centos

STAR Labs has published a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked as CVE-2026-53264 (CVSS score: 7.8), is a use-after-free race in the kernel's network traffic-control subsystem. Researcher Lee Jia Jie said artificial intelligence (AI) helped him find the bug and speed up exploit development. This is local privilege escalation, not remote code execution, so an attacker needs a foothold on the machine before any of it applies. The demonstrated exploit also requires unprivileged user namespaces, the CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER kernel options, and a kernel-specific return-oriented programming (ROP) chain containing hardcoded offsets. Those conditions narrow the immediate exposure, but full exploit source code is now public. The upstream fix landed on June 1, 2026, and has since been backported to several stable kernel branches. The Linux CNA record lists vulnerable ranges beginning with Linux 4.14. Fixed releases are 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13, with the mainline fix entering 7.1-rc7. Linux users should install a distribution kernel carrying the fix rather than rely on the upstream version number alone. The Hacker News found no entry for the flaw in CISA's Known Exploited Vulnerabilities catalog and no official report of exploitation in the wild as of July 28, 2026. Lee said in a technical write-up that AI assisted with vulnerability discovery, production of a Kernel Address Sanitizer (KASAN) proof of concept, and optimisation of the race window. STAR Labs also released the CentOS-targeted exploit code. Without the model, prompts, service, or interaction record, the disclosure is difficult to use as a benchmark of AI capability or to separate the system's contribution from Lee's direction and judgement. The Hacker News asked STAR Labs for details on the AI system, test environment, and disclosure timeline and will update this story with any response. "AI still has many blind spots and lapses in reasoning ability," Lee said, adding that human judgement remained necessary throughout the work. The vulnerability sits in the lifecycle handling of Linux traffic-control actions. Concurrent RTM_NEWTFILTER and RTM_DELTFILTER operations can leave one thread reading an action object after another thread has freed it. The upstream patch fixes the race by deferring the free operation until existing read-copy-update (RCU) readers have finished. The exploit creates its own user and network namespaces, giving it namespace-local CAP_NET_ADMIN without requiring host administrator rights. It reaches the vulnerable path through a clsact qdisc and flower filter. Timerfd and epoll operations widen the race window, while key payload allocations reclaim the freed object. The ROP chain then overwrites core_pattern. The exploit places a copy of itself in a memfd and deliberately crashes a child process, causing Linux to run the memfd-backed binary as the root core-dump handler in the initial namespace. Lee reported that the exploit succeeded in all 10 of his test runs, taking between nine and 111 seconds on a laptop running CentOS Stream 9. Those reliability figures have not been independently reproduced. The exploit's fixed gadget offsets also mean it must be rebuilt for other kernel packages and may not be adaptable to some newer builds. The practical risk is narrower than a generic "Linux root exploit" label may suggest, but public exploit code raises the urgency for compatible systems that remain unpatched. The upstream patch credits Kyle Zeng, who uses the handle KyleBot, as the reporter. Lee said he found the flaw independently and only later learned that Zeng had reported it shortly before the TyphoonPwn 2026 competition. Lee published the later technical analysis and exploit code. Distribution status remained uneven as of July 28: Debian lists fixed kernels for supported stable releases, Ubuntu still marks multiple maintained kernel packages vulnerable, and SUSE lists the issue as pending across multiple products. SUSE separately assigns the flaw a 5.5 score, using a vector that records only availability impact, below the Linux CNA's 7.8 assessment. Those trackers show package status, not how many deployed systems have the required namespaces, kernel options, and a compatible kernel build. The public sources reviewed do not establish the population at immediate risk. Lee wrote that the AI-heavy process made bug hunting "feel more like I was doing n-day analysis even on new bugs."

