Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
wsrp4echo - 0day Chain Vulnerability
Web Services for Remote Portlets (WSRP) is an OASIS-approved network protocol standard designed for communications with remote portlets. Uses in:
- Oracle WebCenter
- IBM WebSphere
- Microsoft SharePoint
https://medium.com/@aryanchehreghani/wsrp4echo-0day-chain-vulnerability-fd2c395dc45b
P.S. Thx
Web Services for Remote Portlets (WSRP) is an OASIS-approved network protocol standard designed for communications with remote portlets. Uses in:
- Oracle WebCenter
- IBM WebSphere
- Microsoft SharePoint
https://medium.com/@aryanchehreghani/wsrp4echo-0day-chain-vulnerability-fd2c395dc45b
P.S. Thx
Reaza for the link 🤝Medium
wsrp4echo - 0day Chain Vulnerability
Message From wsrp4echo :
Hello. I’m wsrp4echo. I’m not just a vulnerability — I’m a chain reaction.
Born not from a bug, but from trust…
Hello. I’m wsrp4echo. I’m not just a vulnerability — I’m a chain reaction.
Born not from a bug, but from trust…
ImageRunner: A Privilege Escalation Vulnerability Impacting GCP Cloud Run
https://www.tenable.com/blog/imagerunner-a-privilege-escalation-vulnerability-impacting-gcp-cloud-run
https://www.tenable.com/blog/imagerunner-a-privilege-escalation-vulnerability-impacting-gcp-cloud-run
Tenable®
ImageRunner: A Privilege Escalation Vulnerability Impacting GCP Cloud Run
Tenable Research discovered a privilege escalation vulnerability in Google Cloud Platform (GCP) that is now fixed and which we dubbed ImageRunner. At issue are identities that lack registry permissions but that have edit permissions on Google Cloud Run revisions.…
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Threat actors leverage tax season to deploy tax-themed phishing campaigns
https://www.microsoft.com/en-us/security/blog/2025/04/03/threat-actors-leverage-tax-season-to-deploy-tax-themed-phishing-campaigns/
https://www.microsoft.com/en-us/security/blog/2025/04/03/threat-actors-leverage-tax-season-to-deploy-tax-themed-phishing-campaigns/
Microsoft News
Threat actors leverage tax season to deploy tax-themed phishing campaigns
As Tax Day approaches in the United States on April 15, Microsoft has detected several tax-themed phishing campaigns employing various tactics. These campaigns use malicious hyperlinks and attachments to deliver credential phishing and malware including RaccoonO365…
Incomplete NVIDIA Patch to CVE-2024-0132 Exposes AI Infrastructure and Data to Critical Risks
https://www.trendmicro.com/en_us/research/25/d/incomplete-nvidia-patch.html
https://www.trendmicro.com/en_us/research/25/d/incomplete-nvidia-patch.html
Trend Micro
Incomplete NVIDIA Patch to CVE-2024-0132 Exposes AI Infrastructure and Data to Critical Risks
A previously disclosed vulnerability in NVIDIA Container Toolkit has an incomplete patch, which, if exploited, could put a wide range of AI infrastructure and sensitive data at risk.
🎉 OpenBLD.net на AppSecFest 2025!
25 апреля встречаемся на AppSecFest 2025 — крупнейшем событии года в мире прикладной безопасности.
В этом году организаторы второй год подряд поддерживают OpenBLD.net — и это чертовски приятно!
У нас будет собственная стилизованная стойка, экран для демонстрации технологий, а логотип OpenBLD.net появится на официальном сайте фестиваля. Это действительное признание того, что мы делаем действительно важное дело 💪
Что будет на нашем стенде:
• Футболки и стикеры
• Живые демки технологий OpenBLD.net
• А самое главное — возможность пообщаться, обсудить идеи, задать вопросы и вдохновиться
Если вы интересуетесь DNS-безопасностью, фильтрацией вредоносных доменов, приватностью и киберзащитой — обязательно загляните к нам. Увидимся на AppSecFest 2025!
• Подробнее о проекте: openbld.net
• О фестивале: appsecfest.kz
P.S. И да, дорогой друг — у тебя есть шанс попасть на мероприятие вместе с нашей командой 😉
25 апреля встречаемся на AppSecFest 2025 — крупнейшем событии года в мире прикладной безопасности.
В этом году организаторы второй год подряд поддерживают OpenBLD.net — и это чертовски приятно!
