cybersecurity

cross-posted from: https://lemmy.sdf.org/post/38295658

Archived

The Czech Republic has banned the use of any products by the Chinese AI startup DeepSeek in state administration over cybersecurity concerns, authorities said Wednesday.

Czech Prime Minister Petr Fiala said the government acted after receiving a warning from the national cybersecurity watchdog, which noted a threat of unauthorized access to users data because the firm is obliged to cooperate with Chinese state authorities.

The move follows similar steps made by some other countries that aimed to protect users’ data, including Italy, which in January blocked access to the chatbot, and also Australia.

The Czech government in 2018 stopped using the hardware and software made by Chinese telecoms company Huawei and another Chinese telecommunications company, ZTE, after a warning they posed a security threat.

DeepSeek was founded in 2023 in Hangzhou, China, and released its first AI large language model later that year.

Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

Introduction

This vulnerability report has been generated using data aggregated on Vulnerability-Lookup, with contributions from the platform’s community.

It highlights the most frequently mentioned vulnerability for June 2025, based on sightings collected from various sources, including MISP, Exploit-DB, Bluesky, Mastodon, GitHub Gists, The Shadowserver Foundation, Nuclei, and more. For further details, please visit this page.

The final section focuses on exploitations observed through The Shadowserver Foundation's honeypot network.

The Month at a Glance

The June 2025 report highlights a mix of long-standing and newly identified high-risk vulnerabilities. Notably, Citrix discloses a critical NetScaler ADC/Gateway flaw (CVE-2025-5777), dubbed “CitrixBleed 2,” which can expose session tokens and bypass multi-factor authentication — echoing last year’s infamous CitrixBleed. Other urgent issues include a PayU India WordPress plugin vulnerability (CVE-2025-31022) that allows full account takeover across thousands of sites, and a Python “tarfile” library bug (CVE-2025-4517) that enables attackers to write files outside intended directories. Among the most sighted vulnerabilities are multiple Microsoft Windows 10 and Google Chrome flaws, as well as several Citrix ADC bugs, many rated “High” or “Critical.” Common web weaknesses like cross-site scripting and SQL injection (CWE-79, CWE-89) remain widespread, highlighting the ongoing need for strong patching hygiene. Some older vulnerabilities — such as the 2015 D-Link DIR-645 flaw and known Confluence or Cisco RCE bugs — also continue to see active exploitation. Organizations should prioritize remediation of these critical and actively targeted vulnerabilities, while reinforcing application security against injection and XSS attacks.

Top 10 vulnerabilities of the Month

Vulnerability	Vendor	Product	VLAI Severity
CVE-2025-33053	Microsoft	Windows 10 Version 1809	High
CVE-2025-49113	Roundcube	Webmail	High
CVE-2025-5777	NetScaler	ADC	Critical
CVE-2025-5419	Google	Chrome	High
CVE-2025-2783	Google	Chrome	High
CVE-2025-6019	Red Hat	Red Hat Enterprise Linux 10	Medium
CVE-2025-33073	Microsoft	Windows 10 Version 1809	High
CVE-2025-6543	NetScaler	ADC	Critical
CVE-2015-2051	D-Link	DIR-645	Critical
CVE-2017-18368	ZyXEL	P660HN-T1A	Critical

Evolution of sightings per week

Top 10 Weaknesses of the Month

| CWE | Number of vulnerabilities | |

| -------------------------------------------------------- |

| CWE-79 | 659 | | CWE-89 | 411 | | CWE-74 | 342 | | CWE-119 | 190 | | CWE-862 | 157 | | CWE-352 | 157 | | CWE-120 | 105 | | CWE-94 | 94 | | CWE-22 | 86 | | CWE-98 | 74 |

Insights from Contributors

CitrixBleed 2
Citrix patched a critical vulnerability in its NetScaler ADC and NetScaler Gateway products that is already being compared to the infamous CitrixBleed flaw exploited by ransomware gangs and other cyber scum, although there haven't been any reports of active exploitation. Yet.

Security analyst Kevin Beaumont dubbed the vulnerability "CitrixBleed 2." As The Register's readers likely remember, that earlier flaw (CVE-2023-4966) allowed attackers to access a device's memory, find session tokens, and then use those to impersonate an authenticated user while bypassing multi-factor authentication — which is also possible with this new bug.