Rspamd 4.0.0 ships memory savings, a new scan protocol, and a required migration step The open-source spam filtering platform Rspamd released version 4.0.0, delivering infrastructure changes across its scan protocol, memory model, hash storage, and configuration system. Several of the changes are breaking, and at least one requires a migration step before upgrade. A new scan protocol The release introduces a /checkv3 endpoint that replaces HTTP headers with structured JSON or msgpack for metadata transport. The new endpoint uses multipart/form-data for requests and multipart/mixed for responses, supports per-part zstd compression, includes an optional body part for rewritten messages, and uses zero-copy piecewise writev for response output. Operators can activate the new protocol with the rspamc --protocol-v3 or rspamc --msgpack flags. The previous protocol remains available. Fasttext goes built-in, cuts memory use Rspamd previously depended on an external C++ libfasttext library. Version 4 removes that dependency and replaces it with a built-in mmap-based shim that loads model data into shared memory across all worker processes. The change eliminates per-worker heap copies of model data, which the project estimates saved between 500MB and 7GB of RAM in multi-worker deployments, depending on model size. Existing .bin and .ftz model files continue to work without modification. The ENABLE_FASTTEXT cmake option is removed; Fasttext support is now always compiled in. Packagers must remove the external libfasttext build dependency. Fuzzy hashes gain multiple flags A stored fuzzy hash previously carried a single flag. Version 4 allows a single digest to carry up to eight flags simultaneously, so multiple detection rules can match the same hash independently without duplicating the stored entry. The Redis update logic was rewritten in Lua with EVALSHA and NOSCRIPT recovery. The release also introduces an HTML_FUZZY_PHISHING symbol. It fires when an HTML template matches a known phishing template but the embedded domains differ, targeting phishing campaigns that reuse a template structure while swapping out links. The wire protocol moves to epoch 12 and remains backward-compatible. The highest-value flag occupies the primary slot. Ring Hash replaces Jump Hash Rspamd used Jump Hash for consistent upstream hashing in sharded Bayes deployments. Version 4 replaces it with Ring Hash (Ketama) with virtual nodes. Under Ring Hash, only roughly 1/n keys redistribute when an upstream fails, and keys return to their original upstream when it recovers. This change is a breaking one for operators running per-user Bayes on sharded Redis. After the upgrade, existing data lands on the wrong shards. The project requires operators to run rspamadm statistics_dump migrate before upgrading. Single-server deployments are not affected. HTTPS support added natively Workers can now serve HTTPS without a reverse proxy in front. SSL is auto-detected from bind socket configuration. The previous ssl = true worker option is removed; operators should remove it from configs and apply the ssl suffix to bind lines. Token bucket load balancing becomes the default Proxy upstream load balancing switches from simple round-robin to token bucket balancing by default. The algorithm accepts configurable max_tokens, scale, and base_cost parameters for burst traffic handling. Operators who want to restore round-robin can remove the token_bucket key from proxy upstream config. Jinja2 templating for configuration files Configuration files are now preprocessed by the Lupa Jinja2-compatible template engine before UCL parsing. Environment variables prefixed with RSPAMD_ are available inside templates as the env table. The templating system uses modified delimiters ({= =} for expressions, {% %} for control structures) to avoid conflicts with UCL syntax. Validation filters including mandatory, require_int, and require_json abort startup on invalid input, which the project intends to support container deployments that configure Rspamd through environment variables. Other additions and fixes Rspamd 4 adds native UUID v7 generation per scanning task, synchronized with the Log-Tag header and ClickHouse UUID v7 column support. The Bayesian classifier gains multiclass support, allowing classifiers to learn arbitrary categories beyond binary spam/ham. The WebUI learning interface is updated accordingly. Hyperscan compilation moves to an async Lua backend with Redis-based shared cache across workers and hosts. Multiple use-after-free conditions in Hyperscan cache handling during live configuration reload are resolved. SenderScore RBLs are disabled by default in this release. The project notes that the rules require a MyValidity account and were returning blocked results for all unregistered IPs. Operators with registered accounts must explicitly re-enable the rules. PDF parsing receives fixes for ASCII85 decoding, ligature substitution, and object padding evasion. DKIM unknown and broken key handling is updated to follow RFC behavior. A memory leak in the RSA path of DKIM signing is fixed, as is a SHA-1 DKIM signature crypto-policy bypass on RHEL/CentOS 10. A use-after-free in fuzzy UDP sessions and a CPU busy-loop in the fuzzy TCP client are also resolved in this release. Rspamd is available for free download on GitHub. Must read: 40 open-source tools redefining how security teams secure the stack Firmware scanning time, cost, and where teams run EMBA Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

