Threat mitigation

Security Advisory

NVIDIA DGX Spark Security Update Fixed 14 Vulnerabilities

Summary : NVIDIA DGX Spark GB10 firmware vulnerabilities including CVE-2025-33187, CVE-2025-33188, CVE-2025-33189 & 11 more CVEs can Execute Malicious Code and DoS Attacks. Systems running DGX OS versions prior to OTA0 are affected. Immediate upgrade to OTA0 is strongly advised. 

OEM NVIDIA 
Severity Critical 
CVSS Score 7.5 
CVEs CVE-2025-33187, CVE-2025-33188, CVE-2025-33189 & 11 more CVEs 
POC Available No 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

NVIDIA has released a security update addressing 14 vulnerabilities in the NVIDIA DGX Spark firmware, a high-performance AI workstation for machine learning and model training.

These vulnerabilities enable attackers with local access to bypass protections and manipulate firmware and hardware controls. Exploitation could lead to unauthorized code execution, data tampering, system disruption, and exposure of sensitive AI data.

                      Vulnerability Name CVE ID Product Affected Severity CVSS  Fixed Version 
​SoC Access Bypass Vulnerability via SROOT CVE-2025-33187 NVIDIA DGX Spark Critical 9.3 OTAO 
Hardware Control Tampering Vulnerability CVE-2025-33188 NVIDIA DGX Spark High 8.0 OTAO 
Out-of-Bounds Write Vulnerability in SROOT CVE-2025-33189 NVIDIA DGX Spark High 7.8 OTAO 

Technical Summary 

The NVIDIA DGX Spark GB10 firmware vulnerabilities primarily affect SROOT, OSROOT and hardware controls, enabling local attackers to bypass SoC protections for code execution, data tampering, information disclosure, denial of service and privilege escalation.

Critical flaws like out-of-bounds writes and hardware tampering allow memory corruption and system manipulation, while medium/low issues involve improper input handling, memory reads and resource reuse that risk data leaks or crashes.

All versions prior to OTA0 are vulnerable and security patch released fully addresses these risks.  

CVE ID Vulnerability Details Impact 
CVE-2025-33187 SROOT vulnerability allows attackers to access SoC-protected memory regions using privileged access Code execution, privilege escalation 
CVE-2025-33188 Hardware controls can be tampered with due to improper authorization enforcement Information disclosure, DoS 
CVE-2025-33189 Out-of-bounds writing in SROOT firmware enables memory corruption Code execution, privilege escalation 

Other Vulnerabilities: 

These other vulnerabilities are medium & low severity issues that may cause data leaks, system errors or minor disruptions. 

Vulnerability Name CVE ID Description Severity CVSS Impact 
Out-of-Bounds Write Vulnerability CVE-2025-33190 This vulnerability may allow unintended modification of system data Medium 6.7 Code execution, Privilege escalation 
Invalid Memory Read vulnerability in OSROOT CVE-2025-33191 Error in memory handling can crash system Medium 5.7 Denial of service 
Arbitrary Memory Read vulnerability CVE-2025-33192 Unauthorized access to stored information Medium 5.7 Info disclosure, DoS 
Integrity Validation Failure vulnerability CVE-2025-33193 Firmware integrity checks can be bypassed Medium 5.7 Code execution, info leak 
Input Processing Issue CVE-2025-33194 Faulty input handling reveals internal data Medium 5.7 Info disclosure, DoS 
Unexpected Buffer Operations CVE-2025-33195 Memory mishandling leads to data modification Medium 4.4 Data tampering, DoS 
Resource Reuse Exposure CVE-2025-33196 Reused firmware resources reveal sensitive data Medium 4.4 Information disclosure 
NULL Pointer Dereference CVE-2025-33197 System crashes due to improper pointer handling Medium 4.3 DoS, possible code execution 
Resource Reuse vulnerability CVE-2025-33198 Unintended reuse of resources leaks data Low 3.3 Information disclosure 
Incorrect Control vulnerability CVE-2025-33199 System behavior can be manipulated Low 3.2 Data tampering 
Resource Reuse vulnerability CVE-2025-33200 Data exposure due to resource reuse Low 2.3 Information disclosure 

Remediation: 

  • Upgrade all NVIDIA DGX Spark systems to DGX OS OTA0 or the latest fixed version. 

Conclusion: 

The discovery of 14 critical vulnerabilities in the NVIDIA DGX Spark firmware provides a stark reminder that advanced hardware requires strict security practices round the clock. 


These vulnerabilities pose a significant security risk to organizations using NVIDIA DGX Spark for AI or ML workloads. If exploited, attackers could gain deep hardware-level access, risk confidential AI datasets, system stability and training integrity. Immediate upgrading to OTA0 to  mitigate all the vulnerabilities. 