GCVE-1-2025-0002: Cl0p Ransomware Data Exfiltration Vulnerable to RCE Attacks A newly identified security vulnerability in the Cl0p ransomware group’s data exfiltration utility has exposed a critical remote code execution (RCE) flaw that security researchers and rival threat actors could potentially exploit.

The vulnerability, designated as GCVE-1-2025-0002, was published on July 1, 2025, and carries a high severity rating of 8.9 on the CVSS:4.0 scale.

Stuxnet-related CVEs

• CVE-2010-2568 MS10-046 Windows
• CVE-2010-2729 MS10-061 Windows
• CVE-2008-4250 MS08-067 Windows
• CVE-2010-2772 Not Available Siemens SIMATIC WinCC

CVE-2025-31022: More details about PayU wordpress extension
"This can be abused by a malicious actor to perform action which normally should only be able to be executed by higher privileged users. These actions might allow the malicious actor to gain admin access to the website."

CVE-2025-4517: Additional information
RISK : Multiple vulnerabilities affect the standard TarFile library for CPython. Currently, there is no indication that the vulnerability is actively exploited, but because it is a zero-day with a substantial install base, attackers can exploit it at any moment. An attacker could exploit flaws to bypass safety checks when extracting compressed files, allowing them to write files outside intended directories, create malicious links, or tamper with system files even when protections are supposedly enabled. Successful exploitation could lead to unauthorised access, data corruption, or malware installation, especially if your systems or third-party tools handle untrusted file uploads or archives RECOMMENDED ACTION: Patch Source: ccb.be

Continuous Exploitation

• CVE-2025-32433 - erlang / otp
• CVE-2015-2051 - D-Link / DIR-645
• CVE-2022-26134 - Atlassian / Confluence Data Center
• CVE-2019-1653 - Cisco / Cisco Small Business RV Series Router Firmware

Thank you

Thank you to all the contributors and our diverse sources!

If you want to contribute to the next report, you can create your account.

Feedback and Support

If you have suggestions, please feel free to open a ticket on our GitHub repository. Your feedback is invaluable to us!
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/

cross-posted from: https://lemmy.sdf.org/post/37950350

Archived

• [Security firm] Silent Push Threat Analysts followed a tip from Mexican journalist Ignacio Gómez Villaseñor about a threat actor targeting “Hot Sale 2025,” an annual sales event similar to “Black Friday” in the U.S.
• The team pivoted from that Mexico-centric campaign into thousands of websites that broadly targeted a more global audience with abundant waves of fake marketplace scams.
• We identified a private technical fingerprint associated with this infrastructure, which contains Chinese words and characters to strongly indicate that the developers of this network are from China.
• Our analysts observed this threat actor group building multiple phishing websites with pages spoofing well-known retailers, including Apple, Harbor Freight Tools, Michael Kors, REI, Wayfair, and Wrangler Jeans.
• The threat actor has also been caught abusing online payment services, including MasterCard, PayPal, and Visa, as well as payment security techniques such as Google Pay, across the campaign’s network of scam websites.

[...]

• GitHub Archive logs every public commit, even the ones developers try to delete. Force pushes often cover up mistakes like leaked credentials by rewriting Git history. GitHub keeps these dangling commits, from what we can tell, forever. In the archive, they show up as “zero-commit” PushEvents.
• I scanned every force push event since 2020 and uncovered secrets worth $25k in bug bounties.
• Together with Truffle Security, we're open sourcing a new tool to scan your own GitHub organization for these hidden commits (try it here).

cross-posted from: https://lemmy.sdf.org/post/37887750

Archived

Here is the report (pdf).

The French National Agency for Information Systems Security, or ANSSI, said Tuesday it observed French organizations affected by activity using a slew of security flaws to break into an end-of-life version of the Utah company's Cloud Services Appliance applications. The campaign affected government agencies, telecoms and firms in the media, finance and transport sectors. ANSII dubs the intrusion set "Houken".

[...]

The hacker used a wide number of open-source tools "mostly crafted by Chinese-speaking developers," were active during Chinese working hours and exhibited behaviors consistent with intelligence collection. The threat actor also sought self-enrichment, installing a cryptominer on one victim system. Chinese nation-state hacking is an unusual combination of intelligence agencies and private sector companies. Some hackers choose their own targets and sell exfiltrated data or access to government agencies - or may do for-profit hacking on the side. "Nevertheless, the use of cryptominers remains uncommon for this threat actor," ANSSI wrote.

[...]