Tag: zero-day
-
Apple zero day used in ‘extremely sophisticated attack’
CVE-2025-24200 is a zero-day vulnerability that bypasses Apple’s USB Restricted Mode in iPhones and iPads and was exploited in the wild against ‘specific targeted individuals.’ First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366619044/Apple-zero-day-used-in-extremely-sophisticated-attack
-
Microsoft’s February 2025 Patch Tuesday Addresses 55 CVEs (CVE-2025-21418, CVE-2025-21391)
Tags: access, advisory, android, apt, attack, authentication, best-practice, cve, cyber, data, exploit, firmware, flaw, group, Internet, lazarus, linux, malicious, microsoft, network, north-korea, ntlm, office, rce, remote-code-execution, service, technology, tool, update, vulnerability, windows, zero-day3Critical 52Important 0Moderate 0Low Microsoft addresses 55 CVEs with three rated critical and four zero-day vulnerabilities, including two that were exploited in the wild. Microsoft patched 55 CVEs in its February 2025 Patch Tuesday release, with three rated critical and 52 rated as important. Our counts omitted one vulnerability reported by HackerOne. This month’s update…
-
Microsoft Security Update Summary (11. Februar 2025)
Am Microsoft Security Update Summary (11. Februar 2025) hat Microsoft Sicherheitsupdates für Windows-Clients und -Server, für Office sowie für weitere Produkte veröffentlicht. Die Sicherheitsupdates beseitigen 55 Schwachstellen (CVEs), davon drei als kritisch und vier als 0-day klassifiziert. Nachfolgend … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/02/12/microsoft-security-update-summary-11-februar-2025/
-
Microsoft fixes 63 vulnerabilities, including 2 zero-days
The company’s monthly Patch Tuesday update comes with more than two-thirds of the patches closing high-severity flaws. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-patch-tuesday-february-2025/
-
The Rise of Typhoon Cyber Groups
Tags: access, attack, breach, communications, control, cyber, cyberattack, cybersecurity, data, defense, dns, endpoint, espionage, exploit, finance, government, group, infrastructure, intelligence, iot, military, monitoring, network, phone, resilience, supply-chain, tactics, threat, tool, vulnerability, zero-day -
Apple Fixes Actively Exploited iOS, iPadOS, Zero-Day Flaw
First seen on scworld.com Jump to article: www.scworld.com/brief/apple-fixes-actively-exploited-ios-ipados-zero-day-flaw
-
Microsoft Patches ‘Wormable’ Windows Flaw and File-Deleting Zero-Day
The Microsoft Patch Tuesday machine hummed loudly this month urgent fixes for a pair of already-exploited Windows zero-days. The post Microsoft Patches ‘Wormable’ Windows Flaw and File-Deleting Zero-Day appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/microsoft-patches-wormable-windows-flaw-and-file-deleting-zero-day/
-
Microsoft fixes two actively exploited zero-days (CVE-2025-21418, CVE-2025-21391)
February 2025 Patch Tuesday is here, and Microsoft has delivered fixes for 56 vulnerabilities, including two zero-days CVE-2025-21418 and CVE-2025-21391 under … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/02/11/microsoft-fixes-exploited-zero-days-cve-2025-21418-cve-2025-21391-patch-tuesday/
-
Fortinet FortiOS FortiProxy Zero-Day Exploited to Hijack Firewall Gain Super Admin Access
Tags: access, authentication, csf, cyber, cybersecurity, exploit, firewall, flaw, fortinet, vulnerability, zero-dayCybersecurity firm Fortinet has issued an urgent warning regarding a newly discovered zero-day authentication bypass vulnerability (CVE-2025-24472) affecting its FortiOS and FortiProxy products. This critical flaw enables remote attackers to obtain super-admin privileges by exploiting maliciously crafted CSF proxy requests. The vulnerability impacts FortiOS versions 7.0.0 through 7.0.16, as well as FortiProxy versions 7.0.0 through…
-
Actively exploited iOS, iPadOS zero-day addressed
First seen on scworld.com Jump to article: www.scworld.com/brief/actively-exploited-ios-ipados-zero-day-addressed
-
Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws
Today is Microsoft’s February 2025 Patch Tuesday, which includes security updates for 55 flaws, including four zero-day vulnerabilities, with two actively exploited in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-february-2025-patch-tuesday-fixes-4-zero-days-55-flaws/
-
Fortinet warns of new zero-day exploited to hijack firewalls
Fortinet warned today that attackers are exploiting another authentication bypass zero-day bug in FortiOS and FortiProxy to hijack Fortinet firewalls and breach enterprise networks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fortinet-warns-of-new-zero-day-exploited-to-hijack-firewalls/
-
Microsoft Patch Tuesday February 2025: 61 Vulnerabilities Including 25 RCE 3 0-Day
Microsoft has released its highly anticipated Patch Tuesday security updates for February 2025, addressing a wide range of vulnerabilities across its products and services. This month’s release includes fixes for critical remote code execution (RCE) vulnerabilities, elevation of privilege flaws, and other security issues that attackers could potentially exploit. Organizations and users are urged to…
-
VeraCore zero-day vulnerabilities exploited in supply chain attacks
Cybercriminals maintained access to one victim;organization for more than four years. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/veracore-zero-day-vulnerabilities-exploited-in-supply-chain-attacks/739784/
-
XE Group Shifts From Card Skimming to Supply Chain Attacks