References: 

Blogs

AWS Recent Outage, Effects What we need to know

The recent disruption that sparked world wide impact and effect is the AWS outage. The AWS (Amazon web services) disruption happened on October 20, 2025, centered on its “US‑EAST‑1” cloud region . The disruption triggered a series of failures and disrupted normal working of number of consumer apps, finance, government portals and parts of Amazon’s own services.

The AWS outage a case of internet outage, impacted over disruptions at over 3,500 companies across more than 60 countries, placing this among the largest internet outages on record for Downdetector.

Now the crucial question that hovers the mind is how the disruption affected digital services and what does this means to organizations relying on third party cloud service providers, to developers and other who are in the ecosystem and rely on AWS service that run uptime.

AWS covers 30% of the global cloud infrastructure market and such a kind of disruption is hard for the world relying on AWS infra. Many global apps and websites rely heavily on AWS for cloud hosting and data processing, which means the disruption can rapidly become widespread and create a knock out effect to many services and businesses to return to normal may witness challenege.

Origin of the AWS incident:

The incident originated in the US-EAST-1 (Northern Virginia) region one of AWS’s oldest and most heavily utilized hubs — and impacted key services such as DynamoDB, EC2, Lambda, and SQS.

As services in all these started failing the spread was wide and impacted AWS’s internal infrastructure and external applications, affecting end-user experiences who were on Snapchat, Pinterest, Fortnite, Signal etc.
Earlier it happened in the same region US-East-1. If we go by history (2017, 2021 & 2023).

The outage echoes shed light on the most crucial point, i.e. over reliance on single point of cloud infrastructure. AWS pointed on DNS issues and admitted global services or features that rely on US-EAST-1 endpoints, such as IAM updates and DynamoDB Global tables, “may also be experiencing issues.”

DNS Issue resolved as per AWS:

After the disruption and AWS says the DNS issue has “been fully mitigated”, and most AWS Service operations are succeeding normally now. However, it added that some requests may be throttled “while we work toward full resolution.”

Technical Analysis AWS Disruption:

The investigation revealed how a control plane failure in the US-EAST-1 region, triggered by an unexpected behavior within AWS’s internal load balancing and routing layer. So a configuration change happened in the service responsible for metadata and service discovery propagated inconsistently.

This lead to authentication and routing failures for dependent instances and services which further expanded and caused choke and resource exhaustion across interdependent services like EC2, Lambda, and S3, all of which rely on low-latency internal communication.

The largest hit services

The heaviest‑hit services by report count included Snapchat (~3M), AWS itself (~2.5M), Roblox (~716k), Amazon retail (~698k), Reddit (~397k), Ring (~357k) and Instructure (~265k). The UK alone generated more than 1.5M reports, far exceeding a typical day’s ~1M global baseline across all markets, highlighting both the unique intensity and breadth of this event.

Country wise bifurcation on AWS outage & results

(Image sources: Revealing the Cascading Impacts of the AWS Outage | Ookla®)

What amplified the disruption of AWS

All apps we are using are mostly chain together managed services like storage, queues, and serverless functions. If DNS cannot reliably resolve a critical endpoint (for example, the DynamoDB API involved here), errors cascade through upstream APIs and cause visible failures in apps users do not associate with AWS. That is precisely what Downdetector recorded across Snapchat, Roblox, Signal, Ring, HMRC, and others.

Cloud infrastructure should be of national importance

The AWS outage/ disruption highlighted how cloud infrastructures are not risk free and over dependence eon single point. Any fault in the infrastructure stack on which everything else depends and from which failures can trigger and subsequent redundancy.

The need of the hour is to recognize that Cloud infrastructure should be of national importance and any failure on the entire stack can be overcome with systematic approach. This will require by pulling down or dismantling each part and diversify the route so that on event of outage , the rest of the part of can be recovered by not depending on single point of the platform.

Organizations relying solely on a single AWS region or without robust multi-region, multi-cloud, or hybrid failover mechanisms faced significant downtime and operational risk, a wake up call for governments.

Various government across Europe recognized the risk associated with cloud infrastructure introduced policy’s for e.g., EU’s flagship Digital Operational Resilience Act (DORA) introduces EU-level oversight of critical ICT third-party providers, while the UK’s Critical Third Parties act for finance. These tool kits will act as balancers when it comes to reporting, stress management, incident reporting and adhering to transparency that is required as mandate.

Why Network resilience is important ?

The AWS disruption highlighted importance of network resilience. The reason being network resilience prevents single points of failure with backup systems and alternative pathways. Further this helps to adapt to sudden increases in demand without degrading performance. At the same time efficiently reallocates resources and adapts to changing conditions.



Security Advisory

Critical Oracle EBS 0-Day Hit by Clop Ransomware; Oracle Released Emergency Patch 

Summary : Security Advisory: Clop Ransomware aimed at extortion of emails targeting customers of Oracle E-Business Suite. The zero-day vulnerability affected Oracle EBusiness Suite (EBS), specifically the Concurrent Processing component used with BI Publisher Integration and is remotely exploitable without authentication. This allows attackers to execute arbitrary code via HTTP.

