Author: Gargi

Blogs

Fintech Cybersecurity; Best Practices to Navigate Risk & Challenges

Fintech apps have gained momentum as Paypal, Mint, Gpay and Stash have transformed the way payment is made in financial service industries in the last few years. Fintech platforms are mostly subject to varying security standards striving the threat landscapes across different regions of geography.

In this blog we will discover how Fintech’s are growing at a pace and scaling up along with rising user base making it difficult for security teams to detect at the same pace and understand the attack surface vastness. As Fintech companies grow at pace, its impossible to keep growing with smaller infrastructure and security practices that may not be sufficient for smaller operations. Also growth in user base, makes it difficult with security teams to have proper visibility over an ever-expanding attack surface. 

IntruceptLabs has a team of certified security experts who conduct manual penetration testing, identifying different business-centric vulnerabilities that an automated scan may not identify. GaarudNode from Intrucept provides a comprehensive security framework that ensures your applications are built, tested, and deployed with confidence.

The global aspect of operation in Fintech based organizations gives rise to data sovereignty issues, where some data must be within specific geographic limits. 

The Fintech Service (FaaS) market from past few yrs is experiencing substantial growth and the global market is projected to increase by USD 806.9 billion by 2029. This growth is fueled by increasing demand for digital financial solutions and the adoption of FaaS among businesses of all sizes.FaaS provides agility, flexibility, and seamless integration, making it attractive for businesses. 

Fintech’s mining Ground for cybercriminals

Apart from consumers and legitimate users across the globe, for cyber criminals Fintech’s are mining treasures as they can quiet probably gather or steal valuable personal and financial data.

Money is constantly flowing through various associated apps and we don’t know when and how bad actors will launch clever tactics and spill of money through various associated apps .This is making cyber security posture for fintech’s difficult.

Yes, Organizations can take up cyber skilling and training seriously and help staff to use phishing-resistant multifactor authentication and robust identity-verification measures. Organisation can take up security strategies and devise it keeping uniformity in enforcement practices and incident reporting requirements.

The past decade gave a consistent rise in the number and sophistication of cyberattacks targeting financial institutions as observed.

Now that is posing significant threats to the stability and trust within the financial ecosystem as financial losses increase due to cyber breaches or data hack and causing operational disruptions including reputational damage.

Navigating the risk & challenges affecting Fintech service (FaaS)

Fintech security is directly related to API security as API’s are responsible for smooth functioning of ‘Fintech as a platform’.

It is the same API’s that are prime target of cyber criminals as there has been increase in Cloud computing, mobile apps usage and Internet of Things (IoT) all have accelerated the adoption of APIs. 

API’s are used by developers to integrate third party services ,also increase the functionable features and create solutions that are innovative in nature. Any flaw in API security could substantially damage the endpoints and is a common vulnerabilities. API ‘s can become insecure when endpoints finds failure to validate input, leading to injection attacks.

User identity Theft

Authentication vulnerabilities are issues that affect authentication processes and make websites and applications susceptible to security attacks in which an attacker can masquerade as a legitimate user.

Any flaw in authentication and authorization will give way to account compromises with insecure password that are crackable or single-factor authentication in systems lacking additional verification step. Authentication is a vital part of any website or application since it is simply the process of recognizing user identities.

Having authentication vulnerabilities have serious repercussions — whether it’s because of weak passwords or poor authentication design and implementation.

Threat actors use these vulnerabilities to get access into systems and user accounts to:

  • Steal sensitive information
  • Masquerade as a legitimate user
  • Gain control of the application
  • Destroy the system completely

Supply chain risk or third party integration

Often fintech applications interact with external services or providers. Any weaknesses arising in Supply chain from backdoors are embedded within financial apps via compromised third-party code. So many Vendor fail the risk assessments as they are unable to identify risks well before integration. 

Mostly fintech functions are mobile transfers require Apps interacting with traditional banks having legacy infrastructure to support. Integrating the modern high-tech apps with the legacy systems often used by established financial institutions is a difficult technical challenge. 

Regulatory Compliance

Fintech firms operate under regulatory landscape that is complex and changing and must comply with various frameworks, including GDPR,PCI etc, and few local financial regulations based on geographical points or country wise .

These regulations add up to lot of over head expenses and if something overlaps

The regulations adds massive, unnecessary overhead, as requirements often overlaps creating chaos. Complying with local regulations, requires resources that can be diverted away from other security efforts.

Moreover, if a Fintech platform ventures into multiple markets, it must comply with local regulations, which often requires a race against time and diverts resources away from other security efforts.

