Threats tagged 'exploit'

In August 2025, a sophisticated nation-state actor gained persistent access to F5's internal systems, specifically targeting the BIG-IP product development environment and engineering knowledge platforms. The attacker exfiltrated portions of BIG-IP source code, details of undisclosed vulnerabilities under development, customer configuration details, and internal engineering documentation. There is no evidence of compromise to CRM, financial, or support systems, nor the software supply chain. The exposure of unpublished vulnerabilities and source code significantly increases the risk of future exploits against BIG-IP deployments worldwide. Organizations using BIG-IP should urgently reassess threat models and patching strategies, anticipating that adversaries may develop exploits from the leaked information. This incident highlights the increasing targeting of critical infrastructure vendors by nation-state actors and the challenges posed by long dwell times. No known exploits are currently in the wild, but the breach is rated critical due to the potential impact. European organizations relying on BIG-IP should prioritize monitoring, segmentation, and rapid patch deployment once fixes are available.

A high-severity vulnerability in Zendesk's email handling allows attackers to exploit lax authentication mechanisms to launch email bombing attacks. These attacks can overwhelm Zendesk's ticketing system by flooding it with massive volumes of emails, potentially disrupting customer support operations. Although no known exploits are currently active in the wild, the vulnerability poses a significant risk due to the critical role Zendesk plays in customer service for many organizations. European companies relying on Zendesk could face service degradation or denial of support capabilities, impacting business continuity and customer trust. Mitigation requires Zendesk to strengthen authentication controls on incoming emails and implement rate limiting or filtering to detect and block email floods. Countries with high Zendesk adoption and significant customer service sectors, such as the UK, Germany, France, and the Netherlands, are most at risk. Given the ease of exploitation without authentication and the potential for widespread disruption, the threat severity is assessed as high. Defenders should prioritize monitoring email traffic patterns and liaise with Zendesk for timely patches or configuration updates.

Vulnerability#infosecnews#redditGermany+3

A high-severity vulnerability in Cisco switches' SNMP implementation has been exploited by hackers to deploy a rootkit, enabling persistent unauthorized control over network switches. Although no specific affected versions or patches have been disclosed, the exploitation allows attackers to compromise the integrity and availability of critical network infrastructure. This threat poses significant risks to European organizations relying on Cisco networking equipment, potentially disrupting operations and enabling further lateral attacks. Mitigation requires immediate network monitoring for anomalous SNMP activity, restricting SNMP access to trusted hosts, and applying any forthcoming Cisco security updates promptly. Countries with high Cisco market penetration and critical infrastructure reliance, such as Germany, France, and the UK, are most at risk. Given the rootkit deployment and ease of exploitation without user interaction, the threat severity is assessed as high. Defenders must prioritize detection and containment to prevent persistent compromise of network devices.

Vulnerability#infosecnews#redditGermany+2

A maximum-severity vulnerability in Adobe software has been confirmed by CISA to be actively exploited in the wild. Although specific affected versions and technical details are not provided, the flaw is rated high severity and is now leveraged by attackers. This exploitation poses significant risks to confidentiality, integrity, and availability of affected systems. European organizations using Adobe products are at risk, especially those with critical infrastructure or sensitive data. Mitigation requires immediate patching once updates are available, enhanced monitoring for exploitation attempts, and restricting Adobe software usage where possible. Countries with high Adobe market penetration and strategic digital infrastructure, such as Germany, France, and the UK, are likely most impacted. Given the active exploitation and high severity, the threat is assessed as critical. Defenders should prioritize vulnerability management and incident detection related to Adobe products to reduce exposure.

News#infosecnews#redditGermany+7

A critical zero-day vulnerability in Gladinet file-sharing software was recently fixed after being actively exploited. The flaw allowed attackers to compromise affected systems, posing significant risks to confidentiality, integrity, and availability. Although specific technical details and affected versions are not disclosed, the exploit was urgent enough to warrant immediate patching. European organizations using Gladinet software for file sharing are at risk of data breaches and operational disruptions. Mitigation requires prompt patch application and enhanced monitoring of file-sharing activities. Countries with higher adoption of Gladinet or strategic industries relying on secure file sharing are more likely to be targeted. Given the active exploitation and critical severity, organizations must prioritize remediation to prevent potential damage. No CVSS score is available, but the threat is assessed as critical due to its impact and exploitation status.