OEM Oracle 
Severity Critical 
CVSS Score 9.8 
CVEs CVE-2025-61882 
POC Available Yes 
Actively Exploited Yes 
Advisory Version 1.0 

Overview 

Oracle released an emergency patch and Clop ransomware group actively exploited this flaw in real-world data theft campaigns targeting vulnerable versions using by the organizations.

All EBS versions from 12.2.3 to 12.2.14 are affected and immediate patching requires mitigate the vulnerability. 

                Vulnerability Name CVE ID Product Affected Severity Affected Version 
RCE vulnerability in Oracle E-Business Suite  CVE-2025-61882 Oracle E-Business Suite  Critical 12.2.3 through 12.2.14 

Technical Summary 

The vulnerability allows attackers to gain remote code execution by sending specially crafted HTTP requests to exposed Oracle EBS services. Once exploited, it enables full system compromise, including reverse shell access. The vulnerability has been using by Clop ransomware group in conjunction with other previously known EBS flaws to exfiltrate sensitive data and extort victims. Indicators of compromise (IoCs) such as malicious IPs, shell commands, and exploit files have been published to help organizations detect past intrusions.

Oracle’s fix includes the patch for this flaw but also mitigates additional exploitation paths identified during their internal investigation. 

CVE ID Component Affected  Vulnerability Details Impact 
CVE-2025-61882 BI Publisher Integration A critical unauthenticated RCE in Oracle EBusiness Suite affecting the Concurrent Processing/BI Publisher integration.   Full system compromise, data theft.  

Recommendations 

Users And Administrators should immediately apply the Security Patch for CVE202561882 on all affected Oracle E-Business Suite systems: 

  • Log in to My Oracle Support. 
  • Use the patch availability document & search for the patch specific to CVE-2025-61882 for your OS and Oracle EBS version. 

Prerequisite: Ensure the October 2023 Critical Patch Update (CPU) is already installed. 

Here are some recommendations below 

  • If immediate patching is not possible, restrict HTTP/HTTP/HTTPS access to the EBS application from untrusted networks. 
  • Review server logs, network traffic and system processes to detect signs of exploitation. 
  • Monitor for known Indicators of Compromise (IoCs) provided by Oracle from the table below. 

IOCs 
 

Indicator Type Description 
200[.]107[.]207[.]26 IP Potential GET and POST activity 
185[.]181[.]60[.]11 IP Potential GET and POST activity 
sh -c /bin/bash -i >& /dev/tcp// 0>&1 Command Establish an outbound TCP connection over a specific port 
76b6d36e04e367a2334c445b51e1ecce97e4c614e88dfb4f72b104ca0f31235d SHA 256 oracle_ebs_nday_exploit_poc_scattered_lapsus_retard_cl0p_hunters.zip 
aa0d3859d6633b62bccfb69017d33a8979a3be1f3f0a5a4bf6960d6c73d41121 SHA 256 oracle_ebs_nday_exploit_poc_scattered_lapsus_retard-cl0p_hunters/exp.py 
6fd538e4a8e3493dda6f9fcdc96e814bdd14f3e2ef8aa46f0143bff34b882c1b SHA 256 oracle_ebs_nday_exploit_poc_scattered_lapsus_retard-cl0p_hunters/server.py 

Source: Oracle 

Conclusion: 
This is the ongoing threat exploitation by the ransomware group, particularly for unpatched Oracle EBS deployments.

As this is being actively exploited in the wild, upgrade to the supported patched version and organizations should also review logs, investigate for signs of compromise using Oracle’s IoCs, and strengthen network access controls around EBS systems. Immediate action is required to reduce the risk of further exploitation, data loss and operational disruption. 

References: 

Security Advisory

Jenkins Security Patch Fixed HTTP/2 DoS and Permission Issues  

Security advisory: Jenkins addressed critical security flaws in its built-in HTTP server related to the handling of HTTP/2 connections, where attackers could overwhelm servers causing denial of service. This mainly impacts Jenkins instances running with HTTP/2 enabled, which is not the default setting.

Severity High 
CVSS Score 7.7 
CVEs CVE-2025-5115, CVE-2025-59474, CVE-2025-59475, CVE-2025-59476 
POC Available No 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

Jenkins, a popular open-source automation server used for building and deploying software, recently patched several high & medium security flaws.

The high severity issue is a Denial-of-Service (DoS) vulnerability that could allow attackers to overwhelm the server and make it stop working properly even without needing to log in.

Other issues included the risk of unauthorized users viewing sensitive configuration information and the possibility of attackers inserting fake log entries to confuse system administrators. Jenkins released updates to fix these issues and strongly recommends users upgrade to the latest versions to stay protected. 

