On August 21, 2025, Apple released security updates to fix a dangerous zero-day vulnerability (CVE‑2025‑43300) affecting the ImageIO framework across iOS, iPadOS, and macOS. Maliciously crafted image files could trigger an out-of-bounds write, leading to memory corruption and potential remote code execution. The vulnerability was discovered internally and immediately patched by tightening bounds checking.

Who CVE‑2025‑43300 Affects

The patches apply to a wide array of Apple devices:

• iOS & iPadOS: iOS 18.6.2 and iPadOS 18.6.2—covering iPhone XS and newer, iPad Pro (13‑in, 12.9‑in 3rd gen+, 11‑in 1st gen+), iPad Air 3rd gen+, iPad 7th gen+, iPad mini 5th gen+
• Legacy iPads: iPadOS 17.7.10—for older models like iPad Pro 12.9‑in 2nd gen, iPad Pro 10.5‑in, and iPad 6th gen
• macOS: Ventura (13.7.8), Sonoma (14.7.8), Sequoia (15.6.1)

Even though the exploit appears to be highly targeted, affecting a limited set of individuals in sophisticated attacks, Apple strongly urges all users to update immediately.

Expert Commentary on the Situation

This flaw underscores a sobering truth: everyday features like image rendering can become stealthy attack vectors. Attackers exploiting such functionality—common across apps, messaging platforms, and emails—makes detection all the more difficult.

Targeted campaigns like these often point to advanced persistent threat (APT) actors or commercial spyware vendors. With seven zero-days already patched in 2025, Apple faces an ongoing battle to safeguard its users.

How to Stay Safe From CVE‑2025‑43300

• Update immediately to the versions listed above.
• Avoid opening untrusted images, especially from suspicious sources or unknown senders.
• Use security best practices: keep browsers, apps, and OS always up to date.

Conclusion

This latest patch highlights both the sophistication of modern attacks and the critical importance of rapid updates. Even seemingly benign inputs like image files can now have severe consequences. Updating your device, regardless of the perceived risk, remains your most reliable defense.

The post CVE‑2025‑43300 first appeared on www.rivitmedia.com.

The post CVE‑2025‑43300 appeared first on www.rivitmedia.com.

The issue lies in how WebDAV handles file paths. Attackers can use specially crafted .url shortcut files to trick systems into launching malicious code from external WebDAV servers. This zero-day has been weaponized in live attacks, notably by the espionage-focused Stealth Falcon group.

Threat Profile

Deep Dive: How the Exploit Works

How Infections Occur

Victims are lured into opening email attachments appearing to be PDFs. In reality, they’re .url shortcut files pointing to remote content hosted on attacker-controlled WebDAV servers. Once clicked, the system uses built-in utilities to fetch and execute remote scripts, launching the malicious payload.

What Happens Next

The primary malware delivered is the Horus Loader, which then installs the Horus Agent, a stealthy espionage tool. This spyware is capable of:

• Harvesting sensitive documents
• Monitoring user activity
• Performing remote shell commands
• Logging keystrokes without detection

The entire process is designed to evade endpoint defenses and maintain persistent access without user awareness.

Why This Is Dangerous

This exploit abuses trusted system functions (WebDAV and Windows utilities), making it hard to detect. Because it requires no user credentials and operates through seemingly legitimate channels, it can silently compromise both personal and enterprise networks.

Exploit Sample Content

There is no ransom note or phishing text included in this particular attack; it’s a zero-day vulnerability exploit used for cyber-espionage.

Final Thoughts

CVE-2025-33053 represents a serious threat to both individual users and organizations, especially those in defense or government sectors. Its stealthy deployment method and zero-day nature make it particularly insidious. Microsoft has released a patch as part of its June 2025 updates—install it immediately if you haven’t already. For added protection, scan your system using SpyHunter to detect and eliminate any lingering threats linked to this exploit.

The post CVE-2025-33053 WebDAV Vulnerability Exploit first appeared on www.rivitmedia.com.

The post CVE-2025-33053 WebDAV Vulnerability Exploit appeared first on www.rivitmedia.com.

The monthly update covers critical patches across Windows, Office, Azure, and other widely deployed Microsoft products, and arrives amid heightened cybersecurity concerns following a string of high-profile exploits in recent months.

Breakdown of May 2025 Security Vulnerabilities

Microsoft’s May release includes:

• 11 Critical vulnerabilities
• 66 Important vulnerabilities
• 1 Low-severity vulnerability

The most severe issues addressed involve remote code execution (RCE), privilege escalation, and information disclosure, all of which are commonly exploited by threat actors for initial access or lateral movement within networks.

Notably, 28 vulnerabilities could lead to remote code execution, while 21 are tied to privilege escalation. An additional 16 vulnerabilities involve information disclosure, with others affecting denial-of-service and spoofing.

This diverse spread emphasizes the evolving attack surface and the need for layered defense strategies across infrastructure, endpoint, and identity-based security controls.

Five Actively Exploited Zero-Day Vulnerabilities Fixed

Of particular concern are five zero-day vulnerabilities that were already being exploited in the wild before the update. These flaws were serious enough to be included in the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities catalog, mandating federal agencies to apply patches by June 3, 2025.