A high-severity vulnerability has been reported affecting ICTBroadcast servers, where attackers exploit a flaw in cookie handling to gain remote shell access. This exploit allows unauthorized remote code execution, potentially compromising server confidentiality, integrity, and availability. Although no specific affected versions or patches have been disclosed, the threat is considered urgent due to the nature of the access gained. There are no known exploits in the wild yet, and public discussion remains minimal. European organizations using ICTBroadcast for communication or call center operations could face significant risks, including data breaches and service disruptions. Mitigation requires immediate review of cookie management, network segmentation, and monitoring for suspicious activity. Countries with higher ICTBroadcast adoption and critical infrastructure relying on such systems are at greater risk. Given the ease of exploitation and impact scope, the threat severity is assessed as high. Defenders should prioritize detection and containment while awaiting official patches or advisories.

A critical zero-day vulnerability in Oracle software has been linked to a security breach at Harvard University. The exploit is currently under investigation and has not yet been publicly detailed or patched. There are no confirmed known exploits in the wild, but the breach indicates active exploitation. This zero-day vulnerability poses a significant risk to confidentiality, integrity, and availability of affected Oracle systems. European organizations using Oracle products should be vigilant due to the widespread use of Oracle software in enterprise environments. Immediate mitigation steps include enhanced monitoring, network segmentation, and applying any interim security controls recommended by Oracle once available. Countries with high Oracle adoption and critical academic or research institutions are at greater risk. Given the critical severity and potential for significant impact without available patches, organizations must prioritize detection and containment strategies. The threat landscape is evolving, and further details are expected as investigations progress.

Blind enumeration of gRPC services exploits subtle differences in error messages returned by gRPC servers when invalid requests are made. Attackers can map available services and methods even when server reflection is disabled, by sending crafted requests and analyzing error codes such as UNIMPLEMENTED, NOT_FOUND, and INVALID_ARGUMENT. This technique reveals service sprawl, method proliferation, and inconsistent authentication controls, often arising from partial migrations and fragmented development teams. Although crafting valid protobuf messages still requires additional effort, enumerating service existence significantly aids attackers in reconnaissance. The threat is particularly relevant for organizations using gRPC-based microservices architectures without strict security controls or proper network segmentation. European organizations with complex service deployments and legacy microservices are at risk of information disclosure and potential unauthorized access. Mitigation involves strict authentication enforcement on all methods, network segmentation of internal services, disabling or tightly controlling reflection endpoints, and regular audits for service sprawl and auth drift. Countries with strong technology sectors and widespread gRPC adoption, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. The severity is assessed as medium due to the information disclosure nature, the need for some attacker effort, and the lack of direct remote code execution or data manipulation without further exploitation.

Campaign#netsec#redditGermany+6

A critical zero-day vulnerability has been discovered in Gladinet file sharing software, currently being exploited by hackers. Although specific technical details and affected versions are not disclosed, the exploit is confirmed to be active in the wild. Gladinet software is used for enterprise file sharing and cloud storage integration, making this vulnerability particularly dangerous for organizations relying on it. The zero-day nature means no official patch is available yet, increasing the risk of data breaches, unauthorized access, and potential lateral movement within networks. European organizations using Gladinet face significant risks to confidentiality and integrity of sensitive data. Immediate mitigation steps include restricting Gladinet software usage, monitoring network traffic for anomalies, and applying any available vendor advisories. Countries with higher adoption of Gladinet and critical infrastructure relying on file sharing solutions are at greater risk. Given the critical severity and active exploitation, organizations must prioritize incident response and threat hunting related to this vulnerability.

Forescout honeypot caught hacktivist activity targeting a decoy water treatment plant in Sept.2025. A Russian-aligned group, TwoNet, claimed responsibility for the attack. The group logged into the human-machine interface (HMI) for: defacement, process disruption, manipulation, and evasion.

