CBI Shuts Down £390K U.K. Tech Support Scam, Arrests Key Operatives in Noida Call Center

India's Central Bureau of Investigation CBI has announced that it has taken steps to dismantle what it said was a transnational cybercrime syndicate that carried out "sophisticated" tech support scams targeting citizens of Australia and the United Kingdom. The fraudulent scheme is estimated to ha...

Unbreakable Enterprise kernel security update

5.4.17-2136.345.5.3 - x86/bpf: Classic BPF program can fail when BHB barrier is used Alexandre Chartre Orabug: 38167806 5.4.17-2136.345.5.2 - Add Zen34 clients Borislav Petkov AMD Orabug: 38023241 CVE-2024-36350 CVE-2024-36357 - x86/process: Move the buffer clearing before MONITOR Kim Phillips...

CVE-2025-52089

A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges...

Fedora 42 : gnutls (2025-16a24364ce)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-16a24364ce advisory. This updates gnutls to the latest upstream release. Notable changes are: PKCS11 cryptographic provider support Support for kTLS rekeying with kernel...

WordPress Support Ticket Plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Support Ticket versions = 1.9...

CVE-2025-52089

A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges...

Security update for umoci

This update for umoci fixes the following issues: Update to umoci v0.5.0. Upstream changelog is available from bsc1243388 A security flaw was found in the OCI image-spec, where it is possible to cause a blob with one media-type to be interpreted as a different media-type. As umoci is not a regist...

SUSE-SU-2025:02282-1 Security update for umoci

This update for umoci fixes the following issues: Update to umoci v0.5.0. Upstream changelog is available from bsc1243388 A security flaw was found in the OCI image-spec, where it is possible to cause a blob with one media-type to be interpreted as a different media-type. As umoci is not a regist...

CVE-2025-7401

The Premium Age Verification / Restriction for WordPress plugin for WordPress is vulnerable to arbitrary file read and write due to the existence of an insufficiently protected remote support functionality in remotetunnel.php in all versions up to, and including, 3.0.2. This makes it possible for...

CVE-2025-52089

A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges...

CVE-2025-52089

CVE-2025-52089 : Totolink N300RB firmware 8.54 contains a hidden remote support feature protected by a static secret. An authenticated attacker can trigger this feature to execute arbitrary OS commands with root privileges. Multiple sources corroborate the vulnerability and affected product/versi...

PT-2025-29234

Name of the Vulnerable Software and Affected Versions: TOTOLINK N300RB firmware versions 8.54 Description: A hidden remote support feature, protected by a static secret, allows an authenticated attacker to execute arbitrary OS commands with root privileges. Recommendations: At the moment, there i...

CVE-2025-52089

A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges...

TOTOLINK N300RB 操作系统命令注入漏洞

The TOTOLINK N300R is a wireless router for home and small office scenarios from Korean networking brand TOTOLINK. The TOTOLINK N300RB suffers from a command injection vulnerability that originates from the remote support feature of static key protection, which can be exploited by an attacker to...

Microsoft Office 2016 Information Disclosure Vulnerability (KB5002734)

This host is missing an important security update according to Microsoft KB5002734 SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

The vulnerability in the implementation of the Credential Security Support Provider (CredSSP) protocol of the Microsoft Windows operating system allows a perpetrator to enhance their privileges.

The vulnerability of the Credential Security Support Provider CredSSP protocol implementation in the Microsoft Windows operating system lies in the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow attackers to enhance their privileges...

WordPress plugin Premium Age Verification Restriction for WordPress 信任管理问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A trust management issue vulnerability exis...

Azure Linux 3.0 Security Update: coredns (CVE-2025-47950)

The version of coredns installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-47950 advisory. - CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service DoS...

CBL Mariner 2.0 Security Update: coredns (CVE-2025-47950)

The version of coredns installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-47950 advisory. - CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service DoS...

Patch, track, repeat

Welcome to this week's edition of the Threat Source newsletter. We've made it halfway through 2025 already! It's been a while since I last wrote about CVEs and how free support for Windows 10 will end on October 14, 2025, leaving you with no more security fixes. While the CVE system remains the...