Reading view

CVE-2026-1281 & CVE-2026-1340: Actively Exploited Pre-Authentication RCE in Ivanti EPMM

Learn how CVE-2026-1281 and CVE-2026-1340 enable pre-auth RCE in Ivanti EPMM, now actively exploited, and how AppTrana helps block attacks across applications.

The post CVE-2026-1281 & CVE-2026-1340: Actively Exploited Pre-Authentication RCE in Ivanti EPMM appeared first on Indusface.

The post CVE-2026-1281 & CVE-2026-1340: Actively Exploited Pre-Authentication RCE in Ivanti EPMM appeared first on Security Boulevard.

  •  

Hackers Use LLM to Create React2Shell Malware, the Latest Example of AI-Generated Threat

Microsoft bug bounty AI LockBit ransomware

Darktrace researchers caught a sample of malware that was created by AI and LLMs to exploit the high-profiled React2Shell vulnerability, putting defenders on notice that the technology lets even lesser-skilled hackers create malicious code and build complex exploit frameworks.

The post Hackers Use LLM to Create React2Shell Malware, the Latest Example of AI-Generated Threat appeared first on Security Boulevard.

  •  

European Commission Hit by Mobile Infrastructure Data Breach

European Commission Mobile Cyberattack Thwarted by Quick Action

The European Commission's central infrastructure for managing mobile devices was hit by a cyberattack on January 30, the Commission has revealed. The announcement said the European Commission mobile cyberattack was limited by swift action, but cybersecurity observers are speculating that the incident was linked to another recent European incident involving Netherlands government targets that was revealed around the same time.

European Commission Mobile Cyberattack Detailed

The European Commission’s Feb. 5 announcement said its mobile management infrastructure “identified traces of a cyber-attack, which may have resulted in access to staff names and mobile numbers of some of its staff members. The Commission's swift response ensured the incident was contained and the system cleaned within 9 hours. No compromise of mobile devices was detected.” The Commission said it will “continue to monitor the situation. It will take all necessary measures to ensure the security of its systems. The incident will be thoroughly reviewed and will inform the Commission's ongoing efforts to enhance its cybersecurity capabilities.” The Commission provided no further details on the attack, but observers wondered if it was connected to another incident involving Dutch government targets that was revealed the following day.

Dutch Cyberattack Targeted Ivanti Vulnerabilities

In a Feb. 6 letter (download, in Dutch) to the Dutch Parliament, State Secretary for Justice and Security Arno Rutte said the Dutch Data Protection Authority (AP) and the Council for the Judiciary (Rvdr) had been targeted in an “exploitation of a vulnerability in Ivanti Endpoint Manager Mobile (EPMM).” Rutte said the Dutch National Cyber ​​Security Centre (NCSC) was informed by Ivanti on January 29 about vulnerabilities in EPMM, which is used for managing and securing mobile devices, apps and content. On January 29, Ivanti warned that two critical zero-day vulnerabilities in EPMM were under attack. CVE-2026-1281 and CVE-2026-1340 are both 9.8-severity code injection flaws, affecting EPMM’s In-House Application Distribution and Android File Transfer Configuration features, and could allow unauthenticated remote attackers to execute arbitrary code on vulnerable on-premises EPMM installations without any prior authentication. “Based on the information currently available, I can report that at least the AP and the Rvdr have been affected,” Rutte wrote. Work-related data of AP employees, such as names, business email addresses, and telephone numbers, “have been accessed by unauthorized persons,” he added. “Immediate measures were taken after the incident was discovered. In addition, the employees of the AP and the Rvdr have been informed. The AP has reported the incident to its data protection officer. The Rvdr has submitted a preliminary data breach notification to the AP.” NCSC is monitoring further developments with the Ivanti vulnerability and “is in close contact” with international partners, the letter said. Meanwhile, the Chief Information Officer of the Dutch government “is coordinating the assessment of whether there is a broader impact within the central government.”

European Commission Calls for Stronger Cybersecurity Controls

The European Commission’s statement noted that “As Europe faces daily cyber and hybrid attacks on essential services and democratic institutions, the Commission is committed to further strengthen the EU's cybersecurity resilience and capabilities.” To that end, the Commission introduced a Cybersecurity Package on January 20 to bolster the European Union's cyber defenses. “A central pillar of this initiative is the Cybersecurity Act 2.0, which introduces a framework for a Trusted ICT Supply Chain to mitigate risks from high-risk suppliers,” the EC statement said.
  •  

CISA Silently Updates Vulnerabilities Exploited by Ransomware Groups

CISA Silently Updates Vulnerabilities Exploited by Ransomware Groups

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has been “silently” updating its Known Exploited Vulnerabilities (KEV) catalog when it concludes that vulnerabilities have been exploited by ransomware groups, according to a security researcher. CISA adds a “known” or “unknown” field next to the “Known To Be Used in Ransomware Campaigns?” entry in its KEV catalog. The problem, according to a blog post by Glenn Thorpe of GreyNoise, is the agency doesn’t send out advisories when a vulnerability changes from “unknown” to “known” vulnerabilities exploited by ransomware groups. Thorpe downloaded daily CISA KEV snapshots for all of 2025 and found that the agency had flipped 59 vulnerabilities in 2025 from “unknown” to “known” evidence of exploitation by ransomware groups. “When that field flips from ‘Unknown’ to ‘Known,’ CISA is saying: ‘We have evidence that ransomware operators are now using this vulnerability in their campaigns,’" Thorpe wrote. “That's a material change in your risk posture. Your prioritization calculus should shift. But there's no alert, no announcement. Just a field change in a JSON file. This has always frustrated me.” In a statement shared with The Cyber Express, CISA Executive Assistant Director for Cybersecurity Nick Andersen suggested that the agency is considering Thorpe’s input. “We continue to streamline processes and enrich vulnerability data through initiatives like the KEV catalog, the Common Vulnerabilities and Exposures (CVE) Program, and Vulnrichment,” Andersen said. “Feedback from the cybersecurity community is essential as CISA works to enhance the KEV catalog and advance vulnerability prioritization across the ecosystem.”

Microsoft Leads in Vulnerabilities Exploited by Ransomware Groups

Of the 59 CVEs that flipped to “known” exploitation by ransomware groups last year, 27% were Microsoft vulnerabilities, Thorpe said. Just over a third (34%) involved edge and network CVEs, and 39% were for CVEs before 2023. And 41% of the flipped vulnerabilities occurred in a single month, May 2025. The “Fastest time-to-ransomware flip” was one day, while the longest lag between CISA KEV addition and the change to “known” ransomware exploitation status was 1,353 days. The “Most flipped vulnerability type” was Authentication Bypass at 14% of occurrences.

Ransomware Groups Target Edge Devices

Edge devices accounted for a high number of the flipped vulnerabiities, Thorpe said. Fortinet, Ivanti, Palo Alto and Check Point Security edge devices were among the flipped CVEs. “Ransomware operators are building playbooks around your perimeter,” he said. Thorpe said that 19 of the 59 flipped vulnerabilities “target network security appliances, the very devices deployed to protect organizations.” But he added: “Legacy bugs show up too; Adobe Reader vulnerabilities from years ago suddenly became ransomware-relevant.” Authentication bypasses and RCE vulnerabilities were the most common, “as ransomware operators prioritize ‘get in and go’ attack chains.” The breakdown by vendor of the 59 vulnerabilities “shouldn't surprise anyone,” he said. Microsoft was responsible for 16 of the flipped CVEs, affecting SharePoint, Print Spooler, Group Policy, Mark-of-the-Web bypasses, and more. Ivanti products were affected by 6 of the flipped CVEs, Fortinet by 5 (with FortiOS SSL-VPN heap overflows standing out), and Palo Alto Networks and Zimbra were each affected by 3 of the CVEs. “Ransomware operators are economic actors after all,” Thorpe said. “They invest in exploit development for platforms with high deployment and high-value access. Firewalls, VPN concentrators, and email servers fit that profile perfectly.” He also noted that the pace of vulnerability exploitation by ransomware groups accelerated in 2025. “Today, ransomware operators are integrating fresh exploits into their playbooks faster than defenders are patching,” he said. Thorpe created an RSS feed to track the flipped vulnerabilities; it’s updated hourly.
  •  

Hackers Exploit React2Shell Vulnerability to Deploy Miners and Botnets Worldwide

CVE-2025-55182

Threat actors have been actively exploiting a critical vulnerability in React Server Components, tracked as CVE-2025-55182 and commonly referred to as React2Shell, to compromise systems across multiple industry sectors worldwide.   React2Shell affects the Flight protocol, which is responsible for client–server communication in React Server Components. The vulnerability arises from insecure deserialization, where servers accept client-supplied data without sufficient validation.   Under specific conditions, this allows attackers to achieve remote code execution, making CVE-2025-55182 particularly dangerous in production environments. 

Exploiting CVE-2025-55182 

The campaign was first observed in December 2025, shortly after details of the vulnerability became available. According to BI.ZONE Threat Detection and Response, attackers moved quickly. “In December 2025, BI.ZONE TDR detected malicious activity targeting companies in the Russian insurance, e-commerce, and IT sectors.   The threat actors leveraged the CVE-2025-55182 (React2Shell) vulnerability,” the company reported. The primary payload observed during this phase was the XMRig cryptocurrency miner, though Kaiji, Rustobot, and the Sliver implant were also deployed.  The vulnerable packages include react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, versions 19.0 through 19.2.0. Security patches were released in 19.0.1, 19.1.2, and 19.2.1, but exploitation continued against unpatched systems. 

Malware Deployment Following React2Shell Exploitation 

In one documented case targeting Russian organizations, attackers exploited the React2Shell vulnerability inside a container environment and executed a chained command sequence to download an ELF binary named bot from 176.117.107[.]154. This file was identified as RustoBot, a Rust-based botnet primarily associated with attacks on TOTOLINK devices. RustoBot resolves multiple domain names, including ilefttotolinkalone.anondns[.]net and rustbot.anondns[.]net—all pointing to the IP address 45.137.201[.]137.  RustoBot is capable of launching UDP flood, TCP flood, and Raw IP flood DDoS attacks, with configurable parameters such as duration, target address, and packet size. The malware also embeds XMRig as a secondary payload, monetizing compromised infrastructure.  Following the initial infection, attackers executed Base64-encoded shell commands that retrieved additional scripts from tr.earn[.]top. One of these, apaches.sh, installed an UPX-packed XMRig binary and established persistence through systemd services and cron jobs, storing files in /usr/local/sbin when executed as root or /tmp otherwise.  Further activity included the deployment of Kaiji (Ares build) via wocaosinm.sh. Kaiji supports SYN, ACK, and UDP flood attacks, WebSocket abuse, command execution, dynamic encrypted configuration files, extensive persistence mechanisms, and replacement of system utilities such as lsps, and netstat. The malware also deployed XMRig and attempted to conceal its presence by masquerading as legitimate system libraries.  Attackers later delivered the Sliver implant using the d5.sh script, which handled privilege-aware persistence and aggressively erased forensic traces by clearing shell history and deleting temporary files.  

