What’s Going On

Security firm Wordfence reports that the CVE-2025-6389 vulnerability affects all Sneeit versions up to, and including, 8.3 — a plugin used by more than 1,700 active WordPress installations.

The flaw resides in the plugin’s sneeit_articles_pagination_callback() function, which improperly passes unsanitized user input into PHP’s call_user_func(). This oversight enables unauthenticated attackers to execute arbitrary PHP functions — such as wp_insert_user() — to create backdoor administrator accounts, upload malicious PHP files, or otherwise hijack the site.

Less than 24 hours after public disclosure on November 24, 2025, Wordfence had already blocked over 131,000 exploit attempts — 15,381 of those in a single day.

Attackers have been observed sending specially crafted HTTP requests to typical WordPress endpoints (e.g., /wp-admin/admin-ajax.php), creating malicious admin users such as “arudikadis” and uploading webshells like “tijtewmg.php” to maintain persistent backdoor access.

Compromised sites reportedly store malicious PHP shells — often named “xL.php,” “Canonical.php,” “.a.php,” or “simple.php” — granting attackers full control over the server: directory scanning, file read/write/delete, ZIP extraction, and more.

Why It Matters

RCE vulnerabilities like CVE-2025-6389 are especially dangerous because they give attackers server-level control — meaning they can deface websites, steal or leak data, send spam, or even pivot deeper into hosting infrastructures. In the case of Sneeit, malicious actors can operate without any user credentials, making automated wide-scale attacks trivial.

Moreover, Sneeit is commonly bundled within WordPress themes — which increases the likelihood that some site owners may be unaware of the underlying plugin and therefore miss critical updates.

What to Do: Immediate Actions & Mitigations

• Update Immediately: Site owners must upgrade to Sneeit version 8.4 or later, the patched release (rolled out on August 5, 2025).
• Audit & Hard-Harden: Review user accounts for unknown administrators, inspect file systems for suspicious PHP files (especially in upload or plugin directories), and check web-server logs and access patterns.
• Temporarily Disable Sneeit: If updating is not immediately feasible, consider disabling or removing the Sneeit plugin until patching is possible.
• Use Web Application Firewalls (WAFs): Deploy WAF rules to block untrusted POST requests, unusual calls to admin-ajax.php, or attempts to drop PHP files.

Security researchers and site administrators alike are also advising stronger supply-chain hygiene — especially avoiding themes bundled with outdated or rarely maintained plugins, and staying alert with vulnerability advisories

Broader Context: WordPress & Plugin Risk Landscape

This incident adds to a growing list of severe plugin-related vulnerabilities rocking the WordPress ecosystem. As attackers increasingly mechanize their reconnaissance and exploitation processes, a single unpatched plugin can jeopardize an entire website — or even a hosting server — overnight.

According to security tracking services, the Sneeit flaw is not unique. Flaws caused by improper input validation, dangerous PHP function execution, or weak plugin maintenance have repeatedly surfaced in 2025 — making plugin management and timely patching among the most critical tasks for any WordPress administrator

The post Sneeit WordPress RCE Under Active Attack by Hackers appeared first on CyberHood Sentinel.

Zero-Days Under Attack
Two key vulnerabilities — tracked as CVE‑2025‑20333 and CVE‑2025‑20362 — are reported to be under active exploitation by adversaries. According to vendor and independent advisories these flaws impact Cisco ASA and FTD software, allowing remote code execution and unauthorized access to restricted web-VPN endpoints.

CVE-2025-20333 is especially severe: an authenticated attacker with valid VPN credentials could execute arbitrary code with root privileges, potentially taking complete control of the appliance. Meanwhile, CVE-2025-20362 enables unauthenticated access to normally restricted URL endpoints and is believed to be chained with the former to achieve device compromise.

The scale of exposure is sizeable: as of late September 2025, security researchers reported nearly 50,000 internet-connected Cisco ASA/FTD devices remained unpatched and vulnerable.

Background Context

Cisco’s ASA and FTD platforms serve as key perimeter security appliances in many enterprise and government networks, managing VPN access, firewalling and web-VPN services. The threat actor behind this wave is identified by Cisco as UAT4356, and by Microsoft as Storm-1849 — a group linked to the earlier “ArcaneDoor” campaign of 2024.

