WatchGuard warns of critical vulnerability in Firebox firewalls
Source: https://www.bleepingcomputer.com/news/security/watchguard-warns-of-critical-vulnerability-in-firebox-firewalls/
A path traversal in LG webOS TV allows unauthenticated file downloads, leading to an authentication bypass for the secondscreen.gateway service, which could lead to a full device takeover.
Windows Defender's vulnerability: Break The Protective Shell Of Windows Defender With The Folder Redirect Technique
Source: https://www.zerosalarium.com/2025/09/Break-Protective-Shell-Windows-Defender-Folder-Redirect-Technique-Symlink.html
CISA Orders Immediate Patch of Critical Sitecore Vulnerability Under Active Exploitation
Source: https://thehackernews.com/2025/09/cisa-orders-immediate-patch-of-critical.html
A critical flaw in the [Mobile Security Framework (MobSF)](https://cybersecuritynews.com/mobsf-framework-zero-day-vulnerability/) has been discovered, allowing authenticated attackers to upload and execute malicious files by exploiting improper path validation.
**TL;DR: Discovered an unpatched zero-day in TP-Link routers (AX10/AX1500) that allows remote code execution. Reported to TP-Link on May 11th, 2024 - still unpatched.4,247 vulnerable devices found online.**
# The Discovery
Used automated taint analysis to find a stack-based buffer overflow in TP-Link's CWMP (TR-069) implementation. The vulnerability exists in function `sub_1e294` that processes SOAP SetParameterValues messages.
**Key Technical Details:**
* Stack buffer: 3072 bytes
* PC register overwrite: 3112 bytes (payload: "A"\*3108 + "BBBB")
* Result: `pc = 0x42424242` (full control)
* Canary exploit mitigations
# Proof of Concept
// Vulnerable code pattern
char* result_2 = strstr(s, "cwmp:SetParameterValues");
// Size calculated from user input - BAD PRACTICE
strncpy(stack_buffer, user_data, calculated_size);
// OVERFLOW!
Exploitation requires setting a malicious CWMP server URL in router config, then device connects and gets pwned.
# Impact
**Affected Models:**
* TP-Link Archer AX10 (all hardware versions V1, V1.2, V2, V2.6)
* TP-Link Archer AX1500 (identical binary)
* Potentially: EX141, Archer VR400, TD-W9970
**Firmware Versions:** 1.3.2, 1.3.8, 1.3.9, 1.3.10 (all vulnerable)
**Internet Exposure:** 4,247 unique IPs confirmed vulnerable via Fofa search
# Why This Matters
Router security is often terrible - default passwords, weak configs, other vulns. Getting config access isn't that hard, and setting up a rogue CWMP server is trivial. Once you change the TR-069 server URL, the router connects to your malicious server and you get root.
# Timeline
* **Discovery:** January 2025 (automated analysis)
* **Vendor Notification:** May 11th, 2024
* **Current Status:** Probably Patched
* **Public Disclosure:** Now
We recently published a breakdown of a subtle but impactful vulnerability: misconfigured upload paths that allow public access to uploaded files.
The core issue occurs when a webserver accepts file uploads but stores them in a directory directly accessible via the browser. If there’s no validation or access control, attackers can upload malicious files—like webshells or phishing pages—and access them immediately.
How do others approach detecting and preventing this kind of misconfiguration? Have you seen this exploited in the wild? What tooling or scanning techniques do you use to catch it?
A loophole in VS Code Marketplace allows malicious actors to reuse names of removed extensions. ReversingLabs discovered this vulnerability after finding a malicious extension with the same name as one previously identified. The platform's documentation states that extension names must be unique, but removed extensions' names can be reused. This poses a risk of threat actors publishing malicious extensions under previously legitimate names. The research team conducted experiments to confirm this vulnerability, successfully publishing extensions with names of removed packages. This technique has been observed in other open-source platforms like PyPI. The discovery highlights the increasing popularity of VS Code Marketplace among malicious actors and the need for developers to be vigilant about package security.
Google Big Sleep AI Detection Tool Finds Critical 9.8 Chrome Vulnerability
Source: https://hackread.com/google-big-sleep-ai-tool-critical-chrome-vulnerability/
Docker Desktop Vulnerability Allowed Host Takeover on Windows and macOS
Source: https://hackread.com/docker-desktop-vulnerability-host-takeover-windows-macos/
A significant spike in brute-force traffic targeting Fortinet SSL VPNs was observed on August 3, with over 780 unique IPs triggering the Fortinet SSL VPN Bruteforcer tag. The activity was deliberate and precise, focusing on FortiOS. Two distinct waves of attacks were identified: a long-running set of brute-force activity and a sudden burst beginning August 5. The second wave shifted from targeting FortiOS to FortiManager - FGFM profile. Historical data revealed a potential residential origin or proxy use. The analysis suggests evolving attack patterns and potential reuse of tooling. Research indicates that such spikes often precede new vulnerability disclosures within six weeks. Defenders are advised to use GreyNoise to search for and block malicious IPs associated with this campaign.
Carmaker’s Portal Vulnerability Could Have Allowed Hackers to Unlock Vehicles and Access Data
Source: https://hackread.com/carmaker-portal-flaw-hackers-unlock-cars-steal-data/
Lets imagine a scenario where you're coerced whether through threats, torture, or even legal pressure to reveal the password to your secure vault.
In countries like the US, UK, and Australia, refusing to provide passwords to law enforcement can result months in prison in certain cases.
I invented a solution called [Veilith](https://www.veilith.com/) ( [veilith.com](http://veilith.com/) ) addresses this critical vulnerability with perfect deniable encryption. It supports multiple passwords, each unlocking distinct blocks of encrypted data that are indistinguishable from random noise even to experts. And have a lot of different features to protect your intellectual properties.
In high-stakes situations, simply provide a decoy password and plausibly deny the existence of anything more.
Dive deeper by reading the whitepaper, exploring the open-source code, or asking me any questions you may have.
Apple Patches Safari Vulnerability Also Exploited as Zero-Day in Google Chrome
Source: https://thehackernews.com/2025/07/apple-patches-safari-vulnerability-also.html