Additional Campaigns and Global Targeting 

In another case, attackers exploited the same React2Shell vulnerability to deploy XMRig version 6.24.0 using setup2.sh, a modified mining script. The miner configuration included a hardcoded wallet address and companion scripts, alive.sh and lived.sh, designed to terminate competing processes while preserving the miner.  A third case involved DNS-based data exfiltration. After exploiting CVE-2025-55182, attackers executed reconnaissance commands and exfiltrated results via DNS tunneling to oastify[.]com. This was followed by the installation of XMRig from GitHub and persistence via a systemd service named system-update-service.service.  Outside Russia, it has been observed that React2Shell exploitation delivers a broader malware ecosystem. Payloads included CrossC2 for Cobalt Strike, Tactical RMM, VShell, and EtherRAT. These tools enabled long-term access, command execution, encrypted C2 communication, and stealthy persistence.  EtherRAT, in particular, retrieved its command-and-control address from an Ethereum smart contract, later contacting 91.215.85[.]42:3000 to fetch JavaScript payloads. 
  •  

Microsoft Releases Emergency Fix for Exploited Office Zero-Day

Microsoft Emergency Fix Released for Exploited Office Zero-Day

Microsoft has released an emergency fix for an actively-exploited zero-day vulnerability affecting Microsoft Office. The vulnerability, CVE-2026-21509, is labeled a Microsoft Office Security Feature Bypass vulnerability that exploits the software weakness CWE-807 (Reliance on Untrusted Inputs in a Security Decision). Microsoft doesn’t say what threat actor is exploiting the vulnerability or how it’s being exploited, and doesn’t even acknowledge the researchers who discovered the vulnerability, but the software giant’s advisory includes lengthy mitigation guidance for users of Office 2016 and 2019, who must wait for a forthcoming Microsoft emergency fix.

Microsoft Emergency Fix for Office 2016 and 2019 Coming Soon

Microsoft said that customers on Office 2021 and later “will be automatically protected via a service-side change, but will be required to restart their Office applications for this to take effect.” Office 2016 and 2019 customers will have to wait for a forthcoming security update, but can protect themselves by applying registry keys as instructed (included below). Office Client 2016 and 2019 updates “will be released as soon as possible, and when they are available, customers will be notified via a revision to this CVE,” Microsoft said. The 7.8-rated vulnerability requires user interaction to be exploited. An attacker would have to send a malicious Office file and convince users to open it for an exploit to be successful. It is the second actively exploited zero-day vulnerability fixed by Microsoft this month, following CVE-2026-20805 fixed on Patch Tuesday. Microsoft has also released out-of-band Windows and Windows Server fixes this month for Windows and Outlook bugs. Microsoft said the new CVE-2026-21509 fix addresses a vulnerability that bypasses OLE (Object Linking and Embedding) mitigations in Microsoft 365 and Microsoft Office that protect users from vulnerable COM (Component Object Model)/OLE controls. COM/OLE is the framework that allows content from one application to be integrated into another, such as from an Excel spreadsheet into a Word document. The Preview Pane is not an attack vector, Microsoft noted.

Office 2016 and 2019 Mitigations

Microsoft said Office 2016 and 2019 customers can apply registry keys as described for immediate protection. Microsoft recommends first backing up your registry and exiting all Microsoft Office applications. Start the Registry Editor by tapping Start or pressing the Windows key on your keyboard,  then typing regedit and pressing enter.

Step 1

Locate the proper registry subkey. It will be one of the following: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\ (for 64-bit MSI Office, or 32-bit MSI Office on 32-bit Windows) or HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\ (for 32-bit MSI Office on 64-bit Windows) or HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\16.0\Common\COM Compatibility\ (for 64-bit Click2Run Office, or 32-bit Click2Run Office on 32-bit Windows) or HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\ (for 32-bit Click2Run Office on 64-bit Windows) Note: The COM Compatibility node may not be present by default and may need to be added by right-clicking the Common node and choosing Add Key.

Step 2

Add a new subkey named {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} by right-clicking the COM Compatibility node and choosing Add Key. Within that new subkey, add one new value by right-clicking the new subkey and choose New > DWORD (32-bit) Value, naming the new REG_DWORD value Compatibility Flags and assigning it a value of 400. Exit Registry Editor and start your Office application. Microsoft offered the following example: In Office 2016, 64-bit, on Windows you would locate this registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\ If the COM Compatibility node doesn't exist, you'll need to create it. Then add a subkey with the name {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}. The resulting path in this case is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}. To that subkey, add a REG_DWORD value called Compatibility Flags with a value of 400.  
  •  

GitLab Releases Critical Patch Updates to Address Multiple High-Severity Vulnerabilities

GitLab patch

GitLab has issued a new GitLab patch release addressing a range of security vulnerabilities and stability issues across multiple supported versions. The latest updates, versions 18.8.2, 18.7.2, and 18.6.4, apply to both GitLab Community Edition and Enterprise Edition and are now available for self-managed installations. According to the release information, these updates contain important bug fixes and security remediations, and administrators are strongly advised to upgrade as soon as possible.  The GitLab patch release applies to GitLab Community Edition and Enterprise Edition deployments running affected versions. GitLab.com is already operating on the patched versions, and GitLab Dedicated customers are not required to take any action. However, organizations managing their own instances are encouraged to prioritize the upgrade to mitigate risk from known vulnerabilities.  Cyble Annual Threat Landscape Report, Annual Threat Landscape Report, Cyble Annual Threat Landscape Report 2025, Threat Landscape Report 2025, Cyble, Ransomware, Hacktivism, AI attacks, Vulnerabilities, APT, ICS Vulnerabilities

Overview of the Latest GitLab Patch Release

This GitLab patch release resolves multiple security issues affecting both GitLab Community Edition and Enterprise Edition, including several high-severity vulnerabilities.  One of the most critical issues, tracked as CVE-2025-13927, involves a denial of service vulnerability in the Jira Connect integration. GitLab reported that an unauthenticated attacker could create a denial of service condition by sending crafted requests containing malformed authentication data. The vulnerability affects all GitLab CE/EE versions from 11.9 up to, but not including, versions 18.6.4, 18.7.2, and 18.8.2. The issue carries a CVSS score of 7.5. GitLab credited a92847865 for reporting the vulnerability through its HackerOne bug bounty program.  Another high-severity issue, CVE-2025-13928, impacts the Releases API. Due to incorrect authorization validation in API endpoints, an unauthenticated user could trigger a denial of service condition. This vulnerability affects GitLab Community Edition and Enterprise Edition versions from 17.7 prior to the patched releases and also has a CVSS score of 7.5. The issue was reported by the same researcher.  GitLab also addressed CVE-2026-0723, a vulnerability in authentication services that could have allowed an attacker with knowledge of a victim’s credential ID to bypass two-factor authentication by submitting forged device responses. This issue affects versions from 18.6 prior to the patched releases and has a CVSS score of 7.4. The vulnerability was reported by ahacker1 through HackerOne.  Medium-severity issues include CVE-2025-13335, an infinite loop flaw in Wiki redirects that could allow an authenticated user to cause a denial of service by crafting malformed Wiki documents. This issue affects versions from 17.1 onward and has a CVSS score of 6.5. GitLab also fixed CVE-2026-1102, a denial-of-service vulnerability in an API endpoint triggered by repeated malformed SSH authentication requests, affecting versions from 12.3 onward with a CVSS score of 5.3. GitLab noted that this vulnerability was discovered internally by team member Thiago Figueiró. 

Bug Fixes and Upgrade Considerations for Self-Managed Users 

In addition to addressing vulnerabilities, the GitLab patch release introduces a wide range of bug fixes across versions 18.8.2, 18.7.2, and 18.6.4. These include backported fixes for merge request reviewer crashes, searchable dropdown race conditions, container repository index repairs, Git LFS throttling exclusions, accessibility-related soft wrap issues, and Git push errors in self-managed environments. Several fixes also improve CI jobs, Sidekiq worker behavior, migration health checks, and AI catalog workflows.  GitLab cautioned that this patch release includes database migrations that may impact the upgrade process. Single-node installations will experience downtime during the upgrade because migrations must be completed before GitLab can restart. Multi-node deployments, however, can apply the updates without downtime by following recommended zero-downtime upgrade procedures. Version 18.7.2 includes post-deploy migrations that can run after the main upgrade process.  GitLab strongly recommends that all installations of GitLab Community Edition and Enterprise Edition running affected versions upgrade to the latest patch release as soon as possible to reduce exposure to known vulnerabilities and maintain platform stability. 
  •  

Fortinet Admins Report Active Exploits on “Fixed” FortiOS 7.4.9 Firmware

FortiOS, CVE-2025-59718, FortiSIEM Vulnerabiliti, Fortinet, CVE-2025-25256

Network administrators worldwide are scrambling this morning following credible reports that the critical Fortinet Single Sign-On (SSO) vulnerability, tracked as CVE-2025-59718, is being actively exploited on systems previously thought to be patched.

The vulnerability, originally disclosed in December 2025, allows unauthenticated attackers to bypass authentication on FortiGate firewalls by forging SAML assertions. At the time, Fortinet released FortiOS version 7.4.9 as the definitive fix for the 7.4 release branch. However, emerging data from the cybersecurity community suggests this update may have failed to close the door on attackers.

The "Zombie" FortiOS Vulnerability

Over the last 48 hours, a wave of reports has surfaced on community hubs like Reddit, where verified administrators have shared logs indicating successful breaches on devices running the supposedly secure FortiOS 7.4.9.

The attack pattern is distinct and alarming. Victims report observing unauthorized logins via the FortiCloud SSO mechanism—even when they do not actively use the feature for their own administration. Once access is gained, the attackers typically create a local administrator account, often named "helpdesk" or similar generic terms, to establish persistence independent of the SSO flaw.

"We have been on 7.4.9 since December 30th," wrote one frustrated administrator who shared redacted logs of the incident. "Our SIEM caught a local admin account being created. The attack vector looks exactly like the original CVE-2025-59718 exploit, but against the patched firmware.

