Active vulnerabilities, advisories, and threat intelligence — filtered for IT practitioners.
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2008-4128 Cisco IOS Cross-Site Request Forgery Vulnerability This type of vulne...
Microsoft patched a zero-day in the Windows Common Log File System driver that ransomware operators Storm-0506 and RansomEXX actively exploited to escalate from standard user to SYSTEM before deploying payloads.
A critical stack-based buffer overflow in Ivanti Connect Secure VPN was exploited as a zero-day by UNC5221 (China-nexus) to deploy TRAILBLAZE dropper and BRUSHFIRE passive backdoor on edge devices globally.
A zero-click NTLM hash leak via .library-ms files is being actively exploited in phishing campaigns targeting government and private sector organizations in Poland and Romania.
A sandbox escape in Google Chrome was exploited as a zero-day in a targeted espionage campaign against media organizations, educational institutions, and government entities in Russia.
Five vulnerabilities in the Kubernetes ingress-nginx controller, collectively dubbed IngressNightmare, allow unauthenticated attackers with access to the admission webhook to achieve cluster-level code execution.
A trivial header injection in Next.js allows attackers to skip middleware execution entirely, bypassing authentication, authorization, and security checks on any route protected only by Next.js middleware.
A deserialization vulnerability in Veeam Backup & Replication allows any authenticated domain user to execute arbitrary code on the backup server, potentially destroying or encrypting backups before a ransomware attack.
The widely-used tj-actions/changed-files GitHub Action was compromised in a supply chain attack, executing malicious code that printed CI/CD secrets to workflow logs in hundreds of repositories.
CISA added six actively exploited vulnerabilities to its KEV catalog this week, including flaws in Microsoft Windows, Cisco, and SAP products, requiring federal agencies to patch within 21 days.
A Windows Management Console security feature bypass was exploited by the Russian-linked Water Gamayun group to execute malicious .msc files, bypassing Windows file reputation and MotW protections.
Scattered Spider (UNC3944) continues to compromise Fortune 500 companies by impersonating employees to IT help desks and exploiting SIM swapping — even after MGM and Caesars breaches drew federal attention.
Microsoft's January 2025 Patch Tuesday addressed 159 vulnerabilities including 8 zero-days (3 exploited in the wild) and critical RCE flaws in Windows OLE, LDAP, and Hyper-V.
Fortinet's critical authentication bypass in FortiOS and FortiProxy management interfaces is being actively exploited at scale, with attackers creating hidden super-admin accounts and pivoting to internal networks.