Malware#twonet#hacktivistGermany+2

A high-severity authentication bypass vulnerability has been identified in the Service Finder WordPress plugin, which is currently under active exploit. This flaw allows attackers to bypass authentication controls, potentially granting unauthorized access to administrative or sensitive functionalities within affected WordPress sites. Although specific affected versions and patch information are not provided, the exploitability of this vulnerability poses significant risks to website confidentiality, integrity, and availability. European organizations using this plugin, especially those relying on WordPress for service-related websites, are at risk of compromise. Mitigation requires immediate identification of the plugin on sites, restricting access, and monitoring for suspicious activity. Countries with high WordPress usage and significant service industry web presence, such as Germany, the UK, France, and the Netherlands, are most likely to be impacted. Given the ease of exploitation without authentication and the potential for broad impact, the severity is assessed as high. Defenders should prioritize detection, containment, and patching once available to prevent unauthorized access and potential data breaches.

Vulnerability#infosecnews#redditGermany+3

A high-severity vulnerability affecting Gladinet and TrioFox products enables attackers to escalate from Local File Inclusion (LFI) to Remote Code Execution (RCE). Although no CVSS score or patch information is currently available, active exploitation has been detected, highlighting the urgency for organizations using these products to assess their exposure. The vulnerability allows attackers to execute arbitrary code remotely, potentially compromising confidentiality, integrity, and availability of affected systems. European organizations using Gladinet or TrioFox for file sharing or cloud gateway services are at risk, especially in countries with higher adoption of these solutions. Mitigation requires immediate network segmentation, monitoring for unusual activity, and applying vendor updates once available. Given the lack of authentication requirements and the ease of exploitation from LFI to RCE, the threat severity is assessed as high. Countries with significant cloud infrastructure and digital transformation initiatives, such as Germany, France, and the UK, are more likely to be targeted. Defenders should prioritize detection of exploitation attempts and prepare incident response plans to contain potential breaches.

Vulnerability#infosecnews#redditGermany+2

The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability in Grafana to its Known Exploited Vulnerabilities catalog. Grafana is a widely used open-source platform for monitoring and observability. Although specific technical details and affected versions are not provided, the inclusion in CISA's catalog indicates active exploitation or significant risk. The severity is assessed as medium, with no known exploits currently in the wild. European organizations using Grafana for monitoring critical infrastructure or services could face risks to data confidentiality and system integrity if unpatched. Mitigation requires timely patching once updates are available, restricting access to Grafana dashboards, and monitoring for suspicious activity. Countries with high adoption of Grafana and critical infrastructure reliance on monitoring platforms, such as Germany, France, and the UK, are more likely to be impacted. Given the medium severity, ease of exploitation is uncertain, but the potential impact on availability and confidentiality warrants proactive defense measures.

News#infosecnews#redditGermany+5

On June 8th, 2025, we received a submission through our Bug Bounty Program for an Authentication Bypass vulnerability in Service Finder Bookings, a WordPress plugin bundled with the Service Finder theme. This theme has been sold to approximately 6,000 customers. This vulnerability makes it possible for an unauthenticated attacker to gain access to any account on a site including accounts with the ‘administrator’ role. The vendor released the patched version on July 17, 2025, and we publicly disclosed this vulnerability on July 31, 2025.

Campaign#service finder bookings#service finderGermany+9

Hackers are exploiting vulnerabilities in WordPress sites, specifically targeting themes or plugins, to facilitate advanced ClickFix phishing attacks. These attacks leverage compromised WordPress sites as infrastructure to host or redirect victims to phishing pages, increasing the credibility and reach of the campaigns. Although no specific affected versions or patches are currently identified, the threat is considered high severity due to the potential scale and impact. No known exploits are reported in the wild yet, but the threat is emerging and requires immediate attention. European organizations using WordPress for their websites are at risk, especially those with high web presence or e-commerce platforms. Attackers benefit from the widespread use of WordPress and the trust users place in legitimate websites, making phishing campaigns more effective. Mitigation involves securing WordPress installations, auditing themes and plugins, and monitoring for unauthorized changes or suspicious traffic. Countries with large WordPress user bases and significant online business sectors, such as Germany, the UK, France, and the Netherlands, are more likely to be targeted. The threat severity is assessed as high due to the ease of exploitation, potential for widespread impact, and significant confidentiality and integrity risks without requiring user interaction beyond clicking a link.