Technical Confusion and Workarounds

The persistence of this flaw in version 7.4.9 has led to speculation that the initial patch was incomplete or that attackers have found a bypass to the mitigation logic. Some users report that Fortinet support has acknowledged the issue privately, hinting that the vulnerability might persist even into upcoming builds like 7.4.10, though this remains unconfirmed by official public advisories.

The exploit relies on the "Allow administrative login using FortiCloud SSO" setting, which is often enabled by default when a device is registered to FortiCloud.

Security experts are now advising a "trust no patch" approach for this specific vector. The only guaranteed mitigation currently circulating in professional circles is to manually disable the vulnerable feature via the Command Line Interface (CLI), regardless of the firmware version installed.

Administrators are urged to run the following command immediately on all FortiGate units:

config system global
    set admin-forticloud-sso-login disable
end

Indicators of Compromise

Organizations running FortiOS 7.4.x—including version 7.4.9—should immediately audit their system event logs for the following activity:

  1. Unexpected SSO Logins: Filter logs for successful logins where the method is forticloud-sso, especially from unrecognized public IP addresses.

  2. New User Creation: Check for the recent creation of administrator accounts with names like helpdesk, support, or fortinet-admin.

  3. Configuration Exports: Look for logs indicating a full system configuration download shortly after an SSO login.

As trust in the official patch cycle wavers, the community is once again serving as the first line of defense, sharing Indicators of Compromise (IOCs) and workarounds faster than vendors can issue bulletins. For now, disable the SSO feature, or risk compromise.

  •  

Cloudflare Zero-Day Let Attackers Bypass WAF via ACME Certificate Validation Path

Cloudflare

A critical zero-day vulnerability in Cloudflare exposed a fundamental weakness in how security exceptions are handled at scale. The flaw allowed attackers to bypass Cloudflare’s Web Application Firewall (WAF) entirely and directly access protected origin servers by abusing a certificate validation endpoint. The issue was not caused by customer misconfiguration, but by a logic error in Cloudflare’s edge processing of ACME certificate validation traffic.  The vulnerability was discovered on October 9, 2025, by security researchers at FearsOff and reported through Cloudflare’s bug bounty program. At its core, the issue involved Cloudflare’s handling of requests to the ACME HTTP-01 challenge path: /.well-known/acme-challenge/*. This path is used by certificate authorities to verify domain ownership during automated SSL/TLS certificate issuance. 

How the Cloudflare Vulnerability Worked

ACME (Automatic Certificate Management Environment) automates certificate lifecycle management by requiring a domain to respond with a specific token at a well-known URL. For Cloudflare-managed certificates, Cloudflare itself responds to these validation requests at the edge. To prevent legitimate certificate issuance from failing, Cloudflare intentionally disables certain WAF features on this path, since firewall rules can interfere with validation requests from certificate authorities.  The zero-day vulnerability emerged because Cloudflare’s logic disabled WAF protections for any request sent to the ACME challenge path, without verifying whether the token in the request matched an active certificate challenge for that hostname. If the token did not correspond to a Cloudflare-managed certificate order, the request was forwarded to the customer’s origin server with WAF protections still disabled.  This meant an attacker could send arbitrary requests to /.well-known/acme-challenge/* and bypass all customer-configured WAF rules, regardless of whether a valid certificate challenge existed. The ACME path effectively became a universal WAF bypass. 

Cloudflare’s Confirmation and Technical Details

Cloudflare confirmed the issue in an official disclosure dated October 13, 2025, stating:  “Security researchers from FearsOff identified and reported a vulnerability in Cloudflare's ACME (Automatic Certificate Management Environment) validation logic that disabled some of the WAF features on specific ACME-related paths.”  The company explained that when a request matched an active ACME challenge token, WAF features were disabled because Cloudflare directly served the response. However, the same behavior occurred when the token belonged to a different zone or an external certificate workflow. In those cases, the request should have remained subject to WAF inspection but was instead passed through to the origin unchecked.  This logic flaw created a direct path around Cloudflare’s security controls, allowing access to backend infrastructure that customers assumed was fully protected by the WAF. 

Mitigation and Impact

Cloudflare mitigated the vulnerability by updating its edge logic so that WAF features are only disabled when a request matches a valid ACME HTTP-01 challenge token for the specific hostname and when Cloudflare has a challenge response to serve. All other requests to the ACME path are now processed normally through WAF rulesets.  According to Cloudflare, no customer action was required, and the company stated it was not aware of any malicious exploitation of the vulnerability before the fix. 
  •  

All In One SEO Plugin Flaw Exposes AI Token to Low-Privilege WordPress Users

All In One SEO

A newly disclosed security vulnerability in the All In One SEO ecosystem has drawn attention across the WordPress community due to its potential reach and impact. The flaw affects the widely used AIOSEO plugin, which is active on more than 3 million WordPress websites. It allows low-privileged users to access a site-wide AI access token tied to the plugin’s artificial intelligence features.  The issue adds to a growing list of security problems involving All In One SEO in 2025. According to security researchers, this is the sixth vulnerability disclosed for the plugin this year, raising concerns about recurring authorization and permission-related weaknesses. 

All In One SEO and the AIOSEO Plugin in WordPress 

The AIOSEO plugin is one of the most popular SEO tools in the WordPress ecosystem. It helps site owners manage essential optimization tasks such as generating metadata, creating XML sitemaps, adding structured data, and improving on-page SEO performance.  In recent versions, All In One SEO also introduced AI-powered tools designed to help users write SEO titles, meta descriptions, blog posts, FAQs, social media content, and generate images. These AI features rely on a global AI access token that allows the plugin to communicate with external AIOSEO AI services on behalf of the site. 

Missing Capability Check in the AIOSEO Plugin 

The vulnerability was traced to a missing permission check in a REST API endpoint used by the All In One SEO plugin. According to Wordfence, the issue allowed users with Contributor-level access or higher to retrieve sensitive AI-related data.  This endpoint is intended to return information about a site’s AI usage and remaining credits. However, it failed to verify whether the user making the request was authorized to view that information. As a result, the plugin exposed the site’s global AI access token to low-privilege users. 

Why Low-Privilege Access Is a Serious Issue in WordPress 

Contributor is one of the lowest privilege roles in WordPress. Many websites grant Contributor access to guest authors, freelancers, or editorial staff so they can submit drafts for review.  By exposing a site-wide AI token to these users, All In One SEO effectively allowed broad access to a credential that controls AI functionality across the entire site. That token could be misused in several ways. 

Potential Risks of the All In One SEO Vulnerability 

While the vulnerability does not enable direct code execution, it still presents meaningful risks: 
  • Unauthorized AI usage: The exposed token could be used to generate AI content through the affected WordPress site, consuming available credits. 
  • Service depletion: An attacker could automate AI requests to exhaust the site’s AI quota, preventing administrators from using those features. 
  • Billing and resource concerns: Even without direct financial theft, misuse of AI credits could lead to unexpected costs or disrupted workflows. 

How the AIOSEO Plugin Vulnerability Was Fixed 

The vulnerability affects all versions of All In One SEO up to and including version 4.9.2. It was addressed in version 4.9.3. In the official plugin changelog, the developers described the fix as:  “Hardened API routes to prevent AI access token from being exposed.”  This change directly resolves the missing permission check identified in the REST API endpoint. 

What WordPress Site Owners Should Do Now 

Anyone using All In One SEO on a WordPress site should update to version 4.9.3 or newer as soon as possible. Sites that allow multiple Contributors or external collaborators face a higher risk, as low-privilege accounts could access the AI token on vulnerable versions.  Regularly updating WordPress plugins, especially those like AIOSEO, which integrate AI services and external APIs, remains one of the most effective ways to reduce exposure to security risks. 
  •  

New n8n Vulnerability (CVE-2026-21858) Allows Unauthenticated File Access and RCE

CVE-2026-21858

Cybersecurity researchers have disclosed a new critical flaw in the popular workflow automation platform n8n that could allow unauthenticated attackers to fully compromise vulnerable systems. The issue, tracked as CVE-2026-21858 and assigned a maximum CVSS score of 10.0, is being described as one of the most severe n8n vulnerabilities reported to date.  The n8n vulnerability was discovered and responsibly disclosed by security researcher Dor Attias on November 9, 2025. n8n later confirmed the issue in a security advisory, warning that attackers could access files on the underlying server through certain form-based workflows.  According to n8n, “A vulnerability in n8n allows an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker.” The company noted that the flaw could expose sensitive data and potentially enable further compromise depending on configuration and usage.  CVE-2026-21858 is a Content-Type confusion bug tied to how the n8n webhook processes incoming HTTP requests. The webhook parses requests differently based on the Content-Type header, creating a gap that attackers can exploit to manipulate file-handling behavior. 

How the n8n Webhook Content-Type Confusion Is Exploited 

The vulnerability stems from how n8n handles form submissions. When a request is processed, the platform uses parseRequestBody() to determine whether to invoke a file upload parser or a regular body parser. If multipart/form-data is specified, uploaded files are parsed and stored in req.body.files.  However, researchers found that certain file-handling functions are executed without verifying the Content-Type header. As a result, attackers can override req.body.files even when no file upload is present.  “Since this function is called without verifying the content type is ‘multipart/form-data,’ we control the entire req.body.files object,” Attias explained. This allows an attacker to copy any local file from the server instead of an uploaded file, exposing sensitive system data to downstream workflow nodes. 

n8n Vulnerability Enables Admin Bypass and Remote Code Execution 

The impact of CVE-2026-21858 extends beyond arbitrary file reads. Researchers demonstrated how attackers could escalate the flaw into a full system compromise. By abusing the n8n vulnerability, a threat actor could read the internal SQLite database at /home/node/.n8n/database.sqlite, extract administrator credentials, and then retrieve encryption secrets from /home/node/.n8n/config.  Using this information, attackers could forge a valid admin session cookie, bypass authentication, and gain full administrative access. From there, they could create a malicious workflow containing an “Execute Command” node, achieving remote code execution on the host system.  Cyera warned that the centralized nature of n8n significantly amplifies the risk. “A compromised n8n instance doesn’t just mean losing one system; it means handing attackers the keys to everything,” the company said, citing stored API credentials, OAuth tokens, and database connections as high-value targets. 