Here are the critical details of each zero-day flaw:

CVE-2025-30397

Component: Microsoft Scripting Engine
Type: Memory Corruption
Impact: Remote Code Execution
Vector: Malicious web content

This vulnerability allows remote attackers to execute arbitrary code in the context of the user running the application. If exploited, it can be triggered through specially crafted web pages or malicious scripts, making it particularly dangerous for users browsing untrusted sites.

CVE-2025-30400

Component: Desktop Window Manager (DWM) Core Library
Type: Elevation of Privilege
Impact: SYSTEM-level Access

This flaw enables local attackers to gain SYSTEM privileges, the highest level of user rights on a Windows machine. The vulnerability lies in how the DWM Core Library handles certain requests, allowing attackers to bypass standard access controls.

CVE-2025-32701 & CVE-2025-32706

Component: Windows Common Log File System (CLFS)
Type: Elevation of Privilege
Impact: Local Code Execution with Elevated Rights

Both vulnerabilities stem from flaws in the CLFS driver. By exploiting these issues, attackers can run processes with elevated privileges, potentially leading to full system compromise. These types of vulnerabilities are often used in chained exploits after initial access is gained.

CVE-2025-32709

Component: Windows Ancillary Function Driver for WinSock
Type: Elevation of Privilege
Impact: Elevated Access for Local Attackers

This vulnerability provides an attacker with a pathway to escalate privileges via the networking stack. It could be weaponized to move laterally across a compromised network or to gain persistence on affected systems.

Inclusion in CISA’s Known Exploited Vulnerabilities Catalog

The addition of these five vulnerabilities to CISA’s KEV catalog signals their confirmed exploitation in real-world attacks and elevates the urgency for federal systems and private enterprises alike. Under Binding Operational Directive (BOD) 22-01, all federal civilian agencies are required to patch these vulnerabilities by June 3, 2025, or risk compliance violations.

This also serves as a broader warning to critical infrastructure sectors and businesses operating in regulated environments to take swift action.

Broader Security Implications

The May Patch Tuesday rollout is another reminder of the persistent and adaptive nature of threat actors targeting the Microsoft ecosystem. Given the widespread adoption of Windows, Office, and Azure cloud services, vulnerabilities in these platforms can have far-reaching consequences.

From supply chain attacks to ransomware delivery, attackers continue to exploit both overlooked system components and newly discovered flaws. Vulnerabilities in CLFS and WinSock, for example, reflect a pattern of targeting lower-level system drivers that often lack user-level visibility or logging.

Organizations need to treat these threats with the highest level of urgency. Even if no indicators of compromise are immediately visible, unpatched systems are effectively open doors for adversaries leveraging automated exploit kits or sophisticated reconnaissance tactics.

Expert Recommendations for IT and Security Teams

Security professionals across sectors agree: prompt patching is the most effective line of defense against exploitation of known vulnerabilities. However, patch management alone isn’t enough.

Here are key recommendations for enterprise and SMB security teams:

• Prioritize zero-days first: CVE-2025-30397 through CVE-2025-32709 should be patched immediately across all affected systems.
• Apply updates organization-wide: Include both user endpoints and backend systems like virtual machines, domain controllers, and on-prem cloud integrations.
• Audit systems for compromise: Use endpoint detection and response (EDR) tools to look for signs of suspicious behavior or privilege escalation.
• Update attack surface reduction rules: Strengthen Group Policy Objects (GPOs) and endpoint hardening to reduce script-based and driver-based attacks.
• Communicate with end-users: Inform staff about the importance of patching, and consider enforced restarts or scheduled patching windows to ensure updates are fully applied.

Closing Thoughts

Microsoft’s May 2025 Patch Tuesday is a crucial security update that addresses not just routine bugs but active threatsimpacting users worldwide. With five zero-day exploits already in the wild, the window for action is narrow.

Security teams, systems administrators, and CISOs must act swiftly to prevent compromise and ensure resilience. In today’s digital landscape, failing to patch known vulnerabilities is equivalent to leaving the door open — and adversaries are always knocking.

SEO-Optimized Tags

Microsoft Patch Tuesday, May 2025 updates, CVE-2025-30397, Microsoft zero-day, actively exploited vulnerabilities, Windows security updates, Microsoft vulnerability patch, remote code execution, elevation of privilege, CISA KEV catalog, Patch Tuesday zero-day flaws, DWM vulnerability, CLFS driver flaw, WinSock security issue, system privilege escalation, critical Windows patches

The post Microsoft’s May 2025 Patch Tuesday: Five Actively Exploited Zero-Day Vulnerabilities Addressed first appeared on www.rivitmedia.com.

The post Microsoft’s May 2025 Patch Tuesday: Five Actively Exploited Zero-Day Vulnerabilities Addressed appeared first on www.rivitmedia.com.

In April 2025, Apple confirmed the exploitation of two newly discovered zero-day vulnerabilities—CVE-2025-31200 and CVE-2025-31201—that have been used in highly targeted cyberattacks. These threats are not your typical drive-by malware incidents; they’re part of a rising wave of surgical strikes against high-value individuals such as journalists, human rights defenders, and government officials.

“These attacks are not random. They are precise, persistent, and alarmingly sophisticated.”
— Cybersecurity analyst Lena Cordero, SafeGuard Alliance

Breaking Down the Threats: What Are CVE-2025-31200 and CVE-2025-31201?

