Infosec bits for 2025 week 5
Heloise Meyer | Jan. 31, 2025, 2:25 p.m.
Vulnerabilities & Patches:
Critical Cacti Security Flaw (CVE-2025-22604) Enables Remote Code Execution [Ravie Lakshmanan, The Hacker News]
Actively Exploited Fortinet Zero-Day Gives Attackers Super-Admin Privileges [Elizabeth Montalbano, DarkReading]
TeamViewer Patches High-Severity Vulnerability in Windows Applications [Ionut Arghire, SecurityWeek]
Zyxel CPE Devices Face Active Exploitation Due to Unpatched CVE-2024-40891 Vulnerability [Ravie Lakshmanan, The Hacker News]
Cyberattacks & Breaches:
DeepSeek halts new signups amid "large-scale" cyberattack [Lawrence Abrams, BleepingComputer]
DeepSeek leaks one million sensitive records in a major data breach [Gyana Swain, CSO Online]
ChatGPT-4o Jailbreak Vulnerability “Time Bandit” Let Attackers Create Malware [Guru Baran, Cyber Security News]
Recent Jailbreaks Demonstrate Emerging Threat to DeepSeek [Unit 42, Palo Alto Networks]
New Jailbreaks Allow Users to Manipulate GitHub Copilot [Nate Nelson, DarkReading]
Syncjacking Attack Enables Full Browser and Device Takeover [Phil Muncaster, Infosecurity Magazine]
Hackers Use 10,000 WordPress Sites To Deliver Malware To macOS and Microsoft Systems [Tushar Subhra Dutta, Cyber Security News]
South Africa’s government-run weather service knocked offline by cyberattack [Jonathan Greig, The Record]
Hackers Exploit Public-facing Vulnerable IIS, Apache, SQL Servers to Attack Gov & Telcom Networks [Tushar Subhra Dutta, Cyber Security News]
Tooling:
Unlocking Vulnrichment: Enhancing CVE Data for Smarter Vulnerability Management [Cyble, Cyble]
Web Cache Vulnerability Scanner: Open-source tool for detecting web cache poisoning [Help Net Security, Help Net Security]
