Do Son Apache HTTP Server 2.4.66 patched five flaws. Key fixes include a moderate SSRF flaw (CVE-2025-59775) that risks NTLM hash leakage on Windows, and a mod_userdir/suexec bypass. Update immediately.
Windows Security
A High-severity flaw (CVSS 8.0) in Splunk Enterprise/Universal Forwarder for Windows allows low-privileged users to access/tamper with sensitive installation directories due to incorrect permissions. Update to v10.0.2+.
CVE-2025-60718 lets attackers hijack Windows Administrator Protection to gain full control. Learn how the "Shadow Admin" exploit works.
CVE-2025-54918 allows attackers to gain SYSTEM privileges on Windows Server 2025 via a new NTLM relay attack that bypasses LDAP Channel Binding. Patch now.
Elastic patched a High-severity flaw (CVE-2025-37735) in Elastic Defend for Windows. A local attacker can delete arbitrary files via the SYSTEM service, risking privilege escalation. Update to v8.19.6+.
NVIDIA patched a High-severity EoP flaw (CVE-2025-23358) in the NVIDIA App installer for Windows. A local attacker could exploit a search path issue to achieve code execution with elevated privileges.
A China-nexus APT, Mustang Panda, is targeting the Tibetan community using DLL sideloading and the EnumFontsW API to launch the stealthy Publoader backdoor and achieve persistence.
Point Wild uncovered Shuyal Stealer, a sophisticated infostealer targeting 19 browsers. It disables Windows Task Manager via a registry key and exfiltrates data via Telegram Bot API.
A newly disclosed vulnerability in the Zabbix Agent and Agent 2 for Windows could allow local attackers...
A vulnerability dubbed "LNK Stomping" (CVE-2024-38217) is actively used to strip the 'Mark of the Web' from LNK files, bypassing Windows security policies.
A new phishing campaign is spreading MostereRAT, a sophisticated RAT that uses a Chinese scripting language and advanced evasion to bypass antivirus and EDR solutions.
A new report from Huntress reveals a hybrid ClickFix attack that abuses the Windows search protocol and malicious LNK files to deliver MetaStealer malware.
Windows 11 25H2 Dev Build introduces deeper password manager integration, starting with 1Password, allowing Windows Security to use and save passkeys in 1Password vaults.
CVE-2025-49144 lets attackers gain NT AUTHORITY\SYSTEM via Notepad++ v8.8.1 installer flaw. PoC available—secure paths and signatures urged.
XDSpy, a covert cyber-espionage group, is back with a sophisticated campaign targeting governments, leveraging an obscure Windows LNK file parsing flaw and new XDigo malware
Microsoft's June 2025 Patch Tuesday fixes 69 vulnerabilities, including two exploited zero-days in WebDAV and Windows SMB Client. Patch immediately!
A new PoC shows how BitLocker can be bypassed in minutes using Bitpixie (CVE-2023-21563). No hardware needed—just a PXE boot and memory scan.
May 2025 Patch Tuesday fixes 83 Microsoft flaws, including 5 zero-days actively exploited. Critical updates address RCE and SYSTEM privilege bugs.
A flaw in Windows tied to the inetpub folder (CVE-2025-21204) allows attackers to block updates without admin rights, exposing systems to future threats.
Threat actors abuse Microsoft’s mavinject.exe to inject malicious DLLs into trusted processes, evading detection in stealthy APT campaigns.
IBM's X-Force Red discovers RemoteMonologue, a novel DCOM attack that bypasses LSASS protection and steals NTLM credentials without payloads. Learn how it works and how to mitigate it.