Blind Eagle Uses Proton66 Hosting for Phishing, RAT Deployment on Colombian Banks

The threat actor known as Blind Eagle has been attributed with high confidence to the use of the Russian bulletproof hosting service Proton66. Trustwave SpiderLabs, in a report published last week, said it was able to make this connection by pivoting from Proton66-linked digital assets, leading t...

OneClik: A ClickOnce-Based APT Campaign Targeting Energy, Oil and Gas Infrastructure

OneClik: A ClickOnce-Based Red Team Campaign Simulating APT Tactics in Energy Infrastructure By Nico Paulo Yturriaga and Pham Duy Phuc · Updated : June 30, 2025 The Trellix Advanced Research Center previously uncovered what appeared to be a sophisticated APT malware campaign, which we dubbed...

OneClik Red Team Campaign Targets Energy Sector Using Microsoft ClickOnce and Golang Backdoors

Cybersecurity researchers have detailed a new campaign dubbed OneClik that leverages Microsoft's ClickOnce software deployment technology and bespoke Golang backdoors to compromise organizations within the energy, oil, and gas sectors. "The campaign exhibits characteristics aligned with...

CVE-2025-6750

A flaw was found in hdf5. The H5Omtimenewencode function in src/H5Omtime.c contains a heap-based buffer overflow vulnerability that can be triggered by crafted input. A local attacker can exploit this condition by providing a specially constructed file. This manipulation may result in a denial of...

io.quarkus:quarkus-infinispan-client-deployment (>=3.5.2, <=3.6.0.cr1), io.quarkus:quarkus-test-infinispan-client (>=3.5.2, <=3.6.0.cr1) +8 more potentially affected by CVE-2025-5731 via org.infinispan:infinispan-cli-client (14.0.20.final)

org.infinispan:infinispan-cli-client MAVEN version 14.0.20.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-cli-client and may be impacted: - io.quarkus:quarkus-infinispan-client-deployment =3.5.2, =3.5.2, =3.6.0.cr1 -...

Security Bulletin: IBM QRadar Deployment Intelligence app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities (CVE-2025-27152, CVE-2025-27789)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Deployment Intelligence app for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-27152 DESCRIPTION: axios is a...

deployment plugin GLPI Inventory Path Traversal

The vulnerability of the software deployment and GLPI Inventory network component relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker to gain access to protected information...

CVE-2025-4656

A key handling flaw has been discovered in Vault. The rekey and recovery key operations may lead to a denial of service in the vault application due to uncontrolled cancellations of these operations. Mitigation Mitigation for this issue is either not available or the currently available options d...

DEBIAN-CVE-2025-6442

Ruby WEBrick readheader HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The...

AZL-64352 CVE-2025-6442 affecting package ruby for versions less than 3.3.5-4

Ruby WEBrick readheader HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The...

CVE-2025-6442

Ruby WEBrick readheader HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The...

CVE-2025-20264

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability is due to insufficient authorization enforcement mechanisms fo...

SUSE CVE-2025-6442

Ruby WEBrick readheader HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The...

io.quarkus:quarkus-smallrye-reactive-messaging-kafka-deployment (0.14.0), io.quarkus:quarkus-vertx-deployment (0.14.0) +2 more potentially affected by CVE-2025-49574 via io.quarkus:quarkus-vertx (0.14.0)

io.quarkus:quarkus-vertx MAVEN version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx and may be impacted: - io.quarkus:quarkus-smallrye-reactive-messaging-kafka-deployment 0.14.0 - io.quarkus:quarkus-vertx-deployment...

io.quarkus:quarkus-reactive-pg-client (0.15.0), io.quarkus:quarkus-reactive-pg-client-deployment (0.15.0) +4 more potentially affected by CVE-2025-49574 via io.quarkus:quarkus-vertx (0.15.0)

io.quarkus:quarkus-vertx MAVEN version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx and may be impacted: - io.quarkus:quarkus-reactive-pg-client 0.15.0 - io.quarkus:quarkus-reactive-pg-client-deployment 0.15.0 -...

A Retrospective on DISPEED -- Leveraging Heterogeneity in a Drone Swarm for IDS Execution

Swarms of drones are gaining more and more autonomy and efficiency during their missions. However, security threats can disrupt their missions' progression. To overcome this problem, Network Intrusion Detection Systems NIDS are promising solutions to detect malicious behavior on network traffic...

LURK-T: Limited Use of Remote Keys with Added Trust in TLS 1.3

In many web applications, such as Content Delivery Networks CDNs, TLS credentials are shared, e.g., between the website's TLS origin server and the CDN's edge servers, which can be distributed around the globe. To enhance the security and trust for TLS 1.3 in such scenarios, we propose LURK-T, a...

Flexible Hardware-Enabled Guarantees for AI Compute

As artificial intelligence systems become increasingly powerful, they pose growing risks to international security, creating urgent coordination challenges that current governance approaches struggle to address without compromising sensitive information or national security. We propose flexible...

Position: Certified Robustness Does Not (Yet) Imply Model Security

While certified robustness is widely promoted as a solution to adversarial examples in Artificial Intelligence systems, significant challenges remain before these techniques can be meaningfully deployed in real-world applications. We identify critical gaps in current research, including the parad...

Building Automotive Security on Internet Standards: an Integration of DNSSEC, DANE, and DANCE to Authenticate and Authorize In-Car Services

The automotive industry is undergoing a software-as-a-service transformation that enables software-defined functions and post-sale updates via cloud and vehicle-to-everything communication. Connectivity in cars introduces significant security challenges, as remote attacks on vehicles have become...