The likely Vietnam-based threat actor has been using two zero-days in VeraCore’s warehouse management software in some of its latest cyberattacks. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/xe-group-shifts-card-skimming-supply-chain-attacks
-
Apple issues emergency patches to contain an ‘extremely sophisticated attack’ on targeted individuals
Security researcher uncovers the exploit: The vulnerability was discovered by Bill Marczak, a senior researcher at Citizen Lab, a digital rights research group at the University of Toronto’s Munk School.Marczak took to social media to urge users to update their devices immediately, stating: “Update your iPhones”¦ again! iOS 18.3.1 out today with a fix for…
-
Apple fixes zero-day flaw exploited in >>extremely sophisticated<< attack (CVE-2025-24200)
Users of iPhones and iPads that run iOS/iPadOS 18 and iPadOS 17 are urged to implement the latest updates to plug a security feature bypass vulnerability (CVE-2025-24200) … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/02/11/apple-fixes-zero-day-flaw-exploited-in-extremely-sophisticated-attack-cve-2025-24200/
-
Apple Mitigates “Extremely Sophisticated” Zero-Day Exploit
Apple has patched a zero-day vulnerability being exploited in targeted attacks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/apple-update-extremely/
-
Top 5 ways attackers use generative AI to exploit your systems
Tags: access, ai, attack, authentication, awareness, banking, captcha, chatgpt, china, control, cyber, cybercrime, cybersecurity, defense, detection, exploit, extortion, finance, flaw, fraud, group, hacker, intelligence, LLM, malicious, malware, network, phishing, ransomware, resilience, service, spam, tactics, theft, threat, tool, vulnerability, zero-dayFacilitating malware development: Artificial intelligence can also be used to generate more sophisticated or at least less labour-intensive malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s…
-
Apple Patches Actively Exploited iOS Zero-Day CVE-2025-24200 in Emergency Update
Apple on Monday released out-of-band security updates to address a security flaw in iOS and iPadOS that it said has been exploited in the wild.Assigned the CVE identifier CVE-2025-24200, the vulnerability has been described as an authorization issue that could make it possible for a malicious actor to disable USB Restricted Mode on a locked…
-
Trimble Cityworks zero-day flaw under attack, patch now
CVE-2025-0994 is a high-severity deserialization vulnerability that enables remote code execution in unpatched versions of Cityworks enterprise asset management software. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366619160/Trimble-Cityworks-zero-day-flaw-under-attack-patch-now
-
Apple fixes iPhone and iPad bug exploited in ‘extremely sophisticated attacks’
Apple released iOS and iPadOS updates to address a zero-day likely exploited in extremely sophisticated attacks targeting specific individuals. Apple released emergency security updates to address a zero-day vulnerability, tracked as CVE-2025-24200, that the company believes was exploited in >>extremely sophisticated
-
Apple fixes iPhone and iPad bug used in an ‘extremely sophisticated attack’
Unknown attackers may have exploited a zero-day bug to access data on locked phones, according to Apple. First seen on techcrunch.com Jump to article: techcrunch.com/2025/02/10/apple-fixes-iphone-and-ipad-bug-used-in-an-extremely-sophisticated-attack/
-
Apple fixes zero-day exploited in ‘extremely sophisticated’ attacks
Apple has released emergency security updates to patch a zero-day vulnerability that the company says was exploited in targeted and “extremely sophisticated” attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/apple/apple-fixes-zero-day-exploited-in-extremely-sophisticated-attacks/
-
Apple fixes iPhone and iPad bug used in an >>extremely sophisticated attack<<
Unknown attackers may have exploited a zero-day bug to access data on locked phones, according to Apple. First seen on techcrunch.com Jump to article: techcrunch.com/2025/02/10/apple-fixes-iphone-and-ipad-bug-used-in-an-extremely-sophisticated-attack/
-
XE Group shifts from credit card skimming to exploiting zero-days
The cybercrime group XE Group exploited a VeraCore zero-day to deploy reverse shells, web shells in recent attacks. A recent investigation by researchers from Intezer and Solis Security shed light on the recent operations of the XE Group. Active since at least 2013, XE Group is a cybercriminal group focused on credit card skimming and…
-
XE Hacker Group Exploits VeraCore Zero-Day to Deploy Persistent Web Shells
Threat actors have been observed exploiting multiple security flaws in various software products, including Progress Telerik UI for ASP.NET AJAX and Advantive VeraCore, to drop reverse shells and web shells, and maintain persistent remote access to compromised systems.The zero-day exploitation of security flaws in VeraCore has been attributed to a threat actor known as XE…
-
Core-Media-Framework Day-Schwachstelle
First seen on security-insider.de Jump to article: www.security-insider.de/apple-core-media-framework-sicherheitsluecke-a-b1e972a48d78893f3808f22de82f36b6/
-
Week in review: Exploited 7-Zip 0-day flaw, crypto-stealing malware found on App Store, Google Play
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Russian cybercrooks exploiting 7-Zip zero-day vulnerability (CVE-2025-0411) … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/02/09/week-in-review-exploited-7-zip-0-day-flaw-crypto-stealing-malware-found-on-app-store-google-play/