A significant security vulnerability has emerged affecting QNAP’s NetBak PC Agent software through a critical flaw in Microsoft ASP.NET Core. The vulnerability, tracked as CVE-2025-55315, exploits HTTP Request Smuggling techniques to bypass essential security controls and could expose thousands of backup-dependent systems to unauthorized access and data manipulation. Attribute Details CVE ID CVE-2025-55315 Vulnerability Type […]
The zero-day exploitation of a now-patched security flaw in Google Chrome led to the distribution of an espionage-related tool from Italian information technology and services provider Memento Labs, according to new findings from Kaspersky.
The vulnerability in question is CVE-2025-2783 (CVSS score: 8.3), a case of sandbox escape which the company disclosed in March 2025 as having come under
Svenska kraftnät, Sweden’s national power grid operator, has confirmed it suffered a significant data breach that exposed certain information to unauthorized parties. The incident, disclosed on October 26, 2025, is linked to the notorious Everest ransomware gang, marking a concerning development in the ongoing wave of cyberattacks targeting critical infrastructure operators across Europe. Critical Infrastructure […]
Trend Micro Research has identified a significant evolution in the aggressive Water Saci malware campaign, revealing a new infection chain that abandons traditional .NET-based delivery methods in favor of sophisticated script-driven techniques. On October 8, 2025, researchers discovered file downloads originating from WhatsApp Web sessions that utilize Visual Basic Script downloaders and PowerShell scripts to […]
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a stark advisory highlighting two severe vulnerabilities in Veeder-Root’s TLS4B Automatic Tank Gauge System, a critical tool used in fuel storage and management across the energy sector.
These flaws, if exploited, could enable attackers to run arbitrary system-level commands on affected devices, potentially leading to widespread disruptions in critical infrastructure.
The primary vulnerability has a CVSS v4 score of 9.4, making it highly exploitable remotely and low-complexity, especially for those with basic credentials.
Veeder-Root, a U.S.-based company with global deployments, urges immediate upgrades to mitigate these risks, as reported by researcher Pedro Umbelino of Bitsight.
The vulnerabilities stem from flaws in the system’s handling of commands and time values, exposing Linux-based consoles to manipulation.
Discovered in systems deployed worldwide for monitoring underground storage tanks, they underscore ongoing challenges in securing industrial control systems (ICS) against sophisticated threats.
CISA emphasizes that these issues affect energy operations, where downtime could cascade into fuel supply interruptions or safety hazards.
Vulnerability Breakdown
The TLS4B system, versions prior to 11.A, suffers from a command injection flaw and an integer overflow related to the 2038 Unix epoch problem.
The command injection (CWE-77) arises in the SOAP-based web services interface, allowing authenticated remote attackers to inject malicious elements and execute Linux shell commands.
This could grant full system access, enabling data theft or further network compromise.
A secondary integer overflow (CWE-190) mishandles time values beyond the 2038 rollover, resetting the clock to 1901 and causing authentication failures, log corruption, and halted leak detection.
Attackers could exploit this for denial-of-service (DoS) by tampering with system time, locking out administrators, and disrupting operations.
CVE ID
Description
Affected Products
CVSS v3.1 Score (Vector)
CVSS v4 Score (Vector)
CVE-2025-58428
Command Injection (CWE-77) via SOAP interface; enables RCE and shell access.
Exploitation could yield remote command execution, lateral movement, administrative lockouts, and DoS conditions, severely impacting energy infrastructure reliability.
With low barriers to entry requiring only valid credentials, these flaws heighten risks for unpatched systems.
Veeder-Root recommends upgrading to TLS4B version 11.A for the command injection fix; for the overflow issue, a patch is in development, so users should follow network security best practices like isolating devices and securing ports.
CISA advises minimizing internet exposure, deploying firewalls, and using VPNs for remote access while conducting thorough risk assessments.
Microsoft is enhancing Windows 11’s stability with a new feature that prompts users for a quick memory diagnostic scan following blue screen of death (BSOD) incidents.
This proactive tool aims to detect and mitigate memory corruption issues that often lead to unexpected restarts, potentially reducing future system crashes.
Announced in recent Windows Insider builds, the update reflects Microsoft’s ongoing efforts to refine OS diagnostics amid rising reports of hardware-related failures.
The system triggers a notification upon login after a bugcheck, which is a critical kernel or driver error causing a BSOD. Users see a prompt suggesting a “quick memory scan,” scheduling the Windows Memory Diagnostic tool to run during the next reboot.
