Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

youki

Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writes to unintended procfs locations. While resolving a path component-by-component, a shared-mount race can substitute intermediate components and redirect the final target. This issue is fixed in version 0.5.7.

CVE-2025-62596 is a vulnerability identified in Youki, a Rust-based container runtime, specifically in versions 0.5.6 and earlier. The flaw stems from insufficiently strict validation of write targets within Youki's AppArmor integration. AppArmor is a Linux kernel security module that confines programs according to a set of profiles. In this case, Youki's handling of AppArmor profiles allows a race condition during pathname resolution, where an attacker can exploit a shared-mount race to substitute intermediate path components. This substitution can redirect write operations to unintended locations within the proc filesystem (procfs), a virtual filesystem that exposes process and kernel information. The vulnerability is categorized under CWE-61 (Improper Restriction of Symbolic Links) and CWE-363 (Race Condition). The attack requires local privileges and user interaction, as indicated by the CVSS vector (AV:L, UI:A, PR:L). The impact on confidentiality, integrity, and availability is high because unauthorized writes to procfs can lead to privilege escalation, process manipulation, or denial of service. Although no known exploits are reported in the wild, the vulnerability poses a significant risk in containerized environments where Youki is deployed. The issue is resolved in Youki version 0.5.7 by enforcing stricter write-target validation and mitigating the race condition during pathname resolution.

Detailed information about CVE-2025-62596: CWE-61: UNIX Symbolic Link (Symlink) Following in youki-dev youki affecting youki-dev youki. Get real-time updates, t

CVE-2025-62596: CWE-61: UNIX Symbolic Link (Symlink) Following in youki-dev youki - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-62596: CWE-61: UNIX Symbolic Link (Symlink) Following in youki-dev youki

Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container's /dev/null as a file mask. This issue is fixed in version 0.5.7.

CVE-2025-62161 is a race condition vulnerability classified under CWE-363 (Race Condition) and CWE-61 (Improper Restriction of Symbolic Links) affecting the youki container runtime, a Rust-based container runtime. In versions 0.5.6 and earlier, the initial validation of the source /dev/null device node during bind mounting is insufficient. Specifically, when youki bind mounts the container's /dev/null as a file mask, the validation process does not adequately prevent a race condition that allows an attacker to replace or follow symbolic links. This flaw can be exploited to escape the container sandbox, potentially allowing an attacker with limited privileges inside the container to gain unauthorized access to the host system or other containers. The vulnerability requires local access with some privileges (PR:L), partial authentication (AT:P), and user interaction (UI:A), but the impact on confidentiality, integrity, and availability is high (VC:H, VI:H, VA:H). The CVSS 4.0 score is 7.3, indicating a high severity. The vulnerability was reserved in early October 2025 and published in November 2025. No known exploits have been reported in the wild yet. The issue is resolved in youki version 0.5.7, which includes improved validation to prevent the race condition and symbolic link following during bind mounts of /dev/null. This vulnerability is critical for container environments relying on youki, as container escape can lead to full host compromise.

Detailed information about CVE-2025-62161: CWE-363: Race Condition Enabling Link Following in youki-dev youki affecting youki-dev youki. Get real-time updates, 

CVE-2025-62161: CWE-363: Race Condition Enabling Link Following in youki-dev youki - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-62161: CWE-363: Race Condition Enabling Link Following in youki-dev youki


CVE-2025-62596: CWE-61: UNIX Symbolic Link (Symlink) Following in youki-dev youkiCVE-2025-62596 0 Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writes to unintended procfs locations. While resolving a path component-by-component, a shared-mount race can substitute intermediate components and redirect the final target. This issue is fixed in version 0.5.7. HighVulnerabilityGermanyFranceNetherlands+3#cve #cve-2025-62596 #cwe-61 Join the discussion	CVE Database V5	11/05/2025, 23:14:37 UTC Added: 11/05/2025, 23:23:52 UTC
CVE-2025-62161: CWE-363: Race Condition Enabling Link Following in youki-dev youkiCVE-2025-62161 0 Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container's /dev/null as a file mask. This issue is fixed in version 0.5.7. HighVulnerabilityGermanyFranceUnited Kingdom+4#cve #cve-2025-62161 #cwe-363 Join the discussion	CVE Database V5	11/05/2025, 23:09:09 UTC Added: 11/05/2025, 23:23:52 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional