Netlas.io – Telegram
Netlas.io
1.99K subscribers
342 photos
3 videos
465 links
Explore the latest in cybersecurity with Netlas.io. Stay ahead with updates on high-profile vulnerabilities, expert tutorials, essential safety tips, and the latest Netlas developments.
Download Telegram
CVE-2025-20352: Buffer Overflow in Cisco IOS, 7.7 rating❗️

A vulnerability in the SNMP subsystem of Cisco IOS and Cisco IOS XE allows low-privilege attackers to perform DoS and high-privilege attackers to perform RCE.

Search at Netlas.io:
👉 Link: https://nt.ls/TCs49
👉 Dork: snmp.banner:"Cisco IOS"

Vendor's advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-x4LPhte
👾4👍1
🚨 When Patches Fail — why fixes get bypassed and what to check after an update

Patches often fix a symptom, not the root cause. This analysis walks through real bypass timelines (SharePoint, SAP, NTLM, Grafana), shows how NVD/KEV delays and PoC/IOC flows speed exploitation, and gives compact checks teams should run immediately.

Quick highlights:
🧩 Concrete case studies with timelines and residual CVEs.
⚖️ Why many vendor patches are incomplete — root-cause vs surface fixes.
How disclosure delays and fast PoC/AI tooling narrow your window.
🛠️ Actionable post-patch checklist: test alternative code paths, validate root issue, chain input tests, and apply virtual patches (WAF/IPS).
🔍 Netlas-based telemetry and simple queries to measure internet exposure.

👉 Read the full analysishttps://netlas.io/blog/when_patches_fail/
👍2👾2
CVE-2025-62506: Privilege Escalation in MinIO, 8.1 rating❗️

A privilege escalation vulnerability allows service accounts and STS (Security Token Service) accounts with restricted session policies to bypass their inline policy restrictions when performing "own" account operations, specifically when creating new service accounts for the same user.

Search at Netlas.io:
👉 Link: https://nt.ls/yVIu7
👉 Dork: http.favicon.hash_sha256:7a2d79d4a5801b848bf2d577c6c3d16598d69fd78bc9d2399dcc4ac2497b0759 OR http.headers.server:"MinIO" OR http.meta:"MinIO" OR http.favicon.hash_sha256:052d1670e36345713bd69e405403034f69b3a0adab8fa7d6f178faac4406199a

Vendor's advisory: https://github.com/minio/minio/security/advisories/GHSA-jjjj-jwhf-8rgr
👾6
CVE-2025-11702, -10497, -6601 and other: Multiple vulnerabilities in GitLab, 3.8 - 8.5 rating❗️

GitLab published a new advisory disclosing several vulnerabilities, including Improper Access Control, DoS, Incorrect Authorization, and others.

Search at Netlas.io:
👉 Link: https://nt.ls/ECfGM
👉 Dork: http.favicon.hash_sha256:72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef OR http.headers.set_cookie:"gitlab" OR http.headers.location:"gitlab"

Vendor's advisory: https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/
🔥2👾1
📌 Zero-Click Exploits — silent, interactionless compromises

Our new article explains how zero-click chains work, why they evade classic defenses, and what engineers and incident responders should prioritise.

Good and bad news alternate:

1️⃣ Bad: Zero-clicks are real and high-impact — real chains (iMessage, WhatsApp, Pegasus-style attacks) have been used to silently breach high-value targets.
2️⃣ Good: Many successful mitigations are practical — stricter input validation for parsers and media handlers reduces the attack surface.
3️⃣ Bad: End-to-end encryption and sandboxing remove traditional inspection points, so network sensors often can’t see malicious payloads.
4️⃣ Good: Layered telemetry, anomaly detection and ready IR playbooks can shorten dwell time and limit damage when interactionless compromises occur.
5️⃣ Bad: Zero-day economics + slow patching turn single flaws into long-running risks — many chains leave little forensic trace.
6️⃣ Good: Engineering fixes (fuzzing, careful protocol parsing, faster patch rollout) plus threat-informed testing make devices measurably safer.

The full article contains case studies, attack anatomy and concrete defensive recommendations.

👉 Worth a focused read: https://netlas.io/blog/zero_click_exploits/
👾5
CVE-2024-9234, CVE-2024-9707, and CVE-2024-11972: Actively exploited vulnerabilities in WordPress plugins, 9.8 rating 🔥

Researchers at Wordfence have noted widespread attempts to exploit three last year vulnerabilities in the GutenKit and Hunk Companion plugins.

