admin

admin

  • Joined: September 10, 2024
  • Articles: 5656

Severe RCE Vulnerabilities in Cisco ISE and ISE-PIC Enable Unauthenticated Attackers to Obtain Root Access

Jun 26, 2025
Vulnerability, Network Security

Cisco has issued updates to resolve two critical security vulnerabilities in the Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that may allow unauthenticated attackers to execute arbitrary commands with root privileges. These vulnerabilities, identified as CVE-2025-20281 and CVE-2025-20282, both carry a maximum CVSS score of 10.0. Here’s a detailed overview of the vulnerabilities:

  • CVE-2025-20281: A remote code execution flaw impacting Cisco ISE and ISE-PIC versions 3.3 and later, enabling an unauthenticated attacker to execute arbitrary code on the system as root.

  • CVE-2025-20282: A remote code execution vulnerability in Cisco ISE and ISE-PIC version 3.4 that allows an unauthenticated attacker to upload arbitrary files to the device and execute them as root.

Cisco has indicated that CVE-2025-20281 stems from inadequate…

Cisco Addresses Critical RCE Vulnerabilities in ISE and ISE-PIC On June 26, 2025, Cisco issued urgent updates to mitigate two severe vulnerabilities in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). These flaws could allow unauthenticated remote…

Microsoft Flags Storm-0501 as a Significant Threat in Hybrid Cloud Ransomware Operations

September 27, 2024
Ransomware / Cloud Security

Microsoft has identified the cyber group Storm-0501 as a noteworthy threat, targeting key sectors such as government, manufacturing, transportation, and law enforcement in the United States. Their sophisticated, multi-stage attack strategy is designed to infiltrate hybrid cloud environments, allowing attackers to move laterally from on-premises systems to the cloud. This approach leads to data exfiltration, credential theft, tampering, persistent backdoor access, and ransomware deployment. According to Microsoft’s threat intelligence team, Storm-0501 operates as a financially driven cybercriminal organization, utilizing both commodity and open-source tools for their ransomware activities. Active since 2021, they initially focused on educational institutions with the Sabbath ransomware before transitioning to a ransomware-as-a-service (RaaS) model, distributing various ransomware variants including Hive, BlackCat (ALPHV), Hunters International, LockBit, and Embargo ransomware.

Microsoft Flags Storm-0501 as Significant Threat in Hybrid Cloud Ransomware Incidents On September 27, 2024, Microsoft announced a notable increase in ransomware attacks orchestrated by the threat actor known as Storm-0501, which has predominantly targeted integral sectors such as government,…

Reevaluating Security in the Software Supply Chain

Black Hat, Events, Video Cyfinoid’s Shrivastava Advocates for Enhanced Transparency in Software Security Risks Tom Field (SecurityEditor) • August 15, 2025 Anant Shrivastava, Founder & Chief Researcher, Cyfinoid Research Despite the crucial importance of software supply chain security, many organizations…

ConnectWise Cyberattack: Nation-State Actor Suspected in Targeted Breach
May 30, 2025 | Vulnerability / Data Breach

ConnectWise, known for its remote access software ScreenConnect, has reported being targeted in a cyberattack believed to be orchestrated by a nation-state actor. On May 28, the company issued a brief advisory detailing that it had identified suspicious activity linked to the threat, which has affected a limited number of ScreenConnect customers. To investigate the incident further, ConnectWise has enlisted Google Mandiant for a forensic examination and has informed all impacted customers. While the company has not disclosed the specific number of affected customers, the timing of the breach, or the identity of the responsible party, it is important to note that just weeks prior, in late April 2025, ConnectWise addressed a high-severity vulnerability (CVE-2025-3935) with a CVSS score of 8.1 in ScreenConnect versions 25.2.3 and earlier.