Vulnerability#infosecnews#redditGermany+3

OpenAI has reported an increasing trend of foreign threat groups exploiting AI tools for malicious purposes. These threat actors are leveraging AI capabilities to enhance cyberattacks, automate phishing, generate malicious code, and evade detection. While no specific vulnerabilities or exploits have been detailed, the growing misuse of AI tools represents a medium-level security concern. European organizations could face increased risks in confidentiality, integrity, and availability due to AI-augmented attacks. Mitigation requires proactive monitoring of AI tool usage, employee training on AI-driven threats, and enhanced detection capabilities tailored to AI-generated attack patterns. Countries with high AI adoption and critical infrastructure reliance on AI technologies are most at risk. Given the ease of AI tool access and the broad scope of potential targets, the suggested severity is medium. Defenders should prioritize understanding AI threat landscapes and integrating AI threat intelligence into their cybersecurity strategies.

News#infosecnews#redditGermany+6

The Clop ransomware group has been exploiting a zero-day vulnerability in Oracle software since early August to conduct data theft operations. This critical vulnerability allows attackers to gain unauthorized access to sensitive data without requiring prior authentication. The exploitation is ongoing and targets organizations using vulnerable Oracle products, enabling attackers to exfiltrate valuable information. European organizations relying on Oracle infrastructure are at significant risk, especially those in sectors with high-value data. The threat is severe due to the zero-day nature, lack of available patches, and the involvement of a sophisticated threat actor known for ransomware and data extortion. Immediate mitigation efforts are necessary to reduce exposure, including enhanced monitoring and network segmentation. Countries with large Oracle deployments and critical infrastructure are more likely to be targeted. The threat severity is assessed as critical given the potential impact on confidentiality and integrity, ease of exploitation, and the scope of affected systems. Defenders should prioritize detection and containment strategies while awaiting official patches from Oracle.

Medusa ransomware is reported to be exploiting a vulnerability in the GoAnywhere Managed File Transfer (MFT) software, as confirmed by Microsoft. This exploitation allows attackers to deploy ransomware payloads, potentially encrypting critical files and demanding ransom payments. Although no specific affected versions or CVEs have been disclosed, the threat is considered medium severity due to the potential impact on confidentiality, integrity, and availability of data. The attack vector involves leveraging a flaw in a widely used enterprise file transfer solution, which is common in European organizations for secure data exchange. No known exploits in the wild have been confirmed yet, but the threat is newsworthy and emerging. European organizations using GoAnywhere MFT should prioritize patching and monitoring for suspicious activity. Countries with significant adoption of GoAnywhere MFT and critical infrastructure relying on secure file transfers are at higher risk. Mitigation includes applying vendor patches once available, restricting network access to MFT servers, implementing robust backup strategies, and enhancing detection capabilities for ransomware behaviors. Given the medium severity, proactive defense is essential to prevent potential ransomware incidents impacting business continuity and data security.

Malware#infosecnews#redditGermany+7

The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added multiple vulnerabilities affecting Oracle, Mozilla, Microsoft Windows, the Linux Kernel, and Microsoft Internet Explorer to its Known Exploited Vulnerabilities catalog. These vulnerabilities are recognized as actively exploited or pose a significant risk, prompting increased attention for remediation. Although no specific CVSS scores or detailed technical exploit information are provided, the inclusion in CISA's catalog indicates a medium severity level with potential impacts on confidentiality, integrity, and availability. European organizations using these widely deployed software products are at risk, especially those in critical infrastructure, government, and large enterprises. Mitigation requires prioritizing patch management, monitoring for exploitation attempts, and applying vendor advisories promptly. Countries with high adoption of these technologies and strategic importance in digital infrastructure, such as Germany, France, the UK, and the Netherlands, are likely to be most affected. Given the broad scope and active exploitation potential, the suggested severity is medium. Defenders should focus on rapid vulnerability assessment and remediation to reduce exposure.

News#infosecnews#redditGermany+7

A critical vulnerability in the GoAnywhere managed file transfer software has been exploited in active ransomware attacks, as reported by Microsoft and covered by BleepingComputer. The flaw allows attackers to execute arbitrary code remotely, enabling ransomware deployment without requiring user interaction or authentication. This vulnerability poses a significant risk to organizations relying on GoAnywhere for secure file transfers, potentially leading to data encryption, operational disruption, and financial loss. European organizations using GoAnywhere are at heightened risk, especially in countries with high adoption of this software in critical infrastructure and enterprise sectors. Immediate patching and enhanced network monitoring are essential to mitigate exploitation. Due to the critical nature and ease of exploitation, this threat demands urgent attention from cybersecurity teams across Europe.

Malware#infosecnews#redditGermany+7