CitrixBleed 2: Electric Boogaloo — CVE-2025–5777 Remember CitrixBleed, the vulnerability where a simple HTTP request would dump memory, revealing session tokens? CVE-2023–4966 It’s back like Kanye West returning to Twitter about two years later, this time as CVE-2025–5777. another high quality vulnerability…
Category: DoublePulsar – Medium
CitrixBleed 2: Electric Boogaloo — CVE-2025–5777
CitrixBleed 2: Electric Boogaloo — CVE-2025–5777 Remember CitrixBleed, the vulnerability where a simple HTTP request would dump memory, revealing session tokens? CVE-2023–4966 It’s back like Kanye West returning to Twitter about two years later, this time as CVE-2025–5777. another high quality vulnerability…
Big Game Ransomware: the myths experts tell board members
There’s a piece in The Sunday Times today about the DragonForce ransomware incident at Marks and Spencer which caught my eye. It’s a great piece, e.g. it looks at M&S containing the threat to eradicate it. For example, the incident…
DragonForce Ransomware Cartel attacks on UK high street retailers: walking in the front door
The individuals operating under the DragonForce banner and attacking UK high street retailers are using social engineering for entry. I think it’s in the public interest to break down what is happening. The attacks on Marks and Spencer, Co-op and…
Microsoft’s patch for CVE-2025–21204 symlink vulnerability introduces another symlink vulnerability
Microsoft recently patched CVE-2025–21204, a vuln which allows users to abuse symlinks to elevate privileges using the Windows servicing stack and the c:\inetpub folder. There’s a good write up here: Edit: removed that link as I pasted the wrong link. To…
Microsoft’s patch for CVE-2025–21204 symlink vulnerability introduces another symlink vulnerability
Microsoft recently patched CVE-2025–21204, a vuln which allows users to abuse symlinks to elevate privileges using the Windows servicing stack and the c:\inetpub folder. There’s a good write up here: Abusing the Windows Update Stack to Gain SYSTEM Access (CVE-2025-21204) To…
Microsoft Recall on Copilot+ PC: testing the security and privacy implications
Some background on Recall Last year, Microsoft announced Recall, a feature which screenshots your PC every few seconds, OCRs the screenshots and produces a searchable text database of everything you’ve ever viewed or written from your computer. I took a look…
Oracle attempt to hide serious cybersecurity incident from customers in Oracle SaaS service
Being a provider of cloud SaaS (Software-as-a-service) solutions requires certain cybersecurity responsibilities — including being transparent and open. The moment where this is tested at Oracle has arrived, as they have a serious cybersecurity incident playing out in a service they manage…
Oracle attempt to hide serious cybersecurity incident from customers in Oracle SaaS service
Being a provider of cloud SaaS (Software-as-a-service) solutions requires certain cybersecurity responsibilities — including being transparent and open. The moment where this is tested at Oracle has arrived, as they have a serious cybersecurity incident playing out in a service they manage…
No, there isn’t a world ending Apache Camel vulnerability
Posts have been circulating publicly on the internet for several days about a “critical”, end of the world “zero day” in Apache Camel, CVE-2025–27636. Many of the posts explained in specific detail about how to exploit the vulnerability — despite the fact…
No, there isn’t a world ending Apache Camel vulnerability
Posts have been circulating publicly on the internet for several days about a “critical”, end of the world “zero day” in Apache Camel, CVE-2025–27636. Many of the posts explained in specific detail about how to exploit the vulnerability — despite the fact…
No, there isn’t a world ending Apache Camel vulnerability
Posts have been circulating publicly on the internet for several days about a “critical”, end of the world “zero day” in Apache Camel, CVE-2025–27636. Many of the posts explained in specific detail about how to exploit the vulnerability — despite the fact…
Use one Virtual Machine to own them all — active exploitation of ESXicape
Use one Virtual Machine to own them all — active exploitation of VMware ESX hypervisor escape ESXicape Yesterday, VMware quietly released patches for three ESXi zero day vulnerabilities: CVE-2025–22224, CVE-2025–22225, CVE-2025–22226. The advisory: Support Content Notification – Support Portal – Broadcom support portal…
Use one Virtual Machine to own them all — active exploitation of ESXicape
Use one Virtual Machine to own them all — active exploitation of VMware ESX hypervisor escape ESXicape Yesterday, VMware quietly released patches for three ESXi zero day vulnerabilities: CVE-2025–22224, CVE-2025–22225, CVE-2025–22226. The advisory: Support Content Notification – Support Portal – Broadcom support portal…
2022 zero day was used to raid Fortigate firewall configs. Somebody just released them.
Back in 2022, Fortinet warned that somebody had a zero day vulnerability and was using it to exploit Fortigate firewalls https://www.fortinet.com/blog/psirt-blogs/update-regarding-cve-2022-40684 Today, Belsen Group publicly released Fortigate firewall configs from just over 15k unique devices: Kevin Beaumont (@GossiTheDog@cyberplace.social) I have been…
Handala attempts a supply chain hack via ReutOne
During the week, Handala — a group painfully in love with Israel, breached ReutOne, a small Microsoft 365 Dynamics reseller. They sent out an email to their customers on 24th December 2024, asking them to run a software update: Kevin Beaumont (@GossiTheDog@cyberplace.social) The…
Burning Zero Days: FortiJump FortiManager vulnerability used by nation state in espionage via MSPs
Yes, I’ve made a logo in crayon and named this FortiJump. Did you know there’s widespread exploitation of FortiNet products going on using a zero day, and that there’s no CVE? Now you do. I’ve even made a picture explaining! I…
EIW — ESET Israel Wiper — used in active attacks targeting Israeli orgs
EIW — ESET Israel Wiper — used in active attacks targeting Israeli orgs One of my Mastodon followers sent me an interesting toot today: This lead me to this forum post: "Government-Backed Attackers May Be Trying to Compromise Your Device!" email With this email: The forum post had…
Hacker group Handala Hack Team claim battery explosions linked to Israeli battery company.
Iran linked hacker group Handala Hack Team claim pager explosions linked to Israeli battery company Back in May, I started tracking Handala, a hacktivist branded group expressing pro-Palestine views: https://medium.com/media/8e57dca18a2af602b3beccdc5549dca0/href Handala is word which is a prominent national symbol and personification…
Hacker group Handala Hack Team claim battery explosions linked to Israeli battery company.
Iran linked hacker group Handala Hack Team claim pager explosions linked to Israeli battery company Back in May, I started tracking Handala, a hacktivist branded group expressing pro-Palestine views: https://medium.com/media/8e57dca18a2af602b3beccdc5549dca0/href Handala is word which is a prominent national symbol and personification…