gladinet

Gladinet: disponibili PoC per nuove vulnerabilità in Triofox Alert AL04/260528/CSIRT-ITA Sintesi Disponibili online Proof of Concept (PoC) per 6 nuove vulnerabilità – già sanate dal vendor - presenti in Gladinet TrioFox Server Agent, componente software dedicato che fa da ponte tra i file server Windows on‑premises e la piattaforma cloud di accesso remoto Triofox, consentendo l’accesso remoto e la collaborazione sui file tramite interfacce HTTP/HTTPS senza necessità di VPN tradizionali. Tipologie Authentication Bypass Data Manipulation Denial of Service Information Disclosure Remote Code Execution Security Restrictions Bypass Descrizione e potenziali impatti Disponibili online Proof of Concept (PoC) per 6 nuove vulnerabilità – già sanate dal vendor - presenti in Gladinet TrioFox Server Agent, componente software dedicato che fa da ponte tra i file server Windows on‑premises e la piattaforma cloud di accesso remoto Triofox, consentendo l’accesso remoto e la collaborazione sui file tramite interfacce HTTP/HTTPS senza necessità di VPN tradizionali. Di seguito il dettaglio delle vulnerabilità. CVE-2026-8364: di tipo “Missing Authentication for Critical Function” e con score CVSS v3.1 pari a 9.8, è dovuta all’assenza di meccanismi di autenticazione sugli endpoint esposti dal servizio Triofox Server Agent (/resources, /Settings, ecc.). Un attaccante remoto non autenticato potrebbe sfruttare tale vulnerabilità tramite richieste HTTP opportunamente predisposte e dirette agli endpoint esposti (porta 7878), interagendo con le API senza alcun controllo di autenticazione, con possibilità di accesso e manipolazione dei file e dei dati. CVE-2026-8363: di tipo “Stack-based Buffer Overflow” e con score CVSS v3.1 pari a 9.8, risiede nel componente WOSDeviceDropFolder.dll, ed è dovuta all’uso della funzione sprintf su buffer a dimensione fissa sui quali non vengono effettuati adeguati controlli sui limiti degli stessi. Una richiesta HTTP con un path /resources/ contenente un input eccessivamente lungo controllato dall’attaccante può provocare un crash del servizio (DoS) e/o consentire l’esecuzione di codice arbitrario sul sistema target. CVE-2026-8362: di tipo “Stack-based Buffer Overflow” e con score CVSS v3.1 pari a 9.8, risiede nel componente WOSDefaultHttpModule.dll, ed è causato da concatenazione non sicura (wcscat) dell’input fornito dall’utente su un buffer a dimensione fissa allocato nello stack. Un attaccante remoto potrebbe sfruttare tale vulnerabilità tramite una richiesta HTTP verso /woshome/ contenente stringhe molto lunghe, causando overflow e corruzione dello stack. Le possibili conseguenze includono la compromissione della disponibilità del servizio e l’esecuzione di codice arbitrario sul sistema target. CVE-2026-8361: di tipo “Path Traversal” e con score CVSS v3.1 pari a 7.5, risiede nel componente WOSDefaultHttpModule.dll, ed è dovuta alla mancata validazione dei percorsi nei path URL, consentendo attacchi di directory traversal (../). Un attaccante potrebbe sfruttare tale vulnerabilità inviando richieste HTTP opportunamente predisposte per accedere a file al di fuori delle directory consentite, con conseguente esposizione di informazioni sensibili. CVE-2026-8360: di tipo “NULL Pointer Dereference” e con score CVSS v3.1 pari a 7.5, è dovuta al mancato controllo del valore restituito dalla funzione WOSSysInfoGetDeviceInterface(). Un attaccante potrebbe sfruttare tale vulnerabilità tramite richieste HTTP opportunamente predisposte e, in condizioni specifiche (ad esempio in assenza di un utente autenticato nella console di gestione), causare la dereferenziazione di un puntatore NULL, provocando l’indisponibilità del servizio (DoS) sul sistema target. CVE-2026-8359: di tipo “NULL Pointer Dereference” e con score CVSS v3.1 pari a 7.5, è dovuta all’assenza del modulo WOSHttpStatusModule.dll, con conseguente chiamata a una funzione tramite puntatore NULL. Un attaccante potrebbe sfruttare tale vulnerabilità inviando richieste HTTP verso gli endpoint /status o /sysinfo, che attivano il caricamento del modulo mancante e causano l’esecuzione a indirizzo NULL, provocando l’indisponibilità del servizio (DoS) sul sistema target. Prodotti e/o versioni affette Gladinet Triofox Server Agent, versioni precedenti alla 17.1.10488.57063 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettino di sicurezza disponibile nella sezione Riferimenti

The Clop ransomware gang (also known as Cl0p) is targeting Internet-exposed Gladinet CentreStack file servers in a new data theft extortion campaign. Gladinet CentreStack enables businesses to securely share files hosted on on-premises file servers through web browsers, mobile apps, and mapped drives without requiring a VPN. According to Gladinet, CentreStack "is used by thousands of businesses from over 49 countries." Since April, Gladinet has released security updates to address several other security flaws that were exploited in attacks, some of them as zero-days. The Clop cybercrime gang is now scanning for and breaching CentreStack servers exposed online, with Curated Intel telling BleepingComputer that ransom notes are left on compromised servers. However, there is currently no information on the vulnerability Clop is exploiting to hack into CentreStack servers. It is unclear whether this is a zero-day flaw or a previously addressed bug that the owners of the hacked systems have yet to patch. "Incident Responders from the Curated Intelligence community have encountered a new CLOP extortion campaign targeting Internet-facing CentreStack file servers," warned threat intel group Curated Intelligence on Thursday. "From recent port scan data, there appears to be at least 200+ unique IPs running the "CentreStack - Login" HTTP Title, making them potential targets of CLOP who is exploiting an unknown CVE (n-day or zero-day) in these systems." Clop's data theft attacks Clop has a long history of targeting secure file transfer products. In the past, the extortion gang has been behind other data theft campaigns targeting Accellion FTA, GoAnywhere MFT, Cleo, and MOVEit Transfer file-sharing servers, the latter of which affected over 2,770 organizations worldwide. Most recently, it exploited an Oracle EBS zero-day flaw (CVE-2025-61882) to steal sensitive files from many organizations since early August 2025. The list of Oracle customers impacted includes Harvard University, The Washington Post, GlobalLogic, the University of Pennsylvania, Logitech, and the American Airlines subsidiary Envoy Air. After breaching their systems and exfiltrating sensitive documents, Clop published the stolen data on its dark web leak site and made it available for download via Torrent. The U.S. Department of State is offering a $10 million reward for any information that could link this cybercrime gang's attacks to a foreign government. A Gladinet spokesperson was not immediately available for comment when contacted by BleepingComputer earlier today Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Gladinet: rilevato sfruttamento attivo di vulnerabilità in CentreStack e Triofox Alert AL03/251216/CSIRT-ITA Sintesi Ricercatori di sicurezza hanno rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2025-14611 che interessa i prodotti Gladinet CentreStack e Triofox, soluzioni di accesso remoto e condivisione sicura di file server. Tipologie Remote Code Execution Information Disclosure Privilege Escalation Authentication Bypass Security Feature Bypass Descrizione e potenziali impatti Ricercatori di sicurezza hanno rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2025-14611 che interessa i prodotti Gladinet CentreStack e Triofox, soluzioni di accesso remoto e condivisione sicura di file server. Tale vulnerabilità – di tipo “Use of Hard-coded Credentials” e con score CVSS v4.0 pari a 7.1, permetterebbe ad un utente malintenzionato e non autenticato l’inclusione arbitraria di file locali tramite invio di una richiesta appositamente costruita. Questo apre la strada a ulteriori exploit, come l’accesso a chiavi critiche e l’esecuzione di codice remoto, fino alla compromissione completa del sistema. Prodotti e/o versioni affette Gladinet CentreStack versioni precedenti alla 16.12.10420.56791 Triofox versioni precedenti alla 16.12.10420.56791 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili e di applicare le misure di mitigazione seguendo le indicazioni dei bollettini di sicurezza disponibili nella sezione Riferimenti. https://www.centrestack.com/p/gce_latest_release.html https://access.triofox.com/releases_history/ https://support.centrestack.com/hc/en-us/articles/360007159054-Hardening-the-CentreStack-Cluster https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability

Huntress warns of a new wave of attacks targeting Gladinet CentreStack instances to retrieve cryptographic keys and achieve remote code execution. As part of the attacks, hackers have exploited a new vulnerability in the mobile access and secure sharing solution, the cybersecurity firm says. The exploited bug, Huntress says, is an insecure cryptography issue that allows attackers to access the ‘web. config’ file, which contains a ‘machineKey’ cryptographic key. Huntress’s analysis of the attacks revealed that the hackers have been abusing the fact that CentreStack relies on the same two 100-byte strings to derive the cryptographic keys. According to the cybersecurity firm, an attacker that can retrieve this cryptographic information can also use it for future encryption/decryption operations, thus compromising the instance. “Because these keys never change, we could extract them from memory once and use them to decrypt any ticket generated by the server or worse, encrypt our own,” Huntress notes. Using the two strings, any attacker could craft requests to obtain the machine keys from the ‘web. config’ file, and the system would trust those requests. Next, armed with the machine keys, the attacker can abuse the ASPX ViewState mechanism in deserialization attacks by forging ViewState payloads and achieving remote code execution. The ViewState deserialization issue has been exploited this year in attacks targeting two other CentreStack vulnerabilities, namely CVE-2025-30406 and CVE-2025-11371. Huntress also discovered that the attackers crafted their malicious requests to create a ticket that never expires, which essentially allows them to reuse the same URL indefinitely to retrieve the configuration file. “As of December 10, we have seen nine organizations that have been impacted by this vulnerability. These businesses ranged across different sectors, from healthcare to technology,” Huntress notes. No CVE identifier has been published for the flaw and Gladinet has not shared details on it. However, the company notified its customers in late November of a security issue resolved with a new CentreStack update (version 16.11.10417.56762). Organizations are advised to update to the latest version of CentreStack and Triofox, namely version 16.12.10420.56791, which was released on December 10, and to review the indicators of compromise (IoCs) released by Huntress and Gladinet. Related: Recent GeoServer Vulnerability Exploited in Attacks Related: Unpatched Gogs Zero-Day Exploited for Months Related: Critical King Addons Vulnerability Exploited to Hack WordPress Sites Related: Microsoft Silently Mitigated Exploited LNK Vulnerability