                Vulnerability Name CVE ID Product Affected Severity Fixed Version 
HTTP/2 Denial of Service in bundled Jetty  CVE-2025-5115 Jenkins (bundled Jetty)  High Weekly 2.524+, LTS 2.516.3+ 
Missing permission check – agent names CVE-2025-59474 Jenkins core Medium Weekly 2.528+, LTS 2.516.3+ 
Missing permission check – user profile menu CVE-2025-59475 Jenkins core Medium Weekly 2.528+, LTS 2.516.3+ 
Log Message Injection Vulnerability CVE-2025-59476 Jenkins core Medium Weekly 2.528+, LTS 2.516.3+ 

Technical Summary 

Additionally, permission checks in some user interface areas were incomplete, allowing unauthorized users to access sensitive information such as agent names and configuration details.

There was also a vulnerability in log message processing that could let attackers insert misleading entries to confuse administrators. All the issues are fixed in Jenkins latest version. 

CVE ID System Affected  Vulnerability Details Impact 
CVE-2025-5115 Jenkins instances with embedded Jetty server with HTTP/2 enabled It causes the Jetty server to repeatedly reset HTTP/2 streams (RST_STREAM) in response to malicious or malformed frames, leading to resource exhaustion and potential denial of service.  Denial of service 
CVE-2025-59474 Jenkins automation server Permission check flaw allowing unauthorized users to view Jenkins agent/executor names via the side panel executor’s widget Information Disclosure 
CVE-2025-59475 Jenkins automation server Permission check flaw allowing authenticated users without Overall/Read permission to view sensitive configuration details via the Jenkins user profile dropdown menu. Information Disclosure 
CVE-2025-59476 Jenkins automation server An attacker can inject line breaks into Jenkins log messages, leading to forged or misleading log entries. Misleading administrators 

Remediation: 

  • Users should immediately install the latest, patched version of Jenkins on all servers: 
  • Weekly Release: Update to Jenkins v2.528 or later. 
  • Long-Term Support (LTS): Update to Jenkins v2.516.3 or later 

Here are some recommendations below. 

  • If immediate upgrade is not possible, users should disable HTTP/2 to mitigate the Denial-of-Service vulnerability. 
  • Always keep Jenkins core and plugins up to date with the latest security patches. 
  • Regularly audit and monitor access logs and system activity 
     

Conclusion: 
These security flaws could seriously impact Jenkins users, especially those relying on it for continuous integration and deployment. The DoS vulnerability is particularly dangerous because it can be triggered by anyone over the internet, even if they don’t have an account.

Enterprise admins & users should upgrade immediately to the patched versions or disable HTTP/2 to reduce the risk. Keeping Jenkins up to date and following good security practices along with restricting user permissions and monitoring logs is essential to prevent attacks and maintain the stability and safety of software delivery pipelines. 

References: 

Security Advisory

Apple Patches Zero-Day Vulnerability Exploited in Targeted Attacks (CVE-2025-43300) 

Security Advisory : Apple has released critical security patches to address a newly discovered zero-day vulnerability, CVE-2025-43300, that was found to be actively exploited in targeted attacks.

To protect users, Apple has issued patches in iOS 18.6.2, iPadOS 18.6.2, iPadOS 17.7.10 and the latest macOS versions.

OEM Apple 
Severity High 
CVSS Score 8.8 
CVEs CVE-2025-43300 
POC Available No 
Actively Exploited Yes 
Exploited in Wild Yes 
Advisory Version 1.0 

Overview  The vulnerability resides in Apple’s ImageIO framework, which is used for handling image files across iOS, iPadOS, and macOS platforms. According to Apple, the flaw may have been used in sophisticated, targeted attacks, although exact details have not been disclosed.

The vulnerability affects a wide range of devices, including iPhones starting from the XS, multiple iPad models and Macs running macOS Ventura, Sonoma and Sequoia. This marks the seventh zero-day exploited in the wild that Apple has addressed in 2025, underscoring the increasing frequency and severity of threats targeting Apple users. 

                Vulnerability Name CVE ID Product Affected Severity Fixed Version 
An out-of-bounds write issue   CVE-2025-43300 iPhone, iPad, macOS  High iOS 18.6.2, iPadOS 18.6.2, iPadOS 17.7.10, macOS 13.7.8, macOS 14.7.8, macOS 15.6.1 

Technical Summary 

The vulnerability, CVE-2025-43300, is classified as an out-of-bounds write issue within the ImageIO framework.

It can be exploited when a specially crafted image file is processed, causing memory corruption that could allow an attacker to execute arbitrary code on the affected device.

This makes it a critical security flaw, particularly because the attack vector image files are common and often considered low risk. Apple has mitigated vulnerability by improving bounds by checking in the affected code.