Enterprise security can prevent cyber attacks by enforcing account lockouts, rate limiting, IP-based monitoring, application firewalls, and CAPTCHAs.

AI Soft Spot by Cyber criminals

Now cyber criminals are using AI and machine learning to automate the testing process and find zero-day vulnerabilities—especially in APIs. Perhaps the most observed impact AI has had on cybercrime has been an increase in scams, particularly those leveraging deepfake technology. In certain dark web forums where experimentation takes place, few threat actors are claiming to employ AI to bypass facial recognition technology, create deepfake videos and adopt techniques to summaries large amount of data.

Cyber security best practices for Faas

The outputs derived from assessment of security testing must encompass the entire attack surface, including APIs, mobile applications and other interfaces to develop roadmaps to improve security. In any event of security breach any incident response planning by organizations will help to identify, mitigate threat and recover. 

GaarudNode from IntruceptLabs

GaarudNode is an all-in-one  solution designed to empower development teams with the tools they need to secure their applications throughout the development lifecycle. By combining the power of SAST, DAST, SCA, API security, and CSPM, GaarudNode provides a comprehensive security framework that ensures your applications are built, tested, and deployed with confidence.

The dashboard presents findings with ratings and remediation steps, allowing developers to easily address critical issues.

What else you get from GaarudNode?

  • Identifies security flaws early in the development process by scanning source code, helping developers detect issues like insecure coding practices or logic errors.
  • Tests running applications in real-time to identify vulnerabilities such as SQL injection, Cross-Site Scripting (XSS), and other runtime threats.
  • Detects vulnerabilities in third-party libraries and open-source components, ensuring that your dependencies don’t introduce risks.
  • Continuously tests and monitors your APIs for vulnerabilities such as authentication flaws, data exposure, and insecure endpoints.

Sources: https:www.apisec.ai

Security Advisory

Critical Unauthenticated RCE Vulnerabilities in Cisco ISE and ISE-PIC 

Cisco has disclosed two critical vulnerabilities CVE-2025-20281 and CVE-2025-20282 affecting its Identity Services Engine (ISE) and Passive Identity Connector (ISE-PIC).

These vulnerabilities allow unauthenticated, remote attackers to execute arbitrary commands on the underlying operating system with root privileges. The first flaw CVE-2025-20281 impacts ISE versions 3.3 and later, while the second CVE-2025-20282 is limited to version 3.4.

Summary 

OEM Cisco 
Severity Critical 
CVSS Score 10.0 
CVEs CVE-2025-20281, CVE-2025-20282 
POC Available No 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

Cisco has disclosed two critical vulnerabilities CVE-2025-20281 and CVE-2025-20282 affecting its Identity Services Engine (ISE) and Passive Identity Connector (ISE-PIC).

These vulnerabilities allow unauthenticated, remote attackers to execute arbitrary commands on the underlying operating system with root privileges. The first flaw CVE-2025-20281 impacts ISE versions 3.3 and later, while the second CVE-2025-20282 is limited to version 3.4.

Both issues stem from insecure API implementations that fail to validate user input and uploaded files respectively.  

Given the critical nature of these bugs both scoring CVSS 9.8 & 10.0 Cisco has issued immediate fixes, with no workarounds available. Organizations using the affected versions are urged to apply the patches without delay. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​API Unauthenticated RCE vulnerability  CVE-2025-20281 ISE & ISE-PIC   Critical  3.3 Patch 6, 3.4 Patch 2 
Internal API Arbitrary File Execution vulnerability  CVE-2025-20282 ISE & ISE-PIC   Critical  3.4 Patch 2 

Technical Summary 

Two independent vulnerabilities allow an attacker to gain full control over affected Cisco ISE systems without authentication: 

  • CVE-2025-20281: Triggered via crafted requests to a public API, exploiting insufficient input validation to achieve RCE as root. 
  • CVE-2025-20282: Abuses an internal API that lacks file validation, enabling the upload and execution of malicious files in privileged directories. 

These vulnerabilities align with CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-269 (Improper Privilege Management). 

