Critical Windows Netlogon RCE flaw now exploited in attacks

The Centre for Cybersecurity Belgium (CCB), the country's national authority for cybersecurity, warned on Friday that threat actors are now exploiting a recently patched critical Windows Netlogon vuln...

bleepingcomputer.com

EDR killer tool uses signed kernel driver from forensic software

Hackers are abusing a legitimate but long-revoked EnCase kernel driver in an EDR killer that can detect 59 security tools in attempts to deactivate them.

bleepingcomputer.com

Notepad++ update feature hijacked by Chinese state hackers for months

Chinese state-sponsored threat actors were likely behind the hijacking of Notepad++ update traffic last year that lasted for almost half a year, the developer states in an official announcement today.

bleepingcomputer.com

Overrun with AI slop, cURL scraps bug bounties to ensure "intact mental health"

The onslaught includes LLMs finding bogus vulnerabilities and code that won't compile.

arstechnica.com

Cloudflare Fixes ACME Validation Bug Allowing WAF Bypass to Origin Servers

Cloudflare patched an ACME HTTP-01 validation flaw that disabled WAF protections and let unauthorized requests reach origin servers.

thehackernews.com

Trend Micro Apex Central RCE Flaw Scores 9.8 CVSS in On-Prem Windows Versions

Trend Micro patched a critical Apex Central on-prem Windows flaw (CVE-2025-69258) with CVSS 9.8 that allows remote code execution if access exists.

thehackernews.com

NordVPN denies breach claims, says attackers have "dummy data"

NordVPN denied allegations that its internal Salesforce development servers were breached, saying that cybercriminals obtained "dummy data" from a trial account on a third-party automated testing plat...

bleepingcomputer.com

Massive Rainbow Six Siege breach gives players billions of credits

Ubisoft's Rainbow Six Siege (R6) suffered a breach that allowed hackers to abuse internal systems to ban and unban players, manipulate in-game moderation feeds, and grant massive amounts of in-game cu...

bleepingcomputer.com

TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy in the Era of AI Assisted Reverse Engineering

evilsocket.net

Unpatched Gogs Zero-Day Exploited Across 700+ Instances Amid Active Attacks

Unpatched Gogs flaw CVE-2025-8110 enables file overwrite and code execution, driving over 700 confirmed compromises.

thehackernews.com

Hackers Actively Exploiting 7-Zip Symbolic Link–Based RCE Vulnerability (CVE-2025-11001)

Active exploitation targets 7-Zip CVE-2025-11001; patch 25.00 fixes symbolic link RCE flaws.

thehackernews.com

Catching Credential Guard Off Guard - SpecterOps

Uncovering the protection mechanisms provided by modern Windows security features and identifying new methods for credential dumping.

specterops.io

r-tec Blog | Bypass AMSI in 2025

This blog post will shed some light on what's behind AMSI (roughly, but hopefully easy to understand) and how you can still effectively bypass it - more than four years later.

r-tec.net

13-Year-Old Redis Flaw Exposed: CVSS 10.0 Vulnerability Lets Attackers Run Code Remotely

Redis fixes 13-year CVSS 10 flaw allowing Lua script-based remote code execution in all versions.

thehackernews.com

One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens

While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise ...

dirkjanm.io

ksmbd - Fuzzing Improvements and Vulnerability Discovery (2/3) · Doyensec's Blog

ksmbd - Fuzzing Improvements and Vulnerability Discovery (2/3)

blog.doyensec.com

Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel

Some memory corruption bugs are much harder to exploit than others. They can involve race conditions, crash the system, and impose limitations that make a researcher's life difficult. Working with suc...

a13xp0p0v.github.io

WinRAR zero-day exploited to plant malware on archive extraction

A recently fixed WinRAR vulnerability tracked as CVE-2025-8088 was exploited as a zero-day in phishing attacks to install the RomCom malware.

bleepingcomputer.com

From Chrome renderer code exec to kernel with MSG_OOB

Posted by Jann Horn, Google Project Zero Introduction In early June, I was reviewing a new Linux kernel feature when I learned about the...

googleprojectzero.blogspot.com

ReVault flaws let hackers bypass Windows login on Dell laptops

ControlVault3 firmware vulnerabilities impacting over 100 Dell laptop models can allow attackers to bypass Windows login and install malware that persists across system reinstalls.

bleepingcomputer.com

SonicWall urges admins to disable SSLVPN amid rising attacks

SonicWall has warned customers to disable SSLVPN services due to ransomware gangs potentially exploiting an unknown security vulnerability in SonicWall Gen 7 firewalls to breach networks over the past...

bleepingcomputer.com

Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access

Active SharePoint exploits since July 7 target governments and tech firms globally, risking key theft and persistent access.

thehackernews.com

CVE-2025-1729 - Privilege Escalation Using TPQMAssistant.exe

trustedsec.com

Applocker bypass on Lenovo machines – The curious case of MFGSTAT.zip

This blogpost is about a minor discovery I made regarding a writeable file inside the Windows folder that is present on Lenovo machines. Initially when I found it I thought it was only a handful of…

oddvar.moe

Chinese Hackers Exploit Ivanti CSA Zero-Days in Attacks on French Government, Telecoms

Chinese hackers exploited Ivanti CSA zero-days, targeting French government, media, and telecom sectors in September 2024.

thehackernews.com

Over 1,200 Citrix servers unpatched against critical auth bypass flaw

Over 1,200 Citrix NetScaler ADC and NetScaler Gateway appliances exposed online are unpatched against a critical vulnerability believed to be actively exploited, allowing threat actors to bypass authe...

bleepingcomputer.com

Instagram ads mimicking BMO, EQ Bank are finance scams

Instagram ads impersonating financial institutions like Bank of Montreal (BMO) and EQ Bank (Equitable Bank) are being used to target Canadian consumers with phishing scams and investment fraud. Some ...

bleepingcomputer.com

CISA Warns of Active Exploitation of Linux Kernel Privilege Escalation Vulnerability

CISA warns CVE-2023-0386 is being actively exploited, impacting Linux systems via OverlayFS. Patching is urgent.

thehackernews.com

Apple Zero-Click Flaw in Messages Exploited to Spy on Journalists Using Paragon Spyware

Apple patched zero-day flaws exploited to deploy Paragon’s Graphite spyware targeting journalists and civil society, raising global spyware concerns.

thehackernews.com

Streaming Zero-Fi Shells to Your Smart Speaker

In October 2024, RET2 participated in the “Small Office / Home Office” (SOHO) flavor of Pwn2Own, a competition which challenges top security researchers to c...

blog.ret2.io