Tag: zero-day
-
Patch Tuesday: Microsoft Patches Two Actively Exploited Zero-Day Flaws
February’s report on Microsoft patches includes 56 vulnerabilities, two of which are zero-day flaws that have been exploited. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/patch-tuesday-feb-25-microsoft/
-
Patch Tuesday: Microsoft Fixes 63 Bugs with 2 Zero-Days
Microsoft’s February Patch Tuesday addresses 63 security vulnerabilities, including two actively exploited zero-days. Update your systems now to… First seen on hackread.com Jump to article: hackread.com/patch-tuesday-microsoft-fixes-0-day-bugs/
-
Hackers Exploit Ivanti Connect Secure Vulnerability to Inject SPAWNCHIMERA malware
Tags: cve, cvss, cyber, cybersecurity, exploit, flaw, hacker, ivanti, malware, remote-code-execution, vulnerability, zero-dayIn a concerning development, cybersecurity experts have identified active exploitation of a critical vulnerability in Ivanti Connect Secure (ICS) appliances, tracked as CVE-2025-0282. This zero-day vulnerability, a stack-based buffer overflow with a CVSS score of 9.0, has been leveraged by attackers to deploy the advanced SPAWNCHIMERA malware. The flaw permits unauthenticated remote code execution, enabling…
-
Microsoft plugs two zero-days for February Patch Tuesday
The company corrects active exploits in vulnerable Windows systems, one of which could give the attacker complete control if successful. First seen on techtarget.com Jump to article: www.techtarget.com/searchwindowsserver/news/366619234/Microsoft-plugs-two-zero-days-for-February-Patch-Tuesday
-
Windows Driver Zero-Day Vulnerability Let Hackers Remotely Gain System Access
Microsoft has confirmed the discovery of a significant zero-day vulnerability, tracked as CVE-2025-21418, in the Windows Ancillary Function Driver for WinSock. This flaw, categorized as anElevation of Privilege (EoP)vulnerability, has been exploited in the wild, allowing attackers to remotely gain control of affected systems under certain conditions. Security analysts warn that this flaw is particularly dangerous…
-
Microsoft Fixes Another Two Actively Exploited Zero-Days
February Patch Tuesday sees Microsoft fix four zero-days, including two under active exploitation First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/microsoft-fixes-two-actively/
-
0-Day Vulnerability in Windows Storage Allow Hackers to Delete the Target Files Remotely
A newly discovered 0-day vulnerability in Windows Storage has sent shockwaves through the cybersecurity community. Identified as CVE-2025-21391, this critical flaw allows attackers to elevate privilege and remotely delete targeted files on a victim’s system without their interaction. Microsoft officially confirmed the issue on February 11, 2025. According to the advisory, this vulnerability stems from a…
-
Microsoft Patch Tuesday security updates for February 2025 ficed 2 actively exploited bugs
Microsoft Patch Tuesday security updates for February 2025 addressed four zero-day flaws, two of which are actively exploited in the wild. Microsoft Patch Tuesday security updates for February 2025 addressed 57 vulnerabilities in Windows and Windows Components, Office and Office Components, Azure, Visual Studio, and Remote Desktop Services. Two of these vulnerabilities are listed as…
-
Microsoft’s February Patch a Lighter Lift Than January’s
But there’s plenty in it, including two zero-days, that need immediate attention. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/microsofts-february-patch-lighter-lift-januarys
-
Microsoft’s February 2025 Patch Tuesday Addresses 55 CVEs (CVE-2025-21418, CVE-2025-21391)
Tags: access, advisory, android, apt, attack, authentication, best-practice, cve, cyber, data, exploit, firmware, flaw, group, Internet, lazarus, linux, malicious, microsoft, network, north-korea, ntlm, office, rce, remote-code-execution, service, technology, tool, update, vulnerability, windows, zero-day3Critical 52Important 0Moderate 0Low Microsoft addresses 55 CVEs with three rated critical and four zero-day vulnerabilities, including two that were exploited in the wild. Microsoft patched 55 CVEs in its February 2025 Patch Tuesday release, with three rated critical and 52 rated as important. Our counts omitted one vulnerability reported by HackerOne. This month’s update…
-
Attackers exploit a new zero-day to hijack Fortinet firewalls
Fortinet warned of attacks using a now-patched zero-day vulnerability in FortiOS and FortiProxy to hijack Fortinet firewalls. Fortinet warned that threat actors are exploiting a new zero-day vulnerability, tracked as CVE-2025-24472 (CVSS score of 8.1), in FortiOS and FortiProxy to hijack Fortinet firewalls. The vulnerability is an authentication bypass issue that could allow a remote attacker…
-
Apple zero day used in ‘extremely sophisticated attack’
CVE-2025-24200 is a zero-day vulnerability that bypasses Apple’s USB Restricted Mode in iPhones and iPads and was exploited in the wild against ‘specific targeted individuals.’ First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366619044/Apple-zero-day-used-in-extremely-sophisticated-attack
-
Microsoft Security Update Summary (11. Februar 2025)
Am Microsoft Security Update Summary (11. Februar 2025) hat Microsoft Sicherheitsupdates für Windows-Clients und -Server, für Office sowie für weitere Produkte veröffentlicht. Die Sicherheitsupdates beseitigen 55 Schwachstellen (CVEs), davon drei als kritisch und vier als 0-day klassifiziert. Nachfolgend … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/02/12/microsoft-security-update-summary-11-februar-2025/
-
Microsoft fixes 63 vulnerabilities, including 2 zero-days