Hackers are exploiting a new, undocumented vulnerability in the implementation of the cryptographic algorithm present in Gladinet's CentreStack and Triofox products for secure remote file access and sharing. By leveraging the security issue, the attackers can obtain hardcoded cryptographic keys and achieve remote code execution, researchers warn. Although the new cryptographic vulnerability does not have an official identifier, Gladinet notified customers about it and advised them to update the products to the latest version, which, at the time of the communication, had been released on November 29. The company also provided customers with a set of indicators of compromise (IoCs), indicating that the issue was being exploited in the wild. Security researchers at managed cybersecurity platform Huntress are aware of at least nine organizations targeted in attacks leveraging the new vulnerability along with an older one tracked as CVE-2025-30406 - a local file inclusion flaw that allows a local attacker to access system files without authentication. Hardcoded cryptographic keys Using the IoCs from Gladinet, Huntress researchers were able to determine where the flaw was and how threat actors are leveraging it. Huntress found that the issue stems from the custom implementation of the AES cryptographic algorithm in Gladinet CentreStack and Triofox, where the encryption key and Initialization Vector (IV) were hardcoded inside the GladCtrl64.dll file and could be easily obtained. Specifically, the key values were derived from two static 100-byte strings of Chinese and Japanese text, which were identical across all product installations. The flaw lies in the processing of the ‘filesvr.dn’ handler, which decrypts the ‘t’ parameter (Access Ticket) using those static keys, Huntress explains. Anyone extracting those keys could decrypt the Access Tickets containing file paths, usernames, passwords, and timestamps, or create their own to impersonate users and instruct servers to return any file on the disk. “Because these keys never change, we could extract them from memory once and use them to decrypt any ticket generated by the server or worse, encrypt our own,” the researchers say. Huntress observed that Access Tickets were forged using hardcoded AES keys and setting the timestamp to year 9999, so the ticket never expires. The attackers next requested the server’s web.config file. Since it contains the machineKey, they were able to use it to trigger remote code execution through a ViewState deserialization flaw. Besides an attacking IP address, 147.124.216[.]205, no specific attribution has been made for those attacks. Regarding the targets, Huntress confirmed nine organizations as of December 10, from various sectors, including healthcare and technology. Users of Gladinet CentreStack and Triofox are recommended to upgrade to version 16.12.10420.56791 (released on December 8) as soon as possible and also rotate the machine keys. Additionally, it is recommended to scan logs for the ‘vghpI7EToZUDIZDdprSubL3mTZ2’ string, which is associated with the encrypted file path, and is considered the only reliable indicator of compromise. Huntress provides mitigation guidance in its report, along with indicators of compromise that defenders can use to protect their environments or determine if they were breached. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Week in review: Windows kernel flaw patched, suspected Fortinet FortiWeb zero-day exploited Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Adopting a counterintelligence mindset in luxury logistics In this Help Net Security interview, Andrea Succi, Group CISO at Ferrari Group, discusses how cybersecurity is integrated into every aspect of the logistics industry. He explains why protecting data can be as critical as securing physical assets and how a layered defense approach helps safeguard both. Succi adds that awareness, collaboration, and resilience keep client trust and operations consistent. Wi-Fi signals may hold the key to touchless access control Imagine walking into a secure building where the door unlocks the moment your hand hovers near it. No keycards, no PINs, no fingerprints. Instead, the system identifies you by the way your palm distorts the surrounding Wi-Fi signal. That is the idea behind a new study from researchers at the Aeronautics Institute of Technology (ITA) in Brazil. To get funding, CISOs are mastering the language of money In this Help Net Security interview, Chris Wheeler, CISO at Resilience, talks about how CISOs are managing changing cybersecurity budgets. While overall spending is up, many say the increases don’t match their most pressing needs. Wheeler explains how organizations are reallocating funds, measuring ROI, and linking cybersecurity plans to business goals. When every day is threat assessment day In this Help Net Security interview, Paul J. Mocarski, VP & CISO at Sammons Financial Group, discusses how insurance carriers are adapting their cybersecurity strategies. He explains how ongoing threat assessments, AI-driven automation, and third-party risk management help maintain readiness. Healthcare security is broken because its systems can’t talk to each other In this Help Net Security interview, Cameron Kracke, CISO at Prime Therapeutics, discusses how the healthcare ecosystem can achieve cohesive security visibility. With hospitals, clinics, telehealth, and cloud partners all in the mix, maintaining visibility remains a complex task. Kracke shares how interoperability, collaboration, and strategic investment can strengthen resilience across the healthcare security landscape. Why your security strategy is failing before it even starts In this Help Net Security interview, Adnan Ahmed, CISO at Ornua, discusses how organizations can build a cybersecurity strategy that aligns with business goals. He explains why many companies stumble by focusing on technology before understanding risk and shares how embedding cybersecurity across the business helps build resilience. Attackers exploited another Gladinet Triofox vulnerability (CVE-2025-12480) Attackers have exploited yet another vulnerability (CVE-2025-12480) in the Gladinet Triofox secure file sharing and remote access platform, Mandiant revealed on Monday. CISA: Patch Samsung flaw exploited to deliver spyware (CVE-2025-21042) CISA has added CVE-2025-21042, a vulnerability affecting Samsung mobile devices, to its Known Exploited Vulnerabilities (KEV) catalog, and has ordered US federal civilian agencies to address it by the start of December. Patch Tuesday: Microsoft fixes actively exploited Windows kernel vulnerability (CVE-2025-62215) Microsoft has delivered a rather light load of patches for November 2025 Patch Tuesday: some 60+ vulnerabilities have received a fix, among them an actively exploited Windows Kernel flaw (CVE-2025-62215). UK’s new Cyber Security and Resilience Bill targets weak links in critical services The UK government has introduced the Cyber Security and Resilience Bill, a major piece of legislation designed to boost the country’s protection against cyber threats. The new law aims to strengthen the digital defenses of essential public services and update the ageing Network and Information Systems (NIS) Regulations 2018, the UK’s only cross-sector cyber security law. Rhadamanthys infostealer operation disrupted by law enforcement The rumors were true: Operation Endgame, a joint effort between law enforcement and judicial authorities of several European countries, Australia, Canada, the UK and the US, has disrupted the infrastructure supporting the operation of the Rhadamanthys infostealer. “Patched” but still exposed: US federal agencies must remediate Cisco flaws (again) CISA has ordered US federal agencies to fully address two actively exploited vulnerabilities (CVE-2025-20333, CVE-2025-20362) in Cisco Adaptive Security Appliances (ASA) and Firepower firewalls. Fake spam filter alerts are hitting inboxes A new phishing campaign is attempting to trick users into believing they’ve missed important emails, security researchers are warning. The bogus email alerts look like they are coming from the recipient’s email domain, and falsely claim that due to a “Secure Message system” upgrade, important messages have been blocked. A suspected Fortinet FortiWeb zero-day is actively exploited, researchers warn A suspected (but currently unidentified) zero-day vulnerability in Fortinet FortiWeb is being exploited by unauthenticated attackers to create new admin accounts on vulnerable, internet-facing devices. Chinese cyber spies used Claude AI to automate 90% of their attack campaign, Anthropic claims “Analysis of operational tempo, request volumes, and activity patterns confirms the AI executed approximately 80 to 90 percent of all tactical work independently, with humans serving in strategic supervisory roles,” Anthropic said. Shadow AI risk: Navigating the growing threat of ungoverned AI adoption AI is transforming how businesses operate, but it’s also creating new, often hidden risks. As employees and business units eagerly embrace and experiment with AI solutions, many organizations are losing control over where and how AI is being used. A new threat is emerging: shadow AI. This unsanctioned use of AI tools without oversight from IT or security teams has quickly become a top concern for CISOs. How to adopt AI security tools without losing control In this Help Net Security video, Josh Harguess, CTO of Fire Mountain Labs, explains how to evaluate, deploy, and govern AI-driven security tools. He talks about the growing role of AI in security operations and the new kinds of risks it brings. sqlmap: Open-source SQL injection and database takeover tool Finding and exploiting SQL injection vulnerabilities is one of the oldest and most common steps in web application testing. sqlmap streamlines this process. It is an open-source penetration testing tool that automates the detection and exploitation of SQL injection flaws and can take over database servers when configured to do so. CISOs are cracking under pressure Cybersecurity leaders are hitting their limit. A new report from Nagomi Security shows that most CISOs are stretched thin, dealing with nonstop incidents, too many tools, and growing pressure from their boards. The pressures are so intense that many say they are burned out and thinking about walking away. How far can police push privacy before it breaks Police use drones, body cameras, and license plate readers as part of their daily work. Supporters say these tools make communities safer. Critics see something different, a system that collects too much data and opens the door to abuse. When surveillance expands without public oversight, civil liberties start to slip away, especially for people who already face bias and discrimination. ProxyBridge: Open-source proxy routing for Windows applications ProxyBridge is a lightweight, open-source tool that lets Windows users route network traffic from specific applications through SOCKS5 or HTTP proxies. It can redirect both TCP and UDP traffic and gives users the option to route, block, or allow connections on a per-application basis. Autonomous AI could challenge how we define criminal behavior Whether we ever build AI that thinks like a person is still uncertain. What seems more realistic is a future with more independent machines. These systems already work across many industries and digital environments. Alongside human-to-human and human-to-machine contact, communication between machines is growing fast. Criminology should start to look at what this shift means for crime and social control. Google adds Emerging Threats Center to speed detection and response When a new vulnerability hits the news, security teams often scramble to find out if they are at risk. The process of answering that question can take days or weeks, involving manual research, rule-writing, and testing. Google Security Operations wants to close that window with its new Emerging Threats Center, designed to help teams understand their exposure and detection coverage in near real time. Sprout: Open-source bootloader built for speed and security Sprout is an open-source bootloader that delivers sub-second boot times and uses a clean, data-driven configuration format that works across operating systems. Wanna bet? Scammers are playing the odds better than you are Placing a bet has never been this easy, and that’s the problem. The convenience of online gambling is the same thing scammers are cashing in on. Whether it’s a fake app, a “can’t-miss” tipster, or a rigged casino, the game is stacked against you. Los Alamos researchers warn AI may upend national security For decades, the United States has built its defense posture around predictable timelines for technological progress. That assumption no longer holds, according to researchers at Los Alamos National Laboratory. Their paper argues that AI is advancing so quickly that the current defense system cannot adapt in time. Protecting mobile privacy in real time with predictive adversarial defense Mobile sensors are everywhere, quietly recording how users move, tilt, or hold their phones. The same data that powers step counters and activity trackers can also expose personal details such as gender, age, or even identity. A new study introduces a method designed to stop that information from being inferred in the first place, without interrupting the phone’s normal functions. AI is rewriting how software is built and secured AI has become part of everyday software development, shaping how code is written and how fast products reach users. A new report from Cycode, The 2026 State of Product Security for the AI Era, explores how deeply AI now runs through development pipelines and how security teams are trying to manage the risks that come with it. Hidden risks in the financial sector’s supply chain When a cyber attack hits a major bank or trading platform, attention usually turns to the institution. But new research suggests the real danger may lie elsewhere. BitSight researchers found that many of the technology providers serving the financial sector have weaker cybersecurity performance than the institutions they support. GNU Coreutils 9.9 brings fixes and updates across essential tools GNU Coreutils is the backbone of many enterprise Linux environments. It provides the basic file, shell, and text utilities that every GNU-based system depends on. The latest release, version 9.9, refines these tools with fixes and performance improvements. What the latest data reveals about hard drive reliability What really counts as a hard drive failure? That’s the question at the center of Backblaze’s Q3 2025 Drive Stats report, which tracks the performance of 328,348 hard drives across its global data centers. The latest findings build on more than a decade of data that has made Backblaze one of the most transparent sources on drive reliability for IT teams, researchers, and data professionals. AI is forcing boards to rethink how they govern security Boards are spending more time on cybersecurity but still struggle to show how investments improve business performance. The focus has shifted from whether to fund protection to how to measure its return and ensure it supports growth. The browser is eating your security stack Employees log into SaaS platforms, upload files, use AI tools, and manage customer data from a single tab. While the browser has become the enterprise’s main workspace, it remains largely outside the reach of security controls. According to the 2025 Browser Security Report by LayerX, that blind spot has turned into a major risk surface for data loss, identity theft, and AI misuse. Automation can’t fix broken security basics Most enterprises continue to fall short on basic practices such as patching, access control, and vendor oversight, according to Swimlane’s Cracks in the Foundation: Why Basic Security Still Fails report. Leadership often focuses on broad resilience goals while the day-to-day work that supports them remains inconsistent and underfunded. What happens when employees take control of AI Executives may debate AI strategy, but many of the advances are happening at the employee level. A recent Moveworks study shows that AI adoption is being led from the ground up, with employees, not senior leaders, driving the change. Download: Strengthening Identity Security whitepaper Identity threats are escalating. Attackers increasingly exploit compromised credentials, often undetected by organizations, and use social engineering to gain access. Most companies lack visibility into service account activity and don’t have the tools to detect identity-led threats. Cybersecurity jobs available right now: November 11, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: November 14, 2025 Here’s a look at the most interesting products from the past week, featuring releases from Action1, Avast, Cyware, Firewalla, and Nokod Security.