Together, these two zero-days can allow total device takeover without user interaction—a classic example of a zero-click exploit chain.

Who’s at Risk?

While all Apple users are encouraged to update their devices immediately, certain groups face disproportionate riskdue to the nature of their work or visibility.

 High-Risk User Categories

• Investigative Journalists
• Political Dissidents & Human Rights Activists
• Government Employees & Diplomats
• NGO Workers Operating in Hostile Regions

These users are often the target of state-sponsored espionage, as seen in past cases like Pegasus spyware and NSO Group surveillance campaigns.

“Today, threats aren’t about mass infections—they’re about precision-targeted infiltration.”
— Eva Rehman, Threat Intelligence Lead at CyberWatch Global

Lockdown Mode: The First Line of Defense for the High-Risk

Apple’s Lockdown Mode, introduced with iOS 16, was designed for situations exactly like this. While it may disable certain functionalities, it significantly reduces the attack surface on your device.

What Lockdown Mode Does?

 Enable it via:
Settings > Privacy & Security > Lockdown Mode

Checklist: How High-Risk Users Can Stay Safer Today

Action	Description
Update Your OS	Always use the latest iOS/macOS versions. These vulnerabilities were patched in the April 2025 update.
Enable Lockdown Mode	Strongly recommended for high-risk users.
Avoid Suspicious Media Files	Don’t open unknown audio/video files—even from known contacts if they seem out of context.
Get a Cybersecurity Consultation	Work with a professional to audit and harden your digital hygiene.
Use Encrypted Messaging Only	Apps like Signal (with disappearing messages) are safer than mainstream messengers.

The Bigger Picture: A Trend, Not an Exception

These two zero-days are part of a pattern. From the Pegasus revelations to the Hermit spyware, there’s been an accelerating trend in cyberweaponization aimed at influential or exposed individuals.

“You don’t need to be a hacker’s enemy to be a target—just a person of interest.”
— Arjun Dutta, Senior Advisor at Electronic Frontier Foundation

Final Thoughts: Security is No Longer Optional

This recent exploit duo underscores a simple truth: in 2025, digital defense is life defense for high-risk users. Proactive protection measures are no longer optional—they’re essential. And with tools like Lockdown Mode, Apple’s ecosystem offers a strong but underutilized first line of defense.

Stay vigilant. Stay updated. Stay secure.

The post Targeted Exploits Highlight Need for Vigilance Among High-Risk Apple Users first appeared on www.rivitmedia.com.

The post Targeted Exploits Highlight Need for Vigilance Among High-Risk Apple Users appeared first on www.rivitmedia.com.

This wasn’t a win. It was a bandage on a severed artery.

Understanding CVE and CWE: The Dynamic Duo of Cyber Hygiene

If you’ve ever read a security bulletin or patched your software based on a known bug, chances are you’ve seen a CVE.
CVE (Common Vulnerabilities and Exposures) acts as the global dictionary of specific software flaws—things like:

“Buffer overflow in XYZ version 3.0 allows remote attackers to execute arbitrary code.”

CWE (Common Weakness Enumeration), on the other hand, zooms out. It categorizes the types of mistakes developers make that lead to vulnerabilities:

“Improper input validation” or “insecure deserialization,” for example.

Think of CVE as the diagnosis and CWE as the underlying condition.
Together, they are essential to the software world’s immune system: developers rely on them to code defensively, vendors use them to coordinate patches, and security teams build entire risk models around them.

Their importance cannot be overstated. In fact, no major security tool, threat feed, or vulnerability scanner functions without them.

The Cost of Centralization

And yet, the very lifeblood of the cybersecurity ecosystem is sustained by a fragile, centralized model.

Both CVE and CWE are U.S.-government-funded programs operated by the MITRE Corporation—a federally funded R&D center. While MITRE has long been respected for its stewardship, cracks have formed in the foundation. As global software supply chains expand and vulnerabilities skyrocket, the weight of maintaining these registries has become immense.

According to vulnerability researchers at CERT/CC, the number of new CWE entries has stagnated, despite the explosion of new exploit patterns emerging in the wild. The research community is struggling to keep up.

Meanwhile, the CVE registry continues to balloon:

We’re on pace to hit nearly 30,000 CVEs in 2024, but with limited funding and a small team, the ability to process, verify, and publish those vulnerabilities under a consistent taxonomy is faltering.

This creates dangerous gaps in knowledge-sharing—and worse, delays in remediation.

MITRE’s Own Warning: A System on the Brink

The seriousness of the situation was made plain by MITRE itself.

On the eve of the funding deadline, Yosry Barsoum, Vice President at MITRE, issued a warning that read like a cyber emergency alert:

“A lapse in funding would degrade national databases and incident response efforts—not just in the U.S., but everywhere the CVE/CWE frameworks are used.”

This isn’t bureaucratic panic—it’s a global red flag.

If CVE and CWE were to go dark, the ripple effects would include:

•  Disruption to global patch management systems, breaking update schedules for thousands of vendors
•  Inconsistencies in vulnerability tracking, leading to misaligned severity scores and confusion across platforms
•  Delays in Zero-Day remediation, leaving systems exposed to active exploitation for longer

The scariest part? There is currently no backup. No decentralized alternative. No clear Plan B.