Patch Status and Mitigations for CVE-2026-21858 

The n8n vulnerability affects all versions up to and including 1.65.0 and was patched in version 1.121.0, released on November 18, 2025. Users are strongly urged to upgrade to a fixed or newer release, such as versions 1.123.10, 2.1.5, 2.2.4, or 2.3.0.  As additional mitigations, administrators are advised to avoid exposing n8n instances to the internet, enforce authentications for all Forms, and restrict or disable publicly accessible n8n webhook and form endpoints until patches can be applied.  The disclosure of CVE-2026-21858 follows several other critical issues in n8n, including CVE-2025-68668 and CVE-2025-68613, highlighting the need for rigorous security controls around automation platforms that manage sensitive integrations and credentials. 
  •  

Critical n8n Vulnerability Allows Arbitrary Command Execution (CVE-2025-68668)

CVE-2025-68668

A newly disclosed n8n vulnerability has been confirmed to allow authenticated users to execute arbitrary system commands on affected servers. The issue, tracked as CVE-2025-68668, has been assigned a CVSS score of 9.9, placing it firmly in the critical severity range. The flaw impacts the open-source workflow automation platform n8n and affects a broad range of deployed versions.  n8n is commonly used to design and run automated workflows that connect applications, services, and scripts. Due to its role in handling sensitive integrations and credentials, security vulnerabilities within the platform can have significant consequences.  

Sandbox Bypass in the Python Code Node 

The n8n vulnerability affects all versions from 1.0.0 up to, but not including, 2.0.0. According to the advisory, an authenticated user who has permission to create or modify workflows can exploit the issue to execute arbitrary operating system commands on the host running n8n. The vulnerability has been categorized as a protection mechanism failure.  The root cause lies in a sandbox bypass within the Python Code Node, which uses Pyodide to execute Python code. The advisory describes the issue clearly: “A sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands on the host system running n8n, using the same privileges as the n8n process.”  While the attacker does not automatically gain higher privileges than the n8n service itself, the ability to run system commands at that level may still allow for data access, lateral movement, or further compromise depending on how the instance is deployed. The flaw was published under GHSA-62r4-hw23-cc8v, with security researcher csuermann credited for the report. The affected package is the n8n npm package, and the issue remained present until it was fully addressed in version 2.0.0. 

Patch Details and Security Improvements 

The CVE-2025-68668 issue has been resolved in n8n version 2.0.0, which is now listed as the patched release. However, security improvements related to this issue were introduced earlier. In n8n version 1.111.0, the project added a task runner–based native Python implementation as an optional feature. This implementation was designed to provide a stronger isolation model than the Pyodide-based sandbox used by the Python Code Node.  To enable this more secure execution environment in affected versions, administrators must configure the N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER environment variables. With the release of n8n 2.0.0, this task runner–based Python sandbox became the default behavior, effectively mitigating the sandbox bypass that made CVE-2025-68668 exploitable.  The introduction of this default setting marks an architectural change aimed at reducing the attack surface associated with executing Python code inside workflows. It also reflects a broader shift toward isolating potentially dangerous operations more rigorously within automation platforms. 

Mitigations, Workarounds, and Broader Context for CVE-2025-68668 

For organizations that cannot immediately upgrade, n8n has outlined several workarounds to limit exposure to the n8n vulnerability. One option is to completely disable the Code Node by setting the environment variable NODES_EXCLUDE to ["n8n-nodes-base.code"]  Another mitigation is to disable Python support in the Code Node entirely by setting N8N_PYTHON_ENABLED=false, a configuration option introduced in n8n version 1.104.0. Administrators can also proactively enable the task runner–based Python sandbox using N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER.  The disclosure of CVE-2025-68668 follows another recently addressed critical flaw, CVE-2025-68613, which also carried a CVSS score of 9.9 and could lead to arbitrary code execution under certain conditions.  
  •  

CISA Known Exploited Vulnerabilities Soared 20% in 2025

CISA Known Exploited Vulnerabilities (KEV) Soared 20% in 2025

After stabilizing in 2024, the growth of known exploited vulnerabilities accelerated in 2025. That was one conclusion from Cyble’s analysis of CISA’s Known Exploited Vulnerability (KEV) catalog data from 2025. After growing at roughly 21% in 2023, with 187 vulnerabilities added to the CISA KEV catalog that year, growth slowed to about 17% in 2024, with 185 vulnerabilities added. Growth in exploited vulnerabilities reaccelerated in 2025, with 245 vulnerabilities added to the KEV database, for a roughly 20% growth rate. The KEV catalog ended 2025 with 1,484 software and hardware flaws at high risk of attack. The 245 flaws added in 2025 is also more than 30% above the trend of 185 to 187 vulnerabilities added the previous two years. Cyble also examined vulnerabilities exploited by ransomware groups, the vendors and projects with the most KEV additions (and several that actually improved), and the most common exploited software weaknesses (CWEs).

Older Vulnerabilities Added to CISA KEV Also Grew

Older vulnerabilities added to the CISA KEV catalog also grew in 2025, Cyble said. After adding an average of 65 older vulnerabilities to the KEV catalog in 2023 and 2024, CISA added 94 vulnerabilities from 2024 and earlier to the catalog in 2025, an increase of nearly 45% from the 2023-2024 average. The oldest vulnerability added to the KEV catalog last year was CVE-2007-0671, a Microsoft Office Excel Remote Code Execution vulnerability. The oldest vulnerability in the catalog remains CVE-2002-0367, a privilege escalation vulnerability in the Windows NT and Windows 2000 smss.exe debugging subsystem that has been known to be used by ransomware groups, Cyble said. CISA removed at least one vulnerability from the KEV catalog in 2025. CVE-2025-6264 is a Velociraptor Incorrect Default Permissions vulnerability that CISA determined had “insufficient evidence of exploitation,” Cyble noted.

Vulnerabilities Targeted in Ransomware Attacks

CISA marked 24 of the vulnerabilities added in 2025 as known to be exploited by ransomware groups, Cyble said. Those vulnerabilities include some well-known flaws such as CVE-2025-5777 (dubbed “CitrixBleed 2”) and Oracle E-Business Suite vulnerabilities targeted by the CL0P ransomware group. Vendors with multiple vulnerabilities targeted by ransomware groups included Fortinet, Ivanti, Microsoft, Mitel, Oracle and SonicWall.

Projects and Vendors with the Most Exploited Vulnerabilities

Microsoft once again led all vendors and projects in CISA KEV additions in 2025, with 39 vulnerabilities added to the database, up from 36 in 2024. Apple, Cisco, Google Chromium. Ivanti and Linux each had 7-9 vulnerabilities added to the KEV catalog. Several vendors and projects actually improved in 2025, with fewer vulnerabilities added than they had in 2024, “suggesting improved security controls,” Cyble said. Adobe, Android, Apache, Ivanti, Palo Alto Networks, and VMware were among those that saw a decline in KEV vulnerabilities.

Most Common Software Weaknesses

Eight software and hardware weaknesses (common weakness enumerations, or CWEs) were “particularly prominent among the 2025 KEV additions,” Cyble said, noting that the list is similar to the 2024 list. The most common CWEs in the 2025 CISA KEV additions were:
  • CWE-78 – OS Command Injection – accounted for 18 of the 245 vulnerabilities.
  • CWE-502 – Deserialization of Untrusted Data – was  a factor in 14 of the vulnerabilities.
  • CWE-22 – Path Traversal – appeared 13 times.
  • CWE-416 – Use After Free – was a flaw in 11 of the vulnerabilities.
  • CWE-787 – Out-of-bounds Write – accounted for 10 of the vulnerabilities.
  • CWE-79 – Cross-site Scripting – appeared 7 times.
  • CWE-94 (Code Injection) and CWE-287 (Improper Authentication) appeared 6 times each.
 
  •  

Critical IBM API Connect Vulnerability Enables Authentication Bypass

IBM API Connect

IBM has released security updates to address a critical IBM API Connect vulnerability that could allow remote attackers to bypass authentication controls and gain unauthorized access to affected applications. The flaw, tracked as CVE-2025-13915, carries a CVSS 3.1 score of 9.8, placing it among the most severe vulnerabilities disclosed in recent months. According to IBM, the IBM API Connect vulnerability impacts multiple versions of the platform and stems from an authentication bypass weakness that could be exploited remotely without any user interaction or prior privileges. Organizations running affected versions are being urged to apply fixes immediately to reduce exposure.

CVE-2025-13915: IBM API Connect Authentication Bypass Explained

The vulnerability has been classified under CWE-305: Authentication Bypass by Primary Weakness, indicating a failure in enforcing authentication checks under certain conditions. IBM said internal testing revealed that the flaw could allow an attacker to circumvent authentication mechanisms entirely. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) highlights the seriousness of the issue. The attack can be carried out over the network, requires low attack complexity, and does not depend on user interaction. If exploited, it could result in a complete compromise of confidentiality, integrity, and availability within the affected IBM API Connect environment. IBM warned that a successful attack could grant unauthorized access to API Connect applications, potentially exposing sensitive data and backend services managed through the platform.

Affected IBM API Connect Versions

The IBM API Connect vulnerability affects specific versions within the 10.x release series. IBM confirmed that the following product versions are impacted:
  • IBM API Connect V10.0.8.0 through V10.0.8.5
  • IBM API Connect V10.0.11.0
API Connect is widely deployed in enterprise environments to manage APIs, control developer access, and secure integrations between internal and external services. As a result, vulnerabilities in the platform can have cascading effects across connected systems.

IBM Releases Fixes for IBM API Connect Vulnerability

To remediate CVE-2025-13915, IBM has issued interim fixes (iFixes) for all affected versions and strongly recommends that customers upgrade without delay. For the 10.0.8.x branch, fixes have been released for each affected sub-version, including 10.0.8.1, 10.0.8.2 (iFix1 and iFix2), 10.0.8.3, 10.0.8.4, and 10.0.8.5. IBM has also provided an interim fix for IBM API Connect V10.0.11.0. IBM emphasized that upgrading to the remediated versions is the most effective way to eliminate the authentication bypass risk associated with this vulnerability.

Workarounds and Mitigations for Unpatched Systems

For organizations unable to apply the fixes immediately, IBM has outlined a temporary mitigation to reduce risk. Administrators are advised to disable self-service sign-up on the Developer Portal, if that feature is enabled. While this measure does not fully address the IBM API Connect authentication bypass vulnerability, IBM said it can help minimize exposure until patching is completed. The company cautioned that workarounds should only be used as a short-term solution.

