Tag: zero-day
-
Apple Patches Actively Exploited iOS Zero-Day CVE-2025-24200 in Emergency Update
Apple on Monday released out-of-band security updates to address a security flaw in iOS and iPadOS that it said has been exploited in the wild.Assigned the CVE identifier CVE-2025-24200, the vulnerability has been described as an authorization issue that could make it possible for a malicious actor to disable USB Restricted Mode on a locked…
-
Trimble Cityworks zero-day flaw under attack, patch now
CVE-2025-0994 is a high-severity deserialization vulnerability that enables remote code execution in unpatched versions of Cityworks enterprise asset management software. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366619160/Trimble-Cityworks-zero-day-flaw-under-attack-patch-now
-
Apple fixes iPhone and iPad bug exploited in ‘extremely sophisticated attacks’
Apple released iOS and iPadOS updates to address a zero-day likely exploited in extremely sophisticated attacks targeting specific individuals. Apple released emergency security updates to address a zero-day vulnerability, tracked as CVE-2025-24200, that the company believes was exploited in >>extremely sophisticated
-
Apple fixes iPhone and iPad bug used in an ‘extremely sophisticated attack’
Unknown attackers may have exploited a zero-day bug to access data on locked phones, according to Apple. First seen on techcrunch.com Jump to article: techcrunch.com/2025/02/10/apple-fixes-iphone-and-ipad-bug-used-in-an-extremely-sophisticated-attack/
-
Apple fixes iPhone and iPad bug used in an >>extremely sophisticated attack<<
Unknown attackers may have exploited a zero-day bug to access data on locked phones, according to Apple. First seen on techcrunch.com Jump to article: techcrunch.com/2025/02/10/apple-fixes-iphone-and-ipad-bug-used-in-an-extremely-sophisticated-attack/
-
Apple fixes zero-day exploited in ‘extremely sophisticated’ attacks
Apple has released emergency security updates to patch a zero-day vulnerability that the company says was exploited in targeted and “extremely sophisticated” attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/apple/apple-fixes-zero-day-exploited-in-extremely-sophisticated-attacks/
-
XE Group shifts from credit card skimming to exploiting zero-days
The cybercrime group XE Group exploited a VeraCore zero-day to deploy reverse shells, web shells in recent attacks. A recent investigation by researchers from Intezer and Solis Security shed light on the recent operations of the XE Group. Active since at least 2013, XE Group is a cybercriminal group focused on credit card skimming and…
-
XE Hacker Group Exploits VeraCore Zero-Day to Deploy Persistent Web Shells
Threat actors have been observed exploiting multiple security flaws in various software products, including Progress Telerik UI for ASP.NET AJAX and Advantive VeraCore, to drop reverse shells and web shells, and maintain persistent remote access to compromised systems.The zero-day exploitation of security flaws in VeraCore has been attributed to a threat actor known as XE…
-
Core-Media-Framework Day-Schwachstelle
First seen on security-insider.de Jump to article: www.security-insider.de/apple-core-media-framework-sicherheitsluecke-a-b1e972a48d78893f3808f22de82f36b6/
-
Week in review: Exploited 7-Zip 0-day flaw, crypto-stealing malware found on App Store, Google Play
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Russian cybercrooks exploiting 7-Zip zero-day vulnerability (CVE-2025-0411) … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/02/09/week-in-review-exploited-7-zip-0-day-flaw-crypto-stealing-malware-found-on-app-store-google-play/
-
Modern Bank Heists 2025: Revenge of the Zero Days
Tom Kellermann’s Annual Report on Key Threats to Financial Sector. Zero days. Supply chain attacks. APIs and cloud environments as growing threat vectors. These are among the topics discussed in this seventh annual Modern Bank Heists report, and author Tom Kellermann discusses their impact on financial institutions – and which defensive gaps need to be…
-
Microsoft Sysinternals 0-Day Vulnerability Enables DLL Injection Attacks on Windows
A criticalzero-day vulnerabilityhas been discovered in Microsoft Sysinternals tools, posing a serious security threat to IT administrators and developers worldwide. The vulnerability enables attackers to exploitDLL injection techniquesto execute malicious code, putting systems at risk of compromise. Despite being disclosed to Microsoft over 90 days ago, the issue remains unresolved, leaving users reliant on manual…
-
7-Zip 0-Day Flaw Added to CISA’s List of Actively Exploited Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical 0-day vulnerability affecting the popular file compression utility, 7-Zip, to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability, identified as CVE-2025-0411, highlights a severe flaw that allows attackers to bypass the Mark-of-the-Web (MotW) security feature and execute arbitrary code on targeted systems. Details…
-
Trimble Cityworks Customers Warned of Zero-Day Exploitation
Trimble Cityworks is affected by a zero-day vulnerability that has been exploited in attacks involving the delivery of malware. The post Trimble Cityworks Customers Warned of Zero-Day Exploitation appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/trimble-cityworks-customers-warned-of-zero-day-exploitation/
-
XE Hacker Group Exploiting Veracode 0-Day’s to Deploy Malware Steal Credit Card Details
