CVE-2025-34503 Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution

Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this design predates modern secure-boot or signed-update...

CVE-2025-34502

The CVE-2025-34502 entry affects Deck Mate 2 by lacking a verified secure-boot chain and runtime integrity validation for its controller and display modules. This allows a physically proximate attacker to modify or replace the bootloader, kernel, or filesystem, enabling persistent code execution ...

Persistence Exploit Suggester

This module suggests persistence modules that can be used. The modules are suggested based on the architecture and platform that the user has a shell opened as well as the available exploits in meterpreter. It's important to note that not all modules will be checked. Exploits are chosen based on...

Metasploit Wrap-Up 10/24/2025

Let us suggest persistence… This week's edition brings the new persistence suggester from h00die. Similar to the exploit variant, this module will list the available persistence mechanisms for your selected target. The module requires a session to target the machine, so it can run check methods...

APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign

A Pakistan-nexus threat actor has been observed targeting Indian government entities as part of spear-phishing attacks designed to deliver a Golang-based malware known as DeskRAT. The activity, observed in August and September 2025 by Sekoia, has been attributed to Transparent Tribe aka APT36, a...

Malicious code in gamenodev21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eed42bff5f057d49a644923b46ba868c04890e51c77dffc911c3aaa0be4e0640 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48593 Malicious code in gamenodev2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64b3f4352a6a3cd544967811466ca6b70f6171d40b606d11f2b3375921c68d6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48567 Malicious code in mender-artifact (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e94134964d7a293444da55c5300ca285bae3eac4e6bf9a1f89cc1d9a94f2ceae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48579 Malicious code in mtls-ambassador (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7751747bc3d849e8a9b44fe993f8e2e3a5779f8c940573453433084eb4d3a07b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48571 Malicious code in mender-conductor-enterprise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a94fd07c8d4a77f846cebefc65582f689ea864796af0d0cbff8241f82d31a97e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in deviceconnect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6c1a3984e1cb71a8f8426b3963787a49a096ce770bcabde9e63ca51fa5007e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in generate-delta-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad06efd44d16d4917dd43ae0c9464faaffb8c5f2db9f3b8b3a94a36de4722ecd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-1679

Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s web service that could impact authenticated users interacting with the device’s web interface. This vulnerability is...

IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response

Threat actors predominately exploited public-facing applications for initial access this quarter, with this tactic appearing in over 60 percent of Cisco Talos Incident Response Talos IR engagements - a notable increase from less than 10 percent last quarter. This spike is largely attributable to ...

PT-2025-43541

Name of the Vulnerable Software and Affected Versions Oxford Nanopore Technologies MinKNOW versions prior to 24.11 Description The MinKNOW software stores authentication tokens in a world-readable file within the system's temporary directory /tmp on the host machine. If a token is compromised, an...

CVE-2025-12110: Insufficient Session Expiration

A flaw was found in Keycloak. An offline session continues to be valid when the offlineaccess scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and...

PT-2025-43497

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A flaw exists in the Framework component of Android operating systems due to insufficient input validation. This issue may allow an attacker to escalate privileges. Specifically, a logic erro...

PT-2025-43493

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A flaw exists in the Framework component of Android operating systems due to insufficient input validation. Exploitation of this issue may allow an attacker to escalate privileges...

MAL-2025-48554 Malicious code in js-repack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7a80a1c4ce3e508e53f6fbcff1d53486d344d5e88efb691abaad37cc22759f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-medias (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b5575c56531df502495b31c4b90170d35d991772b25b712d15dc9fdac0e33df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...