The exploitation of this bug in the wild indicates a high level of sophistication, likely by advanced persistent threat actors targeting specific individuals. The technical nature of the bug aligns with a broader trend in which attackers exploit flaws in media-handling components to achieve remote code execution. As such, this patch not only fixes a critical issue but also highlights the need for continued vigilance and timely system updates. 

CVE ID System Affected  Vulnerability Details Impact 
CVE-2025-43300 iPhones, iPads, Macs. Critical out-of-bounds write vulnerability in Apple’s ImageIO framework that allows remote code execution by processing a malicious image. It has been actively exploited in highly targeted attacks on iOS, iPadOS, and macOS devices, prompting urgent patches.  Remote code execution via malicious image zero-click attack surface 

Apple has so far fixed a total of seven zero-day vulnerabilities in 2025 that were actively exploited in real-world attacks, including CVE-2025-43300, reflecting an ongoing effort to patch critical security flaws across iOS, iPadOS, and macOS platforms. 

  • CVE-2025-24085: A memory corruption flaw in WebKit that could allow remote code execution via malicious web content. 
  • CVE-2025-24200: An elevation of privilege vulnerability in the kernel, enabling attackers to gain higher system privileges. 
  • CVE-2025-2420: A logic issue in the kernel that could lead to arbitrary code execution by a malicious app. 
  • CVE-2025-31200: A vulnerability in the CoreGraphics framework allowing remote code execution when processing malicious PDF files. 
  • CVE-2025-31201: An issue in the IOMobileFrameBuffer kernel extension that could permit a local attacker to escalate privileges. 
  • CVE-2025-43200: A flaw in the AppleAVD driver leading to a potential kernel privilege escalation. 
  • CVE-2025-43300: An out-of-bounds write vulnerability in the ImageIO framework actively exploited through malicious images, enabling remote code execution. 

Remediation: 

Update your Apple devices immediately to the latest patched versions: 

  • iPhone – iOS 18.6.2 
  • iPad – iPadOS 18.6.2/17.7.10 
  • macOS – macOS Ventura 13.7.8, Sonoma 14.7.8 or Sequoia 15.6.1. 

Conclusion: 
Apple has urgently patched seven critical zero-day vulnerabilities in 2025, including CVE-2025-43300, that were actively exploited in targeted attacks.

Users are strongly advised to update their devices immediately to stay protected against these serious threats. 

In addition, CISA has added CVE-2025-43300 to its Known Exploited Vulnerabilities (KEV) Catalog under BOD 22-01, requiring federal agencies to remediate the flaw within specified timelines.

While the directive is mandatory for federal agencies, CISA strongly urges all organizations to prioritize remediation of KEV-listed vulnerabilities to reduce their exposure to active threats. 

References: 

Security Advisory

7-Zip Security Flaw Allows Malicious File Writes and Potential Exploits 

Summary Security Advisory: 7-Zip Security Flaw

A vulnerability in 7-Zip (versions before 25.01) allows attackers to abuse symbolic links in archive files to write files outside the intended extraction directory.

Severity Low 
CVSS Score 3.6 
CVEs CVE-2025-55188 
POC Available No 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

This can lead to overwriting sensitive files, potentially enabling code execution or privilege escalation. The flaw is primarily exploitable on Linux systems due to common file permission models but can also impact Windows under specific conditions. Affected archive formats include ZIP, TAR, 7Z and RAR. 

The security flaw was  reported and discoverd by security researcher lunbun, who identified that 7-Zip fails to properly validate symbolic links when extracting certain archive formats.

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​ 7-Zip Arbitrary File Write via Symbolic Link Flaw  CVE-2025-55188 7-Zip  Low  25.01 and later. 

Technical Summary 

Cause: Improper validation of symbolic links during archive extraction. 

Attack Vector: Malicious archives can contain symlinks pointing outside the extraction directory. 

Impact: Overwrites arbitrary files on the system. On Linux, this can replace startup scripts, configuration files, or binaries to gain elevated privileges. On Windows, exploitation requires write access to target paths. 

Affected Formats: ZIP, TAR, 7Z, RAR. 

CVE ID CVSS Score System Affected  Vulnerability Details Impact 
CVE-2025-55188 3.6 Linux, Windows 7-Zip versions 7-Zip mishandles symbolic links in archives, letting attackers write files anywhere on the system during extraction. Code execution, Privilege escalation 

Recommendations: 

Here are some recommendations below 

  • Update 7-Zip to version 25.01 or latest one.  
  • Avoid extracting archives from untrusted sources. 
  • Always consider using sandboxed environments for unknown files extraction. 

Conclusion: 
While CVE-2025-55188 carries a low CVSS score, the real-world impact can be severe in certain environments, especially on Linux systems with high-privilege extraction processes.

Immediate patching to 7-Zip 25.01 or later is strongly advised to mitigate the risk of arbitrary file overwrite attacks. 

The researcher has submitted a request for reevaluation of the CVSS score and offered to provide proof-of-concept demonstrations to package repository maintainers who require additional verification.