CVE ID System Affected  Vulnerability Details Impact 
CVE-2025-20281 Cisco ISE & ISE-PIC 3.3 and later Insufficient validation in a public API allows remote attackers to send crafted requests, leading to unauthenticated command execution as the root user.  Remote code execution  
CVE-2025-20282 Cisco ISE & ISE-PIC 3.4 only An internal API fails to validate uploaded files. Attackers can upload files to system directories and execute them with root privileges.   Remote code execution 

Remediation: 

Cisco has released patches for affected versions of ISE and ISE-PIC. There are no known workarounds, and customers are strongly encouraged to apply the following updates: 

Cisco ISE / ISE-PIC Version CVE-2025-20281 Fixed In CVE-2025-20282 Fixed In 
3.2 and earlier Not affected Not affected 
3.3 3.3 Patch 6 Not affected 
3.4 3.4 Patch 2 3.4 Patch 2 

Conclusion: 
These vulnerabilities represent a severe risk to network security infrastructure, particularly because they impact Cisco ISE a cornerstone for identity and access control in many enterprises. The unauthenticated remote nature of the exploits, combined with root-level access and no required user interaction, significantly increases the threat surface.  

Although Cisco’s PSIRT has stated that there are no known instances of public exploitation, the ease of exploitation and severity (CVSS 10.0) make these vulnerabilities highly attractive to threat actors. Organizations should immediately apply the available patches and review their system logs for any signs of suspicious activity targeting ISE infrastructure. 

References: 

Security Advisory

Citrix NetScaler ADC/Gateway Vulnerability Exploited in the Wild (CVE-2025-6543) 

Summary : Security Advisory;

Citrix is warning that a vulnerability in NetScaler appliances tracked as CVE-2025-6543 is being actively exploited in the wild, causing devices to enter a denial of service condition.

The flaw impacts NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-47.46, 13.1 before 13.1-59.19, and NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.236-FIPS and NDcPP.

OEM Citrix 
Severity Critical 
CVSS Score 9.2 
CVEs CVE-2025-6543 
POC Available No 
Actively Exploited Yes 
Exploited in Wild Yes 
Advisory Version 1.0 

Overview 

A critical memory overflow vulnerability, CVE-2025-6543, has been discovered in NetScaler ADC and NetScaler Gateway products, potentially leading to denial-of-service and unintended control flow. The issue affects deployments configured as Gateway services. Active exploitation in the wild has been reported. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Memory overflow vulnerability  CVE-2025-6543 NetScaler ADC and NetScaler Gateway  Critical  14.1-47.46 / 13.1-59.19 / 13.1-37.236 

Technical Summary 

CVE-2025-6543 is a memory overflow vulnerability in NetScaler ADC and Gateway products that can result in denial-of-service (DoS) or arbitrary control flow, particularly when the system is configured as a Gateway or AAA virtual server.

The flaw stems from improper restriction of operations within memory buffer bounds (CWE-119). This vulnerability has been exploited in real-world attacks. 

CVE ID System Affected  Vulnerability Details Impact 
  CVE-2025-6543 NetScaler ADC & Gateway 14.1 before 14.1-47.46, 13.1 before 13.1-59.19 NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.236-FIPS and NDcPP Memory overflow due to improper memory boundary restrictions when configured as Gateway or AAA virtual servers  Denial-of-Service and Unintended control flow 

Remediation: 

  • Immediate Action: Affected customers are strongly advised to upgrade to the fixed versions: 
Product Version Recommended Fixed Build 
NetScaler ADC / Gateway 14.1 14.1-47.46 or later 
NetScaler ADC / Gateway 13.1 13.1-59.19 or later 
NetScaler ADC 13.1-FIPS / NDcPP 13.1-37.236 or later 

Note: Versions 12.1 and 13.0 are End-of-Life (EOL) and remain vulnerable. These should be replaced with supported, patched builds. 

Customers using FIPS or NDcPP variants should contact Citrix Support directly for access to the fixed builds. 

Conclusion: 
CVE-2025-6543 represents a highly critical risk to organizations utilizing NetScaler Gateway or ADC for secure access and application delivery.

Organizations still using outdated or end-of-life (EOL) versions are especially vulnerable and should prioritize upgrading to supported builds. 

This flaw follows a pattern of severe vulnerabilities affecting NetScaler products, including the recently disclosed CVE-2025-5777 (CVSS score: 9.3), which also posed a significant threat to enterprise infrastructure.

Together these issues highlight the urgent need for timely patching, continuous monitoring, and defense-in-depth strategies to safeguard critical network assets. 

With both flaws being critical bugs, administrators are advised to apply the latest patches from Citrix as soon as possible.

Companies should also monitor their NetScaler instances for unusual user sessions, abnormal behavior, and to review access controls.

References: 

Security Advisory

Privilege Escalation in Notepad++ v8.8.1 Installer via Binary Planting with Public PoC Available 

Security Advisory: A high-severity privilege escalation vulnerability has been discovered in the Notepad++ v8.8.1 and prior installer, which allows local attackers to gain SYSTEM-level privileges through uncontrolled executable search paths (binary planting).

