NewApp Digest
search bot

vulnerability management

Windows Autopatch Adds CVE Reporting to Boost Security Visibility
Winsage
December 8, 2025

Windows Autopatch Adds CVE Reporting to Boost Security Visibility

Microsoft has introduced a Common Vulnerabilities and Exposures (CVE) reporting capability within Windows Autopatch to improve security for IT teams. This tool provides an overview of Windows vulnerabilities addressed in recent updates, enabling device-specific tracking. Key features of the CVE report include a list of CVEs addressed in the past 90 days, tracking of patch compliance at the device level, links to Knowledge Base articles, filtering options, and near real-time updates. Administrators can access the CVEs report by navigating to the Microsoft Intune admin center and selecting the appropriate reports. The report includes CVE identifiers, severity scores, exploitation status, and details on devices needing updates. Organizations can enhance their response to vulnerabilities by utilizing various strategies, such as the Windows Autopatch update readiness feature and targeted fixes with the Security Copilot Vulnerability Remediation Agent.
Cyber security essentials with WSA partner PureCyber 
Tech Optimizer
December 4, 2025

Cyber security essentials with WSA partner PureCyber 

Cyber security is crucial for organizations in the sport and leisure sector to protect digital assets from hackers and cybercriminals. Neglecting cyber security can lead to financial losses, reputational damage, operational disruptions, and legal issues. Key practices for enhancing cyber security include keeping software updated, using strong passwords, training employees, and employing firewalls and antivirus solutions. The Welsh Sports Association (WSA) has partnered with PureCyber to offer a subscription service called Foundations, which provides various cyber security benefits such as incident response, phishing simulations, endpoint detection and response, dark web monitoring, employee training, Microsoft 365 protection, and vulnerability management. WSA members can access this service at preferential rates, and a Lunchtime Learning session will be held to improve skills within member organizations. Interested parties can contact Maria Lopez for more information on the subscription.
CISA Warns of Active Exploits in Critical Windows Flaw
Winsage
October 8, 2025

CISA Warns of Active Exploits in Critical Windows Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert about a significant vulnerability in Microsoft Windows, identified as CVE-2021-43226. This flaw allows attackers to elevate their privileges to SYSTEM level, threatening enterprise networks. It exists within the Common Log File System (CLFS) driver, enabling local, privileged attackers to bypass security measures and gain unauthorized control over systems running various Windows versions, including Windows 10, 11, and Server 2016, 2019, and 2022, as well as legacy systems like Windows 7 SP1 and Server 2008 R2 SP1. The vulnerability arises from improper validation of user-supplied data, leading to buffer overflow and arbitrary code execution without user interaction. It has a CVSS score of 7.8, indicating high severity, and proof-of-concept exploit code is already circulating in underground forums. CISA has set a remediation deadline of October 27, 2025, mandating federal agencies and critical infrastructure operators to implement patches. Recommendations for mitigation include immediate patching, strengthening endpoint controls, implementing layered defenses, continuous monitoring, regular vulnerability management, and maintaining a robust incident response program.
Week in review: Covertly connected and insecure Android VPN apps, Apple fixes exploited zero-day
AppWizard
August 24, 2025

Week in review: Covertly connected and insecure Android VPN apps, Apple fixes exploited zero-day