Vulnerabilità in GNU Inetutils telnetd e rischi strutturali del protocollo Telnet Bollettino BL01/260318/CSIRT-ITA Sintesi Disponibile un Proof of Concept (PoC) per la vulnerabilità CVE-2026-32746, di gravità "critica", che interessa il demone telnetd appartenente alla suite di utility di rete GNU Inetutils. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente malintenzionato remoto non autenticato di eseguire codice arbitrario sui sistemi target. Tipologia Remote Code Execution Descrizione e potenziali impatti Disponibile un Proof of Concept (PoC) per la CVE‑2026‑32746 – di tipo "Remote Pre-Auth Buffer Overflow" e con score CVSS v3.x pari a 9.8 – che riguarda il demone telnetd, presente nella suite di utility di rete GNU Inetutils. La vulnerabilità è dovuta all’assenza di adeguati controlli sui limiti del buffer nella funzione add_slc(), che gestisce le opzioni LINEMODE SLC (Set Local Characters). In presenza di un numero eccessivo di entry SLC, la funzione può scrivere dati oltre i limiti del buffer (out‑of‑bounds write), causando la corruzione della memoria. Nel dettaglio, un utente malintenzionato potrebbe sfruttare la vulnerabilità come segue: connettendosi alla porta 23 ed effettuando l’handshake iniziale; nel momento in cui il server invia DO LINEMODE, rispondendo WILL LINEMODE per entrare nella negoziazione LINEMODE; inviando una subnegotiation LINEMODE SLC contenente un numero elevato di triple SLC (tipicamente 40–50 per garantire l’overflow, ciascuna composta da 3 byte: funzione, flag, valore), nel formato: IAC SB LINEMODE LM_SLC IAC SE; Per ogni tripla ricevuta, il server invoca add_slc() la quale, non verificando opportunamente la capacità del buffer, effettua scritture oltre i limiti corrompendo la memoria adiacente allo stesso. Di conseguenza, mediante richieste opportunamente predisposte, l’attaccante potrebbe ottenere l’esecuzione di codice nel contesto del processo telnetd - tipicamente eseguito con privilegi elevati (root). Prodotti e versioni affette telnetd, versione 2.7 e precedenti che implementano la funzionalità SLC Azioni di mitigazione La vulnerabilità è solo l’ultima di una serie di criticità che riguardano il protocollo telnet, tra cui anche la recente CVE-2026-24061, trattata nell’ambito dell’AL01/260126/CSIRT-ITA. Come già sottolineato da questo CSIRT nel BL01/250626/CSIRT-ITA, il protocollo TELNET è considerato obsoleto - quindi insicuro - poiché non prevede alcuna forma di crittografia, soprattutto durante la fase di autenticazione: le credenziali e i dati trasmessi viaggiano in chiaro durante la comunicazione e sono pertanto facilmente intercettabili. Inoltre, a causa della nota obsolescenza del protocollo, le implementazioni come GNU Inetutils telnetd hanno cicli di manutenzione non tempestivi, e vengono mantenute solo per compatibilità dei sistemi legacy. Si raccomanda, pertanto, di disabilitare eventuali servizi telnet ancora in uso, e sostituirli con varianti più sicure. La soluzione SSH è considerata una alternativa valida, avendo cura di disabilitarne la semplice autenticazione via password e il login diretto come utente root, e utilizzando esclusivamente metodologie di autenticazione a chiave forte (ed25519 o RSA ≥ 3072 bit). Per quanto detto, si riportano di seguito alcune linee guida per la verifica, la disabilitazione e la disinstallazione del servizio telnet: Verificare la presenza di telnetd con il comando ;which telnetd Verificare l'esposizione del servizio telnet con il comando ;ss -tlnp | grep :23 Disabilitare telnet: - sistemi basati su systemd: sudo systemctl stop telnet.socket telnet.service sudo systemctl disable telnet.socket telnet.service sudo systemctl mask telnet.socket telnet.service sudo systemctl stop inetd sudo systemctl stop xinetd sudo systemctl disable inetd sudo systemctl disable xinetd - sistemi basati su init.d: /etc/init.d/inetd stop /etc/init.d/xinetd stop sistemi basati su systemd: Rimozione del pacchetto: Debian/Ubuntu: ;sudo apt remove telnetd inetutils-telnetd RHEL/CENTOS/Fedora: ;sudo dnf remove inetutils-telnetd telnet-server Bonifica delle regole firewall: - Debian/Ubuntu: sudo ufw delete allow 23/tcp sudo ufw reload - RHEL/CENTOS/Fedora: sudo firewall-cmd --permanent --remove-service=telnet sudo firewall-cmd --permanent --remove-port=23/tcp sudo firewall-cmd --reload - Iptables: sudo iptables -D INPUT -p tcp --dport 23 -j ACCEPT Debian/Ubuntu:

ConnectSecure introduces Linux patching capability to simplify cross-distro updates ConnectSecure announced the launch of a new cross-platform Linux operating system patching capability. The update eliminates the complexity of managing fragmented Linux environments by delivering a single, unified interface for deploying critical security updates across the four most widely used Linux distributions: Red Hat, Ubuntu, Debian, and CentOS. The new capability helps MSPs and security teams automate the identification and deployment of kernel and OS patches without requiring distribution-specific tools. As a result, organizations can reduce manual maintenance efforts by up to 80% while maintaining continuous protection against newly disclosed vulnerabilities across their Linux fleets. “Our mission has always been to simplify the lives of system and security administrators who are often forced to juggle multiple tools just to keep their environments secure,” said Peter Bellini, CEO, ConnectSecure. “With this release, we’re delivering cross-platform vulnerability management across different operating systems from one single tool.” In addition, ConnectSecure is introducing a built-in local patch repository capability. With this feature, a probe agent can act as a centralized patch repository by downloading scheduled updates once and securely distributing them to other systems on the network. This approach delivers several operational benefits, including: Keeping all patch traffic inside the firewall Eliminating redundant internet downloads across endpoints Supporting low-bandwidth or restricted environments Enabling faster and more reliable patching at scale