Enter the CVE Foundation: A New Hope?

As the clock ticked toward shutdown, an unexpected announcement shifted the conversation.

A coalition of CVE Board members—including international researchers, nonprofit advocates, and former MITRE collaborators—unveiled the CVE Foundation, a newly established nonprofit organization with a bold vision:

“This is about eliminating a single point of failure,” the board stated in a joint release.

The Foundation aims to eventually assume responsibility for the CVE and CWE programs, removing exclusive U.S. government control and shifting toward neutral, community-driven governance.

Their mission is ambitious but clear:

•  Ensure open access to vulnerability information for all nations and organizations
•  Build a global, federated model where no single entity can halt or delay critical cyber infrastructure
•  Strengthen resilience by distributing operations across geographies and stakeholders

Think of it as turning CVE from a national project into an international utility—a WHO for software vulnerabilities.

Industry Reaction: Relief, Mixed with Caution

The cyber community had plenty to say. Relief that the system didn’t crash—but frustration that we’re still this close to disaster.

“Glad it’s still running. But we need a future where it doesn’t come down to a midnight decision.”
— Kaitlin Harding, Open Source Security Coalition

“It’s like finding out the traffic light system for the world is controlled by one city. Great until the power goes out.”
— @CyberSecMeg on Twitter

Security vendors, open-source maintainers, and bug bounty hunters have long relied on CVE and CWE for their daily work. The idea that this infrastructure could collapse without congressional intervention is not just absurd—it’s unacceptable.

Final Takeaway: The Clock is Still Ticking

Let’s be clear: CISA’s extension was a stay of execution, not a solution.
CVE and CWE survived this time, but the system is still dangerously brittle.

The world’s most important cybersecurity registries cannot be beholden to short-term contracts, single governments, or unpredictable budgets. In a landscape where a single overlooked flaw can lead to multi-billion-dollar breaches, global cyber hygiene demands an independent, resilient, and transparent backbone.

We’ve been given time. Let’s use it wisely—because next time, the lights might actually go out.

The post CVE and CWE Survive the Guillotine — but the System is Screaming for Independence first appeared on www.rivitmedia.com.

The post CVE and CWE Survive the Guillotine — but the System is Screaming for Independence appeared first on www.rivitmedia.com.

While Fortinet’s disclosure focuses on the post-exploitation persistence, what’s arguably more interesting is how SSL VPNs themselves have evolved into the go-to entry point for elite cyber actors—and how the very convenience of remote access is now a liability.

SSL VPNs: A Double-Edged Sword

SSL VPNs were designed to simplify remote access, especially in the hybrid work era. But as companies doubled down on remote connectivity, attackers did the same. The now-infamous CVE-2022-42475 wasn’t just a bug—it was a gold mine for any attacker wanting in.

The exploit allows for unauthenticated remote code execution, giving adversaries system-level control over unpatched devices. But here’s the kicker: this vulnerability was disclosed in late 2022. So why are attackers still finding success in 2025?

Because organizations are failing at patch hygiene and security visibility. Thousands of FortiGate devices remain vulnerable due to inconsistent update schedules, poor monitoring, or—worse—misconfigured patch deployments that leave holes wide open.

Threat Actors Are Patient, Admins Are Not

Fortinet’s latest threat intel suggests these actors gained access months ago and waited—installing stealthy payloads, collecting data, and prepping for lateral movement. This wasn’t smash-and-grab; this was long-game infiltration.

The malware, often hidden in places like /data/lib/ or /flash/, is designed to evade detection. One notable finding is the attackers’ use of tampered SSH binaries, allowing them to authenticate invisibly without triggering standard security alerts.

Why This Matters Beyond Fortinet

This isn’t just Fortinet’s problem. It’s a wake-up call for the entire industry. SSL VPN appliances across brands—from Palo Alto to SonicWall—have all faced similar vulnerabilities in recent years. The Fortinet breach is simply a snapshot of a systemic issue: the overreliance on perimeter-based VPN security, and the chronic underinvestment in post-breach detection.

The Future Is Zero Trust—or Bust

As VPNs become the weakest link, many are pushing for Zero Trust Network Access (ZTNA) as a more secure alternative. Even Fortinet has begun including ZTNA in its product messaging, positioning it as a modern replacement for legacy VPN solutions.

Until then, admins should take advantage of Fortinet’s updated mitigation guidance, begin threat hunting for backdoors, and ensure their infrastructure is clean—not just patched.

The post Fortinet’s Hard Lesson: How Threat Actors Turned VPNs into High-Value Entry Points first appeared on www.rivitmedia.com.

The post Fortinet’s Hard Lesson: How Threat Actors Turned VPNs into High-Value Entry Points appeared first on www.rivitmedia.com.

This case is more than a story of cybercrime—it’s a cautionary tale about operational security, the blurred lines between white-hat and black-hat hacking, and the unintended enabling role of AI tools like ChatGPT in the hands of ambitious threat actors.

The Bug Hunter Turned Hacker

The individual behind EncryptHub started on a path familiar to many in tech: self-taught, ambitious, and eager to break into the cybersecurity industry. Freelancing as a developer, he eventually turned to bug bounty platforms to earn a legitimate income. However, limited success pushed him toward a darker avenue—cybercrime.