This scan typically lasts under five minutes, allowing the PC to boot into Windows afterward.
Windows Memory Diagnostics dialog
If memory problems are identified and addressed, a post-reboot alert informs the user of the resolution. In early testing, all bugcheck codes activate the prompt to gather data on memory-crash correlations.
Not every device supports this yet; it’s unavailable on Arm64-based systems, on systems with Administrator Protection enabled, or on BitLocker setups without Secure Boot.
The feature debuted in Insider Preview Build 26220.6982 for the Dev Channel and Build 26120.6982 for Beta, via update KB5067109.
Microsoft plans to narrow triggers to specific error types in future releases, improving precision without overwhelming users.
This aligns with broader Windows 11 updates, including AI enhancements like Copilot integrations. As PCs handle more demanding tasks, such tools could prevent data loss and downtime, especially for professionals reliant on stable systems.
The initiative underscores memory issues as a common BSOD culprit, urging timely hardware checks. With rollout expanding, Windows users may soon experience fewer frustrating interruptions.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical security alert regarding serious vulnerabilities in Veeder-Root’s TLS4B Automatic Tank Gauge System. Released on October 23, 2025, the alert warns that attackers could exploit these flaws to take control of industrial systems used worldwide, particularly in the energy sector. Two Critical Vulnerabilities Discovered Security […]
A new vulnerability in early versions of OpenVPN has been disclosed, potentially allowing malicious servers to execute arbitrary commands on client machines.
The flaw affects OpenVPN releases from 2.7_alpha1 to 2.7_beta1, enabling script-injection attacks on POSIX-based systems such as Linux, macOS, and BSD variants.
The issue stems from inadequate sanitization of the –dns and –dhcp-option arguments. When a client connects to an untrusted VPN service, these parameters are passed unsanitized to the –dns-updown script hook.
This oversight lets attackers embed malicious commands that run with elevated privileges on the client device, risking data theft, malware deployment, or full system compromise.
Security researchers warn that users relying on these beta builds for remote access or secure networking face immediate risks, especially in enterprise or personal setups involving third-party VPN providers.
OpenVPN – Script Injection Attack
Designated as CVE-2025-10680, the vulnerability has a CVSS score of 8.1 (high severity), highlighting its exploitability over the network without authentication.
It exploits the trust model where clients assume server-pushed DNS configurations are benign. On affected Unix-like systems, the –dns-updown script executes these inputs directly, opening the door to command injection.
Windows users are also impacted if using the built-in PowerShell integration, though the primary exposure remains on Linux and macOS.
Proof-of-concept exploits could involve crafting DNS strings with shell metacharacters, such as backticks or semicolons, to chain additional commands.
The OpenVPN project has confirmed no evidence of widespread exploitation yet, but urges immediate updates.
Patch Released With OpenVPN 2.7_beta2
Responding swiftly, the OpenVPN community released version 2.7_beta2 on October 27, 2025, incorporating critical fixes.
Key among them is enhanced input sanitation for DNS strings, blocking injection attempts from trusted-but-malicious servers.
The update also addresses Windows-specific issues, like improved event logging via a new openvpnservmsg.dll, and restores IPv4 broadcast configuration on Linux.
Additional bug fixes include better handling of multi-socket setups on Windows and repairs to DHCP options in TAP mode. Users should download the beta2 build from the official OpenVPN website and test in non-production environments.
For production use, sticking to stable 2.6.x releases remains advisable until 2.7 stabilizes. This incident underscores the importance of validating VPN software betas, particularly in diverse OS ecosystems.
Cybersecurity researchers have uncovered a sophisticated phishing campaign orchestrated by the notorious Gamaredon threat group, specifically targeting government entities through exploitation of a critical WinRAR vulnerability. The attack leverages CVE-2025-8088, a path traversal vulnerability in the popular file compression software, to deliver weaponized RAR archives that silently deploy malicious payloads without requiring user interaction beyond […]
The Apache Software Foundation has disclosed two security vulnerabilities affecting multiple versions of Apache Tomcat, with one flaw posing a serious risk of remote code execution on vulnerable servers. The flaws impact Apache Tomcat versions 9, 10, and 11, prompting urgent warnings for administrators to upgrade their installations immediately. CVE ID Vulnerability Severity CVSS Score […]