The installer searches for executable dependencies in the current working directory without verification, allowing attackers to place malicious executables that will be loaded with SYSTEM privileges during installation.

OEM Notepad++ 
Severity High 
CVSS Score 7.3 
CVEs CVE-2025-49144 
POC Available Yes 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

Exploitation requires minimal user interaction and a public Proof of Concept (PoC) is available. The issue is resolved in version v8.8.2. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Privilege Escalation Vulnerability  CVE-2025-49144 Notepad++  High  v8.8.2 

Technical Summary 

The Notepad++ installer improperly searches for executable dependencies in the current directory without verifying their authenticity.

This insecure behavior allows attackers to place a malicious executable (e.g. regsvr32.exe) in the same directory as the installer. Upon execution the malicious file is loaded with SYSTEM-level privileges, granting full control over the machine. 

In real world scenario, an attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicious executable to the same directory (typically Downloads folder – which is known as Vulnerable directory). Upon running the installer, the attack executes automatically with SYSTEM privileges.

CVE ID System Affected  Vulnerability Details Impact 
  CVE-2025-49144  Notepad++ v8.8.1 and prior. The installer invokes executables without absolute path (e.g. regsvr32), allowing a malicious binary in the same directory to be executed with elevated privileges.  SYSTEM privilege escalation and full machine control 

Proof of Concept (PoC): 

  • Execution Flow: Attacker places a fake regsvr32.exe in the same directory as the Notepad++ installer. 
  • Trigger: When the user runs the installer, it loads the attacker’s file with SYSTEM privileges. 
  • Evidence: 
  • Process Monitor logs confirm that the installer is searching for executables in the local directory. 
  • Public PoC materials are hosted and shared, confirming reproducibility 

Remediation: 

  • Immediate Action: Upgrade to Notepad++ v8.8.2 or later which explicitly sets absolute paths when invoking executables like regsvr32. 

Recommendations: 

  • Configuration Check: Avoid executing installers from user-writable locations like the Downloads folder. Ensure installers are run from isolated, trusted directories. 
  • Environment Hardening: Implement endpoint detection for binary planting, restrict execution in commonly targeted directories. 

Conclusion: 
CVE-2025-49144 is a critical privilege escalation vulnerability with a working public PoC. It leverages a fundamental flaw in the Notepad++ installer’s handling of executable paths.

Given the low barrier to exploit and high impact, especially in environments where Notepad++ is widely used, immediate remediation is strongly advised. The presence of similar flaws in past versions highlights the persistent risk of insecure software packaging. 

This is a critical security vulnerability requiring immediate attention. While Microsoft classifies some binary planting issues as “Defense-in-Depth,” the severity of gaining SYSTEM privileges with minimal user interaction warrants priority remediation.

References: 

Blogs

Oxford City Council Latest Prey of Cyber criminal; Personal Data on legacy system exposed

The Oxford City Council informed it suffered a data breach where attackers accessed personally identifiable information from legacy systems. The incident which took place over the weekend of 7 and 8 June, witnessed how attackers accessed historic data stored over a decade held on legacy systems.

The leaked personal information are of individuals who worked on elections administered by the council between 2001 and 2022, including poll station workers and ballot counters. Most of these people, said the council, will be current or former council officers.

‘”No evidence to suggest that any of the accessed information has been shared with third parties,” said the council in a statement.

The automated systems were able to detect the breach and resulted in disruption to some of their services last week. But the have been working hard to minimize impact on residents.

The council’s email systems and wider digital services remain secure and safe to use, it said, and the council has reported the incident to the relevant government authorities and law enforcement agencies.

According to the Information Commissioner’s Office (ICO), cyber attacks on local authority systems rose by a quarter between 2022 and 2023, while personal data breaches rocketed by 58%.

Major cyber attacks on institutions based in UK

The Oxford attack is the latest of many to affect UK councils. In 2025 alone, Gateshead and West Lothian councils have reported material attacks on their systems, with ransomware groups claiming responsibility for both.

Nottingham City Council also suffered a freak service outage earlier this year, which turned off the lights at the authority’s office building, although that was caused by a datacenter electrical fault rather than intruders.

Legacy Systems Vulnerable to cyber attacks:

A study by Accenture found that 85% of IT leaders in government agencies believe not updating legacy systems threatens their future.

When legacy systems were developed, these applications may have been on top of then-current cybersecurity practices. But with the passage of even a short time, the threat landscape evolves while many legacy systems get left behind.

Legacy systems are the workhorses of many businesses and dependable as these aging software and hardware applications keep core operations running. Legacy dependencies can stall a strategic move to the cloud and digital transformation. 

