Found 6 bookmarks
Custom sorting
Active Exploitation of Zero-day Zyxel CPE Vulnerability (CVE-2024-40891)
Active Exploitation of Zero-day Zyxel CPE Vulnerability (CVE-2024-40891)
After identifying a significant overlap between IPs exploiting CVE-2024-40891 and those classified as Mirai, the team investigated a recent variant of Mirai and confirmed that the ability to exploit CVE-2024-40891 has been incorporated into some Mirai strains. ‍GreyNoise is observing active exploitation attempts targeting a zero-day critical command injection vulnerability in Zyxel CPE Series devices tracked as CVE-2024-40891. At this time, the vulnerability is not patched, nor has it been publicly disclosed. Attackers can leverage this vulnerability to execute arbitrary commands on affected devices, leading to complete system compromise, data exfiltration, or network infiltration. At publication, Censys is reporting over 1,500 vulnerable devices online.
#greynoise#EN#2025#CVE-2024-40891#active#exploitation#zero-day
·greynoise.io·
Active Exploitation of Zero-day Zyxel CPE Vulnerability (CVE-2024-40891)
Microsoft Says Windows Update Zero-Day Being Exploited to Undo Security Fixes
Microsoft Says Windows Update Zero-Day Being Exploited to Undo Security Fixes
Microsoft on Tuesday raised an alarm for in-the-wild exploitation of a critical flaw in Windows Update, warning that attackers are rolling back security fixes on certain versions of its flagship operating system.
#securityweek#EN#2024#CVE-2024-43491#Downdate#Zero-Day#in-the-wild#Undo#exploitation#Windows#Update#Windows-Update
·securityweek.com·
Microsoft Says Windows Update Zero-Day Being Exploited to Undo Security Fixes
Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)
Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)
On April 10, 2024, Volexity identified zero-day exploitation of a vulnerability found within the GlobalProtect feature of Palo Alto Networks PAN-OS at one of its network security monitoring (NSM) customers. Volexity received alerts regarding suspect network traffic emanating from the customer’s firewall. A subsequent investigation determined the device had been compromised. The following day, April 11, 2024, Volexity observed further, identical exploitation at another one of its NSM customers by the same threat actor.
#volexity#EN#2024#Zero-Day#Exploitation#RCE#GlobalProtect#CVE-2024-3400
·volexity.com·
Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)
Zero-Day Exploitation of Atlassian Confluence
Zero-Day Exploitation of Atlassian Confluence
Over the Memorial Day weekend in the United States, Volexity conducted an incident response investigation involving two Internet-facing web servers belonging to one of its customers that were running Atlassian Confluence Server software. The investigation began after suspicious activity was detected on the hosts, which included JSP webshells being written to disk
#volexity#EN#2022#Zero-Day#Exploitation#Atlassian#Confluence#CVE-2022-26134
·volexity.com·
Zero-Day Exploitation of Atlassian Confluence
Zero-Day Exploitation of Atlassian Confluence
Zero-Day Exploitation of Atlassian Confluence
Over the Memorial Day weekend in the United States, Volexity conducted an incident response investigation involving two Internet-facing web servers belonging to one of its customers that were running Atlassian Confluence Server software. The investigation began after suspicious activity was detected on the hosts, which included JSP webshells being written to disk
#volexity#EN#2022#Zero-Day#Exploitation#Atlassian#Confluence#CVE-2022-26134
·volexity.com·
Zero-Day Exploitation of Atlassian Confluence
Zero-Day Exploitation of Atlassian Confluence
Zero-Day Exploitation of Atlassian Confluence
Over the Memorial Day weekend in the United States, Volexity conducted an incident response investigation involving two Internet-facing web servers belonging to one of its customers that were running Atlassian Confluence Server software. The investigation began after suspicious activity was detected on the hosts, which included JSP webshells being written to disk
#volexity#EN#2022#Zero-Day#Exploitation#Atlassian#Confluence#CVE-2022-26134
·volexity.com·
Zero-Day Exploitation of Atlassian Confluence