Rather than abandoning his legitimate aspirations, he juggled both lives. By day, he reported vulnerabilities; by night, he unleashed malware. This duality is nowhere more evident than in his 2025 disclosures of CVE-2025-24061 (a Mark of the Web bypass) and CVE-2025-24071 (a File Explorer spoofing vulnerability), both addressed by Microsoft and credited to “SkorikARI with SkorikARI”—a name now inseparable from EncryptHub.

The Smoking Gun: Poor OpSec and AI Confessions

Despite his technical prowess, EncryptHub’s downfall came from poor operational security (OpSec)—a recurring irony among technically gifted threat actors. According to Kraken Labs, the unraveling of his identity began with password reuse. An exfiltrated file revealed that 82 of 200 stolen credentials had nearly identical passwords with minor variations.

These sloppy password practices gave researchers direct access to:

• EncryptRAT Command-and-Control servers
• Bulletproof hosting panels
• Cryptocurrency exchanges
• SSL certificate portals
• Domain registrars

Even more damning was his blending of personal and criminal identities:

• Reused personal and criminal usernames and passwords
• Managed hacking infrastructure with personal email accounts
• Used the same system for both malware development and personal activity
• Repurposed legitimate development infrastructure for criminal use

But the most revealing leak? His ChatGPT history.

ChatGPT: The Inadvertent Accomplice

Security researchers unearthed thousands of messages exchanged between EncryptHub and ChatGPT. These conversations served as a goldmine of evidence—not only confirming the link between EncryptHub and SkorikARI, but also detailing the technical and philosophical journey of a conflicted hacker.

ChatGPT reportedly helped EncryptHub:

• Develop infrastructure: Telegram bots, C2 servers, phishing sites, .onion services
• Write malware: Custom stealers, clippers, loaders
• Learn new skills: REST APIs, macOS app development, PowerShell scripting in Go
• Optimize and understand malware code from other developers
• Create phishing lures with greater psychological impact

Remarkably, EncryptHub also used the AI tool as a sort of confessional. He debated the morality of his actions, lamented industry bias, and asked for help on how to pivot from cybercrime to running a legitimate cybersecurity firm.

The Human Element: Ambition, Conflict, and Consequences

Behind the exploits lies a human story—one of ambition, failure, reinvention, and contradiction. This individual is not a typical faceless adversary. He is a reflection of the complexity of the cybersecurity world, where the same skills that protect can also be used to exploit.

He represents a new breed of threat actor—technically sophisticated but emotionally torn, capable of doing good but drawn into cybercrime by the lure of faster returns and a lack of recognition from the legitimate world.

Lessons from the EncryptHub Case

The report closes with a sobering message: no matter how talented or technically gifted a hacker is, basic mistakes can destroy even the most carefully crafted façade.

Key takeaways include:

1. Operational Security Is Critical
   Reusing passwords, devices, and infrastructure is a recipe for exposure.
2. AI Tools Are Double-Edged Swords
   ChatGPT provided technical assistance, but also became a digital diary of criminal activity.
3. Intentions Don’t Erase Actions
   Even though EncryptHub tried to “go legit,” his actions harmed hundreds of organizations.
4. Security Awareness Still Works
   The report concludes with a powerful reminder:”The most complex 0-day exploit is useless against a user that knows better than download a suspicious executable from a shady site.”
5. The Cybersecurity Industry Must Bridge the Gap
   When talented individuals turn to crime due to a lack of opportunity or recognition, it highlights a systemic issue in how talent is identified, nurtured, and rewarded.

Final Thoughts: Talent Misguided, Not Lost

EncryptHub’s double life is now public, and his reputation in both the cybercriminal and white-hat communities will never be the same. But his story is not entirely one of failure. It’s a harsh reminder that brilliance without boundaries can be both dangerous and tragic.

As the cybersecurity world absorbs the implications of this case, it should also ask: how many others like EncryptHub are out there, walking the line between ethical hacking and digital destruction?

The post Unmasking EncryptHub: The Double Life of a Rising Cybercriminal and Microsoft-Recognized Bug Hunter first appeared on www.rivitmedia.com.

The post Unmasking EncryptHub: The Double Life of a Rising Cybercriminal and Microsoft-Recognized Bug Hunter appeared first on www.rivitmedia.com.

Understanding the CVE-2024-10668 Vulnerability

Quick Share, formerly known as Nearby Share, was developed by Google as a cross-platform tool to make file transfers between Android devices, Chromebooks, and Windows PCs as easy as possible. Think of it as a competitor to Apple’s AirDrop — quick, easy, and designed for seamless transfers. But as with any widely-used tool, vulnerabilities can emerge that compromise the very convenience users enjoy.

The vulnerability identified as CVE-2024-10668 allows attackers to perform two major actions:

Bypassing File Transfer Approval

Quick Share typically requires user approval to accept incoming files. However, researchers discovered that an attacker could manipulate the tool by sending two files with the same payload ID during a single session. Quick Share would only delete the first file, leaving the second file undetected and fully accessible in the Downloads folder. This allows unauthorized files to slip through the cracks and end up on your device without your consent.