These outdated software applications, databases, and codebases were once reliable. Presently the software’s struggle to keep pace with digital trends.

Few examples of Legacy system

  • Old Enterprise Resource Planning (ERP) systems: These were often built with a monolithic architecture, making them inflexible and difficult to integrate with newer technologies.
  • Outdated databases: Hierarchical and older relational database systems may lack the features and security needed for modern applications.
  • Custom code: Businesses may still rely on proprietary software written in languages like COBOL, posing challenges for maintenance and updates.

Protect your Network & Digital environment with Intru360

If you are storing sensitive information like passwords, API keys, certificates, and other secrets, it’s critical to ensure they are kept secure.

Many developers often overlook this crucial step, either hardcoding secrets directly into their code or storing them in an insecure manner.

Sometimes lack of attention can have disastrous consequences as we have witnessed many high-profile breaches over the years.

  • For seamless business continuity even in the face of cyber threats while maintaining productivity and profitability Intru360 have been introduced to proactive cybersecurity measures and protect your valuable information.
  • Stay safe, stay informed and protect your digital environment as Intru360 gives security analysts and SOC managers a clear view across the organization, helping them fully understand the extent and context of an attack.
  • Intru360 simplifies workflows by automatically handling alerts, allowing for faster detection of both known and unknown threats.
  • Identify latest threats without having to purchase, implement, and oversee several solutions or find, hire, and manage a team security analyst.
  • Unify latest threat intelligence and security technologies to prioritize the threats that pose the greatest risk to your company.

 

(Sources: https://www.theregister.com/2025/06/20/oxford_city_council_breach/)

https://www.secopsolution.com/blog/common-vulnerabilities-in-legacy-systems-and-how-to-mitigate-them

Blogs

16 Billion Passwords Leaked in Largest Data Breach; Impact of Infostealer Malware

Data Breach with 30 exposed Datasets & contained approx 10 to 3.5 billion records making it one of the largest data breach.

According to a report security researchers from Cybernews found about a Data breach that leaked important data or passwords that was mostly generated by various cybercriminals using info stealing malware. They exposed data was made to look like a breach but these login credentials were gathered from social media, corporate platforms, VPNs etc via infostealer.

Now cybercriminals have unprecedented access to personal credentials and these credentials be used for account takeover, identity theft and targeted phishing activities.

The concern is the structure and recency of these datasets as they are not old breaches being recycled. This is fresh, weaponizable intelligence at scale”, added researchers.

The data sets contains a mix of details from stealer malware, credential stuffing sets and repackaged leaks. There is no way to compare these datasets, but likely to contain at least some duplicated information. This makes it hard to determine how many people were affected by the data breach.

What are Data sets & how deadly can be Infostealer as a malware?

Datasets are basically structure collection of data collected over the years or so and organized as case specific models

In 2024 datasets containing billions of passwords have previously found their way on the internet. Last year, researchers came across what they called the Mother of All Breaches, which contained more than 26 billion records.

The data breach that happened had data in sets, following a particular pattern, containing an URL followed by a username and password. To those unaware, this is exactly how infostealing malware collects information and sends it to threat actors.

The exposed data came from platforms widely used round the world starting from Google, Apple, Github, Telegram & Facebook. So data was first collected over a period of time, further made into data sets and grouped together.

Info stealers are malware programs that are designed to silently steal usernames and passwords Basically designed to swipe of credentials from people’s devices and send them to threat actors for further them for sale on dark web forums.

An infostealer is malware that attempts to steal credentials, cryptocurrency wallets, and other data from an infected device. Over the years, infostealers have become a massive problem, leading to breaches worldwide. No device is spare from infostealer’s impact including Windows and Macs, and when executed, will gather all the credentials it can find stored on a device and save them in what is called a “log.”

If a organization or individual is infected with an infostealer and have hundreds of credentials saved in their browser, the infostealer will steal them all and store them in the log. These logs are then uploaded to the threat actor, where the credentials can be used for further attacks or sold on cybercrime marketplaces.

An infostealer log is generally an archive containing numerous text files and other stolen data.

Fig1:

(Image courtesy: Bleeping computers)

A devastating data breach is a nightmare for customers and affected organizations, but breaches can have a positive side also. Each incident is a learning opportunity. It’s easier to defend critical data when we understand the mistakes made by others and the tactics used by attackers.

How to be secure & keep your Data safe

If users are in midst of data breach or may find that their data is not safe as an infostealer might be there in your systems or devices then scan your device with an antivirus program. Once done then change password or your newly entered credentials could be stolen again. The system is clean so password hygiene can be maintained time to time.

