Do Son A new analysis details how the RansomEXX gang exploited a use-after-free zero-day (CVE-2025-29824) in the Windows Common Log File System to gain SYSTEM privileges.
CVE-2025-29824
A new Kaspersky report reveals the PipeMagic backdoor has resurfaced, now tied to the exploitation of a Microsoft zero-day and targeting organizations in Brazil and Saudi Arabia.
A zero-day privilege escalation vulnerability (CVE-2025-29824) in Microsoft CLFS was exploited by Balloonfly (Play ransomware) before the official patch.
Week of April 7-13 saw critical Ivanti, WordPress, & Windows vulnerabilities exploited, plus major data breaches impacting millions.
CISA has added critical vulnerabilities affecting Windows CLFS (CVE-2025-29824) and Gladinet CentreStack (CVE-2025-30406) to its Known Exploited Vulnerabilities Catalog. Learn about the threats and the urgent need to apply patches.Sources and related content
Microsoft reports active exploitation of a Windows CLFS zero-day (CVE-2025-29824) to escalate privileges and deploy ransomware. Learn about the attacks, the threat actors involved, and how to mitigate the risk.
Microsoft's April 2025 Patch Tuesday addresses 134 vulnerabilities, including a zero-day under active exploitation. This update covers critical RCE flaws in Windows, Office, and more