ConnectWise Reports Cyberattack, Suspected Links to Nation-State Actor May 30, 2025 ConnectWise, known for its remote access and support platform ScreenConnect, has confirmed that it recently fell victim to a cyberattack potentially orchestrated by a nation-state threat actor. In a…

Major Vulnerability in Open VSX Registry Poses Supply Chain Risks for Millions of Developers

On June 26, 2025, cybersecurity analysts revealed a serious flaw in the Open VSX Registry (“open-vsx[.]org”), which, if exploited, could allow attackers to seize control of the entire Visual Studio Code extensions marketplace. This represents a significant supply chain threat. “This vulnerability gives attackers total authority over the extensions marketplace and, consequently, over millions of developer machines,” stated Oren Yomtov, a researcher at Koi Security. “By leveraging a CI issue, a malicious actor could release harmful updates to every extension available on Open VSX.” After responsibly disclosing the issue on May 4, 2025, the maintainers proposed several fixes, culminating in a final patch on June 25. The Open VSX Registry, an open-source alternative to the Visual Studio Marketplace, is maintained by the Eclipse Foundation and is used by various code editors, including Cursor, Windsurf, Google Cloud Shell Editor, and Gitpod.

Critical Vulnerability in Open VSX Registry Poses Major Supply Chain Risk for Developers On June 26, 2025, cybersecurity researchers revealed a significant vulnerability in the Open VSX Registry, an open-source platform available at “open-vsx[.]org.” This flaw has the potential to…

Joint Global Operation Leads to Arrests and Sanctions Against LockBit Ransomware and Evil Corp Members

October 3, 2024
Cybercrime / Ransomware

A coordinated international law enforcement effort has resulted in four arrests and the shutdown of nine servers associated with the LockBit (also known as Bitwise Spider) ransomware operation, targeting a once-prominent financially motivated cybercriminal group. Key developments include the apprehension of a suspected LockBit developer in France while on vacation outside Russia, the arrest of two individuals in the UK linked to an affiliate, and the capture of an administrator of a bulletproof hosting service in Spain used by the gang, according to Europol. Additionally, authorities have identified a Russian national, Aleksandr Ryzhenkov (known by several aliases including Beverley and Corbyn_Dallas), as a high-ranking member of the Evil Corp cybercrime group and a LockBit affiliate. Sanctions have been imposed on seven individuals and two entities connected to the e-crime organization. “The United States, in collaboration with our allies…”

LockBit Ransomware and Evil Corp Members Arrested in Global Law Enforcement Operation On October 3, 2024, a coordinated international law enforcement operation resulted in the arrest of four individuals and the dismantling of nine servers associated with the LockBit ransomware…

Digital Twins of AI Workers Create Emerging Insider Threats

Artificial Intelligence & Machine Learning, Black Hat, Events Researchers Highlight Risks of AI Bots in Cybersecurity Contexts Michael Novinson (@MichaelNovinson) • August 15, 2025 Matthew Canham, Executive Director, Cognitive Security Institute, and Ben Sawyer, Associate Professor, Industrial Engineering and Management…

New Vulnerabilities in Linux Enable Password Hash Theft Through Core Dumps in Ubuntu, RHEL, and Fedora

May 31, 2025
Vulnerability / Linux

Two critical information disclosure vulnerabilities have been discovered in Apport and systemd-coredump, core dump handlers in Ubuntu, Red Hat Enterprise Linux, and Fedora, according to the Qualys Threat Research Unit (TRU). Labeled as CVE-2025-5054 and CVE-2025-4598, both are race condition bugs that could allow local attackers to access sensitive data. Tools like Apport and systemd-coredump are essential for handling crash reports and core dumps within Linux systems. Saeed Abbasi, product manager at Qualys TRU, noted, “These race conditions enable a local attacker to exploit a SUID program and gain read access to the resultant core dump.” Below is a brief overview of the two vulnerabilities:

  • CVE-2025-5054 (CVSS score: 4.7): A race condition in the Canonical Apport package, versions up to 2.32.0, allowing local attackers to leak sensitive information through PID-reuse by leveraging namespaces.
  • CVE-2025-4598 (CVSS score: 4.7): A race condition in…

New Vulnerabilities Uncovered in Linux Core Dump Handlers Could Lead to Password Hash Theft May 31, 2025 Recent findings from the Qualys Threat Research Unit (TRU) have revealed two significant vulnerabilities within core dump handlers in popular Linux distributions, including…