Microsoft Patches a Whopping Seven Zero
60
Microsoft Patch Tuesday for March 2025 — Snort rules and prominent vulnerabilities
60
60
60
60
60
60
Vulnerability landscape analysis for Q4 2024
60
60
Microsoft January 2019 Patch Tuesday updates fix 7 critical vulnerabilities
60
Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
Sysdig documents a skilled human attacker exploiting Marimo pre-auth RCE CVE-2026-39987 (CVSS 9.3), reaching an SSH bastion in eight seconds without AI tooling.
Sysdig detailed exploitation of CVE-2026-39987 (CVSS 9.3), a pre-authenticated RCE affecting all Marimo versions that came under active exploitation within hours of disclosure. A human operator used a hand-written Python script to harvest an AWS key from Secrets Manager and SSH into a bastion host in eight seconds, issuing 850+ commands over nine hours. Separately, Hunt.io disclosed an XMRig cryptomining campaign compromising 3,562 Redis servers via SLAVEOF rogue replication and AOF authorized_keys injection. Operation CameraSwarm, linked to a single operator, compromised over 14,000 Dahua IP cameras using CVE-2021-33044 and CVE-2021-33045.
70
StyleSmuggler: The Magento Zero-Day Behind New Store Attacks
Sansec reports actively exploited Magento/Adobe Commerce zero-day StyleSmuggler enabling unauthenticated RCE and Rust backdoor installation on fully patched stores since September 4.
Sansec discovered StyleSmuggler, an unpatched zero-day in Magento Open Source and Adobe Commerce, affecting all current versions including 2.4.7, 2.4.8 and 2.4.9, with attacks observed since September 4. The two-stage attack poisons Magento's template system via the styles property and executes the injected PHP during 'Payment Transaction Failed Reminder' email rendering, working even when email delivery fails and when sessions are moved to Redis. Successful compromise installs a lightweight Rust backdoor disguised as fc-cache or chronyd that beacons every 60 seconds with 48-byte UDP packets to NTP port 123 at ntp.timesync.to. A second attacker deployed a PHP web shell in product-image cache directories, hidden behind 404 responses unless a correct X-Cache-Token header is present.
85
UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities
Cisco Talos identifies UAT-10147 deploying the SPECTRE implant with cross-platform C2, credential theft, and kernel-level EDR bypass.
Cisco Talos reports that the tracked threat actor UAT-10147 is deploying a newly identified implant named SPECTRE. SPECTRE supports cross-platform command-and-control, process injection, credential theft, and anti-analysis protections. It also includes a Linux rootkit and BYOVD (bring your own vulnerable driver) capability enabling kernel-level EDR bypass, marking an evolution in commodity intrusion tooling.
50
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0
60
Microsoft May 2020 Patch Tuesday fixes 111 flaws, 13 Critical
60
Week in review: Patched curl and libcurl vulnerability, 15 free M365 security training modules
60
Google fixes two actively exploited Chrome zero-days (CVE-2020-16009, CVE-2020-16010)
60
Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)
SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.
A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. Dynamic analysis of the UPX-packed, statically linked x86-64 sample (SHA-256 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox showed it renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket while surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images pre- and post-execution were captured from the hypervisor for forensics.
33
Vulnerability landscape in Q4 2025
60
60
China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud
China-linked Jewelbug runs government espionage and crypto fraud from a single XG-Web browser-based control framework.
Broadcom's Symantec and Carbon Black detail Jewelbug, a China-based hackers-for-hire group conducting espionage against governments and militaries in the Middle East, Southeast Asia, and South Asia, plus crypto fraud against Chinese-speaking victims. Operations center on XG-Web, a browser-centric remote-access and infostealing framework, with implants spanning browsers, Windows, Linux, and network devices. The group overlaps with CL-STA-0049, Ink Dragon, Earth Alux, and REF7707, and compromised a Middle Eastern government's webmail across 15 tenants.
76
⚡ Weekly Recap: Zero-Day Exploits, Insider Threats, APT Targeting, Botnets and More
60
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
New Kimwolf v7 Android botnet adds HTTP/2 DDoS floods with Chrome fingerprints and takedown-resistant ENS/Tor C2.
Palo Alto Networks Unit 42 discovered Kimwolf v7, an evolution of the Kimwolf/AISURU Android and IoT botnet first tracked in February 2026. The new version performs HTTP/2 floods mimicking Chrome browser fingerprints and uses Ethereum Name Service, Tor hidden services, and a local proxy for resilient C2. The botnet targets Android TV boxes via ADB on port 5555 and offloads propagation to an external loader.
55
60
NSA Discovers New Vulnerabilities Affecting Microsoft Exchange Servers
60
57
60
60
60
Microsoft Issues Patches for 121 Flaws, Including Zero
60
60
Update Your Windows Computers to Patch 6 New In-the-Wild Zero
60
60
Microsoft Releases Patch for Two New Actively Exploited Zero
60
Vulnerable Arm GPU drivers under active exploitation. Patches may not be available
60
Microsoft patches three zero-days actively exploited by attackers
60
Week in review: Patch Tuesday forecast, 9 free ransomware guides, Cybertech Europe 2023
60
60
Microsoft Issues Patches for Actively Exploited Excel, Exchange Server 0
60
60