A security researcher discovered 15 potential Linux Kernel vulnerabilities related to race conditions in the Virtual File System (VFS) layer, focusing on non-atomic file operations such as rename and chown. These flaws could allow local privilege escalation (LPE) by exploiting timing windows where security checks and critical operations are not atomic. The researcher developed a proof-of-concept exploit and a real-time mitigation based on CPU time monitoring but faced dismissal from Google’s bug bounty program. No official patches or CVEs exist yet, and no known exploits are in the wild. The vulnerabilities stem from architectural oversights in kernel transaction atomicity, posing critical risks to system integrity and security. European organizations relying on Linux systems could be significantly impacted, especially those with high-value targets or sensitive data. Immediate mitigation involves kernel-level atomic operation fixes and monitoring for abnormal CPU usage during vulnerable operations. Countries with large Linux deployments and strategic infrastructure are most at risk. The threat severity is assessed as critical due to the potential for full system compromise without user interaction or authentication.
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability affecting OpenPLC ScadaBR to its Known Exploited Vulnerabilities catalog. This flaw pertains to the OpenPLC ScadaBR platform, which is used for industrial control systems and SCADA environments. Although no specific CVSS score or detailed technical exploit information is provided, the vulnerability is assessed as medium severity. There are no known exploits in the wild at this time, and technical discussion and details remain minimal. The vulnerability could potentially impact the confidentiality, integrity, and availability of industrial control systems if exploited. European organizations using OpenPLC ScadaBR, especially in critical infrastructure sectors, should be vigilant. Mitigation should focus on monitoring for updates from vendors, applying patches promptly once available, and implementing network segmentation and access controls. Countries with significant industrial automation and critical infrastructure sectors, such as Germany, France, and the UK, are likely to be most affected.
This analysis covers foundational cache poisoning attacks that have historically exploited logic flaws in web caching mechanisms, such as unvalidated headers, inconsistent header normalization, and mismatched cache keys. These vulnerabilities allow attackers to poison cached responses, leading to user redirection to malicious sites, denial of service by caching error responses, and widespread cache poisoning across CDN-backed websites. Although these are older case studies from platforms like HackerOne, GitHub, and Cloudflare, the underlying issues persist in modern frameworks, enabling complex cache poisoning and denial-of-service attacks today. The threat primarily impacts web applications and CDNs that improperly handle HTTP headers and cache keys. Exploitation requires sending crafted HTTP requests but often does not require authentication or user interaction. European organizations relying on vulnerable caching infrastructure or popular frameworks could face service disruption, reputational damage, and potential user redirection to malicious domains. Mitigation involves rigorous validation and normalization of headers, consistent cache key construction, and thorough testing of caching behavior under edge cases. Countries with high adoption of cloud services, CDNs, and modern web frameworks—such as the UK, Germany, France, and the Netherlands—are most likely to be affected. The overall severity is assessed as high due to the potential for widespread impact on availability and integrity without complex exploitation requirements.
This threat involves exploiting 'syntax confusion' vulnerabilities where different components interpret the same input differently due to ambiguous or inconsistent syntax rules. Such confusion can be leveraged to bypass filters and enable real-world exploitation. The research, presented at NahamCon 2025 by Alex Brumen, provides practical examples and step-by-step guidance on crafting payloads that exploit these inconsistencies. Although no specific affected versions or known exploits in the wild are reported, the medium severity rating reflects the potential risk. European organizations using multi-component systems that parse inputs differently are at risk, especially those relying on complex data processing pipelines or legacy systems with inconsistent syntax handling. Mitigation requires thorough input validation harmonized across all components, syntax unification, and rigorous testing for ambiguous parsing. Countries with high adoption of complex enterprise software and critical infrastructure are more likely to be targeted. Given the ease of exploitation through crafted inputs and the potential impact on confidentiality, integrity, and availability, the suggested severity is high. Defenders should focus on understanding their system's parsing behaviors and applying consistent syntax rules to prevent exploitation.