For the latest discoveries in cyber research for the week of 10th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The US Congressional Budget Office (CBO) has confirmed a cyber attack that resulted in a suspected foreign threat actor breaching its network and potentially exposing sensitive communications between congressional offices and CBO analysts. The incident may have led to the compromise of draft reports, economic forecasts, internal emails, and other confidential data. The attack has been attributed to the Chinese state-sponsored APT group known as Silk Typhoon. Hyundai AutoEver America was hit by a cyber attack that resulted in unauthorized access to its IT environment, exposing sensitive personal information, including names, Social Security Numbers, and driver’s license numbers. The attack, which occurred between February 22 and March 2, 2025, affected employees, customers, or users, although the exact number of affected individuals remains unclear. Swedish IT systems supplier Miljödata has suffered a data breach that resulted in the exposure and theft of personal data belonging to up to 1.5 million individuals, including names, email addresses, physical addresses, phone numbers, government IDs, and dates of birth. The incident disrupted operations across multiple Swedish municipalities, affecting both children and protected identity subjects. The stolen data was published on the dark web by the threat group Datacarry. Japanese media giant Nikkei has experienced a cyber-attack caused by malware infection. The attack resulted in unauthorized access to its Slack messaging platform, exposing the personal information of over 17,000 employees and business partners, including names, email addresses, and chat histories. Polish online loan platform SuperGrosz, operated by AIQLABS, has disclosed a breach exposing personal data of at least 10,000 customers, including names, addresses, ID and tax numbers, phone contacts, employment details, and bank account numbers. The disclosure follows a separate distributed denial-of-service (DDoS) attack on a Polish mobile payment leader Blik that disrupted instant transfers and cash withdrawals. No actor has claimed responsibility, though Polish authorities have suggested a possible Russian link to the Blik attack. SonicWall has confirmed that a state-sponsored threat actor was behind the September attack that resulted in the theft of all firewall configuration files stored in its cloud backup environment via an API call. The breach exposed encrypted credentials and device configuration data contained in those files, enabling potential targeted attacks. All customers who used the cloud backup service were affected. VULNERABILITIES AND PATCHES Check Point Research has uncovered four critical vulnerabilities in Microsoft Teams that allow attackers to impersonate users, manipulate messages, notifications, displayed names and forge caller identities in video and audio calls. Microsoft fixed the flaws and officially tracked the notification spoofing flaw as CVE-2024-38197. Check Point Research detected an exploit that drained $128.64M from Balancer V2. The attacker combined a rounding error vulnerability in a certain function with carefully crafted batchSwap operations. It allowed the attacker to artificially suppress Balancer Pool Token prices and extract value through repeated arbitrage cycles A critical remote command execution vulnerability, CVE-2025-48703, affecting CentOS Web Panel (CWP) versions prior to 0.9.8.1204 is actively being exploited in the wild. It enables remote, unauthenticated attackers with knowledge of a valid username to execute arbitrary shell commands as that user. A patch addressing the issue was released in version 0.9.8.1205. Check Point IPS provides protection against this threat (CentOS Web Panel Command Injection (CVE-2025-48703)) Cisco warns of a new attack variant targeting Secure Firewall ASA and FTD that exploits CVE-2025-20333 (RCE as root via crafted HTTP) and CVE-2025-20362 (unauthenticated restricted-URL access), causing unpatched devices to reload into DoS. Both flaws were previously abused as zero-days in late September to deliver RayInitiator and LINE VIPER malware. Check Point IPS provides protection against this threat (Cisco Multiple Products Buffer Overflow (CVE-2025-20333); Cisco Multiple Products Authentication Bypass (CVE-2025-20362)) THREAT INTELLIGENCE REPORTS Check Point Research demonstrated a new way to use ChatGPT for malware analysis directly from the web interface, analyzing XLoader malware. The workflow using exported IDA data enables static analysis, rapid decryption, IoC extraction, and hidden C2 discovery. Check Point Threat Emulation and Harmony Endpoint provide protection against this threat (Trojan.Wins.Xloader; Trojan.Win.Xloader; Trojan.Wins.Xloader.ta.*) Check Point discovered AI-driven pharma scams that deepfake doctors and clinics to sell counterfeit drugs. Infrastructure shows more than 500 fake social pages daily using shared IPs, cloned site kits, AI imagery, deepfake ads/voice cloning, and spoofed clinic sites, with automated “fraud kits”. Researchers identified AI-powered malware families, including FRUITSHELL, PROMPTSTEAL and QUIETVAULT which were observed in operations. These malware strains leveraged LLMs like Gemini for evasive, dynamic attacks on Ukraine and worldwide victims. The researchers also found PROMPTFLUX, an experimental malware family that employed AI capabilities mid-execution to dynamically alter the malware’s behavior.

