Chinese hackers exploiting VMware zero-day since October 2024
Source: https://www.bleepingcomputer.com/news/security/chinese-hackers-exploiting-vmware-zero-day-since-october-2024/
Google Issues Urgent Chrome 140 Update After Zero-Day Exploited in the Wild
Source: https://www.lansweeper.com/blog/vulnerability/google-issues-urgent-chrome-140-update-after-zero-day-exploited-in-the-wild/?utm_source=reddit&utm_medium=social&utm_campaign=ls-global-vulnerability-2025&utm_content=google-chrome-140
CVE-2025-10585 is a critical zero-day vulnerability in the Google Chrome browser's V8 JavaScript and WebAssembly engine, involving a type confusion flaw. This vulnerability has been actively exploited in the wild in 2025 and was discovered by Google's Threat Analysis Group. It allows attackers to corrupt memory, potentially leading to arbitrary code execution, unauthorized access, or service disruption. Google has released patches in Chrome version 140.0.7339.185/.186 and later to address this and other zero-day vulnerabilities. The vulnerability is part of a series of actively exploited Chrome zero-days in 2025. Immediate patching is strongly recommended to mitigate the risk. The vulnerability poses a critical threat due to its active exploitation and potential impact on user security. There is no detailed public technical information about the exploit methods or affected Chrome versions prior to the patch. No specific countries are confirmed as targeted, though European countries with heavy Chrome usage were noted as at elevated risk.
New TP-Link zero-day surfaces as CISA warns other flaws are exploited
Source: https://www.bleepingcomputer.com/news/security/new-tp-link-zero-day-surfaces-as-cisa-warns-other-flaws-are-exploited/
A critical flaw in the [Mobile Security Framework (MobSF)](https://cybersecuritynews.com/mobsf-framework-zero-day-vulnerability/) has been discovered, allowing authenticated attackers to upload and execute malicious files by exploiting improper path validation.
**TL;DR: Discovered an unpatched zero-day in TP-Link routers (AX10/AX1500) that allows remote code execution. Reported to TP-Link on May 11th, 2024 - still unpatched.4,247 vulnerable devices found online.**
# The Discovery
Used automated taint analysis to find a stack-based buffer overflow in TP-Link's CWMP (TR-069) implementation. The vulnerability exists in function `sub_1e294` that processes SOAP SetParameterValues messages.
**Key Technical Details:**
* Stack buffer: 3072 bytes
* PC register overwrite: 3112 bytes (payload: "A"\*3108 + "BBBB")
* Result: `pc = 0x42424242` (full control)
* Canary exploit mitigations
# Proof of Concept
// Vulnerable code pattern
char* result_2 = strstr(s, "cwmp:SetParameterValues");
// Size calculated from user input - BAD PRACTICE
strncpy(stack_buffer, user_data, calculated_size);
// OVERFLOW!
Exploitation requires setting a malicious CWMP server URL in router config, then device connects and gets pwned.
# Impact
**Affected Models:**
* TP-Link Archer AX10 (all hardware versions V1, V1.2, V2, V2.6)
* TP-Link Archer AX1500 (identical binary)
* Potentially: EX141, Archer VR400, TD-W9970
**Firmware Versions:** 1.3.2, 1.3.8, 1.3.9, 1.3.10 (all vulnerable)
**Internet Exposure:** 4,247 unique IPs confirmed vulnerable via Fofa search
# Why This Matters
Router security is often terrible - default passwords, weak configs, other vulns. Getting config access isn't that hard, and setting up a rogue CWMP server is trivial. Once you change the TR-069 server URL, the router connects to your malicious server and you get root.
# Timeline
* **Discovery:** January 2025 (automated analysis)
* **Vendor Notification:** May 11th, 2024
* **Current Status:** Probably Patched
* **Public Disclosure:** Now
FreePBX servers hacked via zero-day, emergency fix released
Source: https://www.bleepingcomputer.com/news/security/freepbx-servers-hacked-via-zero-day-emergency-fix-released/
Apple fixes new zero-day flaw exploited in targeted attacks
Source: https://www.bleepingcomputer.com/news/apple/apple-emergency-updates-fix-new-actively-exploited-zero-day/
Elastic rejects claims of a zero-day RCE flaw in Defend EDR
Source: https://www.bleepingcomputer.com/news/security/elastic-rejects-claims-of-a-zero-day-rce-flaw-in-defend-edr/
Details emerge on WinRAR zero-day attacks that infected PCs with malware
Source: https://www.bleepingcomputer.com/news/security/details-emerge-on-winrar-zero-day-attacks-that-infected-pcs-with-malware/
WinRAR Zero-Day Under Active Exploitation – Update to Latest Version Immediately
Source: https://thehackernews.com/2025/08/winrar-zero-day-under-active.html