Tags: access, credit-card, cve, cyber, cybercrime, exploit, group, hacker, malware, software, vulnerability, zero-dayThe XE Group, a sophisticated Vietnamese-origin cybercrime organization active since 2013, has escalated its operations by exploiting two zero-day vulnerabilities in VeraCore software, CVE-2024-57968 and CVE-2025-25181. These vulnerabilities, identified in a joint investigation by Intezer and Solis Security, have been used to deploy malware, steal sensitive information, and maintain long-term access to compromised systems. VeraCore…
-
AnyDesk Flaw Allows Admin Access Through Weaponized Windows Wallpapers
Cybersecurity enthusiasts and IT administrators worldwide are voicing concerns over a newly discovered vulnerability in AnyDesk that could lead to local privilege escalation (LPE). The vulnerability, identified as CVE-2024-12754 and coordinated by Trend Micro’s Zero Day Initiative, allows attackers to weaponize Windows background images for escalating permissions on Windows systems. A Closer Look at the Vulnerability Discovered…
-
MobSF Framework Zero-Day Vulnerability Allows Attackers to Trigger DoS in Scan Results
A recently discovered zero-day vulnerability in the Mobile Security Framework (MobSF) has raised alarms in the cybersecurity community. The vulnerability, which allows attackers to cause a partial Denial of Service (DoS) on scan results and the iOS Dynamic Analyzer functionality, was disclosed on GitHub yesterday by Ajin Abraham, under the advisory GHSA-jrm8-xgf3-fwqr. Technical Overview The vulnerability,…
-
Hotfix verfügbar – Über 2.000 Sonicwall-Geräte von Zero-Day-Schwachstelle bedroht
First seen on security-insider.de Jump to article: www.security-insider.de/kritische-zero-day-schwachstelle-sonicwall-sma1000-firewalls-a-af6bab505dc779843167f6c45ff264a7/
-
XE Group Exploits Zero-Day Vulnerabilities in VeraCore CVE-2024-57968 CVE-2025-25181
Cybersecurity researchers from Intezer and Solis Security have uncovered a dramatic shift in tactics by XE Group, a First seen on securityonline.info Jump to article: securityonline.info/xe-group-exploits-zero-day-vulnerabilities-in-veracore-cve-2024-57968-cve-2025-25181/
-
Mental Malware: Overcoming Self-Doubt That Holds You Back
Mitigate Career Risk With a Self-Audit, Targeted Training and Real-World Testing Changing jobs or going after that promotion can be difficult, even in a field like cybersecurity where the demand for skilled professionals is high. Often, the biggest career challenge is not that advanced persistent threat or the zero-day vulnerability. It’s what we call mental…
-
7-Zip 0-day was exploited in Russia’s ongoing invasion of Ukraine
Vulnerability stripped MotW tag Windows uses to flag Internet-downloaded files. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/02/7-zip-0-day-was-exploited-in-russias-ongoing-invasion-of-ukraine/
-
U.S. CISA adds Linux kernel flaw to its Known Exploited Vulnerabilities catalog
Tags: android, attack, cisa, cve, cybersecurity, exploit, infrastructure, kev, linux, vulnerability, zero-dayU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux kernel vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Linux kernel vulnerability, tracked as CVE-2024-53104, to its Known Exploited Vulnerabilities (KEV) catalog. The February 2025 Android security updates addressed 48 vulnerabilities, the zero-day flaw CVE-2024-53104 which is actively exploited in attacks…
-
Zyxel won’t patch endlife routers against zero-day attacks
Networking hardware vendor Zyxel has no plans to patch multiple end-of-life routers against new zero-day flaws and advises customers to replace affected devices entirely. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366618782/Zyxel-wont-patch-end-of-life-routers-against-zero-day-attacks
-
Russian Hackers Exploited 7-Zip Zero-Day Against Ukraine
Russian threat groups have been observed exploiting a zero-day vulnerability in 7-Zip against Ukrainian entities. The post Russian Hackers Exploited 7-Zip Zero-Day Against Ukraine appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/russian-hackers-exploited-7-zip-zero-day-against-ukraine/
-
Zyxel Issues ‘No Patch’ Warning for Exploited Zero-Days
Multiple Zyxel legacy DSL CPE products are affected by exploited zero-day vulnerabilities that will not be patched. The post Zyxel Issues ‘No Patch’ Warning for Exploited Zero-Days appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/zyxel-issues-no-patch-warning-for-exploited-zero-days/
-
Russian SmokeLoader Campaign in Ukraine Uses 7-Zip Zero-Day
Tags: credentials, cybercrime, espionage, government, hacker, open-source, russia, ukraine, vulnerability, zero-dayEspionage and Cybercrime Campaign Tied to 7-Zip Mark-of-the-Web Bypass Hits. Russian hackers targeting Ukrainian government agencies and businesses – including a major automotive manufacturer – have been targeting a zero-day vulnerability in the open source and widely used 7-Zip archive utility, to infect systems with credential-stealing SmokeLoader malware. First seen on govinfosecurity.com Jump to article:…
-
Exploitation of Over 700 Vulnerabilities Came to Light in 2024
The number of vulnerabilities first reported as exploited surged last year amid a decrease in zero-day reports. The post Exploitation of Over 700 Vulnerabilities Came to Light in 2024 appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/exploitation-of-over-700-vulnerabilities-came-to-light-in-2024/
-
7-Zip MotW bypass exploited in zero-day attacks against Ukraine
A 7-Zip vulnerability allowing attackers to bypass the Mark of the Web (MotW) Windows security feature was exploited by Russian hackers as a zero-day since September 2024. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/7-zip-motw-bypass-exploited-in-zero-day-attacks-against-ukraine/