Week in review: Cisco fixes critical UCCX flaws, November 2025 Patch Tuesday forecast Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Securing real-time payments without slowing them down In this Help Net Security interview, Arun Singh, CISO at Tyro, discusses what it takes to secure real-time payments without slowing them down. He explains how analytics, authentication, and better industry cooperation can help stay ahead of fraud. Singh also touches on how digital identity and accountability are transforming how trust is built in payments. Heisenberg: Open-source software supply chain health check tool Heisenberg is an open-source tool that checks the health of a software supply chain. It analyzes dependencies using data from deps.dev, Software Bills of Materials (SBOMs), and external advisories to measure package health, detect risks, and generate reports for individual dependencies or entire projects. A new way to think about zero trust for workloads Static credentials have been a weak point in cloud security for years. A new paper by researchers from SentinelOne takes direct aim at that issue with a practical model for authenticating workloads without long-lived secrets. Instead of relying on static keys, the team proposes using temporary, verifiable tokens that expire within minutes. How nations build and defend their cyberspace capabilities In this Help Net Security interview, Dr. Bernhards Blumbergs, Lead Cyber Security Expert at CERT.LV, discusses how cyberspace has become an integral part of national and military operations. He explains how countries develop capabilities to act and defend in this domain, often in coordination with activities in other areas of conflict. AI can flag the risk, but only humans can close the loop In this Help Net Security interview, Dilek Çilingir, Global Forensic & Integrity Services Leader at EY, discusses how AI is transforming third-party assessments and due diligence. She explains how machine learning and behavioral analytics help organizations detect risks earlier, improve compliance, and strengthen accountability. PortGPT: How researchers taught an AI to backport security patches automatically Keeping older software versions secure often means backporting patches from newer releases. It is a routine but tedious job, especially for large open-source projects such as the Linux kernel. A new research effort has built a tool that uses a large language model to do that work automatically. OpenGuardrails: A new open-source model aims to make AI safer for real-world use When you ask a large language model to summarize a policy or write code, you probably assume it will behave safely. But what happens when someone tries to trick it into leaking data or generating harmful content? That question is driving a wave of research into AI guardrails, and a new open-source project called OpenGuardrails is taking a bold step in that direction. What keeps phishing training from fading over time When employees stop falling for phishing emails, it is rarely luck. A new study shows that steady, mandatory phishing training can cut risky behavior over time. After one year of continuous simulations and follow-up lessons, employees were half as likely to take the bait. Metrics don’t lie, but they can be misleading when they only tell IT’s side of the story In this Help Net Security interview, Rik Mistry, Managing Partner at Interval Group, discusses how to align IT strategy with business goals. He explains how security, governance, and orchestration shape IT operations and why early collaboration between IT and security leaders leads to better outcomes. Mistry also shares his perspective on automation and emerging technologies. Cyber-espionage campaign mirroring Sandworm TTPs hit Russian and Belarusian military A spear-phishing campaign aimed to compromise Russian and Belarusian military personnel by using military-themed documents as a lure has been flagged by Cyble and Seqrite security researchers. The goal of the campaign is to get targets to download and open a booby-trapped LNK file masquerading as a PDF, ultimately leading to a complete system compromise. Former ransomware negotiators allegedly targeted US firms with ALPHV/BlackCat ransomware A ransomware negotiator and an incident response manager have been indicted in Florida for allegedly conspiring to deploy the ALPHV/BlackCat ransomware against multiple US companies and extorting nearly $1.3 million from one of the victims. Cybercriminals exploit RMM tools to steal real-world cargo Cybercriminals are compromising logistics and trucking companies by tricking them into installing remote monitoring and management (RMM) tools, Proofpoint researchers warned. Critical Control Web Panel vulnerability is actively exploited (CVE-2025-48703) On Tuesday, CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2025-11371, which affects Gladinet’s CentreStack and Triofox file-sharing and remote access platforms, and CVE-2025-48703, a vulnerability in Control Web Panel (CWP), a web hosting control panel designed for managing servers running CentOS or CentOS-based distributions. Google uncovers malware using LLMs to operate and evade detection PromptLock, the AI-powered proof-of-concept ransomware developed by researchers at NYU Tandon and initially mistaken for an active threat by ESET, is no longer an isolated example: Google’s latest report shows attackers are now creating and deploying other malware that leverages LLMs to operate and evade security systems. SonicWall cloud backup hack was the work of a state actor Incident responders from Mandiant have wrapped up their