Christophe Reitano

🚨 Critical Citrix flaw is under active attack. CVE-2025-6543 (CVSS 9.2) is being exploited in the wild—affecting NetScaler ADC VPN setups. The catch? Many are still unpatched. And this follows another 9.3-rated bug just weeks ago. Details + fixes you can’t ignore → https://lnkd.in/gb_wJY7A

234

3 commentaires

Fortinet FortiOS Vulnerabilities Allowing DoS & RCE Attacks | Read more: https://lnkd.in/gz345y2V 📌 Vulnerabilities arise from Fortinet’s use of the ‘apreq’ library. 📌 RCE : CVE-2024-46666 & DOS : CVE-2024-46668 📌 Patched on January 14, 2025 #cybersecurity

496

17 commentaires

Kron PAM Endpoint Privilege Management (EPM): Eliminating Excess Privileges on Endpoints Endpoints are among the most exploited attack surfaces — with over 70% of ransomware attacks in 2024 originating from compromised endpoints with local admin rights. Permanent privileges give attackers the perfect entry point to install malware, disable defenses, and move laterally. Kron PAM EPM addresses this risk by delivering: ✔️ Strong authentication with AD/LDAP + MFA ✔️ Application discovery and control to expose Shadow IT ✔️ Policy-based privilege elevation — from always-on to just-in-time ✔️ Full admin oversight with approve/deny/revoke workflows ✔️ Complete audit trails for compliance and investigations With least privilege, application control, and auditability, Kron PAM EPM turns endpoints from the weakest link into a resilient part of your IT ecosystem. 🔗 https://lnkd.in/dSWa-q4d #KronPAM #Kron #Krontech #Cybersecurity #EndpointSecurity #PAM #EPM #ZeroTrust #AccessManagement #IdentitySecurity

37

1 commentaire

[TRAINING] Attacking Web Applications 🏴 Web applications represent a large part of the attack surface exposed on the Internet. With technology constantly evolving, new vulnerabilities and exploitation methods continue to emerge, making intrusion stages more complex. To address this, our ninjas have designed an intensive 5-day training course based on their experience in #pentesting. What you will learn: ▪️ Understand the security mechanisms of modern web applications. ▪️ Refine your intrusion methods to exploit the most complex vulnerabilities. ▪️ Master the specifics of languages and frameworks such as Java, PHP, Python, and ASP.NET. This 35-hour training course includes more than 30 practical exercises to help you quickly develop your skills. 🗓️ 17 to 21 November 2025 💰 €4500 per person 🎯 Penetration testers and developers with experience in web intrusion techniques ℹ️ https://lnkd.in/evdSDSAk Ready to take your skills to the next level? Join us and become an expert in web application auditing. 🔗 To find out more and register, contact us at sales@synacktiv.com

31

Is your Active Directory due for a Spring cleanup? Active Directory is the backbone of identity and access management, but over time, it can become cluttered with outdated accounts, excessive privileges, and risky configurations. When that happens, security gaps open up. Modernizing AD isn’t just a nice-to-have. It’s essential for strengthening security, improving visibility, and keeping IT operations running smoothly. Here’s some ways to get started: 🔶 𝗟𝗼𝗰𝗸 𝗱𝗼𝘄𝗻 𝗧𝗶𝗲𝗿 𝟬 𝗮𝘀𝘀𝗲𝘁𝘀 – Reduce the number of Tier 0 assets by consolidating forests and domains, and minimize access to them. 🔶 𝗠𝗶𝗻𝗶𝗺𝗶𝘇𝗲 𝗣𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝗱 𝗔𝗰𝗰𝗲𝘀𝘀 – Ensure least privilege to prevent lateral movement and ensure that any changes to privileges are properly approved and tracked. 🔶 𝗖𝗹𝗲𝗮𝗻 𝘂𝗽 𝗺𝗶𝘀𝗰𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗮𝘁𝗶𝗼𝗻𝘀 – Group Policy and trusts can change the configuration of endpoints and servers, grant elevated access to user accounts, and even grant access across environments. 🔶 𝗘𝗹𝗶𝗺𝗶𝗻𝗮𝘁𝗲 𝗦𝗜𝗗 𝗛𝗶𝘀𝘁𝗼𝗿𝘆 𝗿𝗶𝘀𝗸 – Eliminating SID History is a crucial step to prevent excessive, hidden access rights that could be exploited by attackers. We hope these quick tips can help your organization take control of its Active Directory and enhance security. 💪 #ActiveDirectory #CyberResilience #ITmodernization

96

6 commentaires

Think your certificate issues stop at the domain controller? Think again ⚠️ As more organizations adopt Microsoft Entra's Certificate-Based Authentication (CBA) for phishing-resistant security, a hidden risk is quietly growing. Misconfigured on-premises PKI, especially Active Directory Certificate Services (ADCS), can become an unexpected bridge to the cloud. In this deep dive by Fletcher Davis, we explore how ADCS misconfigurations, like certificate template abuse and enrollment service manipulation, can be weaponized to bypass MFA, escalate privileges, and maintain persistent access in Microsoft Entra environments. Whether you're a red teamer, detection engineer, or security architect, this talk will change how you view hybrid identity security. The attack paths from compromised PKI to the cloud are real and they're being exploited. ➡️ If you're responsible for securing a hybrid environment, now’s the time to revisit your certificate infrastructure. Watch the full session now: https://lnkd.in/eDVFcmes #MicrosoftEntra #ADCS #PKI #CloudSecurity