Attackers reportedly targeted soon-to-be end-of-support ASA 5500-X series hardware lacking Secure Boot and Trust Anchor protections, a factor enabling firmware and ROM-level persistence. Notably, the U.K. national cyber authority (National Cyber Security Centre, NCSC) published analysis of two malware families tied to the campaign — “RayInitiator” (bootkit) and “LINE VIPER” (modular shellcode loader) — capable of surviving reboots and firmware upgrades.

Expert Insights & Response
CISA issued its Emergency Directive 25-03 requiring U.S. federal civilian agencies to identify, isolate and remediate compromised devices, or remove them from network operation entirely. According to cybersecurity firm Tenable, the active exploitation of these zero-days represents “a direct route to full device compromise” and urges immediate patching and forensic investigation.

In practical terms, organizations are advised to inventory all ASA/FTD devices, apply the fixes released by Cisco, hunt for signs of compromise (such as altered ROM/firmware, disabled logging, or unexpected reboots), reset credentials, and rebuild devices if persistence is suspected. Analysts warn that the combination of edge device compromise, firmware-level implant techniques and public exposure makes this campaign uniquely dangerous: a successful attacker at the firewall stage undermines traditional network segmentation and detection layers.

Conclusion
The unfolding campaign exploiting Cisco ASA/FTD zero-days underscores a hard lesson for cybersecurity teams: perimeter devices may appear hardened, but when vulnerable firmware meets a sophisticated threat actor — the consequences can be catastrophic. With tens of thousands of exposed devices still operational worldwide, and national-level directives in motion, the message is clear: patch early, hunt thoroughly, and treat edge devices as high-value targets. As defenders sprint to catch up, the attackers appear to have gained precious lead time — reminding every organisation that in cybersecurity, instability often begins at the edge.

The post Nation-State Threat Looms as Cisco Zero-Days Exploited appeared first on CyberHood Sentinel.

What Happened: Zero-Day Exploitation Drives Urgent Patch

Oracle’s security advisory reveals that CVE-2025-61882, rated CVSS 9.8, is a remotely exploitable flaw in the Oracle E-Business Suite that could allow an unauthenticated attacker (i.e. someone without credentials) to execute code on the Oracle Concurrent Processing component via HTTP access.

The urgency of the patch was driven by real-world exploitation: Cl0p has been observed leveraging this vulnerability in targeted data theft operations. Oracle’s Chief Security Officer, Rob Duhart, stated that the company released additional updates after discovering other potential attack vectors during their investigation.

Indicators of compromise linked to the attack include specific IP addresses (e.g. 200.107.207.26 and 185.181.60.11), and artifacts like exploit scripts and ZIP archives circulating under names such as

Background & Broader Context

This development comes amid a broader campaign by Cl0p targeting Oracle E-Business Suite users. In August 2025, security firm Mandiant reported that multiple vulnerabilities—some already patched in Oracle’s July update and at least one that would later become CVE-2025-61882—had been used to steal large volumes of data across multiple victims.

Charles Carmakal, CTO at Mandiant (now part of Google Cloud), warned that “irrespective of when the patch is applied, organizations should examine whether they were already compromised.” This warning is significant: even if organizations quickly apply Oracle’s fix, attackers may already have gained a foothold through earlier exploitation.

The pattern reflects a familiar tactic in advanced persistent threats (APTs) and ransomware groups: exploit a chain of known and zero-day vulnerabilities to gain access, then move laterally or exfiltrate sensitive data. In this case, Cl0p appears to have orchestrated a “high-volume email campaign” using compromised accounts to further their reach.

Expert Insights & Recommended Actions

Although Oracle did not include independent external commentary in its advisory, experts like those at Mandiant have publicly weighed in. The takeaway: applying the patch is necessary but not sufficient. Organizations should:

• Investigate past compromise indicators: Look into system logs, network traffic, and known IoCs to check for evidence of prior data exfiltration or backdoors.
• Implement segmentation and access controls: Limit the exposure of Oracle EBS components, especially the Concurrent Processing interface, to only trusted networks and systems.
• Monitor for anomalous behavior: Use threat-detection tools and continuous monitoring to detect unexpected outbound connections or privilege escalations.
• Stay current on updates: In this case, Oracle’s emergency patch was issued as soon as additional vectors were identified.