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

“Patched” but still exposed: US federal agencies must remediate Cisco flaws (again) CISA has ordered US federal agencies to fully address two actively exploited vulnerabilities (CVE-2025-20333, CVE-2025-20362) in Cisco Adaptive Security Appliances (ASA) and Firepower firewalls. “In CISA’s analysis of agency-reported data, CISA has identified devices marked as ‘patched’ in the reporting template, but which were updated to a version of the software that is still vulnerable to the threat activity outlined in [Emergency Directive 25-03, released on September 25, 2025],” the agency stated on Wednesday. “CISA is tracking active exploitation of these vulnerable versions in [Federal Civilian Executive Branch] agencies. For agencies with ASA or Firepower devices not yet updated to the necessary software versions or devices that were updated after September 26, 2025, CISA recommends additional actions to mitigate against ongoing and new threat activity.” Last week, Cisco updated the two vulnerabilities’ advisories to say that they became aware of a new attack variant leveraging them. CVE-2025-20333 and CVE-2025-20362 CVE-2025-20333, which allows for remote code execution, and CVE-2025-20362, which makes privilege escalation possible, have been spotted being exploited as zero-days earlier this year. In late September, CISA and several other cybersecurity agencies warned about the attacks and attributed them to a state-sponsored threat actor that perpetrated the ArcaneDoor attack campaign in 2023 and 2024. Those attacks also involved the use of zero-day flaws. The threat actor used custom malware to disable logging and prevent the creation of a crash dump, and modified the ROMMON program that runs before the ASA operating system to assure the persistence of a custom backdoor they installed. Completing the vulnerabilities’ mitigation The Shadowserver Foundation noted in early October that despite repeated warnings, they could still detect around 48,000 unpatched internet-facing appliances, predominantly in the US. That number has since fallen to a little over 32,000. All ASA and Firepower devices, not just those that are public-facing, have to be updated to a firmware version that fixes both, CISA pointed out. Legacy/unsupported devices must be decommissioned and swapped with newer, up-to-date ones. “If CISA has identified an agency with this issue, we will follow up to confirm that these actions have been taken,” the agency added. The new guidance lists firmware versions required to mitigate both vulnerabilities. CISA has also added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on the same day and directed US FCEB agencies to address them by December 3, 2025. Those include: CVE-2025-12480, affecting the Gladinet Triofox secure file sharing and remote access platform CVE-2025-62215, the Windows Kernel fixed by Microsoft this Patch Tuesday, and CVE-2025-9242, a critical pre-auth RCE flaw in WatchGuard’s Firebox network security appliances that’s been patched in September and confirmed to be under active exploitation on October 21. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Gladinet: rilevato sfruttamento in rete della CVE-2025-12480 Alert AL07/251113/CSIRT-ITA Sintesi Ricercatori di sicurezza hanno rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2025-12480 che interessa il prodotto Gladinet TrioFox, soluzione di accesso remoto sicuro ai file server aziendali, progettate per modernizzare la gestione dei file senza richiedere la migrazione al cloud. Tipologia Security Restrictions Bypass Descrizione e potenziali impatti Ricercatori di sicurezza hanno rilevato lo sfruttamento della vulnerabilità CVE-2025-12480 che interessa il prodotto Gladinet TrioFox, soluzione di accesso remoto sicuro ai file server aziendali. Tale vulnerabilità – di tipo “Improper Access Control” e con score CVSS v3.1 pari a 9.1, potrebbe permettere ad un utente malintenzionato e non autenticato di accedere alle pagine di setup dei sistemi interessati. In particolare, nelle versioni di Triofox vulnerabili alla CVE-2025-12480, dopo la configurazione iniziale il software non disabilita l’endpoint di setup permettendo di accedere alla pagina di (/setup/) anche dopo la procedura di setup iniziale. Prodotti e/o versioni affette Gladinet TrioFox, versioni precedenti alla 16.7.10368.56560 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza disponibili nella sezione Riferimenti.