At times even unique passwords won’t help you stay protected if you are hacked, fall for a phishing attack, or install malware. Its better not to change all credentials in one go instead having a cyber security hygiene in routine is better as an option.

Intru360

For organizations to stop and detect any intrusion by attackers prefer to have Intru360 in your list of cyber security go to products from Intruceptlabs.

Intru360 gives security analysts and SOC managers a clear view across the organization, helping them fully understand the extent and context of an attack. It also simplifies workflows by automatically handling alerts, allowing for faster detection of both known and unknown threats.

Globally every year cyberattacks are growing and mutating each month. Organizations have their Intelligent intrusion network detection systems in place analyze and detect anomalous traffic to face these threats.

Do visit our website for more information.

Source: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/no-the-16-billion-credentials-leak-is-not-a-new-data-breach/amp/

Uncategorized

Privilege Escalation Vulnerability in AI Engine WordPress Plugin, Allows Subscriber-Level Account Takeover 

Summary :Security Advisory: A critical privilege escalation vulnerability (CVE-2025-5071) was discovered in the AI Engine WordPress plugin, allowing subscriber-level users to gain administrator privileges when the MCP (Model Context Protocol) module is enabled.

OEM WordPress 
Severity High 
CVSS Score 8.8 
CVEs CVE-2025-5071 
POC Available Yes 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the ‘Meow_MWAI_Labs_MCP::can_access_mcp’ function in versions 2.8.0 to 2.8.3.

This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the MCP and run various commands like ‘wp_create_user’, ‘wp_update_user’ and ‘wp_update_option’, which can be used for privilege escalation, and ‘wp_update_post’, ‘wp_delete_post’, ‘wp_update_comment’ and ‘wp_delete_comment’, which can be used to edit and delete posts and comments.

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Privilege Escalation Vulnerability  CVE-2025-5071 AI Engine WordPress Plugin  High  2.8.4 

Technical Summary 

AI Engine is a WordPress plugin that recently introduced support for MCP (Model Context Protocol), which allows AI agents – such as Claude or ChatGPT – to control and manage the WordPress website by executing various commands, managing media files, editing users, and performing complex tasks more reliably than through standard APIs.

The vulnerability stems from insufficient authorization checks in the can_access_mcp () function within the plugin, enabling any authenticated (logged-in) user to bypass Bearer Token validation and access MCP endpoints.

This access can be exploited to escalate user privileges by executing commands such as wp_update_user, ultimately leading to full site compromise. 

CVE ID System Affected  Vulnerability Details Impact 
  CVE-2025-5071  WordPress with AI Engine Plugin 2.8.0–2.8.3 The can_access_mcp() function incorrectly grants MCP endpoint access to all logged-in users. Even when Bearer Token authentication is enabled, lack of empty value checks in the token validation logic allows privilege escalation.  Complete site compromise 

Remediation: 

  • Immediate Action: Update the AI Engine plugin to version 2.8.4 or later. 
  • Configuration Check: Ensure that MCP and Dev Tools modules remain disabled unless it’s necessary. 

Conclusion: 
The CVE-2025-5071 vulnerability in the AI Engine WordPress plugin highlights the potential risks when advanced modules like MCP are misconfigured.

Even though the feature is disabled by default, sites that have enabled it become susceptible to complete takeover by authenticated users.

Website administrators are urged to update to version 2.8.4 immediately and verify that security best practices are enforced to prevent such escalations. With over 100,000 active installations, this flaw presents a significant risk to the WordPress ecosystem if left unpatched. 

References: 

t  

Security Advisory

Veeam Backup Patched Critical Vulnerabilities Enabling RCE & Privilege Escalation 

Summary ; Security Advisory

Veeam disclosed three critical vulnerabilities affecting its widely deployed backup software. Veeam Backup & Replication is an enterprise-grade data protection solution used to back up, recover and replicate virtual machines, cloud workloads including physical servers.

OEM Veeam 
Severity Critical 
CVSS Score 9.9 
CVEs CVE-2025-23121, CVE-2025-24286, CVE-2025-24287 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

Multiple high-impact vulnerabilities have been disclosed in Veeam Backup & Replication and Veeam Agent for Microsoft Windows, impacting versions prior to 12.3.2 and 6.3.2 respectively.

The most critical issue (CVE-2025-23121) may allow a remote code execution (RCE) on the backup server by an authenticated domain user, effectively granting complete control over backup infrastructure. 

The vulnerabilities also include risks of unauthorized modification of backup jobs (CVE-2025-24286) and privilege escalation via local directory manipulation (CVE-2025-24287). These flaws could enable attackers to execute arbitrary code or gain elevated permissions. 

