Threats tagged 'exploit'

A critical zero-day vulnerability targeting Zimbra email users has been identified, exploiting iCalendar attachments to compromise systems. The exploit leverages maliciously crafted calendar files sent via email, potentially allowing attackers to execute arbitrary code or gain unauthorized access. Although no patches or CVEs have been published yet, the threat is considered high priority due to the widespread use of Zimbra in enterprise environments. There are currently no known exploits in the wild, but the minimal discussion level suggests early-stage awareness. European organizations using Zimbra are at risk, especially those with significant reliance on this collaboration platform. Attackers could disrupt confidentiality, integrity, and availability of email communications and related services. Immediate mitigation involves restricting or filtering iCalendar attachments, enhancing email gateway protections, and monitoring for suspicious activity. Countries with high adoption of Zimbra and strategic importance in finance, government, and technology sectors are most vulnerable. Given the critical severity and ease of exploitation via email attachments without authentication, rapid defensive measures are essential.

U.S. CISA adds Smartbedded Meteobridge, Samsung, Juniper ScreenOS, Jenkins, and GNU Bash flaws to its Known Exploited Vulnerabilities catalog Source: https://securityaffairs.com/182925/hacking/u-s-cisa-adds-smartbedded-meteobridge-samsung-juniper-screenos-jenkins-and-gnu-bash-flaws-to-its-known-exploited-vulnerabilities-catalog.html

News#infosecnews#redditGermany+7

ThreatsDay Bulletin: CarPlay Exploit, BYOVD Tactics, SQL C2 Attacks, iCloud Backdoor Demand & More Source: https://thehackernews.com/2025/10/threatsday-bulletin-carplay-exploit.html

AMI BMC vulns are on the CISA Known Exploited Vulnerabilities catalog now. I think this is the first BMC vuln to hit the KEV. Here are some Nuclei templates to detect this vuln in your BMCs.

News#netsec#redditGermany+9

Hackers Exploit Milesight Routers to Send Phishing SMS to European Users Source: https://thehackernews.com/2025/10/hackers-exploit-milesight-routers-to.html

Software Secured | Hacking Furbo 2: Mobile App and P2P Exploits | USA Source: https://www.softwaresecured.com/post/hacking-furbo-a-hardware-research-project-part-2-mobile-and-p2p-exploits

Tool#netsec#redditGermany+5

Researchers Disclose Google Gemini AI Flaws Allowing Prompt Injection and Cloud Exploits Source: https://thehackernews.com/2025/09/researchers-disclose-google-gemini-ai.html

News#infosecnews#redditGermany+7

Broadcom patches VMware Zero-Day actively exploited by UNC5174 Source: https://securityaffairs.com/182816/uncategorized/broadcom-patches-vmware-zero-day-actively-exploited-by-unc5174.html

Chinese hackers exploiting VMware zero-day since October 2024 Source: https://www.bleepingcomputer.com/news/security/chinese-hackers-exploiting-vmware-zero-day-since-october-2024/

CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems Source: https://thehackernews.com/2025/09/cisa-sounds-alarm-on-critical-sudo-flaw.html

News#infosecnews#redditGermany+8

FullHunt 💜 Open-Source: 39,408 Exploits from 0day.today is Back Online Source: https://fullhunt.io/blog/2025/09/28/fullhunt-releases-0day-today-archive.html

News#netsec#redditGermany+9

Windows Heap Exploitation - From Heap Overflow to Arbitrary R/W Source: https://mrt4ntr4.github.io/Windows-Heap-Exploitation-dadadb/

News#netsec#redditGermany+9

Cisco warns of ASA firewall zero-days exploited in attacks Source: https://www.bleepingcomputer.com/news/security/cisco-warns-of-asa-firewall-zero-days-exploited-in-attacks/

News#infosecnews#redditGermany+9

Hacking Furbo - A Hardware Research Project – Part 5: Exploiting BLE Source: https://www.softwaresecured.com/post/hacking-furbo-a-hardware-research-project-part-5-exploiting-ble

Tool#netsec#redditGermany+5

Cisco fixed actively exploited zero-day in Cisco IOS and IOS XE software Source: https://securityaffairs.com/182564/hacking/cisco-fixed-actively-exploited-zero-day-in-cisco-ios-and-ios-xe-software.html

ReDisclosure: New technique for exploiting Full-Text Search in MySQL (myBB case study) Source: https://exploit.az/posts/wor/

Cisco warns of IOS zero-day vulnerability exploited in attacks Source: https://www.bleepingcomputer.com/news/security/cisco-warns-of-ios-zero-day-vulnerability-exploited-in-attacks/

State-Sponsored Hackers Exploiting Libraesva Email Security Gateway Vulnerability Source: https://thehackernews.com/2025/09/state-sponsored-hackers-exploiting.html

Libraesva ESG issues emergency fix for bug exploited by state hackers Source: https://www.bleepingcomputer.com/news/security/libraesva-esg-issues-emergency-fix-for-bug-exploited-by-state-hackers/

News#infosecnews#redditGermany+9

CISA says hackers breached federal agency using GeoServer exploit Source: https://www.bleepingcomputer.com/news/security/cisa-says-hackers-breached-federal-agency-using-geoserver-exploit/