Metasploit Wrap-Up 10/24/2025

Let us suggest persistence… This week's edition brings the new persistence suggester from h00die. Similar to the exploit variant, this module will list the available persistence mechanisms for your selected target. The module requires a session to target the machine, so it can run check methods...

MAL-2025-48593 Malicious code in gamenodev2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64b3f4352a6a3cd544967811466ca6b70f6171d40b606d11f2b3375921c68d6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gamenodev21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eed42bff5f057d49a644923b46ba868c04890e51c77dffc911c3aaa0be4e0640 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48579 Malicious code in mtls-ambassador (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7751747bc3d849e8a9b44fe993f8e2e3a5779f8c940573453433084eb4d3a07b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48567 Malicious code in mender-artifact (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e94134964d7a293444da55c5300ca285bae3eac4e6bf9a1f89cc1d9a94f2ceae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48571 Malicious code in mender-conductor-enterprise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a94fd07c8d4a77f846cebefc65582f689ea864796af0d0cbff8241f82d31a97e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in generate-delta-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad06efd44d16d4917dd43ae0c9464faaffb8c5f2db9f3b8b3a94a36de4722ecd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in deviceconnect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6c1a3984e1cb71a8f8426b3963787a49a096ce770bcabde9e63ca51fa5007e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-1679

Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s web service that could impact authenticated users interacting with the device’s web interface. This vulnerability is...

IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response

Threat actors predominately exploited public-facing applications for initial access this quarter, with this tactic appearing in over 60 percent of Cisco Talos Incident Response Talos IR engagements - a notable increase from less than 10 percent last quarter. This spike is largely attributable to ...

PT-2025-43541

Name of the Vulnerable Software and Affected Versions Oxford Nanopore Technologies MinKNOW versions prior to 24.11 Description The MinKNOW software stores authentication tokens in a world-readable file within the system's temporary directory /tmp on the host machine. If a token is compromised, an...

PT-2025-43493

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A flaw exists in the Framework component of Android operating systems due to insufficient input validation. Exploitation of this issue may allow an attacker to escalate privileges...

PT-2025-43497

In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after uninstalling due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges...

MAL-2025-48554 Malicious code in js-repack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7a80a1c4ce3e508e53f6fbcff1d53486d344d5e88efb691abaad37cc22759f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-medias (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b5575c56531df502495b31c4b90170d35d991772b25b712d15dc9fdac0e33df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in webpack-compilejsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8c67f3bbe4e8eda380dcbe093fc343b501dc38045f134cb5803093a91b9f48f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-62772

On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases...

Exploit for Out-of-bounds Write in Mediatek Software_Development_Kit

What is Registry Exploit? Phantom-Registry-Exploit-Cve2025-20...

Malicious code in funny-pad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc3cde1ae2412402edab8edbe484702139f4baa345143fb9973baaf3a947f242 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48543 Malicious code in artyfact-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e7943603e230dc9bc1cd9f5f44133fe1b4fee90cb69929ae4b0308b61400753 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...