These flaws pose significant risks to organizations relying on Veeam for data integrity and disaster recovery. The data protection system of an organization may get affected if compromised and threaten domain-joined backup servers.

Vulnerability Name CVE ID Product Affected Severity 
​ Remote Code Execution via Authenticated Domain User  CVE-2025-23121 Veeam Backup & Replication  Critical (9.9) 
Arbitrary Code Execution via Backup Operator Role Abuse  CVE-2025-24286 Veeam Backup & Replication  High (7.2) 
Privilege Escalation via Directory Manipulation  CVE-2025-24287 Veeam Agent for Microsoft Windows  Medium (6.1) 

Technical Summary 

CVE ID System Affected Vulnerability Details Impact 
  CVE-2025-23121  Veeam Backup & Replication 12.3.1.1139 and all earlier v12 builds A remote code execution vulnerability affecting domain-joined Veeam backup servers. An authenticated domain user may execute arbitrary commands with elevated privileges.   Remote Code Execution 
  CVE-2025-24286 Veeam Backup & Replication 12.3.1.1139 and earlier  Authenticated users with the Backup Operator role can modify backup job configurations to inject and execute code.   Arbitrary Code Execution 
  CVE-2025-24287  Veeam Agent for Microsoft Windows 6.3.1.1074 and earlier  Local users can manipulate directory contents leading to code execution with elevated privileges.  Local Privilege Escalation  

Remediation: 

Users are strongly advised to apply the following updates to mitigate the risks: 

  • Upgrade Veeam Backup & Replication to 12.3.2 (build 12.3.2.3617) or later 
  • Upgrade Veeam Agent for Microsoft Windows to 6.3.2 (build 6.3.2.1205) or later 

Here are some recommendations below 

  • Limit backup server access to trusted users only to reduce the risk of unauthorized control. 
  • Apply least privilege principles for backup roles so users have only the permissions they need. 
  • Regularly monitor backup job changes and system logs to detect suspicious activity early. 
  • Provide security awareness training to staff focusing on backup and recovery best practices. 

Conclusion:  For Security Best practices

Veeam has released patches to address all three vulnerabilities and urged organizations to update Veeam Backup & Replication 12.3.2 (build 12.3.2.3617) and Veeam Agent for Microsoft Windows 6.3.2 (build 6.3.2.1205) as soon as possible.

For security best practices maintaining up-to-date backup systems, prompt patching and adherence to security best practices are essential to prevent potential exploitation and data compromise.

The critical nature of vulnerabilities demands backup and disaster recovery along with strict access controls and ongoing monitoring as essential tips to safeguard infrastructure that have been backed up from potential attacks. 

References: 

Security Advisory

Google Chrome Zero-Day CVE-2025-2783 Exploited in APT Group TaxOff Campaigns 

Summary 

A newly-patched zero-day vulnerability in Google Chrome CVE-2025-2783 which was exploited in the wild by a threat actor TaxOff, leading to the deployment of Trinper which an advanced backdoor.

The CVE-2025-2783 exploited a sandbox escape vulnerability within Google Chrome’s Mojo IPC (Inter-Process Communication) framework, which allowed attackers to bypass the browser’s security sandbox and lead to RCE. 

TaxOff Threat Actor 

TaxOff is a highly sophisticated Advanced Persistent Threat (APT) group primarily targeting government organizations which is known for its use of advanced social engineering tactics, often involving phishing campaigns that exploit themed around financial reporting and regulatory compliance. 

The CVE-2025-2783 vulnerability was first detected in March 2025 after Kaspersky reported real-world exploitation.

TaxOff used a phishing-based delivery method, which involved embedding a malicious link in emails masquerading as invitations to legitimate events like the Primakov Readings forum.

Once the link was clicked, the CVE-2025-2783 exploit was triggered, leading to the deployment of the Trinper backdoor. It was a one-click compromise that delivered a highly tailored payload with surgical precision. 

Trinper Backdoor 

This is a multi-threaded C++ backdoor that collected host data, logged keystrokes, exfiltrated targeted documents like document, excel or pdf files and maintained remote access.

But this wasn’t just a “plug-and-play” backdoor. Trinper’s loader employed five layers of encryption, utilizing ChaCha20, modified BLAKE2b hashes, and even machine-specific environmental checks. It was decrypted only on intended systems, using unique hardware identifiers like firmware UUIDs and PEB structures. 