By combining patching with proactive hunting and defensive architecture, security teams can reduce their exposure to both zero-day and future threats.

Conclusion

Oracle’s emergency patch for CVE-2025-61882 underscores the speed with which modern cyber adversaries strike—and the critical need for equally rapid defensive responses. While the patch addresses the immediate flaw exploited by Cl0p, the campaign’s already-completed data thefts mean that affected organizations must review evidence of past compromise. In short: patch fast, but investigate thoroughly.

The post Oracle Patches Critical Flaw Exploited by Cl0p in Data Theft Campaign appeared first on CyberHood Sentinel.

The flaw affects multiple VMware platforms, including VMware Cloud Foundation, vSphere, VMware Aria Operations, and various versions of VMware Tools. Because the vulnerability is a local privilege escalation bug, an attacker already on a target system with non-admin access may exploit it to escalate to root privileges.

Broadcom (the parent of VMware) acknowledged the issue in an advisory, cautioning that a malicious local actor who can run a VM with VMware Tools (and is orchestrated under Aria Operations with SDMP enabled) may leverage it to gain root access.

Technical Root Cause & Attack Methodology

At the heart of the issue lies the get_version() function, which is used to match binary names against regex patterns when listening sockets are detected. The problem lies in overly broad regex patterns using \S (non-whitespace) to match binary names — these may inadvertently match binaries in writable directories, such as /tmp.

An unprivileged attacker could place a malicious binary (for example, /tmp/httpd) and cause VMware’s “metrics collection service” to invoke it under higher privileges. NVISO observed UNC5174 using that very path in attacks, spawning a root shell after privilege escalation.

NVISO researchers suggest that this kind of abuse may have existed in other malware strains already exploiting unintended privilege escalations for years, through mimicking of system binaries.

Though the exploit paths demand local access (i.e., an attacker must already have some foothold), the real danger lies in an attacker chaining this to full system takeover, especially in virtualized or cloud environments.

Background: Why UNC5174 Matters

UNC5174 is not a newcomer. Security firms like Mandiant and NVISO have previously linked the group to high-value intrusions, including those targeting Ivanti and SAP NetWeaver systems.

The detection of this new exploit suggests that UNC5174 has expanded its toolkit to include VMware-based escalation. While VMware’s advisory does not explicitly confirm real-world exploitation, NVISO says its attribution is founded on its own telemetry and observations.

Discovering the flaw was credited to NVISO’s Maxime Thiebaut, who reported it on May 19, 2025, during an incident-response engagement. VMware has since issued patches: VMware Tools 12.4.9 (part of 12.5.4) covers the bug on Windows 32-bit, and Linux distributors will push a fixed open-vm-tools version.

Expert Insight & Strategic Implications

Although direct quotes from third-party experts beyond NVISO are not present in the original report, the NVISO team offers critical insights:

• The exploitation method is deceptively simple (regular expression misuse) but powerful when combined with writeable directories and privileged services.
• Attackers mimicking system binaries is a longstanding evasion technique — this vulnerability amplifies such threats.
• The challenge for defenders lies in preventing the initial local foothold and ensuring proper patching or mitigations before attackers can escalate.

From a strategic viewpoint, the incident underscores a recurring pattern in cybersecurity: core infrastructure such as virtualization platforms remains an attractive target for advanced threat actors. Once they gain local code execution, privilege escalation bugs like CVE-2025-41244 offer a high-leverage path to full compromise.

What Should Organizations Do?

• Patch Immediately: Organizations using the affected VMware versions must apply the fixes via VMware Tools 12.4.9 (or higher) on Windows, or updated open-vm-tools packages on Linux.
• Restrict Writeable Paths: Hardening writeable directories (especially /tmp) and preventing unauthorized deployment of binaries may help reduce exposure.
• Segment Access: Treat and isolate virtual machines with VMware Tools and Aria Operations access to reduce lateral movement risk.
• Monitor for Anomalies: Look for suspicious use of HTTPD-like binaries or upward privilege execution patterns.
• Harden Initial Entry Points: Because an attacker must already have some local access to exploit this bug, focus on preventing phishing, credential theft, or supply-chain intrusions.