52

1 commentaire

🚨 New active exploit alert: Bitdefender has identified in-the-wild exploitation of CVE-2025-53770, a critical RCE vulnerability in Microsoft SharePoint Server. Our latest blog details the attack chain, IoCs, and actionable steps to mitigate risk. Read more: https://lnkd.in/dCjS_kGr. #Bitdefender #Cybersecurity #ThreatIntelligence #Infosec

19

🚨 New #LockBit Variant Tagets ESXi and Linux: Critical Infrastructure at Risk. In September 2025, the LockBit group released LockBit 5.0, a new version of its #ransomware. The new variant introduces stronger obfuscation, flexible configurations, and advanced anti-analysis techniques. ⚠️ The most alarming development is the expansion to #Linux and #VMware ESXi, signaling a clear focus on server environments and critical infrastructure. Ransomware has shifted from targeting endpoints to directly disrupting core infrastructure. ❗️ A single intrusion can cause outages with severe financial and reputational impact. LockBit 5.0 comes in three builds, each optimized for its target OS. 🚨 VMware ESXi: The most critical new variant, a dedicated encryptor for hypervisors that can simultaneously disable all VMs on a host. Its CLI resembles the other builds but adds VM datastore and config targeting. See live execution: https://lnkd.in/eVy9fwfu 📌 Windows: Main variant. Runs with DLL reflection, supports both GUI and console, encrypts local and network files, removes VSS shadow copies, stops services, clears event logs, and drops ransom notes linking to live chat support. See live execution: https://lnkd.in/efDmAAUQ 📌 Linux: Console-based, replicates Windows functionality with mount point filters, post-encryption disk wiping, and anti-analysis checks such as geolocation restrictions and build expiry. See live execution: https://lnkd.in/erQugDNg 🔍 Use these TI Lookup search queries to enrich detection logic with live threat data: ESXi Lockbit 5.0: https://lnkd.in/ehTxKDS2 Linux Lockbit 5.0: https://lnkd.in/ekchCh39 Windows Lockbit 5.0: https://lnkd.in/e4mtH7bF 🚀 Strengthen resilience, protect business continuity through proactive security with #ANYRUN. #ExploreWithANYRUN #CybersecurityAwarenessMonth

99

1 commentaire

Zscaler ThreatLabz provides an in-depth analysis of Raspberry Robin, highlighting new developments such as advanced obfuscation techniques, a transition to ChaCha-20 encryption, a randomized RC4 key seed per campaign, and a new privilege escalation exploit (CVE-2024-38196) → https://bit.ly/4oCtCDl

216

2 commentaires

🔐 Threat actors trojanized KeePass to steal credentials and drop Cobalt Strike, ultimately leading to a ransomware attack on VMware ESXi servers — all via fake download sites. 🏴‍☠️ Domains impersonated WinSCP, Phantom Wallet, Sallie Mae & more ⚠️ Reminder: Never trust download links in ads — even if the URL looks real. ➡️ https://lnkd.in/gKcmG4Z9 #cybersecurity #ransomware #keepass

143

2 commentaires

Attackers don’t just drop malware anymore. They reprogram your cloud. They hijack IAM roles, alter network configs, and move silently between accounts undetected. EDR won’t see it. CNAPPs won’t flag it. SIEMs show the alerts, not the attack. 👉 Discover why the Cloud SOC Paradox is putting security teams at risk in our latest report: https://hubs.la/Q03DfB0_0 #CloudSecurity #SecOps #CDR

17

🛠️ How secure is your Active Directory? The Semperis IFIR team analyzed real-world environments and uncovered the 10 most common AD misconfigurations—many of which attackers actively exploit. ✅ DCSync permissions ✅ Insecure ADCS templates ✅ Stale service accounts ✅ Weak backup strategies …and more. 📋 Use this list to audit your environment and close the gaps before attackers find them. 🔗 https://lnkd.in/gc-ag77w #ActiveDirectory #IdentitySecurity #IFIR

25

🚨 Critical Flaws in MITRE Caldera & Parallels Desktop – Patch Now! Two major vulnerabilities—CVE-2025-27364 in #MITRE Caldera (RCE) and CVE-2024-34331 in Parallels Desktop (LPE)—pose serious security risks. While MITRE has issued a patch, Parallels remains unpatched, leaving macOS users vulnerable. 🔴 Exploitation risks: ⚠ Caldera’s RCE flaw lets attackers execute arbitrary code remotely. ⚠ Parallels’ LPE flaw grants root access, enabling full system compromise. 🛡 Immediate action needed: ✔ Update Caldera to the latest version ✔ Apply strict access controls & network segmentation ✔ Monitor for unusual activity & exploit attempts With #VulnerabilityIntelligence, organizations can track emerging threats, assess risks, and prioritize remediation efforts. Stay ahead of cyber threats with SOCRadar’s real-time threat insights. 🔗 Read more: https://lnkd.in/dCyHVXua #CyberSecurity #ThreatIntelligence #PatchNow #MITRECaldera #Parallels #Infosec

12

The Q3 2025 Issue of the FreeBSD Journal is here! This edition focuses on Embedded FreeBSD and features articles covering: - Starting Firewall Development: Interview with Igor Ostapenko - FreeBSD, Home Assistant, ant rtl_433 - Writing Effective Bug Reports - Implementing a Quantum-Safe Website on FreeBSD And much more! Read it here https://buff.ly/to25H4h #FreeBSD #FreeBSDJournal

201

2 commentaires