with unsafe names, strengthens parental control enforcement, and fixes cross-site scripting vulnerabilities in browser-based administration and media access workflows. Upgrades require a manual backup because the database schema migration is irreversible; supported paths start from version 10.10.7 or 10.11.x, and duplicate case-insensitive usernames will break migration. The release also retires legacy /emby/ and /mediabrowser/ routes, disables deprecated authentication by default, and targets .NET 10, requiring plugin rebuilds.
45
45
30
30
30
30
30
30
45
30
45
30
45
30
30
30
30
45
30
30
45
30
45