Attackers exploited another Gladinet Triofox vulnerability (CVE-2025-12480) Attackers have exploited yet another vulnerability (CVE-2025-12480) in the Gladinet Triofox secure file sharing and remote access platform, Mandiant revealed on Monday. CVE-2025-12480 exploitation and attack details Gladinet’s Triofox solution is used by medium and large businesses to securely share files and allow users to access them without a VPN. CVE-2025-12480 is an Improper Access Control flaw allowing unauthenticated attackers to access the solution’s configuration/setup page. According to Mandiant’s threat analysts, as early as August 24, 2025, a threat cluster they track as UNC6485 exploited CVE-2025-12480 by conducting an HTTP Host header attack. They set the Host value to localhost, which allowed them to bypass access controls on the configuration page, and used the page to run the initial Triofox setup process to create a new native administration account (“Cluster Admin”). This account was then used to upload malicious files and execute them by leveraging the built-in antivirus feature. “The executed payload was a legitimate copy of the Zoho Unified Endpoint Management System (UEMS) software installer. The attacker used the UEMS agent to then deploy the Zoho Assist and Anydesk remote access utilities on the host,” the threat analysts explained. “The attacker used Zoho Assist to run various commands to enumerate active SMB sessions and specific local and domain user information. Additionally, they attempted to change passwords for existing accounts and add the accounts to the local administrators and the ‘Domain Admins’ group.” The attackers’ post-exploitation activity (Source: Mandiant/Google Cloud) Attackers are having a field day with Gladinet zero-day and n-day vulnerabilities The attackers exploited CVE-2025-12480 on a server running Triofox v16.4.10317.56372, which was released in April 2025 to fix CVE-2025-30406, a deserialization vulnerability affecting Triofox and Gladinet’s MSP-friendly file sharing platform CentreStack. According to its NVD entry, CVE-2025-30406 was exploited as a zero-day beginning in March 2025. By April, Huntress had identified multiple successful attacks, and noted that similarities in the attackers’ tradecraft suggested the same group was also behind the exploitation of a CrushFTP vulnerability (CVE-2025-31161) around the same period. In October 2025, Huntress researchers raised the alarm once again: an unauthenticated Local File Inclusion zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and Triofox was being exploited by attackers in the wild. The vulnerability was fixed in CentreStack and Triofox v16.10.10408.56683, released on October 14. Organizations using either of the two solution are advised to upgrade to the latest available release. Mandiant’s threat analysts also recommend: Auditing admin accounts Verifying that Triofox’s Anti-virus Engine is not configured to execute unauthorized scripts or binaries Checking for the presence of attacker tools and indicators of compromise (which they shared) Monitoring for anomalous outbound SSH traffic. UPDATE (November 12, 2025, 08:05 a.m. ET): The headline and the text of this article has been amended to clear up that CVE-2025-12480 had already been patched (in Triofox v16.7.10368.56560, released on July 26, 2025) when Mandiant’s incident responders spotted it being leveraged by attackers. CVE-2025-12480 was, therefore, not a zero-day vulnerability at the time (as initially stated by Help Net Security). In related news, Rapid7 researchers have also analyzed CVE-2025-12480 in the context of Gladinet’s CentreStack solution, and found that it was also affected and received a patch in v16.7.10368.56560. “In addition to demonstrating the vulnerability against CentreStack, our analysis also shows an alternative exploitation strategy to achieve RCE, compared to the exploitation strategy detailed in the Mandiant report,” they said. “The exploitation strategy detailed in this analysis is premised on the access control bypass vulnerability CVE-2025-12480, that leads to administrator account takeover. From there an attacker can reconfigure the servers local storage and perform an arbitrary file read, leaking the unique cryptographic keys used to sign .NET ViewState payloads. After leaking the cryptographic keys, the attacker can achieve arbitrary code execution via .NET deserialization.” Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Week in review: Cisco fixes critical UCCX flaws, November 2025 Patch Tuesday forecast Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Securing real-time payments without slowing them down In this Help Net Security interview, Arun Singh, CISO at Tyro, discusses what it takes to secure real-time payments without slowing them down. He explains how analytics, authentication, and better industry cooperation can help stay ahead of fraud. Singh also touches on how digital identity and accountability are transforming how trust is built in payments. Heisenberg: Open-source software supply chain health check tool Heisenberg is an open-source tool that checks the health of a software supply chain. It analyzes dependencies using data from deps.dev, Software Bills of Materials (SBOMs), and external advisories to measure package health, detect risks, and generate reports for individual dependencies or entire projects. A new way to think about zero trust for workloads Static credentials have been a weak point in cloud security for years. A new paper by researchers from SentinelOne takes direct aim at that issue with a practical model for authenticating workloads without long-lived secrets. Instead of relying on static keys, the team proposes using temporary, verifiable tokens that expire within minutes. How nations build and defend their cyberspace capabilities In this Help Net Security interview, Dr. Bernhards Blumbergs, Lead Cyber Security Expert at CERT.LV, discusses how cyberspace has become an integral part of national and military operations. He explains how countries develop capabilities to act and defend in this domain, often in coordination with activities in other areas of conflict. AI can flag the risk, but only humans can close the loop In this Help Net Security interview, Dilek Çilingir, Global Forensic & Integrity Services Leader at EY, discusses how AI is transforming third-party assessments and due diligence. She explains how machine learning and behavioral analytics help organizations detect risks earlier, improve compliance, and strengthen accountability. PortGPT: How researchers taught an AI to backport security patches automatically Keeping older software versions secure often means backporting patches from newer releases. It is a routine but tedious job, especially for large open-source projects such as the Linux kernel. A new research effort has built a tool that uses a large language model to do that work automatically. OpenGuardrails: A new open-source model aims to make AI safer for real-world use When you ask a large language model to summarize a policy or write code, you probably assume it will behave safely. But what happens when someone tries to trick it into leaking data or generating harmful content? That question is driving a wave of research into AI guardrails, and a new open-source project called OpenGuardrails is taking a bold step in that direction. What keeps phishing training from fading over time When employees stop falling for phishing emails, it is rarely luck. A new study shows that steady, mandatory phishing training can cut risky behavior over time. After one year of continuous simulations and follow-up lessons, employees were half as likely to take the bait. Metrics don’t lie, but they can be misleading when they only tell IT’s side of the story In this Help Net Security interview, Rik Mistry, Managing Partner at Interval Group, discusses how to align IT strategy with business goals. He explains how security, governance, and orchestration shape IT operations and why early collaboration between IT and security leaders leads to better outcomes. Mistry also shares his perspective on automation and emerging technologies. Cyber-espionage campaign mirroring Sandworm TTPs hit Russian and Belarusian military A spear-phishing campaign aimed to compromise Russian and Belarusian military personnel by using military-themed documents as a lure has been flagged by Cyble and Seqrite security researchers. The goal of the campaign is to get targets to download and open a booby-trapped LNK file masquerading as a PDF, ultimately leading to a complete system compromise. Former ransomware negotiators allegedly targeted US firms with ALPHV/BlackCat ransomware A ransomware negotiator and an incident response manager have been indicted in Florida for allegedly conspiring to deploy the ALPHV/BlackCat ransomware against multiple US companies and extorting nearly $1.3 million from one of the victims. Cybercriminals exploit RMM tools to steal real-world cargo Cybercriminals are compromising logistics and trucking companies by tricking them into installing remote monitoring and management (RMM) tools, Proofpoint researchers warned. Critical Control Web Panel vulnerability is actively exploited (CVE-2025-48703) On Tuesday, CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2025-11371, which affects Gladinet’s CentreStack and Triofox file-sharing and remote access platforms, and CVE-2025-48703, a vulnerability in Control Web Panel (CWP), a web hosting control panel designed for managing servers running CentOS or CentOS-based distributions. Google uncovers malware using LLMs to operate and evade detection PromptLock, the AI-powered proof-of-concept ransomware developed by researchers at NYU Tandon and initially mistaken for an active threat by ESET, is no longer an isolated example: Google’s latest report shows attackers are now creating and deploying other malware that leverages LLMs to operate and evade security systems. SonicWall cloud backup hack was the work of a state actor Incident responders from Mandiant have wrapped up their investigation into the SonicWall cloud backup service hack, and the verdict is in: the culprit is a state-sponsored threat actor (though the specific nation wasn’t disclosed). Cisco fixes critical UCCX flaws, patch ASAP! (CVE-2025-20358, CVE-2025-20354) Cisco has fixed two critical vulnerabilities (CVE-2025-20358, CVE-2025-20354) affecting Unified Contact Center Express (UCCX), which may allow attackers to bypass authentication, compromise vulnerable installations, and elevate privileges to root. Attackers upgrade ClickFix with tricks used by online stores Attackers have taken the ClickFix technique further, with pages borrowing tricks from online sellers to pressure victims into performing the steps that will lead to a malware infection. Uncovering the risks of unmanaged identities Every organization manages thousands of identities, from admins and developers to service accounts and AI agents. But many of these identities operate in the shadows, untracked and unprotected. These unmanaged identities quietly expand your attack surface, weaken compliance, and threaten business continuity, posing significant risk. So, how can you uncover, secure, and manage what you can’t see? November 2025 Patch Tuesday forecast: Windows Exchange Server EOL? October 2025 Patch Tuesday was one for the record books in so many ways. There was a big push by Microsoft to fix as many open vulnerabilities as possible in products that were reaching end-of-life (EOL). This included 116 CVEs addressed in Windows 10 and an astronomical 134 CVEs addressed in Windows 11, because don’t forget Windows 11 22H2 Enterprise and Education editions also reached EOL. Cybercriminals have built a business on YouTube’s blind spots The days when YouTube was just a place for funny clips and music videos are behind us. With 2.53 billion active users, it has become a space where entertainment, information, and deception coexist. European authorities dismantle €600 million crypto scam network Nine people have been arrested in a coordinated international operation targeting a large cryptocurrency money laundering network that defrauded victims of more than €600 million. The operation was led by Eurojust, the EU’s judicial cooperation agency, which brought together investigators and prosecutors from France, Belgium, Cyprus, Spain and Germany. Connected homes: Is bystander privacy anyone’s responsibility? Smart doorbells, connected cameras, and home monitoring systems have become common sights on doorsteps and living rooms. They promise safety and convenience, but they also raise a problem. These devices record more than their owners. They capture neighbors, visitors, and anyone passing by. 18 arrested in €300 million global credit card fraud scheme A coordinated international operation has led to 18 arrests in a massive credit card fraud case worth at least €300 million. The effort, led by Eurojust, targeted a network of suspects accused of running fake online subscription services for dating, pornography, and streaming sites. Among those detained were five executives from four German payment service providers. Enterprises are losing track of the devices inside their networks Security teams are often surprised when they discover the range and number of devices connected to their networks. The total goes far beyond what appears in agent-based telemetry or old manual asset inventories. Deepfakes, fraud, and the fight for trust online In this Help Net Security video, Michael Engle, Chief Strategy Officer at 1Kosmos, explains how deepfakes are changing online identity verification. He describes how fake IDs and synthetic identities are being used for account signups and takeovers. What shadow AI means for your company’s security In this Help Net Security video, Peled Eldan, Head of Research at XM Cyber, explains the hidden risks of shadow AI. He describes how employees often use unapproved AI tools at work to save time or solve problems, even when approved tools are available. This behavior, though common, can lead to serious issues such as data leaks, compliance violations, and security blind spots. Europe’s phone networks are drowning in fake calls Caller ID spoofing has become one of Europe’s most persistent enablers of cyber fraud. A new position paper from Europol warns that manipulated phone identities now drive much of the continent’s financial and social engineering crime, making it difficult for law enforcement to track perpetrators. The agency estimates global losses at around EUR 850 million a year, with phone and text-based fraud accounting for roughly two thirds of reported scam cases. Employees keep finding new ways around company access controls AI, SaaS, and personal devices are changing how people get work done, but the tools that protect company systems have not kept up, according to 1Password. Tools like SSO, MDM, and IAM no longer align with how employees and AI agents access data. Financial services can’t shake security debt In financial services, application security risk is becoming a long game. Fewer flaws appear in new code, but old ones linger longer, creating a kind of software “interest” that keeps growing, according to Veracode’s 2025 State of Software Security report. Google says 2026 will be the year AI supercharges cybercrime Security leaders are staring down a year of major change. In its Cybersecurity Forecast 2026, Google paints a picture of a threat landscape transformed by AI, supercharged cybercrime, and increasingly aggressive nation-state operations. Attackers are moving faster, scaling their operations with automation. VulnRisk: Open-source vulnerability risk assessment platform VulnRisk is an open-source platform for vulnerability risk assessment. It goes beyond basic CVSS scoring by adding context-aware analysis that reduces noise and highlights what matters. The tool is free to use and designed for local development and testing. Retailers are learning to say no to ransom demands Ransomware remains one of the biggest operational risks for retailers, but the latest data shows a shift in how these attacks unfold. Fewer incidents now lead to data encryption, recovery costs have dropped, and businesses are bouncing back faster. Yet attackers are demanding more money, and security teams are feeling the strain. Humans built the problem, AI just scaled it Information moves across cloud platforms, personal devices, and AI tools, often faster than security teams can track it. Proofpoint’s 2025 Data Security Landscape report shows that most organizations faced data loss last year, usually caused by their own people. With AI agents part of daily operations, security leaders are confronting risks that come from users and from the systems acting on their behalf. Russia-linked hackers intensify attacks as global APT activity shifts State-aligned hacking groups have spent the past six months ramping up espionage, sabotage, and cybercrime campaigns across multiple regions, according to ESET’s APT Activity Report covering April through September 2025. The research highlights how operations linked to Russia, China, Iran, and North Korea have evolved in scope and technique, showing that nation-state activity remains a constant source of disruption. Hospitals are running out of excuses for weak cyber hygiene Healthcare leaders continue to treat cybersecurity as a technical safeguard instead of a strategic business function, according to the 2025 US Healthcare Cyber Resilience Survey by EY. The study, based on responses from 100 healthcare executives, outlines six areas where hospitals and health systems must act to close resilience gaps that threaten patient care and operations. Old privacy laws create new risks for businesses Businesses are increasingly being pulled into lawsuits over how they collect and share user data online. What was once the domain of large tech firms is now a widespread legal risk for companies of all sizes. The latest analysis from cyber insurer Coalition shows that outdated privacy laws are driving a surge in web privacy claims, with small and midsize businesses now common targets. Product showcase: Cogent Community democratizes vulnerability intelligence with agentic AI Teams are buried under overlapping feeds, inconsistent formats, and fragmented context. Even with advanced tools, analyzing raw intelligence into prioritized, evidence-based action remains one of the hardest problems in modern security operations. Cogent Security addresses this problem head-on with its industry-first AI taskforce for vulnerability management. And with its newly introduced Cogent Community, the company is now delivering an open-access, free-to-use tool that helps security teams operationalize vulnerability intelligence. Cybersecurity jobs available right now: November 4, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: November 7, 2025 Here’s a look at the most interesting products from the past week, featuring releases from 1touch.io, Barracuda Networks, Bitdefender, Forescout, and Komodor.