Search at Netlas.io:
👉 Link: https://nt.ls/6LlSh
👉 Dork: http.body:"plugins/gutenkit-blocks-addon" OR http.body:"plugins/hunk-companion"

Read more: https://www.wordfence.com/blog/2025/10/mass-exploit-campaign-targeting-arbitrary-plugin-installation-vulnerabilities/
👾3👍2
CVE-2025-55752, -55754, -61795: Multiple vulnerabilites in Apache Tomcat, 5.3 - 9.6 rating 🔥

Three new vulnerabilities in Apache Tomcat allow attackers to perform DoS, RCE, and ANSI Injection.

Search at Netlas.io:
👉 Link: https://nt.ls/OLbr7
👉 Dork: http.favicon.hash_sha256:64a3170a912786e9eece7e347b58f36471cb9d0bc790697b216c61050e6b1f08 OR http.headers.server:"Apache-Coyote"

Vendor's advisory: https://lists.apache.org/thread/38vqp0v1fg4gr8c6lvm15wj6k67hxzxd
🔥3👾3👍1
CVE-2025-54236: Improper Input Validation in Magento (Adobe Commerce), 9.1 rating 🔥

A critical vulnerability disclosed in a recent advisory allows attackers to perform RCE. Exploitation attempts have already been recorded!

Search at Netlas.io:
👉 Link: https://nt.ls/Edck5
👉 Dork: tag.name:"magento" AND http.headers.server:"Apache"

Vendor's advisory: https://helpx.adobe.com/security/products/magento/apsb25-88.html
👾4🔥3
⚠️ Service Maintenance Notice
Please note that Netlas will experience brief service interruptions several times today and tomorrow due to maintenance. We appreciate your understanding and patience while we work to improve our system performance.
💊3
📌 When AI Turns Criminal: deepfakes, voice-cloning & LLM-powered malware

Today we unpack how attackers weaponize generative AI — sharper spear-phishing, real-time voice/video fakes, and malware that models can write and refactor on the fly — plus what defenders can do today.

What’s inside:
🤖 How deepfakes and voice clones short-circuit trust, approvals, and even MFAs.
🔎 AI-scaled social engineering: personalized, context-aware outreach at volume.
🦠 LLM-assisted malware chains and why detection misses “AI fingerprints.”
🛡 Concrete playbooks: out-of-band verification, liveness checks, device fingerprinting, intent-aware filtering, tabletop drills.

👉 Read now: https://netlas.io/blog/ai_turns_criminal/
3👾3👍1
CVE-2025-64095: Unauthenticated File Upload in DNN Platform CMS, 10.0 rating 🔥🔥🔥

The vulnerability allows an unauthenticated user to upload files to the server, overwriting existing ones.

Search at Netlas.io:
👉 Link: https://nt.ls/m2HEG
👉 Dork: http.headers.set_cookie:"dnn_IsMobile"

Vendor's advisory: https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-3m8r-w7xg-jqvw
👾4🔥1🤣1
CVE-2025-24893: Eval Injection in XWiki Platform, 9.8 rating 🔥

In a recent post, CISA added an old RCE vulnerability to the list of actively exploited ones.

Search at Netlas.io:
👉 Link: https://nt.ls/ue2o0
👉 Dork: http.noscript:"XWiki" OR http.favicon.hash_sha256:6f0fdef9a229150fbc7183a1bbb136d7b44b6df7c34369c14bebb6adae8aaf20

Read more: https://www.cisa.gov/news-events/alerts/2025/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog
👾6
CVE-2025-8489: Path Traversal in ShopLentor WordPress Plugin, 9.8 rating 🔥

A recent vulnerability in the ShopLentor (formerly WooLentor) plugin allows unauthenticated attackers to execute any code from PHP files on the server.

Search at Netlas.io:
👉 Link: https://nt.ls/wKuHH
👉 Dork: http.body:"plugins/woolentor-addons"

Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woolentor-addons/shoplentor-325-unauthenticated-local-php-file-inclusion-via-load-template
👾5🤔2
CVE-2025-64459, -64458: SQLi and DoS in Django Framework, 7.5 - 9.1 rating 🔥

A recent security update from the Django Team fixes two vulnerabilities that could allow an attacker to destroy or retrieve database contents, as well as halt the operation of a Windows server.