References: 

Blogs

Firmware Vulnerabilities affecting Dell Laptops Could allow attackers to achieve persistent access 

A set of vulnerabilities affecting millions of Dell laptops used by government agencies, cybersecurity professionals, and enterprises worldwide. The vulnerability known as “ReVault,” mainly target the Broadcom BCM5820X security chip embedded in Dell’s ControlVault3 firmware.

This subsequently create opportunities for attackers to steal passwords, biometric data, and maintain persistent access to compromised systems.

How does the vulnerability work

Most of the flaws reside in the firmware for ControlVault3 and ControlVault3+, which are hardware security components that store passwords, biometric templates, and security codes.

The lists includes:

  • Two out-of-bounds vulnerabilities (CVE-2025-24311, CVE-2025-25050)
  • An arbitrary free (CVE-2025-25215) flaw
  • A stack-overflow bug (CVE-2025-24922)
  • An unsafe-deserialization flaw (CVE-2025-24919)

According to the researchers, the vulnerabilities can be exploited in so-called ReVault attacks by:

  • Attackers who have achieved non-administrative access/privileges on a vulnerable target laptop. The vulnerabilities may allow them to interact with the ControlVault firmware and leak key material that would allow them to permanently modify the firmware (i.e., effectively creating a potential backdoor into the system)
  • Attackers that have physical access to the laptop. They could pry the device open, use a custom connector to access the Unified Security Hub board (which runs ControlVault) over USB, and exploit those vulnerabilities – all without having to log into the system beforehand or having knowledge of the full-disk encryption password.

“Another interesting consequence of this scenario is that if a system is configured to be unlocked with the user’s fingerprint, it is also possible to tamper with the CV firmware to accept any fingerprint,” as per researchers.

Technical details have not been publicly shared, but they have, of course, been privately reported to Dell and Broadcom.

These are 5 critical vulnerabilities of ReVault found by Cisco Talos researcher

ReVault Attack – Five Critical Vulnerabilities

ControlVault3 and ControlVault3+ systems:

  • CVE-2025-24311: An out-of-bounds read vulnerability that enables information leakage
  • CVE-2025-25050: An out-of-bounds write flaw allowing code execution
  • CVE-2025-25215: An arbitrary memory free vulnerability
  • CVE-2025-24922: A stack-based buffer overflow enabling arbitrary code execution
  • CVE-2025-24919: An unsafe deserialization flaw in ControlVault’s Windows APIs

Importance of device security posture/Endpoint security

The incident highlight how device posture check is designed to evaluate threat that a device poses to an organization and its systems.

The persistent nature of these attacks represents a significant escalation in firmware-based threats, as the malicious code resides below the operating system level.

Here traditional antivirus solutions cannot detect or remove it. Now sophistication of cyber threats means that organizations need to become more proactive in terms of defense.

The identification and mitigation of a threat early on, via an effective and clearly defined security posture, reduces costs, lessens downtime, and minimizes reputational damage.

Periodic security audits are essential to have a complete check on all the security features of the organization. Such audits identify vulnerabilities in the current security controls and allow for ensuring things align properly with industry standards. 

Importance of Endpoint security

End point security detect and prevent security threats like file-based malware attacks among other malicious activities. It also provides investigation and remediation capabilities needed to respond to dynamic security incidents and alerts.

Conclusion:

Protecting against endpoint attacks is challenging for organisation because endpoints exist where humans and machines intersect. With the increasing number of adversaries trying to breach organizations using sophisticated cyberattacks, quickly detecting potential threats will help speed the remediation process and keep data protected.

(Source: https://www.helpnetsecurity.com/2025/08/05/dell-laptops-firmware-vulnerabilities-revault-attacks/)

Blogs

New Malware Strikes on Users Data, infects Devices has bypass mechanism;

How deadly the malware is warns Researchers. Linux malware variant offers advanced features and evasion mechanisms

PSA stealer malware affected more then 4,000 computers in 62 countries

A brand new malware related to Linux  been found infecting thousands of computers around the world, stealing people’s login credentials, payment information and browser cookies, warns security researchers from SentinelLabs and Beazley Security. More than 4,000 computers were infected with PSA Stealer in 62 countries, the two companies said, suggesting that the campaign is rather successful.

As per researcher PSA Stealer is apparently being distributed through phishing emails and malicious landing pages. The malicious attachments contain a legitimate program (such as a PDF reader) and a weaponized DLL. The program sideloads the DLL, successfully deploying the malware while not raising any alarms.

More than 4,000 computers were infected with PSA Stealer in 62 countries, the two companies said, suggesting that the campaign is rather successful.

The  joint report detailing the activities of PXA Stealer, a new Python-based infostealer for the Linux platform. Spotted in late 2024, and has since grown into a formidable threat, successfully evading defense tools while wreaking havoc across the globe.