Conclusion

The discovery of active exploitation of CVE-2025-41244 by a China-linked threat actor is a stark reminder that virtualization infrastructure remains a coveted attack surface. The convergence of a subtle coding oversight (broad regex patterns) with malware persistence tactics (mimicking system binaries) illustrates how even mature platforms can harbor overlooked risks.

For defenders, the path forward is clear: patch aggressively, limit exposure of writable directories, monitor for anomalies, and always assume that local privilege escalation is part of an attacker’s chain — not the final step. In a landscape of increasingly stealthy threats, defense in depth and rapid response remain essential.

The post China-Linked Hackers Exploit New VMware Zero-Day for Months appeared first on CyberHood Sentinel.

What’s the Key News

• Vulnerability details: CVE-2025-43300 has a CVSS score of 8.8 and stems from ImageIO. A maliciously crafted image file processed by the component could trigger memory corruption.
• Real-world exploitation: Apple confirmed that the vulnerability “may have been exploited in an extremely sophisticated attack against specific targeted individuals.”
• Chained attack vector via WhatsApp: Another vulnerability, CVE-2025-55177 (CVSS 5.4), in WhatsApp for iOS and macOS, is reported to have been chained with CVE-2025-43300 in spyware attacks. Fewer than 200 individuals are believed to be targeted.
• Affected versions & backports: While the fix was first delivered in recent OS updates (e.g., iOS 18.6.2, iPadOS 18.6.2, macOS Ventura 13.7.8, Sonoma 14.7.8, Sequoia 15.6.1), Apple has now backported the patch to older OS versions, including iOS 16.7.12, 15.8.5, and corresponding iPadOS versions covering legacy devices like iPhone 6s/7, iPad Air 2, iPod touch (7th gen) etc.
• Other security fixes: The updates also address a broad slate of other vulnerabilities: from authorization problems in IOKit, keystroke monitoring via LaunchServices, to sandbox permissions, WebKit/ Safari issues, and privilege escalation in DiskArbitration.

Background Context

ImageIO is a core Apple component used to interpret and render images. Out-of-bounds write flaws (writing data outside allocated memory buffers) are dangerous because they often lead to unexpected behavior, crashes, or even arbitrary code execution, should an attacker chain them with other weaknesses. Older devices are especially at risk, as they might no longer receive frequent security patches—or may run outdated OS versions.

The chaining of vulnerabilities—e.g. a flaw in WhatsApp plus CVE-2025-43300—is a classic model in sophisticated spyware and targeted attacks. Attackers often exploit a less privileged bug (such as in an app that can be induced to process a malicious file) together with a system vulnerability to escalate access or persist on a device.

Expert Insights

Although Apple did not name specific attackers or expose full technical details on how the exploit works in the field, the company’s acknowledgment that “specific targeted individuals” were impacted suggests state-level or highly capable adversaries. Security researchers commenting on similar past vulnerabilities warn that ImageIO and other media processing libraries are frequent attack surfaces because they routinely parse untrusted content (images, videos) both from the web and via messaging apps.

Furthermore, backporting fixes to older OS versions demonstrates Apple’s recognition that many devices in the field remain vulnerable and need retrospective protection. This is especially important with legacy devices that users might not update often or cannot update to the latest OS due to hardware constraints.

Conclusion

CVE-2025-43300 is a serious vulnerability actively exploited in the wild and chained with other weaknesses in apps like WhatsApp. Apple’s decision to not only patch its newest operating systems but also backport fixes to older versions is a strong move to mitigate the risk across its device ecosystem. Users of all supported Apple devices—from the latest models down to older hardware—should install updates immediately.

The post Apple Backports Patch for CVE-2025-43300 After Real-World Spyware Exploit appeared first on CyberHood Sentinel.

What’s affected—and what’s fixed

CVE-2025-43300 impacts current Apple operating systems on iPhone, iPad, and Mac. Apple shipped patches in the following releases:

• iOS 18.6.2 and iPadOS 18.6.2
• iPadOS 17.7.10 (for devices remaining on iPadOS 17)
• macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, and macOS Ventura 13.7.8

In all cases, Apple states the bug was addressed by improved bounds checking inside ImageIO. These version numbers and the mitigation approach are documented in Apple’s security notes and the NVD entry for CVE-2025-43300.