investigation into the SonicWall cloud backup service hack, and the verdict is in: the culprit is a state-sponsored threat actor (though the specific nation wasn’t disclosed). Cisco fixes critical UCCX flaws, patch ASAP! (CVE-2025-20358, CVE-2025-20354) Cisco has fixed two critical vulnerabilities (CVE-2025-20358, CVE-2025-20354) affecting Unified Contact Center Express (UCCX), which may allow attackers to bypass authentication, compromise vulnerable installations, and elevate privileges to root. Attackers upgrade ClickFix with tricks used by online stores Attackers have taken the ClickFix technique further, with pages borrowing tricks from online sellers to pressure victims into performing the steps that will lead to a malware infection. Uncovering the risks of unmanaged identities Every organization manages thousands of identities, from admins and developers to service accounts and AI agents. But many of these identities operate in the shadows, untracked and unprotected. These unmanaged identities quietly expand your attack surface, weaken compliance, and threaten business continuity, posing significant risk. So, how can you uncover, secure, and manage what you can’t see? November 2025 Patch Tuesday forecast: Windows Exchange Server EOL? October 2025 Patch Tuesday was one for the record books in so many ways. There was a big push by Microsoft to fix as many open vulnerabilities as possible in products that were reaching end-of-life (EOL). This included 116 CVEs addressed in Windows 10 and an astronomical 134 CVEs addressed in Windows 11, because don’t forget Windows 11 22H2 Enterprise and Education editions also reached EOL. Cybercriminals have built a business on YouTube’s blind spots The days when YouTube was just a place for funny clips and music videos are behind us. With 2.53 billion active users, it has become a space where entertainment, information, and deception coexist. European authorities dismantle €600 million crypto scam network Nine people have been arrested in a coordinated international operation targeting a large cryptocurrency money laundering network that defrauded victims of more than €600 million. The operation was led by Eurojust, the EU’s judicial cooperation agency, which brought together investigators and prosecutors from France, Belgium, Cyprus, Spain and Germany. Connected homes: Is bystander privacy anyone’s responsibility? Smart doorbells, connected cameras, and home monitoring systems have become common sights on doorsteps and living rooms. They promise safety and convenience, but they also raise a problem. These devices record more than their owners. They capture neighbors, visitors, and anyone passing by. 18 arrested in €300 million global credit card fraud scheme A coordinated international operation has led to 18 arrests in a massive credit card fraud case worth at least €300 million. The effort, led by Eurojust, targeted a network of suspects accused of running fake online subscription services for dating, pornography, and streaming sites. Among those detained were five executives from four German payment service providers. Enterprises are losing track of the devices inside their networks Security teams are often surprised when they discover the range and number of devices connected to their networks. The total goes far beyond what appears in agent-based telemetry or old manual asset inventories. Deepfakes, fraud, and the fight for trust online In this Help Net Security video, Michael Engle, Chief Strategy Officer at 1Kosmos, explains how deepfakes are changing online identity verification. He describes how fake IDs and synthetic identities are being used for account signups and takeovers. What shadow AI means for your company’s security In this Help Net Security video, Peled Eldan, Head of Research at XM Cyber, explains the hidden risks of shadow AI. He describes how employees often use unapproved AI tools at work to save time or solve problems, even when approved tools are available. This behavior, though common, can lead to serious issues such as data leaks, compliance violations, and security blind spots. Europe’s phone networks are drowning in fake calls Caller ID spoofing has become one of Europe’s most persistent enablers of cyber fraud. A new position paper from Europol warns that manipulated phone identities now drive much of the continent’s financial and social engineering crime, making it difficult for law enforcement to track perpetrators. The agency estimates global losses at around EUR 850 million a year, with phone and text-based fraud accounting for roughly two thirds of reported scam cases. Employees keep finding new ways around company access controls AI, SaaS, and personal devices are changing how people get work done, but the tools that protect company systems have not kept up, according to 1Password. Tools like SSO, MDM, and IAM no longer align with how employees and AI agents access data. Financial services can’t shake security debt In financial services, application security risk is becoming a long game. Fewer flaws appear in new code, but old ones linger longer, creating a kind of software “interest” that keeps growing, according to Veracode’s 2025 State of Software Security report. Google says 2026 will be the year AI supercharges cybercrime Security leaders are staring down a year of major change. In its Cybersecurity Forecast 2026, Google paints a picture of a threat landscape transformed by AI, supercharged cybercrime, and increasingly aggressive nation-state operations. Attackers are moving faster, scaling their operations with automation. VulnRisk: Open-source vulnerability