Key pointers on installing the applications /malware (Side Loading)

The malware PSA can target browser extensions for various crypto wallets, including Exodus, Magic Eden, Crypto.com and many more

Can pull data from sites such as Coinbase, Kraken, and PayPal.

Finally, it can inject a DLL into running browser instances to bypass encryption mechanisms.

PSA Stealer is apparently being distributed through phishing emails and malicious landing pages

The malicious attachments contain a legitimate program (such as a PDF reader) and a weaponized DLL. 

The program sideloads the DLL, successfully deploying the malware while not raising any alarms.

Hackers who are from Vietnamize origin are selling data selling it on the black market – in a Telegram group. The majority of the victims are located in South Korea, the US, the Netherlands, Hungary, and Austria.

So far, more than 200,000 were stolen passwords, as well as hundreds of credit card information and more than four million cookies.

Vulnerability in SAP NetWeaver recently discovered by threat researchers from from Palo Alto Networks’ Unit 42 is being exploited to deploy Linux malware is capable of running arbitrary system commands and deploying additional payloads, experts have warned.

Security researchers from Palo Alto Networks’ Unit 42 discovered a piece of malware called Auto-Color, a backdoor, from Linux and dubbed for its ability to rename itself after installation.

The researchers found it was capable of opening reverse shells, executing arbitrary system commands, acting as a proxy, uploading and modifying files.

This also include adjusting settings dynamically. It was also discovered that the backdoor remains mostly dormant if its C2 server is unreachable, effectively evading detection by staying inactive until the operator instructions arrive.

Mitigating threat from Malware

Malware is any software intentionally designed to damage, disrupt, or gain unauthorized access to computer systems. In cybersecurity the diversity of malware include viruses, worms, spyware and ransomware. Each has unique attack methods, so it’s essential to understand their nature and behavior to mitigate potential risks.

How does Malware spread & threat Malware pose?

All channels available at disposal should be monitored when we think of malware and how they spread. All types of malware can spread in various ways, using technical vulnerabilities and human inattention to infiltrate systems and networks, but some methods prove more successful than others.  Understanding how malware typically presents itself and spreads can help businesses stay vigilant against its damage.

Deceive & Defend against Malware with Mirage Cloak from IntruceptLabs

Mirage Cloak offers various deception methods to detect and stop threats before they cause damage. These methods include adding decoys to the network, deploying breadcrumbs on current enterprise assets, using baits as tripwires on endpoints, and setting up lures with intentionally misconfigured or vulnerable services or applications. The flexible framework also lets customers add new deception methods as needed.

  • Our AI-powered proactive defense system identifies potential threats in real time, giving you the upper hand in protecting your network and assets.
  • By leveraging advanced artificial intelligence, our system reduces false positives, allowing your security team to focus on genuine threats and respond effectively.
  • With machine learning capabilities, our defense system continuously learns and evolves, adapting to new attack vectors and staying ahead of cyber threats.

Do connect with us for any query: https://intruceptlabs.com/contact/

(Source: Dangerous new Linux malware strikes – thousands of users see passwords, personal info stolen, here’s what we know | TechRadar)

Security Advisory

Critical Zero-Day Vulnerabilities in VMware Exploited at Pwn2Own 2025 – Patch Immediately  

Summary : VMware fixed four vulnerabilities in VMware ESXi, Workstation, Fusion and VMware Tools that were exploited as zero-days during the Pwn2Own Berlin 2025 hacking contest in May 2025.

OEM Broadcom 
Severity Critical 
CVSS Score 9.3 
CVEs CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 
These vulnerabilities, now tracked as CVE-2025-41236, CVE-2025-41237, CVE-2025-41238 and CVE-2025-41239, could allow attackers with local administrative privileges on a virtual machine to execute arbitrary code on the host system or leak sensitive memory content.

VMware has released critical patches for affected products, including ESXi 7/8, Workstation Pro 17.x, Fusion 13.x and VMware Tools. 

                   Vulnerability Name CVE ID Product Affected Severity Fixed Version 
VMXNET3 Integer Overflow CVE-2025-41236 ESXi, Workstation, Fusion Critical (CVSS 9.3) ESXi80U3f-24784735, ESXi70U3w-24784741, ESXi80U2e24789317, 
Workstation 17.6.4, Fusion 13.6.4 
VMCI Integer Underflow CVE-2025-41237 ESXi, Workstation, Fusion Critical (CVSS 9.3) Same as above 
PVSCSI Heap Overflow CVE-2025-41238 ESXi, Workstation, Fusion Critical (CVSS 9.3) Same as above 
vSockets Info Disclosure CVE-2025-41239 ESXi, Workstation, Fusion,  VMware Tools High (CVSS 7.1) VMware Tools 13.0.1.0, same ESXi/Workstation/Fusion versions 

Technical Summary 

These vulnerabilities impact key virtualization components, potentially enabling virtual machine breakout or data leakage from the host system.