How the attack works

Although technical details are limited (to avoid copycat exploitation), multiple security outlets report that attackers can trigger the vulnerability via zero-click or low-click vectors—for example, when a device automatically previews or indexes an image in messaging apps, email, or web content. Because ImageIO is a shared subsystem, the malicious image can reach the parser through many apps, increasing the real-world attack surface. Public reports emphasize that exploitation observed so far has been selective and targeted, consistent with spyware-class operations.

Why this matters

This is one of several zero-days Apple has had to remediate in 2025. While not unusual in today’s threat landscape, such bugs are particularly dangerous because they enable code execution without obvious user interaction. Modern iPhones, iPads, and Macs rely on rich media processing throughout the system; any flaw in a central parser like ImageIO can become a powerful foothold for attackers to deploy surveillance payloads, exfiltrate data, or escalate privileges. U.S. cyber authorities have already highlighted the risk profile of this issue and urged rapid patching across fleets.

What you should do now

For individuals

1. Update immediately: Install iOS/iPadOS 18.6.2 (or iPadOS 17.7.10 where applicable) and the latest macOS point release for your device. Enable Automatic Updates so you receive future fixes without delay.
2. Be cautious with unsolicited images: Until fully patched, avoid opening unknown image attachments or clicking links that may render images in the browser or messaging apps.
3. Check app permissions: Review camera, photos, and network permissions for apps that don’t need them.

For organizations

1. Push the updates with urgency across managed iOS, iPadOS, and macOS fleets; track compliance and remediate stragglers. CISA guidance to U.S. civilian agencies includes a near-term patch deadline, underscoring urgency for enterprise environments.
2. Harden media paths: Where possible, throttle automatic image previewing in email and messaging clients used in high-risk workflows.
3. Threat hunt for exploitation artifacts: Monitor for abnormal ImageIO crashes, unexpected network egress from messaging or image-handling processes, and sudden spikes in preview/thumbnailing activity around the disclosure window (August 20–22, 2025). Use EDR telemetry and mobile management logs to pivot.
4. Update detections: Incorporate the CVE into vulnerability management and ensure asset groups on hold for older OS major versions receive the corresponding point updates (e.g., Sonoma/Ventura).

Bottom line

CVE-2025-43300 is a classic example of a high-impact media-parsing bug: trivially delivered, broadly reachable, and now known to be exploited in the wild. Apple’s fixes are available today; applying them promptly is the most effective way to close this door. If your role or profile places you at higher risk—journalists, activists, executives, or government personnel—treat this as a priority patch and consider additional hardening until your entire device set is confirmed up to date

Download the apple update from: https://support.apple.com/en-us/100100

The post Apple Patches Zero-Day Vulnerability in iOS, iPadOS, and macOS appeared first on CyberHood Sentinel.

Details of the Vulnerability

CVE-2025-2783 is described as an “incorrect handle provided in unspecified circumstances in Mojo on Windows.” Mojo is a set of runtime libraries facilitating platform-agnostic inter-process communication (IPC). The flaw allows attackers to bypass Chrome’s sandbox protections, enabling unauthorized access to the system.

Discovery and Exploitation

Researchers Boris Larin and Igor Kuznetsov from Kaspersky discovered and reported the vulnerability on March 20, 2025. The attacks, dubbed “Operation ForumTroll,” involved sophisticated phishing emails containing malicious links. Upon clicking these links, the victims’ systems were infected without any further action required. The phishing emails masqueraded as invitations from the organizers of the legitimate scientific forum, Primakov Readings, and targeted media outlets, educational institutions, and government organizations in Russia.

Google’s Response

In response to the active exploitation, Google released out-of-band fixes in Chrome version 134.0.6998.177/.178 for Windows. The company acknowledged the reports of the exploit in the wild but has not disclosed additional technical specifics about the attacks or the threat actors involved.

Recommendations for Users

Users of Chrome on Windows are strongly advised to update their browsers to the latest version immediately to mitigate potential threats. Additionally, users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should apply the available fixes promptly. It is also recommended to exercise caution with unsolicited emails and avoid clicking on unknown links to prevent potential infections.

