Tag: zero-day
-
iPhone users targeted in Apple’s first zero-day exploit in 2025
Apple iPhone users were targeted for privilege escalation in the zero-day exploitation of a use-after-free vulnerability affecting Apple’s Core Media framework.”A malicious application may be able to elevate privileges,” Apple said in the security update description. “Apple is aware of a report that this issue may have been actively exploited against versions of iOS before…
-
SonicWall Confirms Exploitation of New SMA Zero-Day
SonicWall has confirmed that an SMA 1000 zero-day tracked as CVE-2025-23006 has been exploited in the wild. The post SonicWall Confirms Exploitation of New SMA Zero-Day appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/sonicwall-confirms-exploitation-of-new-sma-zero-day/
-
Apple Patches First Exploited iOS Zero-Day of 2025
Apple has released fixes for dozens of vulnerabilities in its mobile and desktop products, including an iOS zero-day exploited in attacks. The post Apple Patches First Exploited iOS Zero-Day of 2025 appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/apple-patches-first-exploited-ios-zero-day-of-2025/
-
Apple zero-day vulnerability exploited to target iPhone users (CVE-2025-24085)
Apple has shipped a fix for a zero-day vulnerability (CVE-2025-24085) that is being leveraged by attackers against iPhone users. About CVE-2025-24085 CVE-2025-24085 is a use … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/01/28/apple-zero-day-vulnerability-exploited-to-target-iphone-cve-2025-24085/
-
Apple Security Update Patch for iOS Zero-day, MacOS More
Apple has responded to a newly discovered zero-day vulnerability affecting its operating systems by releasing an array of security updates to protect users from potential exploitation. The updates span iOS, iPadOS, macOS, watchOS, tvOS, visionOS, and Safari, demonstrating Apple’s commitment to user security and privacy. Patch Details The updates, released on January 27, 2025, include…
-
Apple plugs security hole in its iThings that’s already been exploited in iOS
Cupertino kicks off the year with a zero-day First seen on theregister.com Jump to article: www.theregister.com/2025/01/28/apple_cve_2025_24085/
-
Apple Patches Actively Exploited Zero-Day Affecting iPhones, Macs, and More
Apple has released software updates to address several security flaws across its portfolio, including a zero-day vulnerability that it said has been exploited in the wild.The vulnerability, tracked as CVE-2025-24085, has been described as a use-after-free bug in the Core Media component that could permit a malicious application already installed on a device to elevate…
-
SonicWall says hackers are exploiting a new zero-day bug to breach customer networks
SonicWall said the bug is “confirmed as being actively exploited in the wild” by malicious hackers. First seen on techcrunch.com Jump to article: techcrunch.com/2025/01/27/sonicwall-says-hackers-are-exploiting-a-new-zero-day-bug-to-breach-customer-networks/
-
Apple Patches Actively Exploited Zero-Day Vulnerability
The Apple iOS 18.3 update fixes 28 other vulnerabilities identified by the tech company, though there is little information on them. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/apple-patches-actively-exploited-zero-day-vulnerability
-
Apple fixed the first actively exploited zero-day of 2025
Apple addressed the first zero-day vulnerability of 2025, which is actively exploited in attacks in the wild aimed at iPhone users. Apple released security updates to address 2025’s first zero-day vulnerability, tracked as CVE-2025-24085, actively exploited in attacks targeting iPhone users. The vulnerability is a privilege escalation vulnerability that impacts the Core Media framework. >>A malicious…
-
SonicWall’s Zero-Day Provokes Patch Alerts
Preauthentication Deserialization Flaw Could Result in Remote Code Execution. Software vendors and national security agencies are urging immediate patching of a critical SonicWall flaw days after the security device manufacturer disclosed that hackers are actively exploiting a zero-day. The flaw doesn’t require user authentication. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/sonicwalls-zero-day-provokes-patch-alerts-a-27384
-
Apple fixes this year’s first actively exploited zero-day bug
Apple has released security updates to fix this year’s first zero-day vulnerability, tagged as actively exploited in attacks targeting iPhone users. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/apple-fixes-this-years-first-actively-exploited-zero-day-bug/
-
SonicWall SMA Appliances Exploited in Zero-Day Attacks
Critical security flaw in SonicWall SMA 1000 appliances (CVE-2025-23006) exploited as a zero-day. Rated CVSS 9.8, patch immediately… First seen on hackread.com Jump to article: hackread.com/sonicwall-sma-appliances-exploited-zero-day-attacks/
-
SonicWall Says Exploitation Of SMA1000 Flaw Discovered By Microsoft
SonicWall says that exploitation of a ‘critical’ zero-day vulnerability in the SMA1000 Appliance Management Console and Central Management Console has been reported by Microsoft threat researchers. First seen on crn.com Jump to article: www.crn.com/news/security/2025/sonicwall-says-exploitation-of-sma1000-flaw-discovered-by-microsoft
-
Ivanti zero-days chained together in at least 3 attacks, authorities warn
