security Archives | Cyberthreat Blog from Fortify24x7

Clipboard Pictures Exfiltration in Python Infostealer, (Wed, Oct 15th)

by Cyberthreat Blog | Oct 14, 2025 | SANS ISC Bulletins | 0 |

For a while, clipboard content has been monitored by many infostealers. Purposes can be multiple,...

Microsoft Patch Tuesday October 2025, (Tue, Oct 14th)

by Cyberthreat Blog | Oct 14, 2025 | SANS ISC Bulletins | 0 |

I am experimenting today with a little bit of a cleaned-up patch overview. I removed vulnerabilities that affect Microsoft’s cloud systems (but appreciate Microsoft listing them at all), as well as vulnerabilities in...

Heads Up: Scans for ESAFENET CDG V5 , (Mon, Oct 13th)

by Cyberthreat Blog | Oct 13, 2025 | SANS ISC Bulletins | 0 |

In January, a possible XSS vulnerability was found in the electronic document security management system ESAFENET CDG. This was the latest (as far as I can tell) in a long list of vulnerabilities in the product. Prior...

VU#538470: Clevo UEFI firmware embedded BootGuard keys compromising Clevo’s implementation of BootGuard

by Cyberthreat Blog | Oct 13, 2025 | CERT-Vulnerabilities | 0 |

Overview Clevo’s UEFI firmware update packages included sensitive private keys used in their Intel Boot Guard implementation. This accidental exposure of the keys could be abused by an attacker to sign malicious firmware using...

Wireshark 4.4.10 and 4.6.0 Released, (Sun, Oct 12th)

by Cyberthreat Blog | Oct 12, 2025 | SANS ISC Bulletins | 0 |

Wireshark release 4.4.10 fixes 6 bugs and 1 vulnerability (in the MONGO dissector). A new branch with many new features is released too: 4.6.0 Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center....

VU#887923: Kiwire Captive Portal contains 3 web vulnerabilities

by Cyberthreat Blog | Oct 10, 2025 | CERT-Vulnerabilities | 0 |

Overview The Kiwire Captive Portal, provided by SynchroWeb, is an internet access gateway intended for providing guests internet access where many users will want to connect. Three vulnerabilities were discovered within the...

[Guest Diary] Building Better Defenses: RedTail Observations from a Honeypot, (Thu, Oct 9th)

by Cyberthreat Blog | Oct 8, 2025 | SANS ISC Bulletins | 0 |

[This is a Guest Diary by Jin Quan Low, an ISC intern as part of the SANS.edu Bachelor’s...

Polymorphic Python Malware, (Wed, Oct 8th)

by Cyberthreat Blog | Oct 8, 2025 | SANS ISC Bulletins | 0 |

Today, I spoted on VirusTotal an interesting Python RAT. They are tons of them but this one attracted my attention based on some function names present in the code: self_modifying_wrapper(), decrypt_and_execute()...

Exploit Against FreePBX (CVE-2025-57819) with code execution., (Tue, Oct 7th)

by Cyberthreat Blog | Oct 7, 2025 | SANS ISC Bulletins | 0 |

FreePBX is a popular PBX system built around the open source VoIP system Asterisk. To manage Asterisk more easily, it provides a capable web-based admin interface. Sadly, like so many web applications, it has had its share of...

Quick and Dirty Analysis of Possible Oracle E-Business Suite Exploit Script (CVE-2025-61882), (Mon, Oct 6th)

by Cyberthreat Blog | Oct 5, 2025 | SANS ISC Bulletins | 0 |

This weekend, Oracle published a surprise security bulletin announcing an exploited vulnerability in Oracle E-Business Suite. As part of the announcement, which also included a patch, Oracle published IoC observed as part of the...

VU#294418: Vigor routers running DrayOS are vulnerable to RCE via EasyVPN and LAN web administration interface

by Cyberthreat Blog | Oct 3, 2025 | CERT-Vulnerabilities | 0 |

Overview A remote code execution (RCE) vulnerability, tracked as CVE-2025-10547, was discovered through the EasyVPN and LAN web administration interface of Vigor routers by Draytek. A script in the LAN web administration...

More .well-known Scans, (Thu, Oct 2nd)

by Cyberthreat Blog | Oct 2, 2025 | SANS ISC Bulletins | 0 |

I have been writing about the “.well-known” directory a few times before. Recently,...

Tag: security