Search at Netlas.io:
👉 Link: https://nt.ls/srswH
👉 Dork: tag.name:"django"

Vendor's advisory: https://www.djangoproject.com/weblog/2025/nov/05/security-releases/
🔥5👾2
📌 LLM Vulnerabilities: how AI apps break — and how to harden them

This piece maps the most common ways LLM-powered systems fail in the real world and turns them into a practical hardening plan. From prompt and indirect injection to over-privileged tools, leaky RAG pipelines, data poisoning, jailbreaks, and supply-chain traps — plus the guardrails that actually help in production.

Key takeaways:
1️⃣ Prompt & indirect injection: attackers hide instructions in web pages, files, or retrieved notes; the model obeys them and exfiltrates secrets or performs unwanted actions.
2️⃣ Jailbreaks & policy evasion: harmless-looking reformulations bypass safety layers; outputs become unsafe or operationally risky.
3️⃣ RAG data leaks: sloppy retrieval exposes internal docs, customer data, and system prompts; cross-tenant bleed is a real risk.
4️⃣ Over-privileged tools/agents: broad filesystem, network, or payment permissions turn one prompt into a breach.
5️⃣ Poisoning & supply chain: tainted datasets, third-party prompts, and unpinned models/extensions undermine trust.
6️⃣ Output trust & hallucinations: fabricated facts sneak into workflows, tickets, or code — and humans often rubber-stamp them.
7️⃣ Telemetry gaps: without red-team sims and runtime monitoring, you won’t see injection attempts until damage is done.

👉 Read here: https://netlas.io/blog/llm_vulnerabilities/
👾41🔥1
CVE-2025-64492, -64493: SQL Injections in SuiteCRM, 6.5 - 8.8 rating❗️

Vulnerabilities in SuiteCRM allow attackers to obtain information about databases and, in rare cases, perform RCE.

Search at Netlas.io:
👉 Link: https://nt.ls/rsV8B
👉 Dork: http.favicon.hash_sha256:6e1ab006d2a8e2e930bdd6f4e85ae3f7df8c46cd2062a9f85a7193e0558185bb

Vendor's advisory: https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-54m4-4p54-j8hp
👾4
CVE-2025-11224 and other: Multiple vulnerabilities in GitLab, 3.1 - 7.7 rating❗️

In a new bulletin, GitLab described nine vulnerabilities for CE and EE. These include XSS, Information Disclosure, Prompt Injection, and others.

Search at Netlas.io:
👉 Link: https://nt.ls/7x1Mf
👉 Dork: http.favicon.hash_sha256:72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef OR http.headers.set_cookie:"gitlab" OR http.headers.location:"gitlab"

Vendor's advisory: https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/
👾6
CVE-2025-10230: OS Command Injection in Samba, 10.0 rating 🔥🔥🔥

An October vulnerability in the popular Samba AD package allows attackers to execute commands on a server by sending just one specially crafted packet.

Search at Netlas.io:
👉 Link: https://nt.ls/xGVmR
👉 Dork: smb:*

Vendor's advisory: https://www.samba.org/samba/history/security.html
🔥3😱3👾3
CVE-2025-64500: Authorization Bypass in Symfony, 7.3 rating❗️

The vulnerability allows attackers to bypass certain access restrictions based on the leading "/" character.

Search at Netlas.io:
👉 Link: https://nt.ls/yxfE1
👉 Dork: http.body:"Symfony Web Debug Toolbar" OR http.noscript:"Welcome to Symfony!" OR http.noscript:"symfony project"

Vendor's advisory: https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass
👾5
CVE-2025-9501: Command Injection in W3 Total Cache plugin, 9.0 rating 🔥

A vulnerability in a popular website speedup plugin allows attackers to remotely execute PHP code.

Search at Netlas.io:
👉 Link: https://nt.ls/GUyZV
👉 Dork: http.body:"plugins/w3-total-cache"

Read more: https://wpscan.com/vulnerability/6697a2c9-63ae-42f0-8931-f2e5d67d45ae/
👾3🔥2
We are currently experiencing a full service outage caused by a major Cloudflare CDN failure.

At the moment, Netlas App, API, and documentation portal are unavailable.

Our backend systems are running, but Cloudflare’s outage prevents any traffic from reaching our infrastructure.

We are actively monitoring Cloudflare’s incident and will restore service as soon as connectivity is back.
🙏7🗿2