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning that threat actors are exploiting a critical remote command execution flaw in CentOS Web Panel (CWP). The agency has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and is giving federal entities subject to the BOD 22-01 guidance until November 25 to apply available security updates and vendor-provided mitigations, or stop using the product. Tracked as CVE-2025-48703, the security issue allows remote, unauthenticated attackers with knowledge of a valid username on a CWP instance to execute arbitrary shell commands as that user. CWP is a free web hosting control panel used for Linux server management, marketed as an open-source alternative to commercial panels like cPanel and Plesk. It is widely used by web hosting providers, system administrators, and VPS or dedicated server operators. The issue impacts all CWP versions before 0.9.8.1204 and was demonstrated on CentOS 7 in late June by Fenrisk security researcher Maxime Rinaudo. In a detailed technical write-up, the researcher explains that the root cause of the flaw is the file-manager ‘changePerm’ endpoint processing requests even when the per-user identifier is omitted, allowing unauthenticated requests to reach code that expects a logged-in user. Furthermore, the ‘t_total’ parameter, which works as a file permission mode in the chmod system command, is passed unsanitized into a shell command, allowing shell injection and arbitrary command execution. In Rinaudo's exploit, a POST request to the file-manager changePerm endpoint with a crafted t_total injects a shell command and spawns a reverse shell as the target user. The researcher reported the flaw to CWP on May 13, and a fix was released on June 18, in version 0.9.8.1205 of the product. Yesterday, CISA added the flaw to the KEV catalog without sharing any details about how it is being exploited, the targets, or the origin of the malicious activity. The agency also added to the catalog CVE-2025-11371, a local file inclusion flaw in Gladinet CentreStack and Triofox products, and gave the same November 25 deadline to federal agencies to patch or stop using the product. That flaw was marked as an actively exploited zero-day by Huntress on October 10, and the vendor patched it four days later, in version 16.10.10408.56683. Even if CISA's KEV is aimed at federal agencies in the U.S., any organization should monitor it and prioritize dealing with the vulnerabilities it includes. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Critical Control Web Panel vulnerability is actively exploited (CVE-2025-48703) On Tuesday, CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2025-11371, which affects Gladinet’s CentreStack and Triofox file-sharing and remote access platforms, and CVE-2025-48703, a vulnerability in Control Web Panel (CWP), a web hosting control panel designed for managing servers running CentOS or CentOS-based distributions. While active exploitation of CVE-2025-11371 has been reported on since early October 2025, exploitation attempts involving CVE-2025-48703, though detected by cybersecurity professionals, have so far been less widespread (or observed). What is Control Web Panel (CWP)? CWP is server management software that runs on CentOS (whos development was discontinued in late 2020) and its community-driven successors, Rocky Linux and AlmaLinux. CWP users can opt for the free version what offers core features for single-server management, and a (paid) Pro version with better security, automatic updates, and improved support. The software is popular with virtual private server (VPS) and dedicated server operators and is used to manage services like web servers, databases, email servers, DNS, as well as security features. About CVE-2025-48703 CVE-2025-48703 is a critical OS Command Injection flaw that “allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request.” The vulnerability’s current CVSS string indicates that it’s exploitable remotely over a network, without prior authentication or user interaction, but also that it’s not trivially exploitable. Maxime Rinaudo, co-founder of penetration testing firm Fenrisk, explained that attackers must know or guess a valid non-root username to bypass authentication requirements before exploiting CVE-2025-48703. The bad news is that such usernames are often predictable. CVE-2025-48703 is triggered by sending a HTTPS request with a specially crafted t_total value to the user file manager endpoint (filemanager&acc=changePerm), and allows attackers to run commands as that local user. Thus, an attacker can drop web shells, create persistence, pivot, or escalate further depending on local misconfigurations. What to do? With Rinaudo’s technical write-up and PoC published in late June 2025 and other PoC exploits appearing on GitHub since, it was only a matter of time until attackers began attempting to exploit the flaw. In July 2025, FindSec researchers noted that “exploits are being actively developed and shared in hacking forums,” and advised organization runing CWP to manage Linux-based web hosting environments to patch quickly. According to Shodan, there are currently over 220,000 internet-facing CWP instances, though it remains unclear how many are still running a vulnerable version. CVE-2025-48703 affects CWP versions before 0.9.8.1205, released in June 2025. Users should: Upgrade to version 0.9.8.1205 or later. Restrict access to port 2083 (the user interface) to trusted IPs. Look for signs of compromise, e.g., unexpected reverse shell connections, suspicious chmod executions in logs, new or modified .bashrc, .ssh, or cron entries, connections to unfamiliar IP addresses, and unknown user accounts. If found, the host should be isolated, logs preserved, and a forensic investigation mounted. Use intrusion detection systems to detect/block exploitation attempts. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two security flaws impacting Gladinet and Control Web Panel (CWP) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerabilities in question are listed below - CVE-2025-11371 (CVSS score: 7.5) - A vulnerability in files or directories accessible to external parties in Gladinet CentreStack and Triofox that could result in unintended disclosure of system files. CVE-2025-48703 (CVSS score: 9.0) - An operating system command injection vulnerability in Control Web Panel (formerly CentOS Web Panel) that results in unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. The development comes weeks after cybersecurity company Huntress said it detected active exploitation attempts targeting CVE-2025-11371, with unknown threat actors leveraging the flaw to run reconnaissance commands (e.g., ipconfig /all) passed in the form of a Base64-encoded payload. However, there are currently no public reports on how CVE-2025-48703 is being weaponized in real-world attacks. However, technical details of the flaw were shared by security researcher Maxime Rinaudo in June 2025, shortly after it was patched in version 0.9.8.1205 following responsible disclosure on May 13. "It allows a remote attacker who knows a valid username on a CWP instance to execute pre-authenticated arbitrary commands on the server," Rinaudo said. In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are required to apply the necessary fixes by November 25, 2025, to secure their networks. The addition of the two flaws to the KEV catalog follows reports from Wordfence about the exploitation of critical security vulnerabilities impacting three WordPress plugins and themes - CVE-2025-11533 (CVSS score: 9.8) - A privilege escalation vulnerability in WP Freeio that makes it possible for an unauthenticated attacker to grant themselves administrative privileges by specifying a user role during registration. CVE-2025-5397 (CVSS score: 9.8) - An authentication bypass vulnerability in Noo JobMonster that makes it possible for unauthenticated attackers to sidestep standard authentication and access administrative user accounts, assuming social login is enabled on a site. CVE-2025-11833 (CVSS score: 9.8) - A lack of authorization checks in Post SMTP that makes it possible for an unauthenticated attacker to view email logs, including password reset emails, and change the password of any user, including an administrator, allowing site takeover. WordPress site users relying on the aforementioned plugins and themes are recommended to update them to the latest version as soon as possible, use strong passwords, and audit the sites for signs of malware or the presence of unexpected accounts.

ConnectWise has rolled out patches for two vulnerabilities in the Automate remote monitoring and management (RMM) tool that could allow attackers to perform man-in-the-middle (MiTM) attacks. Automate is an RMM tool for enterprises and managed service providers (MSPs) that allows organizations to identify, monitor, and manage all connected devices on a network. Last week, ConnectWise released Automate version 2025.9 with patches for CVE-2025-11492 (CVSS score of 9.6), a critical-severity bug that allows attackers to intercept sensitive information that was being transmitted in cleartext. Additionally, the company warned of a high-severity flaw in the RMM software, tracked as CVE-2025-11493 (CVSS score of 8.8), and described as the lack of integrity checks when downloading code. These vulnerabilities, ConnectWise says, “could expose agent communications and updates to interception or tampering if certain configurations are used.” Essentially, because agents deployed on premises may be configured to use HTTP or encryption, an attacker with access to the network could view or modify traffic, the company says. A threat actor performing an MiTM attack could also replace updates with malicious ones, the company warns. “Automate 2025.9 patch enforces HTTPS for all agent communications to mitigate these risks. Partners running on-prem servers should also ensure TLS 1.2 is enforced to maintain secure communications,” ConnectWise says. The company has rated the vulnerabilities as ‘important’, as they could lead to data compromise but require additional access for successful exploitation. However, it has also assigned them a ‘moderate’ priority, which it typically gives to security defects “that are either being targeted or have higher risk of being targeted by exploits in the wild.” All organizations using on-premises ConnectWise Automate deployments are advised to update their installations as soon as possible. Related: Gladinet Patches Exploited CentreStack Vulnerability Related: Vulnerability in Dolby Decoder Can Allow Zero-Click Attacks Related: High-Severity Vulnerabilities Patched by Fortinet and Ivanti