The company’s monthly Patch Tuesday update comes with more than two-thirds of the patches closing high-severity flaws. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-patch-tuesday-february-2025/
-
The Rise of Typhoon Cyber Groups
Tags: access, attack, breach, communications, control, cyber, cyberattack, cybersecurity, data, defense, dns, endpoint, espionage, exploit, finance, government, group, infrastructure, intelligence, iot, military, monitoring, network, phone, resilience, supply-chain, tactics, threat, tool, vulnerability, zero-day -
Actively exploited iOS, iPadOS zero-day addressed
First seen on scworld.com Jump to article: www.scworld.com/brief/actively-exploited-ios-ipados-zero-day-addressed
-
Apple Fixes Actively Exploited iOS, iPadOS, Zero-Day Flaw
First seen on scworld.com Jump to article: www.scworld.com/brief/apple-fixes-actively-exploited-ios-ipados-zero-day-flaw
-
Microsoft Patches ‘Wormable’ Windows Flaw and File-Deleting Zero-Day
The Microsoft Patch Tuesday machine hummed loudly this month urgent fixes for a pair of already-exploited Windows zero-days. The post Microsoft Patches ‘Wormable’ Windows Flaw and File-Deleting Zero-Day appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/microsoft-patches-wormable-windows-flaw-and-file-deleting-zero-day/
-
Microsoft fixes two actively exploited zero-days (CVE-2025-21418, CVE-2025-21391)
February 2025 Patch Tuesday is here, and Microsoft has delivered fixes for 56 vulnerabilities, including two zero-days CVE-2025-21418 and CVE-2025-21391 under … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/02/11/microsoft-fixes-exploited-zero-days-cve-2025-21418-cve-2025-21391-patch-tuesday/
-
Fortinet FortiOS FortiProxy Zero-Day Exploited to Hijack Firewall Gain Super Admin Access
Tags: access, authentication, csf, cyber, cybersecurity, exploit, firewall, flaw, fortinet, vulnerability, zero-dayCybersecurity firm Fortinet has issued an urgent warning regarding a newly discovered zero-day authentication bypass vulnerability (CVE-2025-24472) affecting its FortiOS and FortiProxy products. This critical flaw enables remote attackers to obtain super-admin privileges by exploiting maliciously crafted CSF proxy requests. The vulnerability impacts FortiOS versions 7.0.0 through 7.0.16, as well as FortiProxy versions 7.0.0 through…
-
Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws
Today is Microsoft’s February 2025 Patch Tuesday, which includes security updates for 55 flaws, including four zero-day vulnerabilities, with two actively exploited in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-february-2025-patch-tuesday-fixes-4-zero-days-55-flaws/
-
Fortinet warns of new zero-day exploited to hijack firewalls
Fortinet warned today that attackers are exploiting another authentication bypass zero-day bug in FortiOS and FortiProxy to hijack Fortinet firewalls and breach enterprise networks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fortinet-warns-of-new-zero-day-exploited-to-hijack-firewalls/
-
Microsoft Patch Tuesday February 2025: 61 Vulnerabilities Including 25 RCE 3 0-Day
Microsoft has released its highly anticipated Patch Tuesday security updates for February 2025, addressing a wide range of vulnerabilities across its products and services. This month’s release includes fixes for critical remote code execution (RCE) vulnerabilities, elevation of privilege flaws, and other security issues that attackers could potentially exploit. Organizations and users are urged to…
-
VeraCore zero-day vulnerabilities exploited in supply chain attacks
Cybercriminals maintained access to one victim;organization for more than four years. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/veracore-zero-day-vulnerabilities-exploited-in-supply-chain-attacks/739784/
-
XE Group Shifts From Card Skimming to Supply Chain Attacks
The likely Vietnam-based threat actor has been using two zero-days in VeraCore’s warehouse management software in some of its latest cyberattacks. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/xe-group-shifts-card-skimming-supply-chain-attacks
-
Apple issues emergency patches to contain an ‘extremely sophisticated attack’ on targeted individuals
Security researcher uncovers the exploit: The vulnerability was discovered by Bill Marczak, a senior researcher at Citizen Lab, a digital rights research group at the University of Toronto’s Munk School.Marczak took to social media to urge users to update their devices immediately, stating: “Update your iPhones”¦ again! iOS 18.3.1 out today with a fix for…
-
Apple fixes zero-day flaw exploited in >>extremely sophisticated<< attack (CVE-2025-24200)
Users of iPhones and iPads that run iOS/iPadOS 18 and iPadOS 17 are urged to implement the latest updates to plug a security feature bypass vulnerability (CVE-2025-24200) … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/02/11/apple-fixes-zero-day-flaw-exploited-in-extremely-sophisticated-attack-cve-2025-24200/
-
Apple Mitigates “Extremely Sophisticated” Zero-Day Exploit
Apple has patched a zero-day vulnerability being exploited in targeted attacks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/apple-update-extremely/
-
Top 5 ways attackers use generative AI to exploit your systems
Tags: access, ai, attack, authentication, awareness, banking, captcha, chatgpt, china, control, cyber, cybercrime, cybersecurity, defense, detection, exploit, extortion, finance, flaw, fraud, group, hacker, intelligence, LLM, malicious, malware, network, phishing, ransomware, resilience, service, spam, tactics, theft, threat, tool, vulnerability, zero-dayFacilitating malware development: Artificial intelligence can also be used to generate more sophisticated or at least less labour-intensive malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s…