A recently disclosed edge case vulnerability affects the mysql and mysql2 Node.js packages, where prepared statements—commonly trusted to prevent SQL injection—can be exploited under certain conditions. This vulnerability undermines the assumption that using prepared statements alone guarantees SQL injection safety, potentially allowing attackers to execute arbitrary SQL commands. While no known exploits are currently in the wild, the issue poses a medium severity risk due to its impact on data confidentiality and integrity. European organizations using Node.js applications with these database libraries should carefully review their usage of prepared statements and apply mitigations promptly. Countries with significant Node.js development ecosystems and industries relying on web applications and databases are at higher risk. Mitigation involves auditing code for unsafe prepared statement usage, applying any forthcoming patches, and employing additional input validation and query parameterization techniques. Given the ease of exploitation once the vulnerability is understood and the widespread use of these packages, the threat demands immediate attention despite limited current exploitation evidence.
ShadowPad malware is actively exploiting a vulnerability in Microsoft's WSUS (Windows Server Update Services) to gain full system access. This exploitation allows attackers to execute arbitrary code with elevated privileges, potentially compromising the entire affected system. Although no CVSS score is available, the threat is assessed as high severity due to the potential for full system compromise without requiring user interaction. European organizations using WSUS for patch management are at risk, especially those with large Windows Server deployments. Mitigation requires immediate patching once available, restricting WSUS server access, and monitoring for unusual activity. Countries with significant enterprise IT infrastructure and heavy Microsoft product usage, such as Germany, France, and the UK, are most likely to be affected. The threat's exploitation complexity is moderate, but the impact on confidentiality, integrity, and availability is critical. Defenders should prioritize WSUS security hardening and incident detection to prevent or quickly respond to exploitation attempts.
A critical vulnerability has been identified in 7-Zip, a widely used open-source file archiver. A public exploit for this vulnerability is available, increasing the urgency for affected users to update their software manually, as no automatic update mechanism is currently in place. The vulnerability could allow attackers to execute arbitrary code or compromise system integrity when processing malicious archive files. Although no widespread exploitation has been reported yet, the availability of a public exploit raises the risk of imminent attacks. European organizations relying on 7-Zip for file compression and decompression are at risk, especially those in sectors with high data sensitivity or regulatory requirements. Mitigation requires immediate manual updating of 7-Zip to the patched version once released, alongside enhanced monitoring for suspicious archive file activity. Countries with high adoption of 7-Zip and significant IT infrastructure, such as Germany, France, and the UK, are likely to be most affected. Given the critical nature, ease of exploitation, and potential for severe impact on confidentiality, integrity, and availability, this vulnerability should be treated with the highest priority.
A critical zero-day vulnerability (CVE-2025-61757) in Oracle Identity Manager allows unauthenticated remote attackers to bypass authentication and execute remote code. The flaw stems from a faulty allow-list mechanism that treats protected API endpoints as publicly accessible when certain query strings are appended. This enables attackers to manipulate authentication flows and escalate privileges. Oracle has released patches for affected versions 12.2.1.4.0 and 14.1.2.1.0. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation prior to patch availability.
ShadowRay 2.0 is a newly identified botnet that exploits an unpatched vulnerability in Ray, a GPU-accelerated computing framework, to propagate itself and perform unauthorized cryptomining. The botnet leverages this flaw to spread autonomously across vulnerable systems without requiring user interaction or authentication. Although no known exploits in the wild have been confirmed yet, the threat is considered high due to the potential for widespread GPU resource hijacking and the strain it can place on organizational infrastructure. European organizations using GPU-accelerated applications or services based on Ray are at risk, especially those in sectors with high GPU utilization such as research, finance, and media. Mitigation is complicated by the absence of an official patch, necessitating proactive network segmentation, monitoring for unusual GPU usage, and restricting access to vulnerable services. Countries with significant technology sectors and high adoption of GPU computing, such as Germany, France, and the UK, are likely to be most affected. Given the ease of exploitation, the broad impact on confidentiality, integrity, and availability, and the self-spreading nature of the botnet, the suggested severity is critical. Defenders should prioritize detection and containment measures while awaiting official patches.