Microsoft’s October Patch Tuesday updates addressed a critical-severity vulnerability in the ASP.NET Core open source web development framework. Tracked as CVE-2025-55315, the flaw has a CVSS score of 9.9, which .NET security program manager Barry Dorrans says was the “highest ever” for an ASP.NET Core issue. The issue is described as an HTTP request smuggling bug that could be used to bypass a security feature over the network. It was discovered in Kestrel, ASP.NET Core’s built-in web server. Essentially, the security defect allows attackers to trigger various application behaviors by hiding an HTTP request in another request. “An attacker who successfully exploited this vulnerability could smuggle another HTTP request and bypass front-end security controls or hijack other users’ credentials,” Microsoft explains. The tech giant says the vulnerability can be exploited to leak sensitive information such as user credentials, tamper with file contents, or cause a denial-of-service (DoS) condition by forcing a crash within the server. “In this case, the vulnerable component and the impacted component are different and managed by different security authorities,” Microsoft notes. According to Dorrans, while the issue was identified in ASP.NET Core, its actual impact differs based on how the applications have been built. Attackers, Dorrans explains, can exploit the flaw to log in as another user, make internal requests, bypass CSRF checks, and perform injection attacks. Software that performs actions involving requests could prove problematic, applications that only append to logs and do not handle authentication may miss log entries, while those performing authentication based on specific rules may be targeted for elevation of privilege. “Thus, we score with the worst possible case in mind, a security feature bypass which changes scope. Is that likely? No, probably not unless your application code is doing something odd and skips a bunch of checks that it ought to be making on every request,” Dorrans says. Microsoft addressed the vulnerability with updates for Microsoft Visual Studio 2022 versions 17.14, 17.12, and 17.10, and for ASP.NET Core versions 2.3, 8.0, 9.0, and 10.0 RC1. It also released Microsoft.AspNetCore.Server.Kestrel.Core version 2.3.6 with fixes for the bug. Related: Gladinet Patches Exploited CentreStack Vulnerability Related: Vulnerabilities Allow Disruption of Phoenix Contact UPS Devices Related: Pixnapping Attack Steals Data From Google, Samsung Android Phones Related: Malicious Code on Unity Website Skims Information From Hundreds of Customers

Gladinet this week released patches for a CentreStack vulnerability that has been exploited in the wild since at least late September. Tracked as CVE-2025-11371, the issue is described as an unauthenticated file inclusion bug that allows attackers to retrieve system files. Impacting the default configurations of Gladinet’s CentreStack and TrioFox products, the security defect was exploited in the wild as a zero-day to retrieve a ‘machineKey’ cryptographic key from a configuration file and execute arbitrary code remotely. To achieve remote code execution, however, the attackers exploited a ViewState deserialization vulnerability, cybersecurity firm Huntress explains. The ViewState deserialization issue was previously abused in attacks exploiting CVE-2025-30406, a critical-severity CentreStack and Triofox flaw rooted in the presence of hardcoded keys in the applications’ configuration files. Armed with a hardcoded machineKey, an attacker could bypass ASPX ViewState protections and execute arbitrary code remotely with the privileges of the IIS application pool user. Successful exploitation of the issue could allow attackers to take full control of a vulnerable system. Gladinet patched CVE-2025-30406 in April by updating one of the configuration files containing the machineKey and removing the key from another. As part of the fresh attacks flagged by Huntress, threat actors are exploiting CVE-2025-11371 to retrieve the configuration file containing the machineKey, which allows them to perform a deserialization attack to execute commands on the vulnerable system. Gladinet resolved the newly discovered vulnerability in CentreStack version 16.10.10408.56683. Given the flaw’s in-the-wild exploitation, organizations and end users are advised to apply the patches as soon as possible. CentreStack is a self-hosted, on-premise cloud file server that provides organizations with secure file sharing capabilities. It can be deployed by MSPs for their clients and integrated with existing infrastructure. Related: Organizations Warned of Exploited Adobe AEM Forms Vulnerability Related: Cisco Routers Hacked for Rootkit Deployment Related: SAP Patches Critical Vulnerabilities in NetWeaver, Print Service, SRM

Gladinet has released security updates for its CentreStack business solution to address a local file inclusion vulnerability (CVE-2025-11371) that threat actors have leveraged as a zero-day since late September. Researchers at cybersecurity platform Huntress disclosed the exploitation activity last week saying that the flaw was a bypass for mitigations Gladinet implemented for the deserialization vulnerability leading to remote code execution (RCE) identified as CVE-2025-30406. The local file inclusion (LFI) vulnerability enabled attackers to read the Web.config file on fully patched CentreStack deployments, extract the machine key, and then use it to exploit CVE-2025-30406. When Huntress alerted of the zero-day attacks Gladinet provided mitigations for customers and was in the process of developing a patch. The security update that addresses CVE-2025-11371 is now available in CentreStack version 16.10.10408.56683 and administrators are strongly recommended to install it. In an update to the original alert, Huntress shares more technical details on CVE-2025-11371 that include a minimal proof-of-concept exploit. The root cause of the LFI issue is a sanitization failure at the temp-download handler, reachable at /storage/t.dn, which accepts an 's=' parameter, leading to directory traversal. At the service runs as NT AUTHORITY\SYSTEM and resolves files relative to the temp folder, the flaw allows attackers to read any file the SYSTEM account can access, including Web.config, which contains the ASP.NET machine key. With this key, attackers can forge a malicious ViewState payload that can be deserialized by the server due to CVE-2025-30406, leading to remote code execution. In the wild, Huntress observed HTTP requests to '/storage/t.dn?s=…' returning Web.config, followed by base64-encoded POST payloads triggering command execution on the targets. Huntress published a one-line PowerShell Invoke-WebRequest example showing how an unauthenticated request to'/storage/t.dn?s=...' can be used to retrieve Web.config. However, the researchers did not release the full exploit chain including the earlier deserialization RCE (CVE-2025-30406). Potentially impacted users are recommended to upgrade to CentreStack version 16.10.10408.56683. If installing the new version is not possible, a mitigation is to disable the temp handler in the Web.config file for the UploadDownloadProxy component by removing the line that defines it in the file. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Week in review: Hackers extorting Salesforce, CentreStack 0-day exploited Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: How to get better results from bug bounty programs without wasting money The wrong bug bounty strategy can flood your team with low-value reports. The right one can surface critical vulnerabilities that would otherwise slip through. A new academic study based on Google’s Vulnerability Rewards Program (VRP) offers rare data on how to tell the difference. Rethinking AI security architectures beyond Earth If you think managing cloud security is complex, try doing it across hundreds of satellites orbiting the planet. Each one is a moving endpoint that must stay secure while communicating through long, delay-prone links. A new study explores how AI could automate security for space systems and whether the best approach is to centralize control or spread it out. Behind the screens: Building security customers appreciate In this Help Net Security interview, Jess Vachon, CISO at PRA Group, discusses the company’s multi-layered defense against fraud and its commitment to protecting customer trust. Vachon explains how PRA Group balances identity verification with a seamless customer experience. From theory to training: Lessons in making NICE usable SMBs may not have big budgets, but they are on the receiving end of many cyberattacks. A new study from Cleveland State University looked at how these companies could train staff without getting lost in the thousands of skills and tasks in the NICE Cybersecurity Workforce Framework. The result is a stripped-down, scenario-based curriculum that may hold lessons for security leaders in much larger enterprises. Cl0p exploits Oracle E-Business Suite zero-day in data theft, extortion campaign (CVE-2025-61882) The Cl0p extortion gang exploited multiple Oracle E-Business Suite (EBS) vulnerabilities, including one zero-day flaw (CVE-2025-61882), “to steal large amounts of data from several victim[s] in August 2025,” Charles Carmakal, CTO at Mandiant – Google Cloud, stated on Sunday. Hackers launch data leak site to extort 39 victims, or Salesforce Scattered Lapsus$ Hunters launched a data leak site over the weekend, aiming to pressure organizations whose Salesforce databases they have plundered into paying to prevent the stolen data from being released. Leaked Oracle EBS exploit scripts expected to drive new wave of attacks (CVE-2025-61882) Resecurity and watchTowr researchers have analyzed the leaked scripts used by attackers to exploit CVE-2025-61882 on internet-facing Oracle ESB instances. Whether the attackers were Cl0p or LAPSUS$, both, or even additional threat actors is still unknown, as the scripts have been leaked on Telegram. Redis patches critical “RediShell” RCE vulnerability, update ASAP! (CVE-2025-49844) Redis, the company behind the widely used in-memory data structure store of the same name, has released patches for a critical vulnerability (CVE-2025-49844) that may allow attackers full access to the underlying host system. North Korean hackers stole over $2 billion in cryptocurrency this year North Korean hackers have stolen more than $2 billion in cryptocurrency in 2025, according to blockchain analytics firm Elliptic, and the year isn’t over yet. Researchers uncover ClickFix-themed phishing kit Palo Alto Networks researchers have discovered and analyzed “IUAM ClickFix Generator”, a phishing kit that allows less skilled attackers to infect unsuspecting users with malware by using the increasingly popular ClickFix social engineering technique. Attackers compromised ALL SonicWall firewall configuration backup files The attackers who brute-forced their way into SonicWall’s firewall cloud backup service accessed configuration backup files of all customers who have used the service, SonicWall stated on Wednesday, following the conclusion of a Mandiant-supported investigation into the incident. Legit tools, illicit uses: Velociraptor, Nezha turned against victims Threat actors are using an increasing variety of commercial and open-source products to carry out their attacks: according to researchers, Velociraptor and Nezha are the latest additions to their attack toolbox. Attackers are exploiting Gladinet CentreStack, Triofox vulnerability with no patch (CVE-2025-11371) CVE-2025-11371, a unauthenticated Local File Inclusion vulnerability in Gladinet CentreStack and Triofox file-sharing and remote access platforms, is being exploited by attackers in the wild. Securing agentic AI with intent-based permissions For decades, action-based permissions have performed the role of the seatbelts of enterprise security, essential guardrails that define what users or systems can do. But with the rise of agentic AI and autonomous software agents that operate independently and make decisions at scale, IAM now needs intent-based permissions that understand not only what an AI agent is doing, but why. October 2025 Patch Tuesday forecast: The end of a decade with Microsoft A lot of classic software is reaching end-of-life (EOL) this month. Windows 10, Office 2016 and Exchange Server 2016 have survived after nearly a decade of service. Not far behind, after six years in existence, comes the end of Office 2019 and Exchange Server 2019. Turning the human factor into your strongest cybersecurity defense In this Help Net Security video, Jacob Martens, Field CISO at Upwind Security, explores one of cybersecurity’s most enduring challenges: the human factor behind breaches. Despite advances in technology, most attacks still begin with people, not code. He explains how tactics like phishing and social engineering continue to succeed by exploiting human emotions such as urgency, fear, and even friendliness. Meet ARGUS, the robot built to catch hackers and physical intruders Hospitals, airports, and campuses are no longer dealing with separate security problems. Someone can slip past a checkpoint while another actor launches a network scan, and together those actions create a bigger risk than either one alone. Most surveillance tools and patrol robots are built to catch one or the other. A new study introduces ARGUS, a mobile system that watches the digital and physical environment at the same time and ties its findings together. How to succeed at cybersecurity job interviews Imagine this: you’ve made it through the résumé screen, your skills look solid on paper, and now it’s interview day. The next hour will decide whether you move forward or go back to the job boards. What separates the candidates who land offers from those who don’t is preparation and knowing what to expect when the questions start coming. The architecture of lies: Bot farms are running the disinformation war Bot farms have moved into the center of information warfare, using automated accounts to manipulate public opinion, influence elections, and weaken trust in institutions. New system aims to keep people connected when networks fail When disaster strikes, communication often fails. Cell towers can go offline, internet connections can disappear, and people are left without a way to share information or ask for help. A new research project looks at how to keep people talking even when regular networks are gone. Developing economies are falling behind in the fight against cybercrime Cybercrime is a global problem, but not every country is equally equipped to fight it. In many developing economies, cybersecurity is still seen as a luxury, something nice to have when budgets allow. That means little investment in tools, training, or talent. Researchers develop AI system to detect scam websites in search results Scam websites tied to online shopping, pet sales, and other e-commerce schemes continue to cause millions in losses each year. Security tools can accurately detect fraudulent sites once they are found, but identifying new ones remains difficult. Proxmox Mail Gateway: Open-source email security solution reaches version 9.0 First released in 2005, the open-source Proxmox Mail Gateway has become a widely adopted mail proxy, positioned between the firewall and the internal mail server to stop threats before they reach users. The platform delivers anti-spam and antivirus filtering to help organizations counter email-borne risks such as malware, Trojans, and phishing campaigns. DefectDojo: Open-source DevSecOps platform DefectDojo is an open-source tool for DevSecOps, application security posture management (ASPM), and vulnerability management. It helps teams manage security testing, track and remove duplicate findings, handle remediation, and generate reports. Nagios: Open-source monitoring solution Nagios is an open-source monitoring solution, now included as part of the robust Nagios Core Services Platform (CSP). It delivers end-to-end visibility across the entire IT infrastructure, covering everything from websites and DNS to servers, routers, switches, workstations, and critical services. It helps organizations proactively detect issues, minimize downtime, and ensure the reliability of their systems. Phishing is old, but AI just gave it new life The volume of cyberattacks has reached staggering levels, with new tactics that blur the line between legitimate and malicious activity. A new threat report from Comcast, based on 34.6 billion cybersecurity events analyzed over the past year, shows what adversaries are doing and what this means for enterprise leaders. Old authentication habits die hard Many organizations still rely on weak authentication methods while workers’ personal habits create additional risks, according to Yubico. Cybersecurity’s next test: AI, quantum, and geopolitics Geopolitics, emerging technology, and skills shortages are reshaping cybersecurity priorities across industries, according to a new PwC report. The findings show a mix of rising awareness, persistent weaknesses, and uneven preparation for the next wave of threats. Six metrics policymakers need to track cyber resilience Most countries are still making national cyber policy decisions without reliable numbers. Regulations often focus on incident reporting after damage is done, but they fail to give governments a forward-looking picture of resilience. A new report from Zurich Insurance Group argues that this gap leaves economies exposed and slows the ability to respond to systemic threats. Outdated encryption leaves crypto wide open The cryptocurrency sector faces an existential threat on two fronts: none of the 2,138 web applications and 146 mobile apps tested by ImmuniWeb support post-quantum encryption, and more than 7.8 million user records are already circulating on the dark web. Your SOC is tired, AI isn’t Security teams have discussed AI in the SOC for years, but solid evidence of its impact has been limited. A recent benchmark study by Dropzone puts measurable evidence behind the idea, showing that AI agents can help analysts work faster and with greater accuracy during alert investigations, without major changes to existing workflows. Cybersecurity jobs available right now: October 7, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. eBook: Defending Identity Security the Moment It’s Threatened Credential-based attacks happen in seconds. Learn how to block weak or stolen passwords instantly, safeguard accounts in real time, and reduce helpdesk headaches with automated defense. New infosec products of the week: October 10, 2025 Here’s a look at the most interesting products from the past week, featuring releases from Object First, OPSWAT, Radiflow, and Semperis.

