2,500+ Truesight.sys Driver Variants Exploited to Bypass EDR and Deploy HiddenGh0st RAT

A large-scale malware campaign has been found leveraging a vulnerable Windows driver associated with Adlice's product suite to sidestep detection efforts and deliver the Gh0st RAT malware. "To further evade detection, the attackers deliberately generated multiple variants with different hashes of...

China-Linked Attackers Exploit Check Point Flaw to Deploy ShadowPad and Ransomware

A previously unknown threat activity cluster targeted European organizations, particularly those in the healthcare sector, to deploy PlugX and its successor, ShadowPad, with the intrusions ultimately leading to deployment of a ransomware called NailaoLocker in some cases. The campaign, codenamed...

Updated Shadowpad Malware Leads to Ransomware Deployment

In this blog, we discuss about how Shadowpad is being used to deploy a new undetected ransomware family. They deploy the malware exploiting weak passwords and bypassing multi-factor authentication...

Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection

Our Threat Hunting team discusses Earth Preta’s latest technique, in which the APT group leverages MAVInject and Setup Factory to deploy payloads, bypass ESET antivirus, and maintain control over compromised systems...

Windows Deployment Services DoS

The vulnerability of Windows Deployment Services for Windows operating systems is related to the incorrect handling of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to cause a service failure...

Platform Management Interface Arbitrary Command Execution

The vulnerability of the platform’s management interface for deploying and managing LoadMaster applications is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially created HTTP request...

Security update for SUSE Manager Client Tools MU 5.0.3

This update fixes the following issues: spacecmd was updated to version 5.0.11-0: Updated translation strings uyuni-tools was updated from version 0.1.23-0 to 0.1.27-0: Security issues fixed: CVE-2024-22037: Use podman secret to store the database credentials bsc1231497 Other changes and bugs...

CVE-2025-25204: Detection of Error Condition Without Action

gh is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool gh attestation verify causes it to return a zero exit status when no attestations are present. This behavior is incorrect:...

CVE-2023-3897

Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message. This issue affects SureMDM On-premise: 6.31 and below version...

CVE-2025-21347

Windows Deployment Services Denial of Service Vulnerability...

br.com.labbs:quarkus-monitor-reactive-deployment (>=3.15.3, <=3.15.4), com.github.fmcejudo:quarkus-eureka-deployment (1.1.1) +47 more potentially affected by CVE-2025-1247 via io.quarkus:quarkus-rest-deployment (>=3.9.0.cr1, <=3.15.3)

io.quarkus:quarkus-rest-deployment MAVEN version =3.9.0.cr1, =3.15.3, =24.5.0-alpha4, =24.5.0-alpha4, =24.5.0-alpha4, =2.0.0, =0.34.0, =0.34.0, =0.0.1.cr38, =0.22.0.cr1, =3.0.13, =3.0.13, =3.0.13, =3.0.18 and more Source cves: CVE-2025-1247 Source advisory: GHSA-PHG3-GV66-Q38Xhttps://vulners.com/...

com.github.mcollovati:quarkus-hilla-commons-deployment (>=24.5.0-beta1, <=24.6.0), com.github.mcollovati:quarkus-hilla-deployment (>=24.5.0-beta1, <=24.6.0) +22 more potentially affected by CVE-2025-1247 via io.quarkus:quarkus-rest-deployment (>=3.16.0.cr1, <=3.18.1)

io.quarkus:quarkus-rest-deployment MAVEN version =3.16.0.cr1, =24.5.0-beta1, =24.5.0-beta1, =24.5.0-beta1, =0.38.0, =0.38.0, =3.0.19, =3.0.19, =3.0.19, =3.16.0.cr1, =3.16.0.cr1, =3.16.0.cr1, =3.16.0.cr1, =3.16.0.cr1, =3.16.0.cr1, =3.18.1 and more Source cves: CVE-2025-1247 Source advisory:...

com.github.mcollovati:quarkus-hilla-commons-deployment (>=24.5.0-beta1, <=24.6.0), com.github.mcollovati:quarkus-hilla-deployment (>=24.5.0-beta1, <=24.6.0) +22 more potentially affected by CVE-2025-1247 via io.quarkus:quarkus-rest-deployment (>=3.16.0.cr1, <=3.18.1)

io.quarkus:quarkus-rest-deployment MAVEN version =3.16.0.cr1, =24.5.0-beta1, =24.5.0-beta1, =24.5.0-beta1, =0.38.0, =0.38.0, =3.0.19, =3.0.19, =3.0.19, =3.16.0.cr1, =3.16.0.cr1, =3.16.0.cr1, =3.16.0.cr1, =3.16.0.cr1, =3.16.0.cr1, =3.18.1 and more Source cves: CVE-2025-1247 Source advisory:...

br.com.labbs:quarkus-monitor-reactive-deployment (>=3.15.3, <=3.15.4), com.github.fmcejudo:quarkus-eureka-deployment (1.1.1) +47 more potentially affected by CVE-2025-1247 via io.quarkus:quarkus-rest-deployment (>=3.9.0.cr1, <=3.15.3)

io.quarkus:quarkus-rest-deployment MAVEN version =3.9.0.cr1, =3.15.3, =24.5.0-alpha4, =24.5.0-alpha4, =24.5.0-alpha4, =2.0.0, =0.34.0, =0.34.0, =0.0.1.cr38, =0.22.0.cr1, =3.0.13, =3.0.13, =3.0.13, =3.0.18 and more Source cves: CVE-2025-1247 Source advisory: OSV:GHSA-PHG3-GV66-Q38Xhttps://vulners...

br.com.labbs:quarkus-monitor-reactive-deployment (>=3.15.3, <=3.15.4), com.github.fmcejudo:quarkus-eureka-deployment (1.1.1) +47 more potentially affected by CVE-2025-1247 via io.quarkus:quarkus-rest-deployment (>=3.9.0.cr1, <=3.15.3)

io.quarkus:quarkus-rest-deployment MAVEN version =3.9.0.cr1, =3.15.3, =24.5.0-alpha4, =24.5.0-alpha4, =24.5.0-alpha4, =2.0.0, =0.34.0, =0.34.0, =0.0.1.cr38, =0.22.0.cr1, =3.0.13, =3.0.13, =3.0.13, =3.0.18 and more Source cves: CVE-2025-1247 Source advisory: MEND:CVE-2025-1247https://vulners.com/m...

com.github.mcollovati:quarkus-hilla-commons-deployment (>=24.5.0-beta1, <=24.6.0), com.github.mcollovati:quarkus-hilla-deployment (>=24.5.0-beta1, <=24.6.0) +22 more potentially affected by CVE-2025-1247 via io.quarkus:quarkus-rest-deployment (>=3.16.0.cr1, <=3.18.1)

io.quarkus:quarkus-rest-deployment MAVEN version =3.16.0.cr1, =24.5.0-beta1, =24.5.0-beta1, =24.5.0-beta1, =0.38.0, =0.38.0, =3.0.19, =3.0.19, =3.0.19, =3.16.0.cr1, =3.16.0.cr1, =3.16.0.cr1, =3.16.0.cr1, =3.16.0.cr1, =3.16.0.cr1, =3.18.1 and more Source cves: CVE-2025-1247 Source advisory:...

CVE-2025-0108

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PH...

CVE-2025-0111

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by...

CVE-2025-21347

Windows Deployment Services Denial of Service Vulnerability...

CVE-2025-21347

Windows Deployment Services Denial of Service Vulnerability...