A week in security (June 23 – June 29)

Last week on Malwarebytes Labs: Gmail’s multi-factor authentication bypassed by hackers to pull off targeted attacks Thousands of private camera feeds found online. Make sure yours isn’t one of them Sextortion email scammers increase their "Hello pervert" money demands Many data brokers are faili...

PT-2025-35964

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the pNFS block/scsi layout implementation. The issue arises from a dereference of uninitialized pointers within the ext tree free commitdata function...

PT-2025-27362

Name of the Vulnerable Software and Affected Versions Airoha Bluetooth audio SDK affected versions not specified Description A permission bypass exists in the Bluetooth LE GATT service that allows unauthorized access to critical data of the RACE protocol. This issue stems from a lack of...

CVE-2025-28993

CVE-2025-28993 concerns the WordPress plugin Content No Cache . The vulnerability is an Improper Control of Generation of Code (Code Injection) , allowing an arbitrary function call due to flaws in the plugin’s code generation logic. Affected versions are listed as up to 0.1.3 (n/a through 0.1.3)...

CVE-2025-28993 WordPress Content No Cache plugin <= 0.1.4 - Arbitrary Function Call vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Jose Mortellaro Content No Cache content-no-cache allows Code Injection.This issue affects Content No Cache: from n/a through = 0.1.4...

CVE-2025-36004

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege...

Why the Do Not Call Registry doesn&#8217;t work

The “Do Not Call Registry” receives a lot of hate online for failing to do its job: Stop calls. “What’s the point of being on the Do Not Call list?” wrote one user on Reddit who shared a screenshot of ten declined phone calls received across one week. Though already registered with the Do Not Cal...

CVE-2025-36004

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege...

CVE-2025-36004

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege...

CVE-2025-36004 IBM i privilege escalation

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege...

CVE-2025-36004 IBM i privilege escalation

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege...

CVE-2025-36004

CVE-2025-36004 (IBM i) affects IBM i versions 7.2–7.5 due to an unqualified library call in IBM Facsimile Support for i, enabling a user to execute code with administrator privileges (CWE-427). Base CVSS 3.1 score 8.8 (HIGH) with network attack vector, low attack complexity, and user interaction:...

PT-2025-26808 · Ibm · Ibm I +1

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.2 through 7.5 Description: The issue allows a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator...

CVE-2025-6518 PySpur-Dev pyspur Jinja2 Template single_llm_call.py SingleLLMCallNode special elements used in a template engine

A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. It has been classified as critical. Affected is the function SingleLLMCallNode of the file backend/pyspur/nodes/llm/singlellmcall.py of the component Jinja2 Template Handler. The manipulation of the argument usermessage leads to imprope...

CVE-2025-50024

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Truong Thanh ATP Call Now atp-call-now allows Stored XSS.This issue affects ATP Call Now: from n/a through = 1.0.3...

CVE-2025-33122

IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 could allow a user to gain elevated privileges due to an unqualified library call in IBM Advanced Job Scheduler for i. A malicious actor could cause user-controlled code to run with administrator privilege...

The vulnerability of the rpcrdma_reply_handler() function in the net/sunrpc/xprtrdma/rpc_rdma.c module of the Linux operating system’s RPC protocol implementation allows a attacker to cause a service failure.

The vulnerability of the rpcrdmareplyhandler function in the net/sunrpc/xprtrdma/rpcrdma.c module of the Linux operating system’s RPC protocol implementation is related to incorrect input validation. Exploiting this vulnerability could allow an attacker to cause a service failure...

Qilin Ransomware Adds "Call Lawyer" Feature to Pressure Victims for Larger Ransoms

The threat actors behind the Qilin ransomware-as-a-service RaaS scheme are now offering legal counsel for affiliates to put more pressure on victims to pay up, as the cybercrime group intensifies its activity and tries to fill the void left by its rivals. The new feature takes the form of a "Call...

CVE-2025-50024

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Truong Thanh ATP Call Now atp-call-now allows Stored XSS.This issue affects ATP Call Now: from n/a through = 1.0.3...

CVE-2025-50024 WordPress ATP Call Now plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Truong Thanh ATP Call Now atp-call-now allows Stored XSS.This issue affects ATP Call Now: from n/a through = 1.0.3...