Tag: FIREWALL

PolarEdge: Unveiling an uncovered ORB network
The article discusses the PolarEdge botnet, which exploits the CVE-2023-20118 vulnerability in various Cisco Small Business Routers and causes compromised devices to launch coordinated attacks. The botnet has infected over 2,000 assets globally using sophisticated methods including web shells and a TLS backdoor. The research emphasizes the need for monitoring edge devices due to their vulnerability and operational importance to threat actors.…
Read More
Everest Forms Plugin Exposes Over 100,000 WordPress Sites to Complete Takeover
Summary: A critical security vulnerability, CVE-2025-1128, has been identified in the Everest Forms WordPress plugin that affects over 100,000 websites, allowing unauthenticated attackers to upload files, execute remote code, and potentially delete essential configuration files. The plugin, used widely for forms and surveys, suffers from inadequate file validation, increasing the risk of complete site compromise.…
Read More
Testing ports for a reverse shell
This article discusses an automated approach to testing network ports for penetration testing and red teaming activities using Python scripts to create TCP listeners and various methods to determine which ports are accessible. The content emphasizes ethical practices, requiring explicit permission for such testing. Affected: penetration testing, red teaming

Keypoints :

Automated ping pong tests help identify open ports for reverse shells.…
Read More
From Theory to Reality: Applying Attack Frameworks to the .xz Backdoor
In cyber security, much of the work occurs before an attack happens, focusing on understanding attacker behaviors and mitigating potential threats. Attack frameworks, such as MITRE ATT&CK and the Diamond Model, help professionals analyze incidents like the .xz backdoor attack, which exploited a vulnerability in a popular Linux compression utility to enable unauthorized SSH access.…
Read More
WordPress ClickFix Malware Causes Google Warnings and Infected Computers
This article discusses a recent fake Google reCAPTCHA malware campaign targeting WordPress sites that tricks users into executing malicious Powershell commands. Victims are led to click through fake prompts that eventually allow malware to infect their systems by running harmful commands, illustrating the need for enhanced security measures for both users and website administrators.…
Read More
Mastering Multi-Cloud Security: Strategies to Overcome Challenges & Maximize Protection
Organizations are increasingly adopting multi-cloud strategies to avoid vendor lock-in, optimize costs, ensure business continuity, and leverage best-in-class services. However, they face challenges such as inconsistent identity management models, lack of unified visibility, and expanded attack surfaces that complicate security across multiple platforms. Affected: Organizations, Cloud Service Providers

Keypoints :

Multi-cloud approaches are utilized to avoid vendor lock-in and optimize costs.…
Read More
Cybersecurity News Review, — Week 8 (2025)
This week’s cybersecurity updates reveal critical vulnerabilities in several platforms like OpenSSH, Atlassian products, and Palo Alto Networks firewalls. There are also reports of new phishing techniques, malware campaigns targeting sensitive data, and alarming data breaches affecting healthcare organizations. Affected: OpenSSH, Atlassian (Confluence, Bamboo, Bitbucket, Jira, Crowd), Palo Alto Networks, Signal Messenger, Australian Infrastructure, HCRG Care Group, DM Clinical Research

Keypoints :

Two critical vulnerabilities in OpenSSH could lead to man-in-the-middle and denial-of-service attacks.…
Read More
Black Basta’s Internal Chats Leak: Everything You Need to Know
On February 11, 2025, leaked internal chat logs from the notorious Black Basta ransomware group surfaced, exposing internal conflicts and their alleged targeting of Russian banks. The revelations include significant instability within the group, with key members defecting and operational weaknesses laid bare. SOCRadar’s intelligence findings present critical Indicators of Compromise (IoCs) which may aid organizations in defending against potential attacks.…
Read More
Second Recently Patched Flaw Exploited to Hack Palo Alto Firewalls
Summary: Palo Alto Networks has issued a warning about active exploitation of the CVE-2025-0108 and CVE-2025-0111 vulnerabilities in their PAN-OS firewalls. These vulnerabilities can be chained with an earlier flaw (CVE-2024-9474) to enable remote code execution. The severity of CVE-2025-0111 has been updated to high, necessitating urgent action from users of affected systems.…
Read More
CISA Warns of Attacks Exploiting Craft CMS Vulnerability
Summary: A recently patched vulnerability in the Craft content management system (CVE-2025-23209) is actively being exploited in cyberattacks, according to CISA. Although Craft CMS has a limited market share, an estimated 41,000 instances are likely affected by this high-severity remote code execution flaw. Federal agencies have been instructed to address the vulnerability by March 13, but no public reports confirm attacks utilizing this specific flaw yet.…
Read More
US healthcare org pays M settlement over alleged cybersecurity lapses
Summary: Health Net Federal Services (HNFS) and Centene Corporation will pay over million to settle allegations of falsely certifying compliance with cybersecurity requirements in their TRICARE contract. Between 2015 and 2018, HNFS failed to implement essential cybersecurity measures while managing healthcare services for military personnel, despite claiming compliance.…
Read More
CVE-2025-0108 Detection: Active Exploitation of an Authentication Bypass Palo Alto Networks PAN-OS Software – SOC Prime
The recent CVE-2025-0108 vulnerability in Palo Alto Networks’ PAN-OS allows unauthorized access to the management interface and execution of PHP scripts, posing significant risks despite not enabling remote code execution. There’s a growing trend of exploit attempts, and security professionals are urged to enhance their defenses.…
Read More
When Spam Hides In Plain Sight
A recent case revealed the presence of Casino spam on a website that was not visible in the usual database rows or files. The spam aimed to collect personal information and financial data from victims. The investigation highlighted the challenges malware poses, and emphasized the importance of proactive security measures for website owners.…
Read More
Patch Now: CISA Warns of Palo Alto Flaw Exploited in the Wild
Summary: A critical authentication bypass vulnerability in Palo Alto Networks’ PAN-OS, tracked as CVE-2025-0108, is being actively exploited by attackers, allowing unauthorized access to certain PHP scripts. Cybersecurity authorities, including CISA, urge organizations to apply patches immediately as exploitation attempts have surged across multiple countries. Users of affected PAN-OS versions should secure their devices promptly to mitigate risks associated with this vulnerability.…
Read More