RondoDox v2: Evolution of RondoDox Botnet with 650% More Exploits #RondoDoxV2 #BotnetEvolution #MassExploitation #IoTSecurity #CybersecurityThreat https://beelzebub.ai/blog/rondo-dox-v2/
Beelzebub
RondoDox v2: Evolution of RondoDox Botnet with 650% More Exploits | AI-Native security platform
AI-Native security platform: Deceive, Detect, Respond. “You can’t defend. You can’t prevent. The only thing you can do is detect and respond.” Bruce Schneier. We turn that hard truth into your tactical advantage. Our AI-based decoys, built using our open…
LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices #LANDFALL #AndroidSpyware #SamsungExploit #ZeroDay #DNGImages https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/
Unit 42
LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices
Commercial-grade LANDFALL spyware exploits CVE-2025-21042 in Samsung Android’s image processing library. The spyware was embedded in malicious DNG files.
What’s That Coming Over The Hill? (Monsta FTP Remote Code Execution CVE-2025-34299) #MonstaFTP #RemoteCodeExecution #ZeroDay #CVE202534299 #VulnerabilityDiscovery https://labs.watchtowr.com/whats-that-coming-over-the-hill-monsta-ftp-remote-code-execution-cve-2025-34299/
watchTowr Labs
What’s That Coming Over The Hill? (Monsta FTP Remote Code Execution CVE-2025-34299)
Happy Friday, friends and.. others.
We’re glad/sorry to hear that your week has been good/bad, and it’s the weekend/but at least it’s almost the weekend!
What’re We Doing Today, Mr Fox?
Today, in a tale that seems all too familar at this point,
We’re glad/sorry to hear that your week has been good/bad, and it’s the weekend/but at least it’s almost the weekend!
What’re We Doing Today, Mr Fox?
Today, in a tale that seems all too familar at this point,
Privilege Escalation With Jupyter From the Command Line #PrivilegeEscalation #Jupyter #CommandLine #Misconfiguration #RootAccess https://www.adversis.io/blogs/privilege-escalation-with-jupyter-from-the-command-line
www.adversis.io
Privilege Escalation With Jupyter From the Command Line
A recent penetration test led to an interesting way to escalate privileges on a Jupyter instance running as root.
Cloud Filter Arbitrary File Creation EoP Patch Bypass LPE https://ssd-disclosure.com/cloud-filter-arbitrary-file-creation-eop-patch-bypass-lpe/
SSD Secure Disclosure
Cloud Filter Arbitrary File Creation EoP Patch Bypass LPE - SSD Secure Disclosure
Vendor Response The vendor has released a patch for Windows that addresses this vulnerability: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55680 CVE CVE-2025-55680 Credit The vulnerability was disclosed during our TyphoonPWN Windows category…
Public Bug Bounty Programs & Responsible Disclosures #BugBounty #SecurityPrograms #EthicalHacking #VulnerabilityDisclosure #HackerDirectory https://www.bugbountydirectory.com/
Bugbountydirectory
Bug Bounty Directory - List of bug bounty programs and responsible disclosure
A list of public bug bounty programs and responsible disclosures.
Ready for Post-Quantum TLS? #QuantumReady #PostQuantumTLS #PQC #CyberSecurity #FutureProofing https://qcready.com/
Qcready
QCready - Evaluate your TLS Quantum readiness
Run the QCReady TLS scan to see if your domain already supports hybrid Kyber/PQC handshakes and is prepared for post-quantum HTTPS.
Arbitrary App Installation on Intune Managed Android Enterprise BYOD #AndroidBYOD #WorkProfile #IntuneVulnerability #AppInstall #CVEBypass https://jgnr.ch/sites/android_enterprise.html
The Burn Notice, Part 3/5 | One Simple Mistake, Thousands at Risk https://medium.com/@attias.dor/the-burn-notice-3-5-one-simple-mistake-thousands-at-risk-996f85fcb92f
Medium
The Burn Notice, Part 3/5 | One Simple Mistake, Thousands at Risk
How Common Misconfigurations Could Lead to Massive Data Exposure
DoorDash allowed any business user to send arbitrary HTML emails from no-reply@doordash.com for 5 years #DoorDash #Disclosure #Security #GitLab #Public https://gitlab.com/mato.ferech/doordash-disclosure-public/-/blob/54535fa7b497e13100aa14f32a46f6aedb4aaf28/index.md
GitLab
index.md · 54535fa7b497e13100aa14f32a46f6aedb4aaf28 · Martin Ferech / DoorDash-Disclosure-Public · GitLab
No Leak, No Problem – Bypassing ASLR with a ROP Chain to Gain RCE #ASLRBypass #ROPChain #IOTSploitation #BufferOverflow #RCE https://modzero.com/en/blog/no-leak-no-problem/
Modzero
No Leak, No Problem – Bypassing ASLR with a ROP Chain to Gain RCE
MacOS Infection Vector: Using AppleScripts to bypass Gatekeeper #MacOSMalware #AppleScript #GatekeeperBypass #InfectionVector #SocialEngineering https://pberba.github.io/security/2025/11/11/macos-infection-vector-applescript-bypass-gatekeeper/
pepe berba
MacOS Infection Vector: Using AppleScripts to bypass Gatekeeper
A look at how threat actors are abusing AppleScript .scpt files to deliver macOS malware, from fake documents to browser update lures, and how these scripts ...
