Oracle has released an emergency patch addressing a critical security flaw in its E-Business Suite. Although specific technical details about the vulnerability are not disclosed, the severity is rated critical, indicating a high risk of exploitation. No known exploits are currently reported in the wild, but the urgency of the patch suggests potential for significant impact if left unpatched. European organizations using Oracle E-Business Suite should prioritize applying this patch to prevent possible compromise. The flaw could affect confidentiality, integrity, and availability of enterprise resource planning data and processes. Countries with a high adoption of Oracle E-Business Suite and significant enterprise infrastructure are most at risk. Immediate mitigation involves deploying the official patch and reviewing access controls and monitoring for suspicious activity. Given the critical nature and potential for broad impact, this vulnerability demands swift action to avoid operational disruption or data breaches.
Juniper Networks has released patches addressing nine critical vulnerabilities in its Junos Space network management platform. These flaws are rated critical due to their potential to allow remote code execution, privilege escalation, or denial of service, impacting the confidentiality, integrity, and availability of managed network devices. Although no known exploits are currently reported in the wild, the severity and nature of these vulnerabilities make timely patching essential. European organizations relying on Junos Space for network management face significant risks, including potential disruption of network operations and unauthorized access to sensitive infrastructure. Mitigation requires immediate deployment of Juniper's patches, enhanced network segmentation, strict access controls, and continuous monitoring for suspicious activity. Countries with high adoption of Juniper networking equipment, such as Germany, France, the UK, and the Netherlands, are particularly at risk due to their critical infrastructure and large enterprise networks. Given the critical impact and ease of exploitation without authentication, the suggested severity is critical. Defenders should prioritize patch management and incident readiness to mitigate potential exploitation risks effectively.
Google Patches “Gemini Trifecta” Vulnerabilities in Gemini AI Suite That Could Steal User Data
Source: https://hackread.com/google-gemini-trifecta-vulnerabilities-gemini-ai/
Microsoft Patches Critical Entra ID Flaw Enabling Global Admin Impersonation Across Tenants
Source: https://thehackernews.com/2025/09/microsoft-patches-critical-entra-id.html
CVE-2025-10585 is a critical zero-day vulnerability in the Google Chrome browser's V8 JavaScript and WebAssembly engine, involving a type confusion flaw. This vulnerability has been actively exploited in the wild in 2025 and was discovered by Google's Threat Analysis Group. It allows attackers to corrupt memory, potentially leading to arbitrary code execution, unauthorized access, or service disruption. Google has released patches in Chrome version 140.0.7339.185/.186 and later to address this and other zero-day vulnerabilities. The vulnerability is part of a series of actively exploited Chrome zero-days in 2025. Immediate patching is strongly recommended to mitigate the risk. The vulnerability poses a critical threat due to its active exploitation and potential impact on user security. There is no detailed public technical information about the exploit methods or affected Chrome versions prior to the patch. No specific countries are confirmed as targeted, though European countries with heavy Chrome usage were noted as at elevated risk.
CISA Orders Immediate Patch of Critical Sitecore Vulnerability Under Active Exploitation
Source: https://thehackernews.com/2025/09/cisa-orders-immediate-patch-of-critical.html
**TL;DR: Discovered an unpatched zero-day in TP-Link routers (AX10/AX1500) that allows remote code execution. Reported to TP-Link on May 11th, 2024 - still unpatched.4,247 vulnerable devices found online.**
# The Discovery
Used automated taint analysis to find a stack-based buffer overflow in TP-Link's CWMP (TR-069) implementation. The vulnerability exists in function `sub_1e294` that processes SOAP SetParameterValues messages.
**Key Technical Details:**
* Stack buffer: 3072 bytes
* PC register overwrite: 3112 bytes (payload: "A"\*3108 + "BBBB")
* Result: `pc = 0x42424242` (full control)
* Canary exploit mitigations
# Proof of Concept
// Vulnerable code pattern
char* result_2 = strstr(s, "cwmp:SetParameterValues");
// Size calculated from user input - BAD PRACTICE
strncpy(stack_buffer, user_data, calculated_size);
// OVERFLOW!
Exploitation requires setting a malicious CWMP server URL in router config, then device connects and gets pwned.
# Impact
**Affected Models:**
* TP-Link Archer AX10 (all hardware versions V1, V1.2, V2, V2.6)
* TP-Link Archer AX1500 (identical binary)
* Potentially: EX141, Archer VR400, TD-W9970
**Firmware Versions:** 1.3.2, 1.3.8, 1.3.9, 1.3.10 (all vulnerable)
**Internet Exposure:** 4,247 unique IPs confirmed vulnerable via Fofa search
# Why This Matters
Router security is often terrible - default passwords, weak configs, other vulns. Getting config access isn't that hard, and setting up a rogue CWMP server is trivial. Once you change the TR-069 server URL, the router connects to your malicious server and you get root.
# Timeline
* **Discovery:** January 2025 (automated analysis)
* **Vendor Notification:** May 11th, 2024
* **Current Status:** Probably Patched
* **Public Disclosure:** Now
Hackers Could Take Over Apple Devices Via Malicious Images – Patch Now!
Source: https://hackread.com/hackers-take-over-apple-devices-malicious-images-patch/
New DripDropper Malware Exploits Linux Flaw Then Patches It Lock Rivals Out
Source: https://hackread.com/dripdropper-malware-exploits-linux-flaw-patche-lock-out/
Over 800 N-able servers left unpatched against critical flaws
Source: https://www.bleepingcomputer.com/news/security/over-800-n-able-servers-left-unpatched-against-critical-flaws/
# Summer cybersecurity news catch up
Paris Natural History Museum and hosting provider Francelink paralyzed, Google victim of an attack documented by their own services, urgent CISA directive for Exchange and 5 new KEV vulnerabilities, Microsoft Patch Tuesday with 111 vulnerabilities patched, Alltricks and Manpower compromised, Dell laptops hacked with vegetables 🤯, etc.
There are also some cool articles and cool tools.
Content in french but most of the articles are in english.
Kudos to Axis for patching their stuff. Looks like someone in MiTM could have leveraged their protocol to hit their server and camera feeds/client. This was a Black Hat talk too.
Over 29,000 Unpatched Microsoft Exchange Servers Leaving Networks at Risk
Source: https://hackread.com/29k-microsoft-exchange-servers-unpatched-networks-risk/