Why the IBM API Connect Vulnerability Matters

Authentication bypass vulnerabilities are particularly dangerous because they undermine one of the most fundamental security controls in enterprise applications. In API-driven environments, such flaws can provide attackers with a direct path to sensitive services, data stores, and internal systems. The vulnerability was published in the National Vulnerability Database (NVD) on December 26, 2025, and last updated on December 31, 2025, with IBM listed as the CNA and source. Given the critical severity rating, security teams are expected to prioritize remediation and review API access logs for any signs of unauthorized activity. Organizations running affected versions of IBM API Connect are urged to assess their deployments immediately and apply the recommended fixes to prevent potential exploitation.
  •  

Why Peak Shopping Seasons Are Now Peak Cyber Risk Periods

Global Commerce

Rizwan Patel, Global Head Cloud, InfoSec and Emerging Technologies, Altimetrik Global commerce no longer pauses between festivals; it moves continuously across markets, moments, and geographies. India's Diwali and Navratri have passed, yet the digital intensity they generated merely sets the stage for what comes next. Christmas shopping surges are building momentum across global markets, followed closely by fiscal closures and Lunar New Year preparations across Asia. What was once a sequence of seasonal events has become a single, continuous stress test of enterprise infrastructure and digital trust. Adversarial AI operates inside this same cycle, and it never takes holidays. While technology leaders finalize year-end campaigns, automated threat networks run relentless reconnaissance against digital platforms, learning transaction patterns, mapping authentication architectures, and calculating optimal breach windows. The asymmetry is significant: enterprises expand transaction capacity during high-volume periods but rarely scale detection capabilities at the same speed. Adversarial systems adapt instantly, while human teams operate on predictable shifts. Every vendor integration, partner API, or cross-border payment is now part of a shared attack surface. Reliability and trust are no longer defined by uptime alone but by resilience under pressure. The next breach may not strike when systems are weakest—it may strike when commerce is strongest. The real question for technology leaders is no longer when adversarial AI will test their systems, but whether their defenses can keep pace when it does.

The Global Commerce Vulnerability Window

High-volume shopping periods create a concentrated attack surface that threat actors exploit with precision. During the 2024 holiday season, December recorded 574 ransomware incidents, the highest monthly volume since monitoring began in 2021 according to NCC Group's Threat Pulse report. The trend overturns historical patterns where December once saw slower attack activity during year-end breaks. Cybersecurity experts increasingly refer to these periods as the Global Commerce Vulnerability Window, marked by intense transaction volumes and limited human oversight across regions that shift like moving targets. As one market reaches its festive peak, adversarial networks redirect focus to the next, maintaining continuous pressure on enterprise systems. The exposure extends deep into B2B ecosystems that enable these surges. Breaches on consumer-facing platforms can cascade through partner networks, exposing critical dependencies across cloud, financial, and logistics systems. A single incident during a client’s key revenue window can erode partner confidence, delay renewals, and weaken market standing while competitors seize the opportunity to advance.

The Strategic Leadership Playbook

Enterprise leaders navigating perpetual threat cycles must architect their security posture around three interdependent capabilities that operate as integrated systems rather than isolated functions. Intelligent Trust transforms security from an invisible assumption into a tangible asset. Explainable AI systems must demonstrate their decision-making logic to both technical teams and business stakeholders. Real-time consent management platforms show customers exactly how their data moves through your infrastructure. During high-volume integrations, visible trust indicators such as verified credentials, anomaly alerts, and transparent data workflows help sustain confidence across partners. Trust becomes an operational metric, tracked and improved with the same rigor as uptime or throughput. Dynamic Compliance treats regulatory adherence as a living system rather than a periodic audit exercise. Laws such as the EU’s GDPR, the U.S. CCPA, India’s DPDP Act, and the EU AI Act emphasize consent, accountability, and transparency across data and AI systems. Additionally, consent-first APIs, continuous monitoring, and automated audit trails ensure alignment across jurisdictions. Treating compliance as a living system builds trust and resilience in an environment where both regulations and risks advance continuously. Autonomous Resilience represents the frontier where agentic systems deliver measurable business value. Guardian Agents operate as intelligent, goal-oriented systems that function within defined governance boundaries. These agents continuously scan transaction patterns for data anomalies, detect adversarial behavior through behavioral analysis, and initiate mitigation protocols automatically. They coordinate with human oversight teams to escalate critical decisions or accept override commands. Most importantly, they evolve through machine learning as threat patterns shift, ensuring your defense posture adapts faster than manual processes allow. This shift from reactive monitoring to self-governed prevention reduces both detection time and response resource requirements, allowing security teams to focus on architecture and strategy rather than tactical firefighting.

The AI Paradox Driving Next-Generation Defense

AI now defines both sides of the cybersecurity equation. According to The IBM 2025 Cost of a Data Breach Report while AI-enabled defenses save organizations nearly $1.9 million per breach, 13% of enterprises faced breaches in AI models or applications often owing to weak access controls. This paradox defines today’s leadership challenge. Autonomous systems deliver measurable advantage, but must remain adaptive, governed, and accountable. Guardian Agents exemplify this evolution through continuous behavioural learning, establishing baselines for normal activity and detecting deviations before traditional defenses respond. Their orchestration model allows coordination across distributed endpoints, sharing intelligence while preserving local decision authority. Each automated response is mapped through audit trails to the specific anomaly that triggered it, enabling transparency and human validation. This alignment of machine precision and human oversight ensures accountability even as response speeds surpass human reaction times. As enterprises expand across jurisdictions and regulatory frameworks, this transition from autonomous to adaptive defense defines the next frontier. The real test of leadership now lies in redefining what resilience means in an era where intelligence itself is the battlefield. AI will not wait for regulation, nor will adversaries wait for readiness. The future belongs to enterprises that can operationalize foresight, building systems that anticipate change, adapt without instruction, and uphold trust even under attack. Those that succeed will not only secure their data but shape the digital order that follows. (This article reflects the author’s analysis and personal viewpoints and is intended for informational purposes only. It should not be construed as legal or regulatory advice.)
  •  

Critical Net-SNMP Flaw CVE-2025-68615 Allows Remote Buffer Overflow and Service Crashes

Net-SNMP CVE-2025-68615

A newly disclosed security issue in the Net-SNMP software suite has raised serious concerns for organizations that rely on the protocol to monitor and manage network infrastructure. The vulnerability, identified as CVE-2025-68615, affects a core component of Net-SNMP and could allow remote attackers to crash critical services or potentially gain deeper control over affected systems.  Net-SNMP is a widely used implementation of the Simple Network Management Protocol (SNMP), commonly deployed across enterprise and service provider environments. It is used to monitor and manage routers, switches, servers, and other network-connected devices. Because of its widespread adoption, vulnerabilities within Net-SNMP often have broad implications, and CVE-2025-68615 is no exception.  According to advisories published on GitHub, the flaw exists in the snmptrapd daemon, a background service responsible for receiving and processing SNMP trap messages. Trap messages are unsolicited alerts sent by devices to notify administrators of specific events. In the case of CVE-2025-68615, the daemon improperly handles incoming packets, creating an opportunity for exploitation. 

Buffer Overflow in snmptrapd Enables Denial of Service (CVE-2025-68615) 

The GitHub advisory explains that a threat actor can exploit this issue by sending a “specially crafted packet” to a vulnerable snmptrapd instance. When the daemon attempts to process the malformed data, a buffer overflow occurs. As described in the advisory, this condition causes the daemon to crash, resulting in a denial-of-service scenario.  The official description states: “A specially crafted packet to a net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash.” While a service crash is the most immediate effect, the underlying vulnerability presents a broader security risk.  CVE-2025-68615 has been assigned a Common Vulnerability Scoring System (CVSS) score of 9.8, classifying it as Critical. The CVSS metrics indicate a “High” impact on confidentiality, integrity, and availability. In security assessments, a buffer overflow with these ratings often implies that exploitation could extend beyond service disruption.  Experts caution that vulnerabilities like CVE-2025-68615 may allow attackers to execute arbitrary code remotely, potentially enabling full system compromise without authentication or user interaction. This risk is heightened by the fact that the snmptrapd daemon often runs with elevated privileges and is designed to accept network traffic. 

Patch Availability and Recommended Mitigations 

The vulnerability was discovered by buddurid, working in collaboration with the Trend Micro Zero Day Initiative. Following responsible disclosure, the Net-SNMP maintainers issued fixes and published details through a GitHub Security Advisory tracked as GHSA-4389-rwqf-q9gq. According to the advisory, all versions of Net-SNMP are affected. The issue has been resolved in Net SNMP versions 5.9.5 and 5.10.pre2, and administrators running the snmptrapd daemon are urged to upgrade immediately. The advisory notes: “Users of Net-SNMP's snmptrapd should upgrade immediately to Net-SNMP 5.9.5 or 5.10.pre2.”  For organizations unable to deploy patches immediately, the advisory outlines limited workaround options. Network segmentation remains the primary defense. SNMP ports should never be exposed to the public internet, and firewall rules should block external access to the snmptrapd port. The advisory emphasizes that there is no mitigation other than upgrading or ensuring the service is properly firewalled.  As details continue to circulate on GitHub and through security channels, organizations using Net-SNMP are encouraged to review their deployments, confirm firewall configurations, and prioritize updates. Given the critical severity of CVE-2025-68615 and the essential role Net-SNMP plays in network monitoring, timely remediation is necessary to reduce the risk of service disruption or system compromise. 
  •  

New Flaw in Somalia’s E-Visa System Exposes Travelers’ Passport Data

Somalia e-visa

A newly identified security flaw in Somalia’s electronic visa platform has raised serious concerns about the safety of personal data belonging to thousands of travelers, only weeks after the country acknowledged a major breach affecting tens of thousands of applicants. Investigations show that the Somalia e-visa system lacks essential protection methods, making it possible for unauthorized users to access and download sensitive documents with minimal effort.  The Somalia e-visa flaw was confirmed this week by Al Jazeera after receiving a tip from a source with professional experience in web development. According to the source, the e-visa platform could be exploited to retrieve large numbers of visa files containing highly sensitive personal information. The exposed data includes applicants’ passport details, full names, and dates of birth, information that could be misused for a wide range of criminal or intelligence-related activities. 

Ignored Warnings Followed by Independent Verification of Global Data Exposure 

The source not only shared evidence of the exposed data with Al Jazeera but also demonstrated that they had formally alerted Somali authorities to the e-visa vulnerability the previous week. Despite these warnings, the individual stated that there was no response from officials and no indication that the flaw had been addressed or corrected.  Al Jazeera independently verified the claims by replicating the vulnerability described by the source. During testing, journalists were able to download e-visas belonging to dozens of individuals within a short period. The compromised files included personal information of applicants from several countries, including Somalia, Portugal, Sweden, the United States, and Switzerland.  “Breaches involving sensitive personal data are particularly dangerous as they put people at risk of various harms, including identity theft, fraud, and intelligence gathering by malicious actors,” Bridget Andere, a senior policy analyst at the digital rights organization Access Now, said in comments to Al Jazeera. She noted that the consequences of such failures extend beyond technical problems and can have lasting effects on individuals’ safety and privacy. 

