Tag: zero-day
-
Apple fixes this year’s first actively exploited zero-day bug
Apple has released security updates to fix this year’s first zero-day vulnerability, tagged as actively exploited in attacks targeting iPhone users. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/apple-fixes-this-years-first-actively-exploited-zero-day-bug/
-
SonicWall SMA Appliances Exploited in Zero-Day Attacks
Critical security flaw in SonicWall SMA 1000 appliances (CVE-2025-23006) exploited as a zero-day. Rated CVSS 9.8, patch immediately… First seen on hackread.com Jump to article: hackread.com/sonicwall-sma-appliances-exploited-zero-day-attacks/
-
SonicWall Says Exploitation Of SMA1000 Flaw Discovered By Microsoft
SonicWall says that exploitation of a ‘critical’ zero-day vulnerability in the SMA1000 Appliance Management Console and Central Management Console has been reported by Microsoft threat researchers. First seen on crn.com Jump to article: www.crn.com/news/security/2025/sonicwall-says-exploitation-of-sma1000-flaw-discovered-by-microsoft
-
Ivanti zero-days chained together in at least 3 attacks, authorities warn
The vendor’s customers have confronted multiple attack sprees targeting zero-days spanning a variety of products. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ivanti-zero-days-chained-attacks/738130/
-
SonicWall flags critical bug likely exploited as zero-day, rolls out hotfix
Big organizations and governments are main users of these gateways First seen on theregister.com Jump to article: www.theregister.com/2025/01/23/sonicwall_critical_bug/
-
SonicWall warns of SMA1000 RCE flaw exploited in zero-day attacks
SonicWall is warning about a pre-authentication deserialization vulnerability in SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), with reports that it has been exploited as a zero-day in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-rce-flaw-exploited-in-zero-day-attacks/
-
SonicWall Learns From Microsoft About Potentially Exploited Zero-Day
SonicWall has credited Microsoft for reporting CVE-2025-23006, a critical remote command execution vulnerability possibly exploited in the wild. The post SonicWall Learns From Microsoft About Potentially Exploited Zero-Day appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/sonicwall-learns-from-microsoft-about-potentially-exploited-zero-day/
-
10 top XDR tools and how to evaluate them
Tags: ai, attack, automation, business, cloud, computing, container, corporate, credentials, data, defense, detection, edr, email, encryption, endpoint, finance, firewall, google, guide, Hardware, iam, ibm, identity, incident response, infrastructure, intelligence, malicious, malware, marketplace, microsoft, mitigation, network, office, okta, open-source, organized, risk, security-incident, service, siem, skills, soar, software, spam, technology, threat, tool, training, vulnerability, zero-dayLittle in the modern IT world lends itself to manual or siloed management, and this is doubly true in the security realm. The scale of modern enterprise computing and modern application stack architecture requires security tools that can bring visibility into the security posture of modern IT components and integrate tightly to bring real-time threat…
-
SonicWall SMA appliances exploited in zero-day attacks (CVE-2025-23006)
A critical zero-day vulnerability (CVE-2025-23006) affecting SonicWall Secure Mobile Access (SMA) 1000 Series appliances is being exploited by attackers. >>We strongly … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/01/23/sonicwall-sma-1000-exploited-zero-day-cve-2025-23006/
-
Pwn2Own Automotive 2025 Day 1: organizers awarded $382,750 for 16 zero-days
Trend Micro’s Zero Day Initiative (ZDI) announced that $380K was awarded on Day 1 of Pwn2Own Automotive 2025. Trend Micro’s Zero Day Initiative (ZDI) announced that over $380,000 was awarded on Day 1 of Pwn2Own Automotive 2025, a hacking contest that was held in Tokyo. In total, the organizers awarded $382,750 for 16 unique working…
-
Critical zero-days impact premium WordPress real estate plugins
The RealHome theme and the Easy Real Estate plugins for WordPress are vulnerable to two critical severity flaws that allow unauthenticated users to gain administrative privileges. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-zero-days-impact-premium-wordpress-real-estate-plugins/
-
Hackers exploit 16 zero-days on first day of Pwn2Own Automotive 2025
On the first day of Pwn2Own Automotive 2025, security researchers exploited 16 unique zero-days and collected $382,750 in cash awards. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-16-zero-days-on-first-day-of-pwn2own-automotive-2025/
-
Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet
Threat actors are exploiting an unspecified zero-day vulnerability in Cambium Networks cnPilot routers to deploy a variant of the AISURU botnet called AIRASHI to carry out distributed denial-of-service (DDoS) attacks.According to QiAnXin XLab, the attacks have leveraged the security flaw since June 2024. Additional details about the shortcomings have been withheld to prevent further abuse.Some…
