The Breach News

CISA Alerts: Active Exploitation of SysAid Vulnerabilities Allows Remote File Access and SSRF

Jul 23, 2025
Vulnerability / Software Security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security flaws affecting SysAid IT support software to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The vulnerabilities are as follows:

  • CVE-2025-2775 (CVSS score: 9.3): This vulnerability involves improper restrictions on XML external entity (XXE) references in the Checkin processing functionality, enabling potential administrator account takeover and file read access.

  • CVE-2025-2776 (CVSS score: 9.3): Similar to the first, this flaw also concerns improper restrictions on XXE references, but it affects the Server URL processing functionality, leading to possible administrator account takeover and file read access.

Both vulnerabilities were disclosed by watchTowr Labs researchers Sina Kheirkhah and Jake Knott in May, along with CVE-2025-2777 (CVSS score: 9.3), which pertains to a pre-authenticated XXE vulnerability within the /lshw endpoint. SysAid has since addressed these issues in their on-premises software.

CISA Alerts: Vulnerabilities in SysAid Software Under Active Attack On July 23, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) unveiled critical vulnerabilities affecting SysAid, a popular IT support software, highlighting their presence in the agency’s Known Exploited Vulnerabilities (KEV) catalog due to signs of active exploitation. The two…

Read More

CISA Alerts: Active Exploitation of SysAid Vulnerabilities Allows Remote File Access and SSRF

Jul 23, 2025
Vulnerability / Software Security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security flaws affecting SysAid IT support software to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The vulnerabilities are as follows:

  • CVE-2025-2775 (CVSS score: 9.3): This vulnerability involves improper restrictions on XML external entity (XXE) references in the Checkin processing functionality, enabling potential administrator account takeover and file read access.

  • CVE-2025-2776 (CVSS score: 9.3): Similar to the first, this flaw also concerns improper restrictions on XXE references, but it affects the Server URL processing functionality, leading to possible administrator account takeover and file read access.

Both vulnerabilities were disclosed by watchTowr Labs researchers Sina Kheirkhah and Jake Knott in May, along with CVE-2025-2777 (CVSS score: 9.3), which pertains to a pre-authenticated XXE vulnerability within the /lshw endpoint. SysAid has since addressed these issues in their on-premises software.

Money, Mandates, and Monitoring: Unpacking the Fight for Identity Integrity in Finance – Webinar

Pravin Chavda: Leading the Charge in Cybersecurity Solutions Practice Director, Simeio Pravin Chavda serves as the Practice Director at Simeio, where he spearheads initiatives in Access Management and Customer Identity & Access Management (CIAM). With over two decades of comprehensive IT experience on a global scale, Chavda has occupied pivotal…

Read MoreMoney, Mandates, and Monitoring: Unpacking the Fight for Identity Integrity in Finance – Webinar

Surge in Cloud Breaches and Identity Theft Highlighted in CrowdStrike’s Latest Threat Report

A recent report from CrowdStrike Holdings Inc. has highlighted a significant increase in the sophistication of cyber adversaries, shedding light on evolving methodologies in the landscape of cybersecurity threats. The report, titled the CrowdStrike 2025 Threat Hunting Annual Report, reveals that cloud-centered attacks, identity-driven breaches, and the advent of generative…

Read MoreSurge in Cloud Breaches and Identity Theft Highlighted in CrowdStrike’s Latest Threat Report

CISA Issues Immediate Patch Directive After Chinese Hackers Exploit SharePoint Vulnerabilities in Ongoing Attacks

CISA Urges Immediate Patching of Microsoft SharePoint Vulnerabilities Amid Ongoing Attacks by Chinese Hackers On July 22, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) formally identified two critical Microsoft SharePoint vulnerabilities—CVE-2025-49704 and CVE-2025-49706—as part of its Known Exploited Vulnerabilities (KEV) catalog. This designation follows evidence indicating that these…

Read MoreCISA Issues Immediate Patch Directive After Chinese Hackers Exploit SharePoint Vulnerabilities in Ongoing Attacks

RedDelta Unleashes PlugX Malware in Espionage Missions Against Mongolia and Taiwan

Jan 10, 2025
Cyber Espionage / Cyber Attack

RedDelta, a state-sponsored threat actor linked to China, has been targeting Mongolia, Taiwan, Myanmar, Vietnam, and Cambodia with a tailored version of PlugX malware from July 2023 to December 2024. According to an analysis by Recorded Future’s Insikt Group, the group utilized lure documents related to the 2024 Taiwanese presidential candidate Terry Gou, the Vietnamese National Holiday, flood protection initiatives in Mongolia, and ASEAN meeting invitations. Notably, compromises of the Mongolian Ministry of Defense in August 2024 and the Communist Party of Vietnam in November 2024 are believed to have occurred. Additionally, various entities in Malaysia, Japan, the United States, Ethiopia, Brazil, Australia, and India were targeted from September to December 2024. Active since at least 2012, RedDelta represents a persistent threat in the cyberspace landscape.

RedDelta Deploys PlugX Malware in Espionage Campaigns Targeting Mongolia and Taiwan Cyber Espionage / Cyber Attack January 10, 2025 In a significant escalation of cyber espionage activities, the state-sponsored threat actor known as RedDelta has exploited various geopolitical themes to deploy a customized version of the PlugX backdoor. This sophisticated…

Read More

RedDelta Unleashes PlugX Malware in Espionage Missions Against Mongolia and Taiwan

Jan 10, 2025
Cyber Espionage / Cyber Attack

RedDelta, a state-sponsored threat actor linked to China, has been targeting Mongolia, Taiwan, Myanmar, Vietnam, and Cambodia with a tailored version of PlugX malware from July 2023 to December 2024. According to an analysis by Recorded Future’s Insikt Group, the group utilized lure documents related to the 2024 Taiwanese presidential candidate Terry Gou, the Vietnamese National Holiday, flood protection initiatives in Mongolia, and ASEAN meeting invitations. Notably, compromises of the Mongolian Ministry of Defense in August 2024 and the Communist Party of Vietnam in November 2024 are believed to have occurred. Additionally, various entities in Malaysia, Japan, the United States, Ethiopia, Brazil, Australia, and India were targeted from September to December 2024. Active since at least 2012, RedDelta represents a persistent threat in the cyberspace landscape.

Navigating a Fluctuating Job Market

Agentic AI, Artificial Intelligence & Machine Learning, Next-Generation Technologies & Secure Development Guidance for Young Cyber Professionals Amidst AI and Security Automation Brandy Harris • July 30, 2025 Image: Shutterstock You may have clicked on a promising opportunity, only to be met with a blank page. This is a familiar…

Read MoreNavigating a Fluctuating Job Market

Report: Over 152,000 Nigerian Accounts Compromised in H1 2025 | Tech | Business

Significant Drop in Data Breaches in Nigeria: Context and Implications In the second quarter of 2025, Nigeria experienced a notable 73% reduction in reported data breaches, a decrease from 120,000 in the first quarter to 31,800. Despite this decline, cybersecurity firm Surfshark reported over 152,000 compromised accounts across various sectors…

Read MoreReport: Over 152,000 Nigerian Accounts Compromised in H1 2025 | Tech | Business