Somalia E-Visa Vulnerability Emerges as Fallout Continues from Earlier Mass Data Breach 

The Somalia e-visa flaw comes barely a month after Somali officials announced an inquiry into an earlier cyberattack on the same e-visa system. That previous incident prompted warnings from both the United States and the United Kingdom governments. According to those alerts, personal information belonging to more than 35,000 Somalia e-visa applicants had been leaked.  At the time, the US Embassy in Somalia detailed the scope of the exposure, stating that the compromised data included applicants’ names, photographs, dates and places of birth, email addresses, marital status, and home addresses.  In response, Somalia’s Immigration and Citizenship Agency (ICA) moved the e-visa platform to a new internet domain, citing the change as an effort to strengthen security. On November 16, the agency said it was treating the breach with “special importance” and confirmed that an investigation had been launched. However, the discovery of a fresh e-visa vulnerability suggests that the underlying security issues may not have been fully resolved. 

Security Claims Clash with Legal Duties 

Earlier that same week, Somalia’s Defence Minister, Ahmed Moalim Fiqi, publicly praised the Somalia e-visa system. He claimed it had played a role in preventing ISIL (ISIS) fighters from entering the country, as Somali forces continued a months-long battle against a local affiliate of the group in the northern regions.  “The government’s push to deploy the e-visa system despite being clearly unprepared for potential risks, then redeploying it after a serious data breach, is a clear example of how disregard for people’s concerns and rights when introducing digital infrastructures can erode public trust and create avoidable vulnerabilities,” Andere said. She also expressed alarm that Somali authorities had not issued any formal public notice about the serious November data breach.  Under Somalia’s data protection law, data controllers are required to notify the national data protection authority when breaches occur. In high-risk cases, such as incidents involving sensitive personal data, affected individuals must also be informed. “Extra protections should apply in this case because it involves people of different nationalities and therefore multiple legal jurisdictions,” Andere added.  Al Jazeera said it could not disclose specific technical details of the current security flaw, as the vulnerability remains unpatched, and publicizing it could enable further exploitation. Any sensitive information obtained during the investigation was destroyed to protect the privacy of those affected. 
  •  

Active Exploitation of Command Injection Flaw Confirmed in Array AG Gateways

CVE-2023-28461

The Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) has confirmed that a command injection vulnerability affecting Array Networks AG Series secure access gateways has been actively exploited in Japan since August 2025. The advisory, updated on December 5, 2025, states that attackers have leveraged the flaw to implant web shells and gain unauthorized access to internal networks.  According to JPCERT, the vulnerability originates in the DesktopDirect feature of the AG Series, Array Networks’ remote desktop access capability designed to help users connect securely to office resources. Although the issue was quietly resolved by the vendor on May 11, 2025, the lack of a public CVE identifier and the continued presence of unpatched devices have left a notable attack surface exposed.  “Exploitation of this vulnerability could allow attackers to execute arbitrary commands,” the advisory states. JPCERT added that systems running DesktopDirect are specifically at risk, emphasizing that the feature enablement is a prerequisite for successful exploitation. 

Ongoing Attacks Traced to a Single IP Address 

JPCERT reports that organizations in Japan have experienced intrusions tied to this security gap beginning in August 2025. In these incidents, attackers attempted to plant PHP-based web shells in paths containing “/webapp/,” a technique that would provide persistent remote access.   The agency noted that malicious traffic has consistently originated from the IP address 194.233.100[.]138, though the identity and motivations of the threat actors remain unclear. Details regarding the scope of the campaign, the tools deployed beyond web shells, or whether the attackers represent a known threat group have not yet been released. 

No Evidence Linking to Past Exploits of CVE-2023-28461 

The newly exposed vulnerability exists alongside another previously exploited flaw in the same product line, CVE-2023-28461, a high-severity authentication bypass rated CVSS 9.8. That earlier issue was abused in 2024 by a China-linked espionage group known as MirrorFace, which has targeted Japanese institutions since at least 2019.  Despite the overlap in affected systems, JPCERT emphasized that there is no current evidence connecting the recent command injection attacks with MirrorFace or with prior activity related to CVE-2023-28461. 

Affected Versions and Required Updates 

The vulnerability impacts ArrayOS AG 9.4.5.8 and earlier versions, all of which support the DesktopDirect functionality. Array Networks issued a fixed release, ArrayOS 9.4.5.9, to address the flaw. The company has advised users to test and deploy the updated firmware as soon as possible.  JPCERT cautioned administrators that rebooting devices after applying the patch may lead to log loss. Because log files are crucial to intrusion investigations, the agency recommends preserving these records before performing any update or system reboot. 

Workarounds 

For organizations unable to immediately apply the firmware update, Array Networks has provided temporary mitigation steps: 
  • Disable all DesktopDirect services if the feature is not actively in use. 
  • Implement URL filtering to block requests containing semicolons (“;”), a common vector used for command injection payloads. 
These measures aim to reduce exposure until patching becomes feasible.  In its advisory, JPCERT urged all users of affected products to examine their systems for signs of compromise. Reported malicious activity includes the installation of web shells, the creation of unauthorized user accounts, and subsequent internal intrusions launched through the compromised AG gateways.
  •  

CISA Warns that Two Android Vulnerabilities Are Under Attack

CISA Warns Android Vulnerabilities Under Attack

CISA warned today that two Android zero-day vulnerabilities are under active attack, within hours of Google releasing patches for the flaws. Both are high-severity Android framework vulnerabilities. CVE-2025-48572 is a Privilege Escalation vulnerability, while CVE-2025-48633 is an Information Disclosure vulnerability. Both were among 107 Android vulnerabilities addressed by Google in its December security bulletin released today.

Android Vulnerabilities CVE-2025-48572 and CVE-2025-48633 Under Attack

Google warned that the CVE-2025-48572 and CVE-2025-48633 framework vulnerabilities “may be under limited, targeted exploitation.” The U.S. Cybersecurity and Infrastructure Security Agency (CISA) followed with its own alert adding the Android vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. “These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise,” CISA warned. “CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice,” the U.S. cybersecurity agency added. The vulnerabilities are so new that the CVE Program lists the CVE numbers as “reserved,” with details yet to be released. Neither Google nor CISA provided further details on how the vulnerabilities are being exploited.

7 Critical Android Vulnerabilities Also Patched

The December Android security bulletin also addressed seven critical vulnerabilities, the most severe of which is CVE-2025-48631, a framework Denial of Service (DoS) vulnerability that Google warned “could lead to remote denial of service with no additional execution privileges needed.” Four of the critical vulnerabilities affect the Android kernel and are all Elevation of Privilege (EoP) vulnerabilities: CVE-2025-48623, CVE-2025-48624, CVE-2025-48637, and CVE-2025-48638. The other two critical vulnerabilities affect Qualcomm closed-source components: CVE-2025-47319, an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability, and CVE-2025-47372, a Buffer Overflow vulnerability that could lead to memory corruption. Google lists CVE-2025-47319 as “Critical” while Qualcomm lists the vulnerability as Medium severity; both list CVE-2025-47372 as Critical. The Qualcomm vulnerabilities are addressed in detail in The Cyber Express article Qualcomm Issues Critical Security Alert Over Secure Boot Vulnerability published earlier today.
  •  

Airbus Nears Completion of A320 Retrofit as Regulators Monitor Largest Emergency Recall in Company History

Airbus

Airbus has entered the final phase of its unprecedented global retrofit effort, confirming that fewer than 100 A320s in service still require updates after the discovery of a software vulnerability that triggered the largest emergency recall the manufacturer has ever executed. The company disclosed on Monday that nearly the entire A320-family fleet, about 6,000 aircraft worldwide, has now received the mandated modification. 

Origins of the Airbus Recall and Early Regulatory Response

The action followed a recent mid-air incident involving a JetBlue A320 in which the aircraft experienced a sudden altitude drop. Investigators later identified that intense solar flares may have compromised data essential to the jet’s flight-control functions, exposing a software vulnerability in the system managing the aircraft’s nose-angle performance. The incident alarmed regulators around the world and quickly led to mandatory retrofit orders across the global fleet of A320s.  Airbus moved quickly, implementing what it described as a “precautionary fleet action” and issuing an eight-page safety alert that initiated immediate groundings. The timing created operational chaos for many carriers, particularly in the United States, where the rush to complete the required updates collided with the heavy travel surge over the Thanksgiving weekend. Airlines from Asia to South America were compelled to take aircraft out of service with little warning as the scale of the issue emerged.  Sources familiar with the internal decision-making reported that the recall was initiated shortly after engineers drew a potential connection between the JetBlue event and the flawed software logic. The findings pointed to how solar radiation could corrupt flight-control data, prompting Airbus to request urgent repairs before allowing affected aircraft back into rotation.

Operational Disruptions Across Airlines Worldwide

The consequences were immediate for operators. Avianca, based in Colombia, suspended new bookings until December 8 in order to manage the grounding of its impacted A320s. Finnair and other carriers were forced to inspect their fleets on one aircraft at a time because Airbus’s initial alert did not list specific serial numbers, complicating efforts to determine which jets required urgent attention.  Airbus detailed the nature of the issue in a formal statement: “Analysis of a recent event involving an A320 Family aircraft has revealed that intense solar radiation may corrupt data critical to the functioning of flight controls. Airbus has consequently identified a significant number of A320 Family aircraft currently in-service which may be impacted.”  The company added that it worked “proactively with the aviation authorities” to implement available software and hardware protections, acknowledging the operational disruptions and apologizing to passengers while emphasizing that safety remains its “number one and overriding priority.” 

