Akira affiliates have been observed exploiting two common drivers as part of a suspected AV/EDR evasion effort following initial access involving SonicWall abuse. The drivers, rwdrv.sys and hlpdrv.sys, are being used to facilitate AV/EDR evasion or disablement through a Bring Your Own Vulnerable Driver (BYOVD) exploitation chain. This behavior has been prevalent in recent Akira ransomware incident response cases. The campaign may be driven by an unreported zero-day vulnerability in SonicWall VPNs. Defenders are advised to harden SonicWall VPNs, implement recommended mitigations, and use provided YARA rules for detection and response to pre-ransomware activity.
Cracking the Vault: how we found zero-day flaws in authentication, identity, and authorization in HashiCorp Vault
Source: https://cyata.ai/blog/cracking-the-vault-how-we-found-zero-day-flaws-in-authentication-identity-and-authorization-in-hashicorp-vault/
A potential zero-day vulnerability in SonicWall VPNs is being actively exploited to bypass MFA and deploy ransomware. The attack chain begins with a breach of the SonicWall appliance, followed by post-exploitation techniques including enumeration, detection evasion, lateral movement, and credential theft. Attackers quickly gain administrative access, establish command and control, move laterally, disable defenses, and deploy Akira ransomware. The threat actors use a mix of automated scripts and manual activity, abusing privileged accounts and utilizing various tools for persistence and data exfiltration. Immediate action is advised, including disabling SonicWall VPN access or severely restricting it, auditing service accounts, and hunting for malicious activity using provided indicators of compromise.
Apple Patches Safari Vulnerability Also Exploited as Zero-Day in Google Chrome
Source: https://thehackernews.com/2025/07/apple-patches-safari-vulnerability-also.html
Ivanti Zero-Days Exploited to Drop MDifyLoader and Launch In-Memory Cobalt Strike Attacks
Source: https://thehackernews.com/2025/07/ivanti-zero-days-exploited-to-drop.html
New CrushFTP zero-day exploited in attacks to hijack servers
Source: https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/
VMware fixes four ESXi zero-day bugs exploited at Pwn2Own Berlin
Source: https://www.bleepingcomputer.com/news/security/vmware-fixes-four-esxi-zero-day-bugs-exploited-at-pwn2own-berlin/
This report analyzes a historical class of security flaws known as “reflected vulnerabilities,”
which were once potent zero-day attack vectors targeting early Windows versions and antivirus
software. We examine classic exploitation techniques, such as parser attacks, packet fragmen-
tation, and syscall abuse, which could lead to remote code execution (RCE) or privilege esca-
lation. The objective is educational, demonstrating how modern defenses in Windows 11 and
Windows Defender—such as Address Space Layout Randomization (ASLR), Data Execution
Prevention (DEP), Control Flow Guard (CFG), and hardened parsers—have rendered this class
of vulnerabilities obsolete. Proof-of-concept (PoC) code is provided solely to illustrate histor-
ical concepts and is non-functional on modern systems, ensuring compliance with responsible
disclosure principles.
The zero-day that could've compromised every Cursor and Windsurf user
Source: https://www.bleepingcomputer.com/news/security/the-zero-day-that-couldve-compromised-every-cursor-and-windsurf-user/
Nippon Steel Solutions suffered a data breach following a zero-day attack
Source: https://securityaffairs.com/179766/data-breach/nippon-steel-solutions-data-breach.html
China-linked group Houken hit French organizations using zero-days
Source: https://securityaffairs.com/179602/apt/china-linked-group-houken-hit-french-organizations-using-zero-days.html
Google Patches Critical Zero-Day Flaw in Chrome’s V8 Engine After Active Exploitation
Source: https://thehackernews.com/2025/07/google-patches-critical-zero-day-flaw.html
Google patched a zero-day vulnerability in Chrome (CVE-2022-2856) related to insufficient validation of untrusted input in the Intents feature on Android. This flaw could allow arbitrary code execution and was actively exploited before the patch. The update included fixes for 11 vulnerabilities, with this being the fifth zero-day Chrome patch of the year. Google withheld detailed technical information until the patch was widely deployed to reduce risk. The vulnerability affects Chrome's handling of Intents, a deep linking mechanism replacing URI schemes on Android devices.