Source: global.ptsecurity.com 

Interestingly, researchers found that Team46, a different APT group shares many similarities with TaxOff in terms of TTPs. This overlap raises the possibility that TaxOff and Team46 are the same group operating under different aliases.

Both groups have used PowerShell-based loaders and Cobalt Strike as their primary exploitation vectors. 

This flaw allows threat actors to:

  • Execute arbitrary code
  • Bypass Chrome’s built-in security sandbox
  • Potentially gain remote control over the system

Recommendation 

The rapid exploitation of CVE-2025-2783 highlights the critical importance of timely patch management. Google released a fix for this vulnerability in March 2025, and all users are strongly advised to update their Chrome browsers to the latest version immediately. 

In addition to patching, organizations should implement the following defensive measures 

  • Enhance email filtering systems and provide regular phishing awareness training for employees. 
  • Continuously monitor systems for unusual or suspicious behavior related to script execution or network anomalies. 
  • Restrict the execution of unsigned or obfuscated scripts and macros, particularly in email attachments or downloaded files, using tools like AppLocker or Microsoft Defender ASR. 

References: 

Security Advisory

Apache Tomcat Vulnerabilities Expose Systems to DoS & Authentication Bypass  

Security Advisory; Summary

Multiple vulnerabilities have been identified in Apache Tomcat affecting various versions and critical security updates provided to address four newly discovered vulnerabilities in Apache Tomcat. The disclosed Apache Tomcat vulnerabilities pose serious threats, especially in high-availability or internet-exposed environments.

Apache Tomcat is one of the world’s most widely used open-source Java servlet containers.

OEM Apache 
Severity High 
CVSS Score 8.4 
CVEs CVE-2025-48976, CVE-2025-48988, CVE-2025-49125, CVE-2025-49124 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

The affected versions 9.0.x, 10.1.x and 11.0.x, also include high-impact denial-of-service (DoS) vulnerabilities and a moderate authentication bypass flaw as well as a Windows installer issue that may allow privilege escalation via side-loading. 

Timely patching is essential to prevent potential service disruptions and unauthorized access. 

Vulnerability Name CVE ID Product Affected Severity 
​Memory Exhaustion via Multipart Header Exploitation  CVE-2025-48976 Apache Tomcat  High 
Multipart Upload Resource Exhaustion  CVE-2025-48988 Apache Tomcat  High 
Security Constraint Bypass (Pre/PostResources)  CVE-2025-49125 Apache Tomcat  High 
Windows Installer Side-Loading Risk  CVE-2025-49124 Apache Tomcat  High 

Technical Summary 

The vulnerabilities affect Tomcat’s handling of multipart HTTP requests, resource mounting and Windows installation process. Exploitation may result in denial-of-service (via memory exhaustion), privilege escalation (via installer abuse) and authentication bypass. 

CVE ID System Affected Vulnerability Details Impact 
  CVE-2025-48976 Apache Tomcat 9.0.0.M1–9.0.105, 10.1.0-M1–10.1.41, 11.0.0-M1–11.0.7 Fixed memory allocation limit in multipart header processing could be exploited to consume memory and cause DoS.  Denial-of-service attack. 
  CVE-2025-48988 Apache Tomcat 9.0.0.M1–9.0.105, 10.1.0-M1–10.1.41, 11.0.0-M1–11.0.7 Multipart request body with many parts can trigger high memory usage due to improper limit handling between parameters and parts.  Denial-of-service attack. 
  CVE-2025-49125  Tomcat with Pre/Post Resources enabled Lack of resource path normalization allows attackers to access resources outside root bypassing auth controls. Authentication and Authorization Bypass. 
  CVE-2025-49124  Tomcat Windows Installers Installer invoked icacls.exe without full path, making it vulnerable to side-loading attacks via PATH manipulation. Privilege Escalation. 

Remediation: 

Update Immediately: Users of the affected versions should apply one of the following mitigations. 

  • Upgrade to Apache Tomcat 11.0.8 or later 
  • Upgrade to Apache Tomcat 10.1.42 or later   
  • Upgrade to Apache Tomcat 9.0.106 or later 

Conclusion: 

Attackers could exploit these flaws to cause denial-of-service, escalate privileges or bypass authentication and authorization controls. 

The Apache Software Foundation credits the TERASOLUNA Framework Security Team of NTT DATA Group Corporation and T. Doğa Gelişli for identifying these issues.

Tomcat is widely used in enterprise and cloud environments, prompt patching is essential to prevent potential exploitation, service outages, or unauthorized access.

References: 

  • https://lists.apache.org/thread/0jwb3d3sjyfk5m6xnnj7h9m7ngxz23db 

Scroll to top