A study by Arizona State University and Citizen Lab found that three families of Android VPN apps, with over 700 million downloads, have significant security vulnerabilities. Apple has released a fix for a zero-day vulnerability (CVE-2025-43300) that was being exploited in targeted attacks. Researchers from the University of Melbourne and Imperial College London developed a method using lightweight large language models to improve incident response planning. The FBI and Cisco warned about a Russian threat group exploiting an old Cisco vulnerability (CVE-2018-0171) to compromise critical infrastructure. Fog Security researchers discovered a flaw in AWS’s Trusted Advisor tool that could mislead users about the security of their data. AI is now being used in security operations centers to reduce alert noise and assist analysts. U.S. federal prosecutors charged an individual linked to the Rapper Bot DDoS botnet. Nikoloz Kokhreidze discussed the strategic choice between hiring a fractional or full-time Chief Information Security Officer for B2B companies. Commvault patched four vulnerabilities that risked remote code execution. Jacob Ideskog highlighted security risks posed by AI agents. VX Underground released an exploit for two SAP Netweaver vulnerabilities (CVE-2025-31324, CVE-2025-42999). Healthcare organizations are preparing for new password security risks in 2025 that may threaten HIPAA compliance. Researchers identified a spear-phishing campaign using the Noodlophile infostealer. Financial institutions are increasingly using open-source intelligence tools to combat money laundering. Greg Bak discussed security risks for DevOps teams in the cloud. NIST released guidelines for detecting morph attacks. Organizations face six challenges in implementing machine learning and AI security. Recep Ozdag discussed vulnerabilities in airport and airline systems. Google introduced new AI and cloud security capabilities at the Cloud Security Summit 2025. Cybersecurity myths continue to complicate the security landscape. LudusHound is an open-source tool that replicates an Active Directory environment for testing. Buttercup is an AI-powered platform for automated vulnerability management in open-source software. The book "Data Engineering for Cybersecurity" addresses challenges in managing logs and telemetry data. A selection of current cybersecurity job openings has been compiled. A forthcoming webinar will discuss AI and SaaS security risks. The iStorage datAshur PRO+C is a USB-C flash drive with AES-XTS 256-bit hardware encryption. New infosec products were released by companies such as Doppel, Druva, LastPass, and StackHawk.
Zero-Day Flaw in PostgreSQL Exploited to Target BeyondTrust Systems
Tech Optimizer
August 4, 2025

Zero-Day Flaw in PostgreSQL Exploited to Target BeyondTrust Systems

A significant PostgreSQL vulnerability, CVE-2025–1094, was identified during the investigation of another vulnerability, CVE-2024–12356, which was exploited in the BeyondTrust breach in December 2024. The breach involved unauthorized access to BeyondTrust's systems and was linked to the state-sponsored hacking group Silk Typhoon from China. The U.S. Treasury Department confirmed its network was compromised through a stolen BeyondTrust API key. CVE-2025–1094 is an SQL injection vulnerability that allows attackers to execute arbitrary SQL commands due to improper handling of invalid UTF-8 byte sequences. Rapid7 found that CVE-2024–12356's exploitation relied on CVE-2025–1094, and that CVE-2025–1094 could be exploited independently. BeyondTrust issued patches for these vulnerabilities, but the patch for CVE-2024–12356 did not directly address the underlying cause of CVE-2025–1094. The exploitation of these vulnerabilities underscores the need for timely patching and proactive security measures in organizations using PostgreSQL.
Preinstalled Android Apps Found Leaking PINs and Executing Malicious Commands
AppWizard
June 2, 2025

Preinstalled Android Apps Found Leaking PINs and Executing Malicious Commands

On May 30, 2025, CERT Polska disclosed three security vulnerabilities affecting preinstalled Android applications on Ulefone and Krüger&Matz smartphones: CVE-2024-13915, CVE-2024-13916, and CVE-2024-13917. - CVE-2024-13915: The com.pri.factorytest application allows any app to invoke the FactoryResetService, enabling unauthorized factory resets due to improper export controls (CWE-926). - CVE-2024-13916: The com.pri.applock application exposes a public method that allows malicious apps to steal the user’s PIN, representing an exposure of sensitive system information (CWE-497). - CVE-2024-13917: The exported activity in com.pri.applock allows privilege escalation by enabling malicious apps to inject intents with system-level privileges if they have access to the compromised PIN (CWE-926). Users of affected devices are advised to seek firmware updates or mitigations from their vendors.
Microsoft Defender vs Bitdefender: Compare Antivirus Software
Tech Optimizer
May 27, 2025