У нас будет собственная стилизованная стойка, экран для демонстрации технологий, а логотип OpenBLD.net появится на официальном сайте фестиваля. Это действительное признание того, что мы делаем действительно важное дело 💪
Что будет на нашем стенде:
• Футболки и стикеры
• Живые демки технологий OpenBLD.net
• А самое главное — возможность пообщаться, обсудить идеи, задать вопросы и вдохновиться
Если вы интересуетесь DNS-безопасностью, фильтрацией вредоносных доменов, приватностью и киберзащитой — обязательно загляните к нам. Увидимся на AppSecFest 2025!
• Подробнее о проекте: openbld.net
• О фестивале: appsecfest.kz
P.S. И да, дорогой друг — у тебя есть шанс попасть на мероприятие вместе с нашей командой 😉
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
MITRE Ends? US Geoverment ends support MITRE. CVE released emergency article about it:
https://www.thecvefoundation.org/home
Letter:
https://www.linkedin.com/posts/tib3rius_breaking-from-a-reliable-source-mitre-activity-7317960862332293120-t6yt
https://www.thecvefoundation.org/home
Letter:
https://www.linkedin.com/posts/tib3rius_breaking-from-a-reliable-source-mitre-activity-7317960862332293120-t6yt
CVE-2025-24054, NTLM Exploit in the Wild
CVE-2025-24054 is a vulnerability related to NTLM hash disclosure via spoofing, which can be exploited using a maliciously crafted
CVE-2025-24054, which also allows NTLM hash disclosure with very little user interaction. For CVE-2025-24054, users can trigger the attack simply by right-clicking or navigating to the folder that holds the maliciously crafted .library-ms file...
Research:
https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/
CVE-2025-24054 is a vulnerability related to NTLM hash disclosure via spoofing, which can be exploited using a maliciously crafted
.library-msCVE-2025-24054, which also allows NTLM hash disclosure with very little user interaction. For CVE-2025-24054, users can trigger the attack simply by right-clicking or navigating to the folder that holds the maliciously crafted .library-ms file...
Research:
https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/
Check Point Research
CVE-2025-24054, NTLM Exploit in the Wild - Check Point Research
Key Points Introduction NTLM (New Technology LAN Manager) is a suite of authentication protocols developed by Microsoft to verify user identities and protect the integrity and confidentiality of network communications. NTLM operates through a direct client…
Introducing ToyMaker, an initial access broker working in cahoots with double extortion gangs
https://blog.talosintelligence.com/introducing-toymaker-an-initial-access-broker
https://blog.talosintelligence.com/introducing-toymaker-an-initial-access-broker
Cisco Talos Blog
Introducing ToyMaker, an initial access broker working in cahoots with double extortion gangs
Cisco Talos discovered a sophisticated attack on critical infrastructure by ToyMaker and Cactus, using the LAGTOY backdoor to orchestrate a relentless double extortion scheme.
Fotinet zero day RCE - Stack-based buffer overflow vulnerability in AP
Status - Critical
https://fortiguard.fortinet.com/psirt/FG-IR-25-254
Status - Critical
https://fortiguard.fortinet.com/psirt/FG-IR-25-254
FortiGuard Labs
PSIRT | FortiGuard Labs
None
Bypassing BitLocker Encryption: Bitpixie PoC and WinPE Edition
https://blog.compass-security.com/2025/05/bypassing-bitlocker-encryption-bitpixie-poc-and-winpe-edition/
https://blog.compass-security.com/2025/05/bypassing-bitlocker-encryption-bitpixie-poc-and-winpe-edition/
Valve Probes 89 Million Steam Data Leak
https://observervoice.com/valve-probes-89-million-steam-data-leak-117641/
A note about the security of your Steam account
https://steamcommunity.com/games/593110/announcements/detail/533224478739530146
https://observervoice.com/valve-probes-89-million-steam-data-leak-117641/
A note about the security of your Steam account
https://steamcommunity.com/games/593110/announcements/detail/533224478739530146
Observer Voice
Valve Probes 89 Million Steam Data Leak
Valve Probes 89 Million Steam Data Leak
VMware Cloud Foundation updates address multiple vulnerabilities
HIGH
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25733
VMware ESXi, vCenter Server, Workstation, and Fusion updates address multiple vulnerabilities
HIGH
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717
HIGH
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25733
VMware ESXi, vCenter Server, Workstation, and Fusion updates address multiple vulnerabilities
HIGH
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717
BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory
https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory
https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory
Akamai
BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory
Akamai researchers found a privilege escalation vulnerability in Windows Server 2025 that allows attackers to compromise any user in Active Directory.
CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel’s SMB implementation
https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/
https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/
Sean Heelan's Blog
How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel’s SMB implementation
In this post I’ll show you how I found a zeroday vulnerability in the Linux kernel using OpenAI’s o3 model. I found the vulnerability with nothing more complicated than the o3 API ̵…
Mark Your Calendar: APT41 Innovative Tactics
https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
Google Cloud Blog
Mark Your Calendar: APT41 Innovative Tactics | Google Cloud Blog
When OpenBLD.net is next to Wazuh, Elastic, Palo Alto - abuse.ch launches API access by keys.
Forwarded from OpenBLD.net (Yevgeniy Goncharov)
CVE-2025-33053, Stealth Falcon And Horus: A Saga Of Middle Eastern Cyber Espionage
The threat actors used a previously undisclosed technique to execute files hosted on a WebDAV server they controlled, by manipulating the working directory of a legitimate built-in Windows tool. Microsoft assigned the vulnerability CVE-2025-33053 and released a patch on June 10, 2025, as part of their June Patch Tuesday updates.
https://research.checkpoint.com/2025/stealth-falcon-zero-day/
The threat actors used a previously undisclosed technique to execute files hosted on a WebDAV server they controlled, by manipulating the working directory of a legitimate built-in Windows tool. Microsoft assigned the vulnerability CVE-2025-33053 and released a patch on June 10, 2025, as part of their June Patch Tuesday updates.
https://research.checkpoint.com/2025/stealth-falcon-zero-day/
Check Point Research
Stealth Falcon's Exploit of Microsoft Zero Day Vulnerability - Check Point Research
Check Point Research uncovers Stealth Falcon's cyber espionage campaign exploiting a Microsoft Zero Day Vulnerability
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass
https://www.binarly.io/blog/another-crack-in-the-chain-of-trust
https://www.binarly.io/blog/another-crack-in-the-chain-of-trust
www.binarly.io
Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass
Binarly uncovers CVE-2025-3052: a Secure Boot bypass affecting most UEFI devices, enabling attackers to run unsigned code before OS load.
Forwarded from OpenBLD.net (Yevgeniy Goncharov)
OpenBLD.net - Phishing Preveting - Toxic trend: Another malware threat targets DeepSeek
DeepSeek-R1 is one of the most popular LLMs right now. Users of all experience levels look for chatbot websites on search engines, and threat actors have started abusing the popularity of LLMs...
Phishing lure, Malicious installer, Loaded implant and more:
https://securelist.com/browservenom-mimicks-deepseek-to-use-malicious-proxy/115728
DeepSeek-R1 is one of the most popular LLMs right now. Users of all experience levels look for chatbot websites on search engines, and threat actors have started abusing the popularity of LLMs...
Phishing lure, Malicious installer, Loaded implant and more:
https://securelist.com/browservenom-mimicks-deepseek-to-use-malicious-proxy/115728
Red / Blue team, багбаунти, пентесты - ключевой навык в инфобезе.
Самое время прокачать навык веб-пентеста.
Курс от Яндекс Практикума в Казахстане.
Освоить веб-пентест за 6 месяцев, научиться искать уязвимости и защищать веб-приложения, что может быть проще?)
Что внутри:
• Учат и атаковать, и защищать
• Практика в облаке в формате CTF
• Наставники — практикующие специалисты
• Есть модули по безопасному коду и DevSecOps
Подходит опытным айтишникам и студентам техвузов.
Можно протестировать себя - пройдя бесплатный тест на вход.
🎁 Промокод KZ2025 — скидка 12%. Детали → Здесь.
Партнёрский материал
Самое время прокачать навык веб-пентеста.
Курс от Яндекс Практикума в Казахстане.
Освоить веб-пентест за 6 месяцев, научиться искать уязвимости и защищать веб-приложения, что может быть проще?)
Что внутри:
• Учат и атаковать, и защищать
• Практика в облаке в формате CTF
• Наставники — практикующие специалисты
• Есть модули по безопасному коду и DevSecOps
Подходит опытным айтишникам и студентам техвузов.
Можно протестировать себя - пройдя бесплатный тест на вход.
🎁 Промокод KZ2025 — скидка 12%. Детали → Здесь.
Партнёрский материал