Threat actors are exploiting a zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and Triofox products, which allows a local attacker to access system files without authentication. At least three companies have been targeted so far. Although a patch is not yet available, customers can apply mitigations. CentreStack and Triofox are Gladinet's business solutions for file sharing and remote access that allow using a company's own storage as a cloud. According to the vendor, CentreStack "is used by thousands of businesses from over 49 countries." No fix, all versions affected The zero-day vulnerability CVE-2025-11371 is a Local File Inclusion (LFI) flaw affecting the default installation and configuration of both products, impacting all versions including the latest release, 16.7.10368.56560. Researchers at managed cybersecurity platform Huntress detected the security issue on September 27 when a threat actor successfully exploited it to obtain a machine key and execute code remotely. A closer analysis revealed that the issue was an LFI leveraged to read the Web.config and extract the machine key. This allowed the attacker to use an older deserialization vulnerability (CVE-2025-30406) and achieve remote code execution (RCE) through ViewState. The CVE-2025-30406 deserialization bug in CentreStack and Triofox was also exploited in the wild in March, and was due to a hardcoded machine key. An attacker knowing the key could perform RCE on an affected system. Huntress contacted Gladinet to let them know the finding. The vendor confirmed that it was aware of the vulnerability and said that it was in the process of notifying customers of a workaround until a patch is available. The researchers shared the mitigation with the targeted customer and published the following recommendations to protect against CVE-2025-11371: Disable the temp handler in the Web.config file for the UploadDownloadProxy component at “C:\Program Files (x86)\Gladinet Cloud Enterprise\UploadDownloadProxy\Web.config” Locate and remove the line that defines the temp handler — it points to t.dn This line enables the vulnerable functionality that attackers exploit via Local File Inclusion, so removing it prevents exploitation of CVE-2025-11371. The researchers warn that the mitigations "will impact some functionality of the platform," but make sure that the vulnerability cannot be exploited. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

SecurityWeek’s cybersecurity news roundup provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape. Each week, we curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports. Here are this week’s stories: Gladinet vulnerability exploited in the wild A vulnerability affecting Gladinet’s CentreStack and Triofox products has been exploited in the wild, Huntress warns. CentreStack is a mobile access and secure sharing solution while Triofox is a secure file access solution. Huntress earlier this year discovered exploitation of CVE-2025-30406, a hardcoded machine key issue affecting the products, and it has now detected exploitation of a new vulnerability, CVE-2025-11371, which allows unauthenticated local file inclusion. Gladinet is aware of the issue and is in the process of providing a workaround to customers until a patch is developed. US universities targeted by payroll pirates Microsoft has warned that a cybercrime group it tracks as Storm-2657 has been targeting US universities in an effort to hack employee accounts on HR platforms such as Workday. The goal is to divert salary payments to accounts controlled by the attackers. These types of threat actors are known as “payroll pirates”. The attacks seen by Microsoft do not involve exploitation of Workday vulnerabilities. Instead the hackers are leveraging social engineering tactics and the lack of MFA to compromise accounts. Zimbra vulnerability exploited in attack on Brazilian military StrikeReady warned that a Zimbra vulnerability tracked as CVE-2025-27915 was exploited earlier this year to target Brazil’s military. The attack involved a malicious ICS calendar file. There do not appear to be other public reports describing exploitation of CVE-2025-27915, which has been described as an XSS flaw allowing an attacker to execute arbitrary JavaScript and perform unauthorized actions on the victim’s Zimbra account, including email redirection and data exfiltration. Mic-E-Mouse attack A team of researchers from the University of California have disclosed the details of an attack method they have named Mic-E-Mouse, which leverages the high-performance optical sensors on a mouse to eavesdrop on users. The researchers showed that speech induces subtle surface vibrations that the mouse’s sensor can detect. The audio quality is initially poor, but the researchers showed how it can be processed to improve its quality. On the other hand, accuracy is still low in real world environment tests. Two arrested in UK over nursery chain hack Two unnamed individuals, reportedly aged 17 and 22, have been arrested in the UK over a cyberattack that targeted the nursery chain Kido. Hackers stole the names, addresses, and photographs of 8,000 children and started leaking them in order to convince Kido to pay a ransom. The hackers also called impacted parents to increase the pressure on the nursery chain. In response to pushback from other hackers, the children’s images were blurred, and later all the data was taken offline. Brightstar and Decisely data breaches impact over 100,000 Brightstar and Decisely Insurance Services have each disclosed data breaches impacting more than 100,000 people. IGT and its lottery business Brightstar said unauthorized access was discovered nearly one year ago, but it took until recently to determine what type of data was compromised and who was impacted. Decisely discovered unauthorized access in December 2024 and started notifying affected individuals in June 2025. The data breach at Decisely impacted personal information related to its partner MetLife. WordPress plugin vulnerability exploited Hackers have been attempting to exploit CVE-2025-5947, a critical vulnerability in the Service Finder Bookings plugin, to hack WordPress websites. The plugin is part of the premium Service Finder theme, which has been acquired by roughly 6,000 websites. The vulnerability was patched on July 17 and disclosed by Defiant on July 31. Exploitation started on August 1 and Defiant’s Wordfence firewall has already blocked nearly 14,000 attacks. Honeypot data shows ICS/OT attacks from Russia and Iran An ICS/OT honeypot run by Forescout, designed to mimic a water treatment plan, has been targeted by a Russia-linked group named TwoNet, which tried to deface the associated HMI, disrupt processes, and manipulate other ICS. TwoNet has been involved in hacktivist attacks, but many of its activities seem driven by profit. Forescout’s honeypots also saw attack attempts that have been linked to Russia and Iran. OpenAI disrupts ChatGPT abuse OpenAI has published another report describing the actions it has taken against the malicious use of ChatGPT. The company has seen Russian, Chinese and (North) Korean threat actors abusing its AI assistant for malware development, phishing, scams, and influence operations. ClayRat Android spyware targets Russia Zimperium has detailed ClayRat, an Android spyware mainly targeting Russian users. The malware has been distributed through Telegram channels and phishing sites, disguised as popular apps such as WhatsApp, TikTok, and YouTube. Once it has been installed on a device, ClayRat can steal SMS messages, notifications, and call logs, take photos with the infected device’s front camera, and send messages or make calls from the victim’s phone. Related: In Other News: PQC Adoption, New Android Spyware, FEMA Data Breach