The vendor’s customers have confronted multiple attack sprees targeting zero-days spanning a variety of products. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ivanti-zero-days-chained-attacks/738130/
-
SonicWall flags critical bug likely exploited as zero-day, rolls out hotfix
Big organizations and governments are main users of these gateways First seen on theregister.com Jump to article: www.theregister.com/2025/01/23/sonicwall_critical_bug/
-
SonicWall warns of SMA1000 RCE flaw exploited in zero-day attacks
SonicWall is warning about a pre-authentication deserialization vulnerability in SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), with reports that it has been exploited as a zero-day in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-rce-flaw-exploited-in-zero-day-attacks/
-
SonicWall Learns From Microsoft About Potentially Exploited Zero-Day
SonicWall has credited Microsoft for reporting CVE-2025-23006, a critical remote command execution vulnerability possibly exploited in the wild. The post SonicWall Learns From Microsoft About Potentially Exploited Zero-Day appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/sonicwall-learns-from-microsoft-about-potentially-exploited-zero-day/
-
10 top XDR tools and how to evaluate them
Tags: ai, attack, automation, business, cloud, computing, container, corporate, credentials, data, defense, detection, edr, email, encryption, endpoint, finance, firewall, google, guide, Hardware, iam, ibm, identity, incident response, infrastructure, intelligence, malicious, malware, marketplace, microsoft, mitigation, network, office, okta, open-source, organized, risk, security-incident, service, siem, skills, soar, software, spam, technology, threat, tool, training, vulnerability, zero-dayLittle in the modern IT world lends itself to manual or siloed management, and this is doubly true in the security realm. The scale of modern enterprise computing and modern application stack architecture requires security tools that can bring visibility into the security posture of modern IT components and integrate tightly to bring real-time threat…
-
SonicWall SMA appliances exploited in zero-day attacks (CVE-2025-23006)
A critical zero-day vulnerability (CVE-2025-23006) affecting SonicWall Secure Mobile Access (SMA) 1000 Series appliances is being exploited by attackers. >>We strongly … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/01/23/sonicwall-sma-1000-exploited-zero-day-cve-2025-23006/
-
Pwn2Own Automotive 2025 Day 1: organizers awarded $382,750 for 16 zero-days
Trend Micro’s Zero Day Initiative (ZDI) announced that $380K was awarded on Day 1 of Pwn2Own Automotive 2025. Trend Micro’s Zero Day Initiative (ZDI) announced that over $380,000 was awarded on Day 1 of Pwn2Own Automotive 2025, a hacking contest that was held in Tokyo. In total, the organizers awarded $382,750 for 16 unique working…
-
Critical zero-days impact premium WordPress real estate plugins
The RealHome theme and the Easy Real Estate plugins for WordPress are vulnerable to two critical severity flaws that allow unauthenticated users to gain administrative privileges. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-zero-days-impact-premium-wordpress-real-estate-plugins/
-
Hackers exploit 16 zero-days on first day of Pwn2Own Automotive 2025
On the first day of Pwn2Own Automotive 2025, security researchers exploited 16 unique zero-days and collected $382,750 in cash awards. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-16-zero-days-on-first-day-of-pwn2own-automotive-2025/
-
Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet
Threat actors are exploiting an unspecified zero-day vulnerability in Cambium Networks cnPilot routers to deploy a variant of the AISURU botnet called AIRASHI to carry out distributed denial-of-service (DDoS) attacks.According to QiAnXin XLab, the attacks have leveraged the security flaw since June 2024. Additional details about the shortcomings have been withheld to prevent further abuse.Some…
-
Spooks of the internet came alive this Halloween
Halloween 2024 made history with a massive spike in distributed denial of service (DDoS) attacks, with one particular assault reaching over 5 Terabits-per-second (Tbps) worth of phony traffic.In its quarterly analysis of DDoS attacks, Cloudflare reported a surge in hyper-volumetric attacks in the fourth quarter of 2024.”In the fourth quarter, over 420 of those attacks…
-
Patch procrastination leaves 50,000 Fortinet firewalls vulnerable to zero-day
Seven days after disclosure and little action taken, data shows First seen on theregister.com Jump to article: www.theregister.com/2025/01/21/fortinet_firewalls_still_vulnerable/
-
CL-UNK-0979 Exploit Zero-Day Flaw in Ivanti Connect Secure to Gain Access to Networks
Palo Alto Networks has issued a detailed threat briefing on two critical vulnerabilities in Ivanti products”, CVE-2025-0282 and CVE-2025-0283. First seen on securityonline.info Jump to article: securityonline.info/cl-unk-0979-exploit-zero-day-flaw-in-ivanti-connect-secure-to-gain-access-to-networks/
-
January Patch Tuesday resolves 3 Hyper-V zero-days
The number of vulnerabilities corrected for January Patch Tuesday is one of the highest in recent memory and includes three Hyper-V vulnerabilities exploited in the wild. First seen on techtarget.com Jump to article: www.techtarget.com/searchwindowsserver/news/366617849/January-Patch-Tuesday-resolves-3-Hyper-V-zero-days