A critical privilege-escalation vulnerability in LiteSpeed Web Server Enterprise versions before 6.3.7 allows a low-privilege shared-hosting user to potentially gain root access by bypassing isolation controls like CloudLinux CageFS. The advisory urges administrators to upgrade to version 6.3.7 or later to mitigate this risk. No CVE or public exploit details are currently available, but the issue is considered critical by cPanel.
The Gentlemen is a ransomware group active since July 2025, operating a Ransomware-as-a-Service model with dual-extortion tactics. They target Windows, Linux, and ESXi systems, focusing on extensive preparation before encrypting data. Their methods include privilege escalation using legitimate tools, persistence via registry and scheduled tasks, disabling security tools, deleting logs, and terminating backup services. They use strong encryption algorithms XChaCha20 and Curve25519. The group primarily targets medium-to-large organizations in the Asia-Pacific region, with a recent surge in activity. Victims face ransom demands with about 10-day deadlines and threats of data publication if unpaid.
Four local privilege escalation vulnerabilities have been discovered in SAPCAR, a tool used to handle SAR archive files in SAP environments. These bugs allow a local attacker to escalate privileges by exploiting flaws in the parsing of SAR archives. Although no known exploits are currently in the wild, the vulnerabilities pose a medium severity risk due to their potential to compromise system integrity. The issues require local access but do not need user interaction beyond executing the vulnerable tool. European organizations using SAP software and SAPCAR for archive management are at risk, especially those with critical SAP infrastructure. Mitigation involves applying patches once available, restricting local access to SAPCAR binaries, and monitoring for suspicious local activity. Countries with significant SAP deployments and critical industries relying on SAP, such as Germany and the UK, are most likely to be affected. Given the impact on integrity and the ease of local exploitation, the suggested severity is medium. Defenders should prioritize controlling local access and prepare for patch deployment to prevent privilege escalation attacks.
pathfinding.cloud is a newly introduced online library that catalogs AWS IAM privilege escalation paths, providing detailed mappings of how attackers might exploit misconfigurations or overly permissive policies to escalate privileges within AWS environments. While not a vulnerability itself, this resource can aid attackers in identifying and exploiting weaknesses in AWS IAM configurations. European organizations using AWS cloud services could face increased risk of privilege escalation attacks if their IAM policies are not properly secured. The threat is medium severity due to the potential impact on confidentiality and integrity, ease of exploitation given misconfigurations, and the broad use of AWS in Europe. Mitigation requires rigorous IAM policy audits, least privilege enforcement, continuous monitoring, and use of automated tools to detect privilege escalation paths. Countries with high AWS adoption and critical cloud infrastructure, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Defenders should prioritize reviewing IAM roles, permissions boundaries, and trust relationships to prevent abuse. This resource emphasizes the importance of proactive cloud security hygiene to reduce attack surface and privilege escalation risks.
Makop ransomware campaigns have recently been observed targeting Indian businesses, leveraging GuLoader malware for initial delivery and employing privilege escalation techniques to maximize impact. The ransomware encrypts victim data, demanding payment for recovery, and uses GuLoader as a downloader to evade detection and deploy payloads stealthily. Privilege escalation allows attackers to gain higher system privileges, facilitating widespread encryption and persistence. Although currently focused on India, the tactics used could pose risks to European organizations, especially those with similar security postures or supply chain links. No known exploits are reported in the wild yet, but the threat remains medium severity due to the combination of ransomware and privilege escalation. Defenders should prioritize monitoring for GuLoader activity, implement strict privilege management, and ensure robust endpoint detection. Countries with significant exposure to Indian business relations or similar targeted sectors should be particularly vigilant. The threat is assessed as medium severity given the moderate impact potential and complexity of exploitation.
A recently disclosed medium-severity vulnerability involves privilege escalation through AWS SageMaker execution roles. Attackers exploiting this issue can potentially gain elevated permissions beyond their intended scope by abusing misconfigurations or inherent weaknesses in SageMaker's role delegation. This threat does not currently have known exploits in the wild, but its presence highlights risks in cloud identity and access management. European organizations using AWS SageMaker for machine learning workloads could face confidentiality and integrity risks if attackers leverage this flaw. Mitigation requires careful auditing and tightening of SageMaker execution roles, including least privilege principles and monitoring role assumptions. Countries with significant AWS adoption and cloud-based AI initiatives, such as Germany, the UK, France, and the Netherlands, are more likely to be impacted. Given the medium severity, the threat demands prompt attention but is not immediately critical. Defenders should prioritize role permission reviews and implement detection for unusual role escalations to reduce risk.
A security researcher discovered 15 potential Linux Kernel vulnerabilities related to race conditions in the Virtual File System (VFS) layer, focusing on non-atomic file operations such as rename and chown. These flaws could allow local privilege escalation (LPE) by exploiting timing windows where security checks and critical operations are not atomic. The researcher developed a proof-of-concept exploit and a real-time mitigation based on CPU time monitoring but faced dismissal from Google’s bug bounty program. No official patches or CVEs exist yet, and no known exploits are in the wild. The vulnerabilities stem from architectural oversights in kernel transaction atomicity, posing critical risks to system integrity and security. European organizations relying on Linux systems could be significantly impacted, especially those with high-value targets or sensitive data. Immediate mitigation involves kernel-level atomic operation fixes and monitoring for abnormal CPU usage during vulnerable operations. Countries with large Linux deployments and strategic infrastructure are most at risk. The threat severity is assessed as critical due to the potential for full system compromise without user interaction or authentication.
A critical vulnerability in Grafana's SCIM implementation allows attackers to impersonate users and escalate privileges, potentially leading to full system compromise. The flaw has been assigned a CVSS score of 10.0, indicating maximum severity. Although no known exploits are currently in the wild, the vulnerability's nature and impact demand immediate attention. European organizations using Grafana for monitoring and analytics are at risk, especially those integrating SCIM for identity management. Exploitation requires no user interaction and can severely impact confidentiality, integrity, and availability. Patching is essential to mitigate this threat. Countries with high adoption of Grafana and strong reliance on SCIM-based identity federation are most vulnerable. Defenders should prioritize applying vendor patches, audit SCIM configurations, and monitor for unusual authentication activity. This vulnerability represents a critical risk to operational security and data protection in affected environments.
This threat involves a privilege escalation scenario arising from insecure deployment of Jupyter servers. When Jupyter is run with root privileges and without authentication tokens, attackers can exploit the terminal API via WebSocket to gain root shell access. This allows them to execute arbitrary commands, access kernel secrets, and hijack other users' notebook sessions. The issue is not a vulnerability in Jupyter itself but a dangerous misconfiguration and deployment anti-pattern. The terminal API, designed for legitimate shell access, becomes an attack vector if exposed improperly. European organizations running Jupyter servers in shared or multi-user environments without proper security controls are at risk. Mitigations include never running Jupyter as root, enabling token-based authentication, restricting terminal API access, and isolating user environments. Countries with strong data science sectors and widespread Jupyter adoption, such as Germany, France, and the UK, are most likely affected. The severity is assessed as high due to the potential for full root compromise without authentication or user interaction.
A Local Privilege Escalation (LPE) vulnerability has been identified in the Ubuntu Linux kernel, specifically caused by a reference count imbalance in the af_unix subsystem. This flaw allows a local attacker to escalate privileges, potentially gaining root access from a lower-privileged user account. The vulnerability is currently rated as medium severity, with no known exploits in the wild and minimal public discussion. No affected Ubuntu versions or patches have been officially disclosed yet. European organizations using Ubuntu servers or desktops could be at risk if attackers gain local access. Mitigation involves monitoring for official patches and restricting local user access until a fix is available. Countries with significant Ubuntu adoption and critical infrastructure relying on Linux systems are more likely to be impacted. Due to the potential for full system compromise without user interaction but requiring local access, the suggested severity is high. Defenders should prioritize patch management and limit local access privileges to mitigate this threat effectively.
An Australian law firm detected anomalous behavior involving two employees accessing numerous sensitive files, which triggered alerts via User and Entity Behavior Analytics (UEBA). Investigation revealed signs of lateral movement and privilege escalation attempts, indicative of a potential ransomware attack. The firm successfully contained the threat before any encryption or data exfiltration occurred, demonstrating the effectiveness of behavioral analytics and least privilege enforcement. This case highlights the importance of monitoring deviations from normal access patterns to detect early stages of ransomware and insider threats. No actual breach or payload delivery took place. The threat underscores risks related to privilege escalation and lateral movement within hybrid environments. It serves as a practical example of proactive defense mechanisms preventing ransomware disasters. European organizations with similar environments and sensitive data face comparable risks. Early detection and strict access controls are critical to mitigating such threats.
Researchers Detail Windows EPM Poisoning Exploit Chain Leading to Domain Privilege Escalation
Source: https://thehackernews.com/2025/08/researchers-detail-windows-epm.html
A critical double-free vulnerability has been discovered in the pipapo set module of the Linux kernel’s NFT subsystem. An unprivileged attacker can exploit this vulnerability by sending a specially crafted netlink message, triggering a double-free error with high stability. This can then be leveraged to achieve local privilege escalationץ
Microsoft's security team has announced a new process mitigation policy to protect against file system redirection attacks. "Redirection Guard, when enabled, helps Windows apps prevent malicious junction traversal redirections, which could potentially lead to privilege escalation by redirecting FS operations from less privileged locations to more privileged ones.
CISA Warns of Active Exploitation of Linux Kernel Privilege Escalation Vulnerability
Source: https://thehackernews.com/2025/06/cisa-warns-of-active-exploitation-of.html
#
**\[Disclosure: I work at CyberArk and was involved in this research\]**
We've completed a security evaluation of the Model Context Protocol and discovered several concerning attack patterns relevant to ML practitioners integrating external tools with LLMs.
**Background:** MCP standardizes how AI applications access external resources - essentially creating a plugin ecosystem for LLMs. While this enables powerful agentic behaviors, it introduces novel security considerations.
**Technical