Implementing the Fix and Remaining Challenges

The mandated fix itself was relatively straightforward but required precise execution. Technicians reverted affected A320s to an earlier version of the software governing the aircraft’s nose-angle system. This involved uploading the legacy software through a data-loader device brought directly into the cockpit, a measure designed to prevent cyber interference. While the installation process was simple in principle, each aircraft had to be updated individually, creating workload bottlenecks for carriers with large fleets.  Airlines also faced an unexpected hurdle: a shortage of data loaders. One industry executive noted privately that some operators had only a handful of these devices on hand, slowing the pace of updates during a period when hundreds of A320s required immediate attention. In addition, an unspecified number of older aircraft will ultimately need full computer replacements rather than software changes, adding another layer of complexity for maintenance teams.  Even with these challenges, the majority of the fleet has now been restored to service, marking good progress just days after regulators issued their emergency directives. With fewer than 100 jets awaiting updates, Airbus appears close to closing one of the most disruptive safety events ever to affect the A320 family, an episode that reshaped holiday travel plans worldwide and highlighted the unexpected risks posed by solar radiation on modern aircraft systems. 
  •  

India Enforces Mandatory SIM-Binding for Messaging Apps Under New DoT Rules

SIM-binding

India’s Department of Telecommunications (DoT) has introduced a shift in the way messaging platforms operate in the country, mandating the adoption of SIM-binding as a core security requirement. Under the Telecommunication Cybersecurity Amendment Rules, 2025, all major messaging services, including Telegram, and regional platforms such as Arattai, must ensure that their applications remain continuously linked to an active SIM card on the user’s device.   The mandate is part of the government’s intensified efforts to combat cyber fraud and strengthen nationwide cybersecurity compliance. The directive requires App-Based Communication Service providers to implement persistent SIM-linking within 90 days and submit detailed cybersecurity compliance reports within 120 days. The move seeks to eliminate longstanding gaps in identity verification systems that have enabled malicious actors to misuse Indian mobile numbers from outside the country. 

New Rules for SIM-Binding Communication 

According to the new requirements, messaging services must operate only when the user’s active SIM card matches the credentials stored by the app. If a SIM card is removed, replaced, or deactivated, the corresponding app session must immediately cease to function. The rules also extend to web-based interfaces: platforms must automatically log users out at least every six hours, requiring a QR-based reauthentication that is tied to the same active SIM.  These changes aim to reduce the misuse of Indian telecom identifiers, which authorities say have been exploited for spoofing, impersonation, and other forms of cyber fraud. By enforcing strict SIM-binding, the DoT intends to establish a clearer traceability chain between the user, their device, and their telecom credentials. 

Why Stricter Controls Were Needed 

Government observations revealed that many communication apps continued functioning even after the linked SIM card was removed. This allowed foreign-based actors to operate accounts associated with Indian mobile numbers without proper authentication. The ability to hijack accounts or mask locations contributed directly to an uptick in cybercrimes, often involving financial scams or identity theft.  Industry groups had previously flagged this vulnerability as well. The Cellular Operators Association of India (COAI), for instance, noted that authentication typically occurs only once, during initial setup, which leaves apps operational even if the SIM is no longer present. By requiring ongoing SIM-binding, authorities aim to close this loophole and establish reliable verification pathways essential for cybersecurity compliance.  The new mandate draws support from multiple regulatory frameworks, including the Telecommunications Act, 2023, and subsequent cybersecurity rules issued in 2024 and 2025. Platforms that fail to comply could face penalties, service restrictions, or other legal consequences under India’s telecom and cybersecurity laws. 

Impact on Platforms and Users 

Messaging platforms must redesign parts of their infrastructure to support real-time SIM authentication and implement secure logout mechanisms for multi-device access. They are also expected to maintain detailed logs and participate in audits to demonstrate cybersecurity compliance.  For users, the changes may introduce constraints. Accessing a messaging app without the original active SIM will no longer be possible. Cross-device flexibility, particularly through desktop or browser-based interfaces, may also be reduced due to the six-hour logout requirement. However, policymakers argue that these inconveniences are offset by a reduced risk of cyber fraud.  India’s focus on SIM-binding aligns with practices already common in financial services. Banking and UPI applications, for example, require an active SIM for verification to minimize fraud. Other regulators have taken similar steps: earlier in 2025, the Securities and Exchange Board of India (SEBI) proposed linking trading accounts to specific SIM cards and incorporating biometric checks to prevent unauthorized transactions. 

India Mandates Pre-Installed Cybersecurity App on Smartphones

In a parallel move to strengthen digital security, India’s telecom ministry has ordered all major smartphone manufacturers, including Apple, Samsung, Vivo, Oppo, and Xiaomi, to pre-install its cybersecurity app Sanchar Saathi on all new devices within 90 days, and push it via updates to existing devices. The app must be installed in a way that users cannot disable or delete it. Launched in January, Sanchar Saathi has already helped recover over 700,000 lost phones, blocked 3.7 million stolen devices, terminated 30 million fraudulent connections, and assists in tracking devices and preventing counterfeit phones. The app verifies IMEI numbers, blocks stolen devices, and combats scams involving duplicate or spoofed IMEIs. The move is aimed at strengthening India’s telecom cybersecurity but may face resistance from Apple and privacy advocates, as Apple traditionally opposes pre-installation of government or third-party apps. Industry officials have expressed concerns over privacy, user choice, and operational feasibility, while the government emphasizes the app’s role in digital safety and fraud prevention.
  •  

Apache Syncope Passwords at Risk from Newly Disclosed CVE-2025-65998

CVE-2025-65998

A critical security flaw has been uncovered in Apache Syncope, the widely used open-source identity management system, potentially putting organizations at risk of exposing sensitive password information.   Tracked as CVE-2025-65998, the vulnerability was publicly disclosed on November 24, 2025, by Francesco Chicchiriccò through the official Apache Syncope user mailing list. Credit for discovering the issue goes to Clemens Bergmann of the Technical University of Darmstadt. 

Understanding the CVE-2025-65998 Vulnerability 

The vulnerability specifically affects Apache Syncope instances configured to store user passwords in their internal database using AES encryption. While this configuration is not enabled by default, organizations that activate it may unknowingly introduce a significant security risk. The system relies on a hard-coded AES key embedded directly in the application’s source code.  This design oversight means that any attacker who gains access to the internal database can easily decrypt stored password values, recovering them in plaintext. This compromise poses a severe risk for account security, allowing unauthorized access, privilege escalation, and lateral movement within affected networks.  It is important to note that this flaw only affects passwords stored using the internal AES encryption feature. Other database attributes encrypted through key management mechanisms remain unaffected, as they use separate AES keys and proper encryption handling. 

Affected Versions 

Research indicates that multiple versions of Apache Syncope are vulnerable to CVE-2025-65998, including: 
  • Apache Syncope (org.apache.syncope.core:syncope-core-spring) 2.1 through 2.1.14 
  • Apache Syncope (org.apache.syncope.core:syncope-core-spring) 3.0 through 3.0.14 
  • Apache Syncope (org.apache.syncope.core:syncope-core-spring) 4.0 through 4.0.2 
Organizations running these versions are strongly advised to upgrade to patched releases—version 3.0.15 or 4.0.3—to mitigate the risk. The update replaces the vulnerable hard-coded AES key approach with a more secure key management process, ensuring that password data cannot be trivially decrypted even if the database is compromised. 

Potential Impact 

Exploitation of CVE-2025-65998 can have serious operational consequences. Once an attacker accesses the internal database, all passwords stored with the default AES encryption method can be decrypted, exposing users’ credentials.   This breach can lead to unauthorized account logins, elevated privileges, and potential internal movement across systems, amplifying the threat to organizational security. Francesco Chicchiriccò, in the advisory posted to the Apache Syncope mailing list, emphasized the importance of upgrading affected systems promptly:  “Apache Syncope can be configured to store user password values in the internal database with AES encryption, though this is not the default option. When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtaining access to the internal database content, to reconstruct the original cleartext password values.”  Clemens Bergmann of the Technical University of Darmstadt is credited with identifying this security gap, bringing attention to the risks associated with embedded AES encryption keys without proper key management. 

Mitigation Steps 

Administrators should promptly review their Apache Syncope deployments. Systems using AES encryption for internal password storage must be updated to versions 3.0.15 or 4.0.3, and key management practices should be strengthened to avoid hard-coded keys.  Cyble can help organizations proactively identify exposed assets and vulnerabilities, providing AI-powered threat intelligence and automated recommendations to prevent credential compromise.   Protect your organization from vulnerabilities like CVE-2025-65998. Leverage Cyble’s AI-powered threat intelligence to uncover exposed assets, assess risks, and secure your systems. Book a free demo today. 
  •  

Grafana Flags Maximum-Severity SCIM Vulnerability Enabling Privilege Escalation

CVE-2025-41115

Grafana Labs has issued a warning regarding a maximum-severity security flaw, identified as CVE-2025-41115, affecting its Enterprise product. The vulnerability can allow attackers to impersonate administrators or escalate privileges if certain SCIM (System for Cross-domain Identity Management) settings are enabled.  According to the company, the issue arises only when SCIM provisioning is activated and configured. Specifically, both the enableSCIM feature flag and the user_sync_enabled option must be set to true. Under these conditions, a malicious or compromised SCIM client could create a user with a numeric externalId that directly maps to an internal account, potentially even an administrative account. 

SCIM Mapping Flaw (CVE-2025-41115) Enables Impersonation Risks 

In SCIM systems, the externalId attribute functions as a bookkeeping field used by identity providers to track user records. Grafana Labs’ implementation mapped this value directly to the platform’s internal user.uid. Because of this design, a numeric external ID such as “1” could be interpreted as an existing Grafana account. This behavior opens a door for impersonation or privilege escalation, enabling unauthorized users to assume the identity of legitimate internal accounts.  Grafana Labs notes in its documentation that SCIM is intended to simplify automated provisioning and management of users and groups, particularly for organizations relying on SAML authentication. The feature, available in Grafana Enterprise and certain Grafana Cloud plans, remains in Public Preview. As a result, breaking changes may occur, and administrators are encouraged to test the feature thoroughly in non-production environments before deployment. 

SAML Alignment Required to Prevent Authentication Mismatches 

A major security requirement highlighted by Grafana Labs involves the alignment between the SCIM externalId and the identifier used in SAML authentication. SCIM provisioning relies on a stable identity provider attribute, such as Entra ID’s user.objectid, which becomes the external ID in Grafana. SAML authentication must use the same unique identifier, delivered through a SAML claim, to ensure proper account linkage.  If these identifiers do not match, Grafana may fail to associate authenticated SAML sessions with the intended SCIM-provisioned accounts. This mismatch can allow attackers to generate crafted SAML assertions that result in unauthorized access or impersonation. The company recommends using the assertion_attribute_external_uid setting to guarantee that Grafana reads the precise identity claim required to maintain secure user associations.  To reduce risk, Grafana requires organizations to use the same identity provider for both user provisioning and authentication. Additionally, the SAML assertion exchange must include the correct userUID claim to ensure the system can link the session to the appropriate SCIM entry. 