risk assessment platform VulnRisk is an open-source platform for vulnerability risk assessment. It goes beyond basic CVSS scoring by adding context-aware analysis that reduces noise and highlights what matters. The tool is free to use and designed for local development and testing. Retailers are learning to say no to ransom demands Ransomware remains one of the biggest operational risks for retailers, but the latest data shows a shift in how these attacks unfold. Fewer incidents now lead to data encryption, recovery costs have dropped, and businesses are bouncing back faster. Yet attackers are demanding more money, and security teams are feeling the strain. Humans built the problem, AI just scaled it Information moves across cloud platforms, personal devices, and AI tools, often faster than security teams can track it. Proofpoint’s 2025 Data Security Landscape report shows that most organizations faced data loss last year, usually caused by their own people. With AI agents part of daily operations, security leaders are confronting risks that come from users and from the systems acting on their behalf. Russia-linked hackers intensify attacks as global APT activity shifts State-aligned hacking groups have spent the past six months ramping up espionage, sabotage, and cybercrime campaigns across multiple regions, according to ESET’s APT Activity Report covering April through September 2025. The research highlights how operations linked to Russia, China, Iran, and North Korea have evolved in scope and technique, showing that nation-state activity remains a constant source of disruption. Hospitals are running out of excuses for weak cyber hygiene Healthcare leaders continue to treat cybersecurity as a technical safeguard instead of a strategic business function, according to the 2025 US Healthcare Cyber Resilience Survey by EY. The study, based on responses from 100 healthcare executives, outlines six areas where hospitals and health systems must act to close resilience gaps that threaten patient care and operations. Old privacy laws create new risks for businesses Businesses are increasingly being pulled into lawsuits over how they collect and share user data online. What was once the domain of large tech firms is now a widespread legal risk for companies of all sizes. The latest analysis from cyber insurer Coalition shows that outdated privacy laws are driving a surge in web privacy claims, with small and midsize businesses now common targets. Product showcase: Cogent Community democratizes vulnerability intelligence with agentic AI Teams are buried under overlapping feeds, inconsistent formats, and fragmented context. Even with advanced tools, analyzing raw intelligence into prioritized, evidence-based action remains one of the hardest problems in modern security operations. Cogent Security addresses this problem head-on with its industry-first AI taskforce for vulnerability management. And with its newly introduced Cogent Community, the company is now delivering an open-access, free-to-use tool that helps security teams operationalize vulnerability intelligence. Cybersecurity jobs available right now: November 4, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: November 7, 2025 Here’s a look at the most interesting products from the past week, featuring releases from 1touch.io, Barracuda Networks, Bitdefender, Forescout, and Komodor.

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning that threat actors are exploiting a critical remote command execution flaw in CentOS Web Panel (CWP). The agency has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and is giving federal entities subject to the BOD 22-01 guidance until November 25 to apply available security updates and vendor-provided mitigations, or stop using the product. Tracked as CVE-2025-48703, the security issue allows remote, unauthenticated attackers with knowledge of a valid username on a CWP instance to execute arbitrary shell commands as that user. CWP is a free web hosting control panel used for Linux server management, marketed as an open-source alternative to commercial panels like cPanel and Plesk. It is widely used by web hosting providers, system administrators, and VPS or dedicated server operators. The issue impacts all CWP versions before 0.9.8.1204 and was demonstrated on CentOS 7 in late June by Fenrisk security researcher Maxime Rinaudo. In a detailed technical write-up, the researcher explains that the root cause of the flaw is the file-manager ‘changePerm’ endpoint processing requests even when the per-user identifier is omitted, allowing unauthenticated requests to reach code that expects a logged-in user. Furthermore, the ‘t_total’ parameter, which works as a file permission mode in the chmod system command, is passed unsanitized into a shell command, allowing shell injection and arbitrary command execution. In Rinaudo's exploit, a POST request to the file-manager changePerm endpoint with a crafted t_total injects a shell command and spawns a reverse shell as the target user. The researcher reported the flaw to CWP on May 13, and a fix was released on June 18, in version 0.9.8.1205 of the product. Yesterday, CISA added the flaw to the KEV catalog without sharing any details about how it is being exploited, the targets, or the origin of the malicious activity. The agency also added to the catalog CVE-2025-11371, a local file inclusion flaw in Gladinet CentreStack and Triofox products, and gave the same November 25 deadline to federal agencies to patch or stop using the product. That flaw was marked as an actively exploited zero-day by Huntress on October 10, and the vendor patched it four days later, in version 16.10.10408.56683. Even if CISA's KEV is aimed at federal agencies in the U.S., any organization should monitor it and prioritize dealing with the vulnerabilities it includes. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Critical Control Web Panel vulnerability is actively exploited (CVE-2025-48703) On Tuesday, CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2025-11371, which affects Gladinet’s CentreStack and Triofox file-sharing and remote access platforms, and CVE-2025-48703, a vulnerability in Control Web Panel (CWP), a web hosting control panel designed for managing servers running CentOS or CentOS-based distributions. While active exploitation of CVE-2025-11371 has been reported on since early October 2025, exploitation attempts involving CVE-2025-48703, though detected by cybersecurity professionals, have so far been less widespread (or observed). What is Control Web Panel (CWP)? CWP is server management software that runs on CentOS (whos development was discontinued in late 2020) and its community-driven successors, Rocky Linux and AlmaLinux. CWP users can opt for the free version what offers core features for single-server management, and a (paid) Pro version with better security, automatic updates, and improved support. The software is popular with virtual private server (VPS) and dedicated server operators and is used to manage services like web servers, databases, email servers, DNS, as well as security features. About CVE-2025-48703 CVE-2025-48703 is a critical OS Command Injection flaw that “allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request.” The vulnerability’s current CVSS string indicates that it’s exploitable remotely over a network, without prior authentication or user interaction, but also that it’s not trivially exploitable. Maxime Rinaudo, co-founder of penetration testing firm Fenrisk, explained that attackers must know or guess a valid non-root username to bypass authentication requirements before exploiting CVE-2025-48703. The bad news is that such usernames are often predictable. CVE-2025-48703 is triggered by sending a HTTPS request with a specially crafted t_total value to the user file manager endpoint (filemanager&acc=changePerm), and allows attackers to run commands as that local user. Thus, an attacker can drop web shells, create persistence, pivot, or escalate further depending on local misconfigurations. What to do? With Rinaudo’s technical write-up and PoC published in late June 2025 and other PoC exploits appearing on GitHub since, it was only a matter of time until attackers began attempting to exploit the flaw. In July 2025, FindSec researchers noted that “exploits are being actively developed and shared in hacking forums,” and advised organization runing CWP to manage Linux-based web hosting environments to patch quickly. According to Shodan, there are currently over 220,000 internet-facing CWP instances, though it remains unclear how many are still running a vulnerable version. CVE-2025-48703 affects CWP versions before 0.9.8.1205, released in June 2025. Users should: Upgrade to version 0.9.8.1205 or later. Restrict access to port 2083 (the user interface) to trusted IPs. Look for signs of compromise, e.g., unexpected reverse shell connections, suspicious chmod executions in logs, new or modified .bashrc, .ssh, or cron entries, connections to unfamiliar IP addresses, and unknown user accounts. If found, the host should be isolated, logs preserved, and a forensic investigation mounted. Use intrusion detection systems to detect/block exploitation attempts. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

The cybersecurity agency CISA on Tuesday warned that a critical vulnerability affecting the Control Web Panel (CWP) server administration software has been exploited in the wild. CWP, previously named CentOS Web Panel, is a free and widely used Linux web hosting control panel that is designed to simplify server management. A vulnerability in CWP, tracked as CVE-2025-48703, allows remote, unauthenticated attackers to execute arbitrary commands on vulnerable systems. An attacker in possession of a valid non-root username can bypass authentication and execute commands using specially crafted requests. The vulnerability was reported to CWP developers in mid-May and patched roughly one month later with the release of version 0.9.8.1205. There do not appear to be any public reports describing attacks in which CVE-2025-48703 has been exploited. Findsec warned a few months ago that exploitation of the vulnerability had been imminent. The company noted that exploitation could be automated and that threat actors had already started developing and sharing exploits on cybercrime forums. According to Netlas.io, there are roughly 150,000 internet-exposed CWP instances that are potentially affected by CVE-2025-48703, a majority in the United States (37,510), followed by Germany, Japan, India, France, and Canada. Shodan shows more than 220,000 internet-exposed instances. Given this widespread exposure, it’s highly likely that the vulnerability has been exploited in opportunistic attacks. CISA added CVE-2025-48703 to its Known Exploited Vulnerabilities (KEV) catalog and instructed federal agencies to address it by November 25. In-the-wild exploitation of a CWP vulnerability was previously reported in early 2023. Related: Critical Flaw in Popular React Native NPM Package Exposes Developers to Attacks Related: CISA Warns of Exploited DELMIA Factory Software Vulnerabilities Related: CISA Adds Exploited XWiki, VMware Flaws to KEV Catalog