-
Spooks of the internet came alive this Halloween
Halloween 2024 made history with a massive spike in distributed denial of service (DDoS) attacks, with one particular assault reaching over 5 Terabits-per-second (Tbps) worth of phony traffic.In its quarterly analysis of DDoS attacks, Cloudflare reported a surge in hyper-volumetric attacks in the fourth quarter of 2024.”In the fourth quarter, over 420 of those attacks…
-
Patch procrastination leaves 50,000 Fortinet firewalls vulnerable to zero-day
Seven days after disclosure and little action taken, data shows First seen on theregister.com Jump to article: www.theregister.com/2025/01/21/fortinet_firewalls_still_vulnerable/
-
CL-UNK-0979 Exploit Zero-Day Flaw in Ivanti Connect Secure to Gain Access to Networks
Palo Alto Networks has issued a detailed threat briefing on two critical vulnerabilities in Ivanti products”, CVE-2025-0282 and CVE-2025-0283. First seen on securityonline.info Jump to article: securityonline.info/cl-unk-0979-exploit-zero-day-flaw-in-ivanti-connect-secure-to-gain-access-to-networks/
-
January Patch Tuesday resolves 3 Hyper-V zero-days
The number of vulnerabilities corrected for January Patch Tuesday is one of the highest in recent memory and includes three Hyper-V vulnerabilities exploited in the wild. First seen on techtarget.com Jump to article: www.techtarget.com/searchwindowsserver/news/366617849/January-Patch-Tuesday-resolves-3-Hyper-V-zero-days
-
Fortinet Confirms Critical Zero-Day Vulnerability in Firewalls
The security provider published mitigation measures to prevent exploitation First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/fortinet-confirms-critical-zero-day/
-
Fortinet Confirms New Zero-Day Exploitation
Fortinet patches critical vulnerabilities, including a zero-day that has been exploited in the wild since at least November 2024. The post Fortinet Confirms New Zero-Day Exploitation appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/fortinet-confirms-new-zero-day-exploitation/
-
Microsoft Patches Eight Zero-Days to Start the Year
Patch Tuesday saw Microsoft fix eight zero-days, three of which are being actively exploited First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/microsoft-patches-eight-zerodays/
-
Attackers exploiting critical Fortinet zero-day vulnerability
Fortinet disclosed another zero-day vulnerability in its FortiOS and FortiProxy products days after Arctic Wolf detailed a threat campaign targeting the vendor’s devices. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366618095/Attackers-exploiting-critical-Fortinet-zero-day-vulnerability
-
3 Actively Exploited Zero-Day Flaws Patched in Microsoft’s Latest Security Update
Microsoft kicked off 2025 with a new set of patches for a total of 161 security vulnerabilities across its software portfolio, including three zero-days that have been actively exploited in attacks.Of the 161 flaws, 11 are rated Critical, and 149 are rated Important in severity. One other flaw, a non-Microsoft CVE related to a Windows…
-
CVE-2024-55591: Fortinet Authentication Bypass Zero-Day Vulnerability Exploited in the Wild
Fortinet patched a zero day authentication bypass vulnerability in FortiOS and FortiProxy that has been actively exploited in the wild as a zero-day since November 2024. Background On January 14, Fortinet released a security advisory (FG-IR-24-535) addressing a critical severity vulnerability impacting FortiOS and FortiProxy. CVE Description CVSSv3 CVE-2024-55591 FortiOS and FortiProxy Authentication Bypass Vulnerability…
-
Microsoft Rings in 2025 With Record Security Update
Company has issued patches for an unprecedented 159 CVEs, including eight zero-days, three of which attackers are already exploiting. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/microsoft-january-2025-record-security-update
-
Fortinet confirms zero-day flaw used in attacks against its firewalls
Fortinet has confirmed the existence of a critical authentication bypass vulnerability in specific versions of FortiOS firewalls and FortiProxy secure web gateways. The flaw has been exploited in the wild since early December in what appears to be an indiscriminate and widespread campaign, according to cybersecurity firm Arctic Wolf.The fix for this zero-day is part…
-
Microsoft Security Update Summary (14. Januar 2025)
Am Microsoft Security Update Summary (14. Januar 2025) hat Microsoft Sicherheitsupdates für Windows-Clients und -Server, für Office sowie für weitere Produkte veröffentlicht. Die Sicherheitsupdates beseitigen 159 Schwachstellen (CVEs), davon acht als 0-day klassifiziert. Nachfolgend findet sich ein kompakter … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/01/14/microsoft-security-update-summary-14-januar-2025/