The exploitation requires local admin privileges on the guest VM and varies in impact depending on the platform (ESXi, Workstation, or Fusion). 

CVE ID System Affected  Vulnerability Details Impact 
CVE-2025-41236 ESXi 7/8, Workstation 17.x, Fusion 13.x Integer overflow in VMXNET3 adapter allows arbitrary code execution on the host via specially crafted network packets from a guest VM. Host code execution from guest VM 
CVE-2025-41237 Same as above Integer underflow in VMCI component can lead to out-of-bounds write and code execution in the VMX process on the host. VM breakout; Host compromise (Workstation/Fusion) 
CVE-2025-41238 Same as above Heap overflow in the PVSCSI controller allows out-of-bounds write more severe on Workstation/Fusion than ESXi due to sandbox restrictions. Host compromise (desktop platforms); limited on ESXi 
CVE-2025-41239 ESXi 7/8, Workstation 17.x, Fusion 13.x,  VMware Tools Use of uninitialized memory in vSockets allows information disclosure to attackers with local VM admin rights. Memory leak from host to guest 

Remediation: 

Users and administrators are strongly advised to immediately apply the following patches to mitigate the vulnerabilities: 

  • VMware ESXi users must update to ESXi80U3f-24784735, ESXi80U2e-24789317 for 8.x and ESXi70U3w-24784741 for 7.x versions. 
  • VMware Workstation Pro users should update to version 17.6.4 or later. 
  • VMware Fusion users to version 13.6.4 or later. 
  • For VMware Tools, apply the 13.0.1.0 or later, especially for Windows guests where the vSockets vulnerability (CVE-2025-41239) is relevant. 

Conclusion: 


These vulnerabilities pose a serious threat to virtualization security, especially in environments using VMware Workstation and Fusion. A successful exploit could enable attackers to escape the virtual machine and compromise the host system.

Administrators should prioritize patching to avoid exposure and reduce the risk of virtual infrastructure compromise. Regular audits of virtual networking components and least-privilege access controls within guest VMs are also recommended. 

References: 

Uncategorized

Google Chrome Zero-Day Vulnerability (CVE-2025-6554) Actively Exploited – Patch Now 

Summary : Security Advisory: Google has issued an urgent security update for Chrome browser users worldwide, addressing a high-severity zero-day vulnerability in the Chrome browser CVE-2025-6554 actively being exploited by cybercriminals.

OEM Google 
Severity High 
CVSS Score N/A 
CVEs CVE-2025-6554 
POC Available No 
Actively Exploited Yes 
Exploited in Wild Yes 
Advisory Version 1.0 

Overview 

This is a type confusion flaw in Chrome’s V8 JavaScript engine allows arbitrary code execution and it’s actively being exploited in the wild. 

The vulnerability was discovered by Clément Lecigne of Google’s Threat Analysis Group (TAG) on June 25, 2025, and a temporary mitigation was pushed on June 26, 2025. This internal discovery highlights the ongoing security monitoring efforts within Google’s infrastructure.

The mitigation measure passed through a configuration change pushed to all stable channel users across all platforms.

                Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Type Confusion in V8 Engine vulnerability  CVE-2025-6554 Google Chrome  High  138.0.7204.96/.97 (Windows)  
138.0.7204.92/.93 (Mac)  
138.0.7204.96 (Linux) 

Technical Summary 

CVE-2025-6554 is a type confusion vulnerability in Chrome’s V8 JavaScript engine. It allows threat actors to exploit memory misinterpretation and execute arbitrary code, potentially compromising the browser or the underlying system. Google has confirmed active exploitation of this flaw. 

CVE ID System Affected  Vulnerability Details Impact 
CVE-2025-6554 Chrome on Windows, macOS, Linux Type confusion in the V8 JavaScript engine allows improper memory handling, leading to code execution  Remote code execution.  Potential system compromise.  

Remediation: 

A full fix is available in the latest stable channel update. Users are strongly advised to update immediately to ensure full protection. 

  • Users should immediately update Google Chrome to the latest patched version: 
  • Windows: 138.0.7204.96/.97 
  • macOS: 138.0.7204.92/.93 
  • Linux: 138.0.7204.96 

Conclusion: 

The exploitation of CVE-2025-6554 in the wild highlights the urgency of applying the latest Chrome security update. Type confusion vulnerabilities like this can lead to full system compromise and are highly sought-after by cybercriminals. Users and organizations should take immediate action to mitigate potential risks. 

Organizations using Chrome in enterprise environments should prioritize this update across their networks.

The combination of confirmed active exploitation and the high-severity rating makes this patch deployment critical for maintaining organizational cybersecurity posture.

Refer to Intruceptlabs products & solution for better cyber security posture with Intru360, Gaarud Node

References: 

Scroll to top