A high-severity remote code execution (RCE) vulnerability identified as CVE-2025-11001 affects 7-Zip, leveraging symbolic link (symlink) handling flaws. Attackers can exploit this vulnerability to execute arbitrary code on affected systems by crafting malicious archives that abuse symlink processing during extraction. Although no known exploits are currently observed in the wild, active exploitation attempts have been reported, indicating an urgent threat. The vulnerability impacts users of 7-Zip, a widely used open-source file archiver, particularly on Windows platforms. European organizations relying on 7-Zip for file compression and decompression are at risk of compromise, potentially leading to data breaches, system takeover, and lateral movement within networks. Mitigation requires immediate patching once updates are available, restricting archive extraction privileges, and monitoring for suspicious archive handling activities. Countries with high adoption of 7-Zip in enterprise environments and critical infrastructure sectors, such as Germany, France, and the UK, are most likely to be targeted. Given the ease of exploitation without authentication and the potential for full system compromise, this vulnerability is assessed as critical. Defenders must prioritize awareness, implement compensating controls, and prepare for incident response related to this threat.
Fortinet has disclosed a critical zero-day vulnerability affecting its FortiWeb web application firewall product. This vulnerability is actively exploited in the wild, posing significant risks to organizations using FortiWeb devices. The zero-day allows attackers to potentially bypass security controls, leading to unauthorized access or disruption of web applications protected by FortiWeb. No patches are currently available, and technical details remain limited, increasing the urgency for defensive measures. European organizations relying on FortiWeb for web application security are at heightened risk, especially those in sectors with high-value web assets. Mitigation requires immediate network-level protections, enhanced monitoring, and strict access controls until an official patch is released. Countries with widespread Fortinet deployments and critical infrastructure reliance on FortiWeb are most vulnerable. Given the critical severity, ease of exploitation, and potential impact on confidentiality, integrity, and availability, this zero-day demands urgent attention from cybersecurity teams across Europe.
A critical zero-day vulnerability has been discovered and actively exploited in the V8 JavaScript engine used by Google Chrome. Google has issued a security fix to address this flaw, which could allow attackers to execute arbitrary code or escalate privileges via crafted web content. Although no detailed technical specifics or CVE identifier are currently available, the vulnerability's active exploitation status and critical severity highlight the urgent need for patching. European organizations relying on Chrome browsers are at risk of compromise, especially those in sectors with high exposure to web-based threats. Mitigation requires immediate deployment of the latest Chrome updates and enhanced monitoring for suspicious browser activity. Countries with high Chrome usage and significant digital infrastructure, such as Germany, France, and the UK, are likely to be most affected. Given the ease of exploitation through web content and the potential for full system compromise, this vulnerability is assessed as critical. Defenders should prioritize patch management and user awareness to reduce exposure.
RondoDox is a botnet malware campaign actively exploiting unpatched XWiki servers to recruit additional devices into its network. The threat leverages known vulnerabilities in XWiki instances that remain unpatched, enabling remote compromise without authentication or user interaction. Once infected, these servers become part of the botnet, potentially used for distributed denial-of-service (DDoS) attacks, data exfiltration, or further propagation. European organizations running XWiki without timely patching are at heightened risk, especially those in sectors relying heavily on collaborative platforms. The threat is considered high severity due to ease of exploitation and potential widespread impact. Mitigation requires immediate patching of XWiki servers, network segmentation, and monitoring for unusual outbound traffic. Countries with significant XWiki adoption and strategic digital infrastructure, such as Germany, France, and the UK, are most likely to be targeted. Given the lack of CVSS scoring, the threat is assessed as high severity based on its impact and exploitation characteristics. Defenders should prioritize vulnerability management and incident detection to prevent botnet expansion.
A critical vulnerability has been identified in Imunify360, a widely used security solution for web hosting servers, putting millions of websites at risk. Although no known exploits are currently observed in the wild, the flaw's critical severity suggests potential for significant compromise if weaponized. The vulnerability could allow attackers to bypass security controls, potentially leading to unauthorized access, data breaches, or service disruption. European organizations relying on Imunify360 for server protection may face increased risk, especially those in countries with large hosting infrastructures. Immediate attention is required to monitor for patches and apply mitigations proactively. The threat's exploitation ease and broad impact potential justify a high severity rating. Defenders should prioritize vulnerability scanning, network segmentation, and enhanced monitoring for suspicious activity related to Imunify360 components. Countries with significant web hosting markets and cloud service providers, such as Germany, the UK, France, and the Netherlands, are likely to be most affected. Given the critical nature and potential impact on confidentiality, integrity, and availability, this vulnerability demands urgent mitigation efforts even in the absence of active exploits. Organizations should also engage with vendors and security communities to track developments and patch releases.