Denial-of-Service (DoS) Condition

The second flaw exploits a malformed UTF-8 filename, which causes Quick Share to crash. This results in a DoS attack, essentially freezing or shutting down the application. While it may not allow direct access to your data, it still disrupts the functionality of the tool, leaving users with an unreliable file-sharing experience.

How the Flaws Evolved

It’s important to note that these vulnerabilities aren’t entirely new. In August 2024, SafeBreach Labs identified several security flaws within Quick Share, tracked as CVE-2024-38271 and CVE-2024-38272, which could be exploited to run arbitrary code on Windows devices. Following responsible disclosure, Google issued patches to address the issues. However, the new research suggests that some of the vulnerabilities remained unpatched or only partially fixed, leading to the reemergence of the problems.

What this teaches us is a valuable lesson about cybersecurity: simply patching over a problem doesn’t always eliminate it completely. If the root cause isn’t addressed thoroughly, vulnerabilities may persist in more subtle forms. This case serves as a reminder that post-patch testing and continuous vigilance are essential to ensure that software tools are genuinely secure.

What You Can Do to Protect Yourself from CVE-2024-10668

So, how can you protect yourself from these vulnerabilities in Quick Share, as well as similar security issues in other file-sharing tools? Here’s a list of actionable steps you can take to secure your data and ensure that you aren’t leaving your device open to malicious attacks:

Keep Your Software Updated

One of the easiest and most effective ways to protect yourself is by ensuring that your software is up to date. Google has already released a patch to fix the vulnerability in Quick Share for Windows version 1.0.2002.2. Regularly check for updates to all your software, especially security-related tools like Quick Share, to make sure that any newly discovered vulnerabilities are addressed as soon as possible. Enable automatic updates whenever possible to ensure you never miss a critical security patch.

Use Reputable File-Sharing Services

While Quick Share is widely used, it’s important to be selective about the tools you use for file sharing. Opt for file-sharing platforms that are well-known for their security measures and have a solid track record of keeping user data safe. Look for features like end-to-end encryption, which ensures that your files are securely transferred without being intercepted or tampered with.

Additionally, choose services that are compliant with data privacy regulations, such as the General Data Protection Regulation (GDPR) in the EU or California Consumer Privacy Act (CCPA) in California. These regulations set standards for how companies handle your personal data, offering an extra layer of protection.

Enable Multi-Factor Authentication (MFA)

Multi-factor authentication (MFA) adds an extra layer of security to your accounts by requiring more than just a password to gain access. While it’s a common security measure for online services, it’s often overlooked for file-sharing tools. If Quick Share or any other file-sharing platform supports MFA, make sure to enable it. Even if a malicious actor manages to exploit a vulnerability, they’ll need additional authentication to gain access to your data.

Be Cautious with Shared Links

Another security precaution is to be cautious with how you share files. When sending files, always set expiration dates for shared links to ensure that they don’t remain accessible indefinitely. This minimizes the risk of unauthorized access to your files after you’ve shared them. Avoid using public sharing links unless absolutely necessary, as these links can easily be accessed by anyone with the URL.

Moreover, always verify the recipient before sending any sensitive information. A simple message to confirm that they are expecting the files can help prevent mistakes and unauthorized transfers.

Monitor File Access and Activity

For those using Quick Share in professional or sensitive contexts, it’s a good idea to monitor file access and set up alerts for any unusual activity. This allows you to quickly detect when a file has been accessed without your knowledge or if an unexpected file transfer occurs. Many file-sharing services, including cloud storage platforms, offer audit logs and access tracking features to help you stay informed.

Educate Yourself and Others

Cybersecurity isn’t just about tools and settings; it’s also about awareness. Make sure that everyone who uses file-sharing tools in your environment — whether at home or in a workplace — is aware of security best practices. Educate them on the risks of transferring files without approval, the importance of keeping software updated, and how to identify phishing attempts that could lead to malicious file transfers.

Conclusion: A Wake-Up Call for File-Sharing Security

The CVE-2024-10668 vulnerability serves as a stark reminder that no software, no matter how popular, is invulnerable to security issues. This flaw, along with others discovered in Quick Share, highlights the need for ongoing vigilance and robust security practices when it comes to file-sharing tools.

As we continue to rely on tools like Quick Share for convenience and efficiency, it’s essential to take the necessary steps to protect our data. By keeping software up to date, using trusted services, enabling MFA, being cautious with file sharing, and staying informed, we can ensure that our devices remain secure against potential threats.

Security is a shared responsibility. While companies like Google must address vulnerabilities promptly, users also play a crucial role in safeguarding their own data. By following the steps outlined above, you can minimize the risk of falling victim to cyberattacks and enjoy a safer digital experience.

The post CVE-2024-10668 first appeared on www.rivitmedia.com.

The post CVE-2024-10668 appeared first on www.rivitmedia.com.

A newly uncovered critical vulnerability in the popular Next.js React framework is raising alarms among developers and security professionals alike. Tracked as CVE-2025-29927, the flaw has been assigned a CVSS score of 9.1, indicating a critical risk level. The vulnerability enables threat actors to bypass middleware-based authorization checks by exploiting the internal x-middleware-subrequest header—potentially granting unauthorized access to sensitive, privileged resources.