This incident underscores the critical importance of timely software updates and vigilance against phishing attempts to maintain cybersecurity.

The post Google Releases Urgent Chrome Update to Patch Actively Exploited Zero-Day Vulnerability appeared first on CyberHood Sentinel.

In a significant cybersecurity incident that has sent shockwaves through the tech industry, BeyondTrust, a global leader in Privileged Access Management (PAM), has disclosed a major data breach. This breach, identified on December 5, 2024, exposed sensitive data of 17 Remote Support SaaS customers, including the U.S. Treasury Department. The breach resulted from the exploitation of a zero-day vulnerability in a third-party application, which enabled unauthorized access to BeyondTrust’s infrastructure.

Breach Details: How the Incident Unfolded
The breach was triggered by a zero-day vulnerability in an unspecified third-party application. Threat actors exploited this vulnerability to infiltrate an online asset hosted within BeyondTrust’s Amazon Web Services (AWS) environment. Once inside, the attackers obtained an infrastructure API key, which allowed them to reset local application passwords. This manipulation granted unauthorized access to BeyondTrust’s Remote Support SaaS infrastructure, compromising sensitive data and client information.

BeyondTrust identified two critical vulnerabilities within its own systems, now tracked as CVE-2024-12356 and CVE-2024-12686. These vulnerabilities facilitated lateral movement within the network, amplifying the breach’s severity.

Response and Mitigation Efforts
Upon discovering the breach, BeyondTrust acted swiftly to contain the incident:

• Revoked the compromised API key to prevent further unauthorized access.
• Suspended affected customer instances to limit the breach’s impact.
• Provisioned alternative Remote Support SaaS instances to maintain business continuity for impacted clients.

The company engaged with cybersecurity experts, launched a comprehensive investigation, and notified relevant authorities. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since added the identified vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signaling active exploitation threats.

Government Involvement and Attribution
The breach’s implications extended to the U.S. Treasury Department, confirming its systems were affected. No other federal agencies have reported impacts so far. The cyberattacks have been attributed to a Chinese state-sponsored hacking group known as Silk Typhoon (formerly Hafnium). This group has a history of targeting government entities and critical infrastructure worldwide.

In response, the U.S. government imposed sanctions on Yin Kecheng, a Shanghai-based cyber actor linked to Silk Typhoon. Kecheng is allegedly responsible for orchestrating attacks that compromised the Treasury’s Departmental Offices network, highlighting escalating concerns over nation-state-sponsored cyber threats.

Impact on BeyondTrust and Its Clients
The breach has significant repercussions for BeyondTrust and its affected clients:

• Reputation Damage: BeyondTrust’s position as a leader in cybersecurity solutions faces scrutiny due to the breach.
• Operational Disruptions: Affected organizations experienced temporary service disruptions during incident response.
• Financial Costs: Incident response, legal fees, potential regulatory fines, and customer compensation are likely to incur substantial costs.

Lessons Learned and Security Recommendations
This breach underscores the critical need for robust cybersecurity practices. Organizations should consider the following measures:

1. Regular Vulnerability Assessments: Proactively identify and patch vulnerabilities, especially zero-day threats.
2. Third-Party Risk Management: Conduct thorough security audits of third-party applications and services.
3. Enhanced Monitoring: Implement advanced threat detection systems to identify suspicious activities in real-time.
4. Zero Trust Architecture: Adopt a Zero Trust security model to minimize unauthorized access risks.
5. Incident Response Planning: Develop and regularly update incident response plans to ensure rapid containment and recovery during breaches.

Conclusion
The BeyondTrust breach serves as a stark reminder that even cybersecurity giants are not immune to sophisticated attacks. As cyber threats evolve, organizations must prioritize proactive security measures, continuous monitoring, and robust incident response strategies to safeguard their digital assets. This incident highlights the growing complexity of the cybersecurity landscape, emphasizing the importance of vigilance in an increasingly interconnected world.

For continuous updates on this developing story, stay tuned to our cybersecurity news coverage.

The post BeyondTrust Zero-Day Breach : Treasury Department Among 17 Affected appeared first on CyberHood Sentinel.