Configuration Requirements, Supported Workflows, and Automation Capabilities 

Administrators can set up SCIM in Grafana through the user interface, configuration files, or infrastructure-as-code tools such as Terraform. The UI option, available to Grafana Cloud users, applies changes without requiring a restart and allows more controlled access through restricted authentication settings.  Grafana’s SCIM configuration includes options for enabling user synchronization (user_sync_enabled), group synchronization (group_sync_enabled), and restricting access for accounts not provisioned through SCIM (reject_non_provisioned_users). Group sync cannot operate alongside Team Sync, though user sync can. Supported identity providers include Entra ID and Okta.  SCIM provisioning streamlines user lifecycle tasks by automating account creation, updates, deactivation, and team management, reducing manual administrative work and improving security. Grafana notes that SCIM offers more comprehensive, near real-time automation than alternatives such as Team Sync, LDAP Sync, Role Sync, or Org Mapping.  Grafana Labs is urging organizations to review their SCIM and SAML identifier mappings immediately, warning that inconsistencies may lead to unauthorized access scenarios tied to CVE-2025-41115.  In parallel, cybersecurity intelligence leaders such as Cyble continue tracking identity-related risks and misconfigurations across global environments. Security teams looking to strengthen visibility, detect threats earlier, and reduce exposure can explore Cyble’s capabilities, book a free demo to see how Cyble’s AI-driven threat intelligence enhances defense across cloud, endpoints, and identity systems. 
  •  

Salesforce Confirms Wider Impact in Ongoing Gainsight Security Incident

Salesforce

Salesforce has issued a new update on the ongoing Salesforce Gainsight security incident, confirming additional details about the unusual activity detected across Gainsight-published applications connected to the CRM platform. The company reiterated that the incident stemmed from the app’s external integration with Salesforce rather than any vulnerability in the Salesforce core platform.

Salesforce Confirms Expanded Investigation

In its latest advisory, Salesforce stated that the unusual activity affecting Gainsight applications may have enabled unauthorized access to certain customers' Salesforce data through the app-to-Salesforce connection. As part of its precautionary measures, Salesforce revoked all active access and refresh OAuth tokens associated with Gainsight-published applications and removed the apps from its AppExchange. While initial communication referenced only three affected customers, Salesforce confirmed on November 21 that the list has expanded, and all newly identified impacted customers have been notified directly. Salesforce emphasized that a broader investigation is underway and continues to provide updates on its official Help portal. [caption id="attachment_107067" align="aligncenter" width="895"]Gainsight security incident Source: Salesforce[/caption]

Gainsight Products and Connectors Temporarily Impacted

According to Gainsight’s latest communication, several of its products, including Gainsight CS, Community (CC), Northpass (CE), Skilljar (SJ), and Staircase (ST), have been affected by Salesforce’s precautionary disconnection. Although the products remain operational, they are currently unable to read or write data to Salesforce. In addition, several third-party connectors integrated with Gainsight, such as Gong.io, Zendesk, and HubSpot, have been temporarily disabled by their respective vendors out of an abundance of caution. Gainsight urged customers to rotate their S3 keys if they have not done so since November 20, 2025, as part of the secure log retrieval process.

No Indication of Salesforce Platform Vulnerability

Salesforce reiterated that there is no evidence suggesting the issue originated from a flaw within the Salesforce platform itself. Instead, the activity appears tied to the external OAuth-based connection between Gainsight applications and Salesforce environments. Crucially, Salesforce confirmed that while the OAuth tokens have been revoked, historical audit trails and logs remain intact, enabling full customer-led investigation efforts. The company also strongly encouraged customers to conduct thorough log reviews using Setup Audit Trail, Event Monitoring logs, and API activity records. Salesforce referenced the Salesforce Log Analysis Guide to support customers in assessing potential compromise indicators.

Indicators of Compromise Published

As part of its transparency efforts, Salesforce shared a list of Indicators of Compromise (IOCs) associated with the threat activity. These include several user agents—such as python-requests/2.32.3 and Salesforce-Multi-Org-Fetcher/1.0—and dozens of IP addresses linked to suspicious access attempts. Gainsight echoed Salesforce’s recommendations and is conducting its own forensic review with support from independent investigators. Both organizations confirmed that the Salesforce Gainsight security incident remains under active investigation. Gainsight has published a detailed timeline and continues to coordinate with Salesforce to determine the full impact. Customers seeking assistance have been directed to Salesforce Help and Gainsight Support for further updates.
  •  

CERT-In Warns of Critical Asus Router Flaw Exposing Millions in India

CVE-2025-59367

According to the Indian Computer Emergency Response Team (CERT-In), thousands of households, small offices, and service providers across the country may already be at risk due to a newly uncovered authentication bypass flaw tracked as CVE-2025-59367. India’s national cybersecurity agency has issued a security alert after identifying a severe vulnerability in several widely used Asus DSL-series WiFi routers. The warning, published in CERT-In Vulnerability Note CIVN-2025-0322, outlines how remote attackers could infiltrate specific router models without user involvement. The affected devices include the Asus DSL-AC51, DSL-N16, and DSL-AC750, three routers that are common in home and SOHO environments relying on DSL internet connections.  CERT-In states that the flaw enables an attacker to bypass login controls and gain unrestricted access to the router’s administrative interface. Once the router is compromised, the intruder could alter configuration settings, observe or reroute internet traffic, intercept personal or financial information, or even compromise connected devices. The agency describes the risks to confidentiality, integrity, and availability as “critical.” 

CVE-2025-59367 Enables Authentication Bypass and Network Compromise 

In its advisory, CERT-In explains that a "vulnerability has been reported in ASUS DSL series routers that allows a remote attacker to gain unauthorized access into the affected system.” The agency notes that the issue affects the DSL-AC51, DSL-N16, and DSL-AC750 models and warns that successful exploitation could result in unauthorized access, modification of configuration parameters, access to sensitive information transmitted through the router, and compromise of connected systems.  The advisory is targeted at IT and network administrators, SOC analysts, SMB operators, home and SOHO users, and managed service providers or ISPs, highlighting the widespread nature of the vulnerability. CERT-In’s assessment reiterates that the authentication bypass flaw, identified as CVE-2025-59367, poses direct threats to data confidentiality and system integrity.  The report also details the broader context of the Asus DSL series line, explaining that these devices serve as integrated modem-router units for environments dependent on DSL connections. Because these routers often operate as central networking hubs, any breach may expose all devices and data flowing through the network.  The advisory includes a directive: “Apply appropriate security updates as mentioned in: https://www.asus.com/security-advisory.” CERT-In urges users to immediately install the firmware patches that Asus has begun releasing for the affected models. The agency also recommends that users change default passwords, disable remote management functions unless necessary, and review router security settings for any misconfigurations. Monitoring router logs for abnormalities has also been emphasized as a crucial preventive step. 

Conclusion  

Asus rolls out patches for the authentication bypass flaw CVE-2025-59367; CERT-In is urging all users of affected DSL-series routers to apply updates immediately. The agency has reiterated the seriousness of the vulnerability and advised users to review their router settings, update firmware through the Asus security advisory page, and remain alert to suspicious activity. Incidents like CVE-2025-59367 show how essential it is for organizations to have reliable insight into new vulnerabilities. Cyble supports this need through detailed vulnerability intelligence, helping teams identify high-risk issues, track exploit activity, and prioritize remediation across assets and products. Its intelligence goes beyond standard CVE and NVD listings, offering context on exploits, attack methods, and threat actor discussions.  Schedule a personalized demo with Cyble to assess how its intelligence platform can support your security operations. 
  •  

Critical 7-Zip Vulnerability CVE-2025-11001 Prompts NHS Cyber Alert

CVE-2025-11001

A newly discovered security flaw, identified as CVE-2025-11001, is targeting users across both public and private sectors. The vulnerability, affecting all versions of 7-Zip before 25.00, allows attackers to execute malicious code remotely, potentially compromising critical systems. NHS Digital issued a cyber alert urging organizations and users to take immediate action. 

Details of the CVE-2025-11001 Vulnerability

CVE-2025-11001 is classified as a file-parsing directory traversal remote code execution vulnerability. With a CVSS score of 7.0, the flaw is considered high severity. Exploitation occurs through 7-Zip’s handling of symbolic links during the extraction of archive files. By crafting malicious archives, attackers can manipulate 7-Zip to write files outside the intended extraction directory. This misbehavior enables the placement of executable files in sensitive system locations, which can then be triggered to execute arbitrary code.  Security researchers have released a proof-of-concept (PoC) exploit demonstrating how CVE-2025-11001 can be leveraged. While the PoC does not constitute a fully weaponized attack, it lowers the barrier for cybercriminals, making unpatched systems increasingly vulnerable. 

Impact and Threat Assessment

All 7-Zip versions before 25.00 are at risk, which includes a vast number of enterprise systems, government agencies, and personal computers. The NHS Digital cybersecurity team has classified this issue as Threat ID CC-4719 with medium severity, highlighting the urgent need for patching.  Although initial reports suggested active exploitation in the wild, a subsequent update on November 20, 2025, clarified that no confirmed exploitation of CVE-2025-11001 has been observed by NHS England’s National Cyber Security Operations Centre (CSOC). The National CSOC did confirm the existence of the public PoC exploit and indicated that potential exploitation remains likely in the future if systems are left unpatched.  Given the deployment of 7-Zip across multiple environments, the potential attack surface is significant. A successful attack could allow unauthorized access to sensitive systems and facilitate the deployment of additional malware payloads. 

Remediation and Recommendations

In response to CVE-2025-11001, 7-Zip released version 25.00, which addresses the vulnerability and mitigates the risk of remote code execution via malicious archive files. Organizations and individual users are strongly advised to upgrade immediately. Delaying the update leaves systems exposed to potential threats that could be exploited once more attacks emerge.  System administrators should prioritize updating all endpoints and servers running vulnerable 7-Zip versions. Implementing this patch eliminates the directory traversal flaw, effectively neutralizing the possibility of arbitrary code execution through symbolic link abuse. 

Conclusion

CVE-2025-11001 is a high-severity 7-Zip vulnerability. While NHS systems haven’t seen confirmed exploitation, the public proof-of-concept raises the risk. Organizations should update to 7-Zip 25.00 or later and report incidents to NHS Digital.  To stay protected from threats like CVE-2025-11001, Cyble provides AI-driven vulnerability intelligence, helping organizations prioritize and patch critical risks before they are exploited. Schedule a personalized demo with Cyble to protect your systems today. 
  •