Discovered and publicly disclosed by security researcher Rachid Allam (also known by the handles zhero and cold-try), the flaw has already been addressed by the Next.js team in multiple patch releases. However, due to the availability of technical details online, systems that have not been updated remain at high risk of exploitation.

CVE-2025-29927 Overview

The vulnerability resides in the way Next.js manages internal subrequests using the x-middleware-subrequest header. Originally designed to prevent infinite request loops in middleware pipelines, this header can be manipulated by an attacker in specific circumstances to entirely skip middleware execution.

In systems that rely solely on middleware for handling authorization and access control, this creates a critical security hole. Attackers can forge requests with the manipulated header to bypass authentication checks, allowing access to admin-only pages, sensitive data endpoints, or restricted user resources—without ever logging in.

Vulnerability Details

Patched Versions Now Available

The Next.js team has responded swiftly, issuing patches for all actively maintained versions of the framework. The vulnerability has been resolved in the following versions:

• 12.3.5
• 13.5.9
• 14.2.25
• 15.2.3

Developers who are unable to immediately upgrade should block external requests containing the x-middleware-subrequest header at the server level to mitigate the risk temporarily.

Real Risk to Middleware-Only Security Models

According to a report from JFrog, this vulnerability is particularly dangerous for applications that use middleware as the sole method for user authorization. Without additional authentication layers (such as server-side session validation or route guards), a malicious actor can easily bypass protection using a modified HTTP header.

This flaw highlights the importance of layered security models in web applications. Relying exclusively on middleware for access control introduces fragility and increases the attack surface when unexpected behaviors like this emerge.

Removal & Mitigation Guide for CVE-2025-29927

The CVE-2025-29927 vulnerability in the Next.js framework allows attackers to bypass middleware-based authorization by manipulating the x-middleware-subrequest header. To protect your application, follow the steps below to remove the vulnerability and harden your security posture.

Step 1: Upgrade to a Patched Version

The safest and most effective way to address this flaw is by upgrading Next.js to a patched version.

Upgrade Targets:

• 12.3.5
• 13.5.9
• 14.2.25
• 15.2.3

How to upgrade:

Open your terminal and run the appropriate command for your project:

bashCopyEditnpm install next@12.3.5
# or for newer versions
npm install next@15.2.3

Then, rebuild your project:

bashCopyEditnpm run build

Step 2: Implement Temporary Header Filtering (If You Can’t Patch)

If you’re unable to upgrade immediately, implement a server-side filter to block requests containing the x-middleware-subrequest header from untrusted sources.

Example (Next.js Custom Server – Express):

javascriptCopyEditconst express = require('express');
const next = require('next');

const app = next({ dev: false });
const handle = app.getRequestHandler();

app.prepare().then(() => {
  const server = express();

  // Header check middleware
  server.use((req, res, next) => {
    if (req.headers['x-middleware-subrequest']) {
      return res.status(403).send('Forbidden: Malicious header detected');
    }
    next();
  });

  server.all('*', (req, res) => {
    return handle(req, res);
  });

  server.listen(3000, () => {
    console.log('Server listening on port 3000');
  });
});

Example (Vercel Middleware – Edge Function Filter):

jsCopyEditimport { NextResponse } from 'next/server';

export function middleware(request) {
  const headerValue = request.headers.get('x-middleware-subrequest');

  if (headerValue) {
    return new Response('Forbidden', { status: 403 });
  }

  return NextResponse.next();
}

Step 3: Strengthen Authorization Logic

Avoid relying solely on middleware for authentication or access control.

• Use server-side checks on API routes and page-level logic.
• Verify user sessions or tokens within your server logic (e.g., inside getServerSideProps or API route handlers).
• Implement role-based access control (RBAC) at the route or controller level, not just middleware.

Step 4: Test for Exploitable Behavior

After patching or mitigating:

1. Simulate a forged request with the x-middleware-subrequest header.
2. Attempt to access restricted routes or admin panels.
3. Verify that the request is denied or redirected appropriately.

Use tools like Postman, curl, or Burp Suite to test request manipulation:

bashCopyEditcurl -H "x-middleware-subrequest: 1" https://yourdomain.com/admin

Step 5: Monitor and Log Suspicious Activity

• Set up WAF (Web Application Firewall) rules to detect suspicious headers.
• Use logging tools to monitor for repeated requests containing the x-middleware-subrequest header.
• Investigate anomalies in access logs, especially for admin or restricted routes.

Conclusion

CVE-2025-29927 is a highly critical flaw in the Next.js framework that presents a real threat to web applications handling sensitive or privileged content. With public disclosure and technical details already available, time is of the essence. Developers must prioritize patching or apply server-side mitigations immediately to prevent unauthorized access through this vector.

Failure to address this vulnerability could result in unauthorized data access, privilege escalation, and potential compliance violations, especially in apps storing personal or financial information.

The post Address CVE-2025-29927 first appeared on www.rivitmedia.com.

The post Address CVE-2025-29927 appeared first on www.rivitmedia.com.

Overview of CVE-2024-48248

CVE-2024-48248 is an absolute path traversal vulnerability in NAKIVO Backup & Replication software that allows unauthorized attackers to access and read sensitive files stored on compromised systems. The flaw has been assigned a CVSS severity score of 8.6, categorizing it as a high-severity vulnerability.