Attackers are exploiting Gladinet CentreStack, Triofox vulnerability with no patch (CVE-2025-11371) CVE-2025-11371, an unauthenticated Local File Inclusion vulnerability in Gladinet CentreStack and Triofox file-sharing and remote access platforms, is being exploited by attackers in the wild. While Gladinet is aware of the vulnerability and of its exploitation, a patch is still in the works. In the meantime, users can and should mitigate the flaw by disabling a handler within their installation’s Web.config file. “We have observed in-the-wild exploitation of this vulnerability impacting three customers so far,” Huntress researchers warned, and advised organizations using Gladinet’s solutions to implement the mitigation as soon as possible. CVE-2025-11371 exploited CentreStack is a file-sharing, sync, and remote access platform aimed at managed service providers and small businesses. Triofox is a secure file-access/gateway solution for medium and large businesses, which allows users to access files without having to use a VPN. Both solutions can be self-hosted, on-premises or in the organization’s cloud, or hosted in Gladinet’s cloud. According to its CVE entry, CVE-2025-11371 affects the default installation and configuration of Gladinet CentreStack and TrioFox in the latest available version – 16.7.10368.56560 – as well as all earlier version. Huntress observed CVE-2025-11371 exploitation on September 27, 2025, on a customer’s CentreStack instance that was running a version later that version 16.4.10315.56368, i.e., a version with a fix for CVE-2025-30406, a previously exploited and patched ViewState deserialization vulnerability. Huntress’ investigators say that CVE-2025-11371 allowed threat actors to retrieve the machine key from vulnerable applications’ Web.config file, use it to forge ASP.NET ViewState payloads that will pass the solution’s integrity checks, and trigger remote code execution by causing unsafe server-side deserialization (CVE-2025-30406) of the forged payload. “Attackers are able to access any file on the file system remotely without authentication as a result of [CVE-2025-11371],” Jamie Levy, director of adversary tactics at Huntress, told Help Net Security. Waiting for a fix “During our investigation, we saw evidence that Gladinet had engaged with a mutual customer to implement a mitigation,” Huntress researchers noted. “Huntress reached out to Gladinet shortly after this discovery to disclose the flaw, per our standard vulnerability disclosure policy; Gladinet confirmed that it was aware of the vulnerability and was in the process of notifying customers of an immediate workaround.” The mitigation for this in-the-wild exploited issue is to remove a specific line within the Web.config file located at C:\Program Files (x86)\Gladinet Cloud Enterprise\UploadDownloadProxy\Web.config. The line that should be removed (Source: Huntress) “This will impact some functionality of the platform; however, it will ensure that this vulnerability cannot be exploited until it is patched,” the researchers added. There are still many unknowns Huntress has blocked the attack before they could see what further malicious activity the attackers were planning. In the attacks exploiting CVE-2025-30406 earlier this year, the attackers tried to download a malicious executable file, install a remote access tool, and perform lateral movement. Help Net Security has reached out to Gladinet for more information about the issue and about the attacks and we will update this article if we hear back from them. UPDATE (October 10, 2025, 05:45 p.m. ET): Based on additional information provided by Huntress’ director of adversary tactics, this article has been updated to make the exploitation process clearer. UPDATE (October 17, 2025, 04:05 a.m. ET): Gladinet has patched CVE-2025-11371 and users should either upgrade to the fixed CentreStack version 16.10.10408.56683, or implement the mitigation outlined by Huntress’ researchers. The researchers have also shared some technical details about the LPI vulnerability and have released a proof-of-concept PowerShell request that retrieves the Web.config file via the discovered unauthenticated endpoint (but does not perform the remote code execution). Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Gladinet: rilevato sfruttamento in rete della CVE-2025-11371 Alert AL02/251010/CSIRT-ITA Sintesi Ricercatori di sicurezza hanno rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2025-11371 che interessa i prodotti Gladinet CentreStack e TrioFox, soluzioni di accesso remoto sicuro ai file server aziendali, progettate per modernizzare la gestione dei file senza richiedere la migrazione al cloud. Tipologia Information Disclosure Remote Code Execution Descrizione e potenziali impatti Ricercatori di sicurezza hanno rilevato lo sfruttamento della vulnerabilità CVE-2025-11371 che interessa i prodotti Gladinet CentreStack e TrioFox, soluzioni di accesso remoto sicuro ai file server aziendali. Tale vulnerabilità – di tipo “Local File Inclusion” e con score CVSS v3.1 pari a 6.1 – se sfruttata in combinazione con la CVE-2025-30406 – già trattata da questo CSIRT nell’ambito dell’AL02/250415/CSIRT-ITA – potrebbe permettere ad un utente malintenzionato di accedere a file di sistema ed eseguire codice arbitrario da remoto sui dispositivi target. In particolare, nelle versioni di CentreStack e Triofox vulnerabili alla CVE-2025-30406, una chiave macchina hardcoded (incorporata nel codice) permetteva a un attaccante di eseguire codice da remoto sfruttando una vulnerabilità di deserializzazione del ViewState. L’attaccante potrebbe quindi sfruttare la CVE-2025-11371, per recuperare la chiave macchina dal file Web.config dell’applicazione, e successivamente eseguire codice da remoto sfruttando la vulnerabilità di deserializzazione ViewState menzionata in precedenza. Prodotti e/o versioni affette Gladinet CentreStack, versione 16.7.10368.56560 e precedenti TrioFox, versione 16.7.10368.56560 e precedenti Azioni di mitigazione In attesa del rilascio di una patch, si consiglia di monitorare il sito del vendor ed applicare le azioni di mitigazione suggerite al link disponibile nella sezione Riferimenti.

Cybersecurity company Huntress said it has observed active in-the-wild exploitation of an unpatched security flaw impacting Gladinet CentreStack and TrioFox products. The zero-day vulnerability, tracked as CVE-2025-11371 (CVSS score: 6.1), is an unauthenticated local file inclusion bug that allows unintended disclosure of system files. It impacts all versions of the software prior to and including 16.7.10368.56560. Huntress said it first detected the activity on September 27, 2025, uncovering that three of its customers have been impacted so far. It's worth noting that both applications were previously affected by CVE-2025-30406 (CVSS score: 9.0), a case of hard-coded machine key that could allow a threat actor to perform remote code execution via a ViewState deserialization vulnerability. The vulnerability has since come under active exploitation. CVE-2025-11371, per Huntress, "allowed a threat actor to retrieve the machine key from the application Web.config file to perform remote code execution via the aforementioned ViewState deserialization vulnerability." In one instance investigated by the company, the affected version was newer than 16.4.10315.56368 and not vulnerable to CVE-2025-30406, suggesting that attackers are exploiting the new flaw to extract the hard-coded machine key and use it to execute code remotely via the ViewState deserialization flaw. In the interim, users are recommended to disable the "temp" handler within the Web.config file for UploadDownloadProxy located at "C:\Program Files (x86)\Gladinet Cloud Enterprise\UploadDownloadProxy\Web.config." "This will impact some functionality of the platform; however, it will ensure that this vulnerability cannot be exploited until it is patched," Huntress researchers Bryan Masters, James Maclachlan, Jai Minton, and John Hammond said. Huntress told The Hacker News that it has observed a "handful of incidents" that led to a confirmed compromise as a result of CVE-2025-11371. The activity has not been attributed to any threat actor, although the possibility that the two sets of attacks could be the work of the same group has not been ruled out. "It's unclear if these are the same threat actors, but I wouldn't be surprised since they would have already been familiar with this particular piece of software and they could have found this new vulnerability with minimal effort," Jamie Levy, director of adversary tactics at Huntress, said. More Details of the Flaw Emerge Gladinet, on October 14, 2025, released version 16.10.10408.56683 of CentreStack and Triofox, which includes a fix for CVE-2025-11371, making it crucial that users apply the latest fixes as soon as possible. In an updated report, Huntress said it observed an "unusual GET request" to the unauthenticated "/storage/t.dn" endpoint that prompted the server to respond with a copy of the Web.config file from the "C:\Program Files (x86)\Gladinet Cloud Enterprise\root\Web.config" location. The entire HTTP request is as follows - GET /storage/t.dn s=..\..\..\Program+Files+(x86)\Gladinet+Cloud+Enterprise\root\Web.config&sid=1 The request to the endpoint is handled by the "GladinetStorage.TempDownload" function located in a DLL named "GSUploadDownloadProxy.dll," which is designed to retrieve files from the temp directory for authenticated users. This, in turn, is a case of a local file inclusion (LFI) vulnerability, which occurs when a web application includes a file from the server based on poorly validated user input, allowing an attacker to read or execute local files on the server. "Because Gladinet Cloud Enterprise is running as the NT AUTHORITY\SYSTEM user account, the user's temporary directory will generally be present at C:\Windows\Temp," Huntress explained. "This means that including directory traversal characters ..\ will allow the application to retrieve any file relative to C:\Windows\Temp\glad_temp. So for example retrieving the file ..\..\explorer.exe would retrieve the file from C:\Windows\explorer.exe." As a result of this issue, an attacker can read the contents of the Web.config file, including the machine key required to carry out a deserialization attack and ultimately achieve remote code execution. In the attack detected by Huntress, the threat actors have been found to run reconnaissance commands (e.g., ipconfig /all) passed in the form of a Base64-encoded payload. The intrusion was ultimately foiled as the infected system was contained before it could progress to the next stage. Users are advised to update to the latest version, or, as previously mentioned, disable the temp handler to thwart exploitation efforts. (The story was updated after publication to include a response from Huntress. It was updated again on October 16, 2025, to include details about the flaw and the availability of fixes.)