Is It CitrixBleed4? Well, No. Is It Good? Also, No. (Citrix NetScaler Memory Leak & RXSS CVE-2025-12101) #CitrixNetScaler #VulnerabilityResearch #MemoryLeak #ReflectedXSS #CVE202512101 https://labs.watchtowr.com/is-it-citrixbleed4-well-no-is-it-good-also-no-citrix-netscalers-memory-leak-rxss-cve-2025-12101/
watchTowr Labs
Is It CitrixBleed4? Well, No. Is It Good? Also, No. (Citrix NetScaler Memory Leak & RXSS CVE-2025-12101)
There’s an elegance to vulnerability research that feels almost poetic - the quiet dance between chaos and control. It’s the art of peeling back the layers of complexity, not to destroy but to understand; to trace the fragile threads that hold systems together…
When The Impersonation Function Gets Used To Impersonate Users (Fortinet FortiWeb Auth. Bypass CVE-2025-64446) #FortiWeb #AuthBypass #CVE202564446 #PathTraversal #Impersonation https://labs.watchtowr.com/when-the-impersonation-function-gets-used-to-impersonate-users-fortinet-fortiweb-auth-bypass/
watchTowr Labs
When The Impersonation Function Gets Used To Impersonate Users (Fortinet FortiWeb Auth. Bypass CVE-2025-64446)
The Internet is ablaze, and once again we all have a front-row seat - a bad person, if you can believe it, is doing a bad thing!
The first warning of such behaviour came from the great team at Defused:
As many are now aware, an unnamed (and potentially…
The first warning of such behaviour came from the great team at Defused:
As many are now aware, an unnamed (and potentially…
Disrupting the first reported AI-orchestrated cyber espionage campaign #FirstAIHack #AgenticAI #CyberEspionage #AutonomousAttacks #CybersecurityFuture https://www.anthropic.com/news/disrupting-AI-espionage
Anthropic
Disrupting the first reported AI-orchestrated cyber espionage campaign
A report describing an a highly sophisticated AI-led cyberattack
N-able N-central: From N-days to 0-days #NableNcentral #0DayExploits #AuthBypass #XXEAttack #DataBreach https://horizon3.ai/attack-research/attack-blogs/n-able-n-central-from-n-days-to-0-days/
Horizon3.ai
N-able N-central: From N-days to 0-days
Root cause analysis for N-able N-central CVE-2025-9163 and CVE-2025-11700 which allow for reading files and and potentially compromising the N-central database which stores client credentials, API keys, and more.
Gotchas in Email Parsing - Lessons From Jakarta Mail #EmailParsing #JakartaMail #SecurityVulnerabilities #ParsingDifferentials #RFCCompliance https://www.elttam.com/blog/jakarta-mail-primitives/
Elttam
Gotchas in Email Parsing - Lessons From Jakarta Mail - elttam
Learn the hidden quirks in Jakarta Mail that can lead to high-impact security bugs, and how to avoid them in your Java applications.
Discussion on assert(int+100 > int) optimized away in gcc https://gcc.gnu.org/bugzilla/show_bug.cgi?id=30475
Python packages to create extensive spy program #Python #SpyProgram #BlockHacks #Hacking #Surveillance https://audits.blockhacks.io/audit/python-packages-to-create-spy-program
BlockHacks
Python packages to create extensive spy program
This article dives deep into the emerging threat of covert audio‑and‑video exfiltration hidden inside seemingly harmless PDF attachments and lightweight Python scripts. It explains how attackers embed microphone listeners, webcam recorders, and motion‑triggered…