Affected Versions

All versions of NAKIVO Backup & Replication prior to 10.11.3.86570 are affected by this flaw. The vulnerability was patched in version 11.0.0.88174, released in November 2024.

How CVE-2024-48248 is Exploited

Threat actors exploiting this vulnerability can access critical system files, including /etc/shadow, through the /c/router endpoint. The flaw allows unauthorized access to configuration files, backups, and stored credentials.

Potential Impact of CVE-2024-48248

Cybersecurity firm watchTowr Labs has confirmed that a proof-of-concept (PoC) exploit was publicly released at the end of last month, significantly increasing the risk of widespread exploitation. Attackers can leverage this vulnerability to:

• Extract credentials from the product01.h2.db database file, potentially compromising entire backup environments.
• Access backup configurations and system files, leading to privilege escalation and further exploitation.
• Serve as a stepping stone for deeper infiltration into the affected network, enabling adversaries to take full control over affected systems.

Given the potential consequences of a successful attack, security experts strongly advise organizations using NAKIVO Backup & Replication to take immediate remedial actions.

Other Vulnerabilities Added to the KEV Catalog

Alongside CVE-2024-48248, CISA has also added two other vulnerabilities to its KEV catalog:

• CVE-2025-1316 (CVSS 9.3) – A critical OS command injection flaw in Edimax IC-7100 IP cameras that allows remote attackers to execute arbitrary commands. This vulnerability remains unpatched as the device has reached end-of-life.
• CVE-2017-12637 (CVSS 7.5) – A directory traversal vulnerability in SAP NetWeaver Application Server (AS) Java, which attackers can exploit to read arbitrary files.

Cybersecurity firm Akamai has observed that CVE-2025-1316 has been exploited since May 2024, with attackers leveraging default credentials to integrate compromised Edimax cameras into Mirai botnet variants.

CISA’s Response and Security Mandates

In response to these threats, CISA has issued a directive requiring all Federal Civilian Executive Branch (FCEB) agencies to implement the necessary security patches by April 9, 2025. Organizations that fail to apply the patches remain at heightened risk of exploitation.

Preventive Measures Against CVE-2024-48248

To mitigate the risks associated with CVE-2024-48248, security experts recommend the following best practices:

1. Immediate Software Update:
   • Upgrade to NAKIVO Backup & Replication v11.0.0.88174 or later, as this version contains a security patch addressing the flaw.
   • Regularly check for and apply security updates to keep software secure from emerging vulnerabilities.
2. Restrict Access to Backup Systems:
   • Limit network exposure of backup servers by placing them behind firewalls.
   • Use Virtual Private Network (VPN) or Zero Trust Network Access (ZTNA) solutions for remote access.
3. Monitor for Suspicious Activities:
   • Review system logs for unauthorized access attempts.
   • Deploy Intrusion Detection Systems (IDS) to detect and block malicious exploitation attempts.
4. Secure Credential Storage:
   • Store backup credentials in a separate, secure location.
   • Implement multi-factor authentication (MFA) to reduce the risk of credential theft.
5. Apply Principle of Least Privilege (PoLP):
   • Restrict user permissions to minimize access to critical backup files and configurations.
   • Regularly audit user privileges and remove unnecessary administrative access.

Steps to Check for and Mitigate the Vulnerability

If your organization uses NAKIVO Backup & Replication software, follow these steps to determine if you are vulnerable and mitigate the risks:

1. Check the Installed Version:
   • Open NAKIVO Backup & Replication.
   • Navigate to Help → About to verify the current version.
   • If the version is below 11.0.0.88174, the system is vulnerable.
2. Upgrade to the Latest Version:
   • Download the latest patched version from the official NAKIVO website.
   • Follow the provided installation instructions to update your backup solution.
3. Review System Logs:
   • Look for unauthorized access attempts, particularly through the /c/router endpoint.
   • Investigate anomalies, such as unexpected file access or database queries.
4. Change Credentials and Security Keys:
   • If the system was exposed to potential exploitation, reset all credentials stored within the backup environment.
   • Change any compromised passwords and update encryption keys.
5. Enhance Network Security:
   • Ensure that backup servers are behind a secure firewall.
   • Restrict external access and disable unnecessary services.

Final Thoughts

CVE-2024-48248 represents a significant security risk, especially given its active exploitation in the wild. Organizations using NAKIVO Backup & Replication should immediately update their software and implement robust security measures to protect their infrastructure.

By staying vigilant, applying patches promptly, and following best security practices, businesses can mitigate the risks associated with this vulnerability and safeguard their data against cyber threats.

For further updates and security advisories, organizations should regularly monitor CISA’s KEV catalog and their cybersecurity infrastructure.

References

• CISA Known Exploited Vulnerabilities (KEV) Catalog
• NAKIVO Backup & Replication Security Updates
• watchTowr Labs Vulnerability Report

The post CVE-2024-48248: High-Severity NAKIVO Backup & Replication Vulnerability Actively Exploited first appeared on www.rivitmedia.com.

The post CVE-2024-48248: High-Severity NAKIVO Backup & Replication Vulnerability Actively Exploited appeared first on www.rivitmedia.com.