Microsoft Defender vs Bitdefender: Compare Antivirus Software

eSecurity Planet maintains editorial independence in content and product recommendations, ensuring financial gain from partner links does not influence information integrity. Microsoft Defender and Bitdefender are prominent small business security providers. Microsoft Defender is ideal for larger SMBs, starting at .00 per user per month, while Bitdefender is suited for startups with over 10 employees, starting at .33 per user per month. Microsoft Defender Overview: - Overall Rating: 3.7/5 - Pricing: 4.4/5 - Features: 3.4/5 - Ease of Use and Administration: 3.8/5 - Customer Support: 3.7/5 - Features include next-gen antivirus, vulnerability management, and EDR. Bitdefender Overview: - Overall Rating: 3.4/5 - Pricing: 3.8/5 - Features: 3/5 - Ease of Use and Administration: 3.4/5 - Customer Support: 4/5 - Features include identity protection, a VPN, and a password manager. Pricing Comparison: - Microsoft Defender: Free Trial: 90 days; Least Expensive Plan: .00/user/month; Mid-Range Plan: .50/user/month; Most Expensive Plan: .00/user/month. - Bitdefender: 30-day money-back guarantee; Least Expensive Plan: .33/user/month; Mid-Range Plan: Not specified; Most Expensive Plan: Not specified. Feature Comparison: - Microsoft Defender offers robust endpoint protection but lacks clarity on web browsing protection and ad-blocking. - Bitdefender offers identity exposure protection, a VPN, and a password manager but also lacks web browsing and ad-blocking features. Ease of Use and Administration: - Microsoft Defender supports macOS, Windows, and Linux Server; Bitdefender supports macOS and Windows but lacks Linux support. Customer Support Comparison: - Microsoft provides phone and live chat support; Bitdefender offers email and chat support, with limited phone support for small business users. Alternative Solutions include Norton, McAfee, and Trend Micro, each offering different features and pricing structures. Evaluation Methodology focused on pricing, features, ease of use, and customer support, with Microsoft winning in pricing, features, and ease of use, while Bitdefender excelled in customer support.
Marbled Dust leverages zero-day in Output Messenger for regional espionage
AppWizard
May 14, 2025

Marbled Dust leverages zero-day in Output Messenger for regional espionage

Since April 2024, the threat actor Marbled Dust has been exploiting a zero-day vulnerability (CVE-2025-27920) in the Output Messenger chat application, targeting user accounts that have not applied necessary fixes. This exploitation has resulted in the collection of sensitive data from users in Iraq, specifically linked to the Kurdish military. Microsoft has high confidence in this assessment and notes that Marbled Dust conducts reconnaissance to identify potential targets using Output Messenger. Marbled Dust has successfully utilized this vulnerability to deploy malicious files and exfiltrate data. Microsoft notified the application’s developer, Srimax, about the vulnerability, leading to the release of a software update. A second vulnerability (CVE-2025-27921) was also found, but no exploitation of this second flaw has been observed. The zero-day vulnerability allows an authenticated user to upload malicious files to the server's startup directory. Marbled Dust has exploited this flaw to place a backdoor file, OMServerService.vbs, in the startup folder, enabling them to access communications and sensitive data indiscriminately. The attack chain begins with Marbled Dust gaining access to the Output Messenger Server Manager, likely through DNS hijacking or other credential interception techniques. Once inside, they exploit the vulnerability to drop malicious files, including a GoLang backdoor, which connects to a Marbled Dust command-and-control domain for data exfiltration. To mitigate this threat, Microsoft recommends updating to the latest version of Output Messenger, activating various security protections, and implementing rigorous vulnerability management strategies. Microsoft Defender XDR customers can identify potential threat activity through specific alerts related to Marbled Dust and utilize advanced hunting queries for detection. Indicators of compromise include traffic to the domain api.wordinfos[.]com, associated with Marbled Dust activities.
Microsoft patches Windows Kernel zero-day exploited since 2023
Winsage
March 12, 2025

Microsoft patches Windows Kernel zero-day exploited since 2023

ESET has identified a zero-day vulnerability in the Windows Win32 Kernel Subsystem, designated as CVE-2025-24983, which has been exploited since March 2023. This vulnerability, stemming from a use-after-free weakness, allows low-privileged attackers to escalate access to SYSTEM privileges without user interaction. It primarily affects older Windows versions, including Windows Server 2012 R2 and Windows 8.1, but also poses risks to newer versions like Windows Server 2016 and Windows 10 (build 1809 and earlier). The exploit was first seen in the wild in March 2023, targeting systems compromised by the PipeMagic malware. Microsoft has addressed this vulnerability in the recent Patch Tuesday updates. Additionally, five other zero-day vulnerabilities were also patched, and CISA has mandated that Federal Civilian Executive Branch agencies secure their systems by April 1st.
Search