A critical security vulnerability has been discovered in PureVPN’s Linux clients that exposes users’ real IPv6 addresses during network reconnections, undermining the privacy protections that users expect from their VPN service. The vulnerability affects both the graphical user interface (GUI version 2.10.0) and command-line interface (CLI version 2.0.1) on Linux systems, specifically tested on Ubuntu […]
Raven Stealer has emerged as a potent information‐stealing threat targeting users of Chromium‐based browsers, most notably Google Chrome.
First observed in mid-2025, this lightweight malware distinguishes itself through a modular architecture and stealthy design, allowing it to harvest sensitive information without alerting victims.
Delivered predominantly via cracked software bundles and underground forums, Raven Stealer capitalizes on social engineering tactics and repackaged installers to convince users to execute its malicious payload.
Once unleashed on a host system, Raven Stealer begins by probing local storage paths associated with Chrome, Edge, Brave, and similar browsers to locate encryption keys and credential vaults.
It then leverages native Windows API calls to decrypt and extract saved passwords, cookies, autofill entries, and payment data. During this phase, the malware avoids writing any components to disk by executing payload modules directly from its resource section, encrypted using ChaCha20.
This in-memory execution strategy enables Raven Stealer to evade signature-based detection and disk-monitoring defenses.
UI of the stealer (Soirce – Point Wild)
Point Wild analysts identified that the resource‐embedding technique streamlines deployment and complicates forensic analysis, as configuration data and modules are retrieved dynamically at runtime.
After initial credential harvesting, Raven Stealer compiles the stolen artifacts into plain text files within the user’s AppData directory, organized under a folder named “RavenStealer.”
The resulting files—cookies.txt, passwords.txt, and payments.txt—are then prepared for exfiltration.
Data transmission is carried out via Telegram’s Bot API: Raven Stealer embeds a user-supplied Bot Token and Chat ID into its payload, which it retrieves from its own resource configuration.
This integration offers attackers a familiar command-and-control channel while bypassing many corporate network filters.
Despite its reliance on Telegram, the malware maintains resilience against token expiration by prompting the builder UI to accept new credentials upon each payload generation.
Infection Mechanism Deep Dive
Raven Stealer’s infection mechanism hinges on reflective process hollowing to inject its main DLL payload into a suspended Chrome process.
Execution Flow (Soirce – Point Wild)
Upon execution, the malware locates the Chrome binary path and launches a new instance in a suspended state:-
Point Wild analysts noted that the payload uses ChaCha20 decryption in memory to reconstruct the DLL before execution.
After writing the decrypted payload into the allocated memory, the malware adjusts thread context to point to the remote buffer and resumes the thread:
This approach masks malicious activity under the guise of a legitimate Chrome process, reducing detection likelihood.
Once injected, the DLL enumerates browser profiles, decrypts stored credentials using the AES key found in Chrome’s Local State file, and writes the cleartext data to disk.
Finally, the compiled archive RavenStealer.zip is sent to the attacker’s Telegram channel via the endpoint https://api.telegram.org/bot<token>/sendDocument.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
Jenkins has released critical updates addressing four security flaws that unauthenticated and low-privileged attackers could exploit to disrupt service or glean sensitive configuration details.
Administrators running Jenkins weekly releases up to 2.527 or the Long-Term Support (LTS) stream up to 2.516.2 must upgrade to mitigate these risks.
HTTP/2 Denial of Service (CVE-2025-5115)
A high-severity issue (CVSS 3.1 A:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) exists in the Winstone-Jetty HTTP/2 implementation bundled with Jenkins core. When Jenkins is launched via an equivalent systemd service configuration, the outdated Jetty version is vulnerable to a denial of service attack known as “MadeYouReset.”
Unauthenticated attackers can trigger unchecked HTTP/2 frames to exhaust server resources, causing Jenkins to crash.
This flaw affects Jenkins 2.523 and earlier, and LTS 2.516.2 and earlier when HTTP/2 is enabled. HTTP/2 remains disabled by default in native installers and official Docker images, reads the advisory.
The fixes in Jenkins 2.524 and LTS 2.516.3 update Jetty to version 12.0.25, removing the vulnerability. Administrators unable to upgrade immediately are strongly advised to disable HTTP/2 support.
Two medium-severity flaws allow unauthorized enumeration of internal components. In the sidepanel executors widget, Jenkins 2.527 and earlier (LTS 2.516.2 and earlier) fail to enforce Overall/Read permission, letting unauthenticated users list agent names (CVE-2025-59474).
Similarly, a bug in the authenticated user profile dropdown (CVE-2025-59475) permits attackers with minimal privileges to discover which plugins, such as the Credentials Plugin, are installed by inspecting menu entries.
Both issues are resolved in Jenkins weekly 2.528 and LTS 2.516.3, which remove the vulnerable sidepanel and enforce permission checks in profile menus.
Log Message Injection (CVE-2025-59476)
Jenkins’ console log formatter in versions up to 2.527 (LTS 2.516.2 and earlier) does not sanitize user-controlled content before writing to system logs (jenkins.log and equivalents).
Attackers can insert carriage return or line feed characters or even Unicode “Trojan Source” codepoints—into log entries, forging misleading log lines that hamper incident response.
The update in weekly 2.528 and LTS 2.516.3 prefixes injected lines with indicators like [CR], [LF], or [CRLF] >, but administrators are still advised to use log viewers that highlight unusual characters and restrict log access to trusted personnel.
Missing permission check in authenticated users’ profile menu
4.6
Medium
CVE-2025-59476
Log message injection vulnerability
4.4
Medium
Mitigations
All Jenkins users should upgrade immediately: weekly releases to 2.528 and LTS to 2.516.3.
These versions collectively address the high-severity HTTP/2 DoS (CVE-2025-5115) and the medium-severity permission-check and log injection flaws (CVE-2025-59474; CVE-2025-59475; CVE-2025-59476).
The security researchers Daniel Beck (CloudBees, Inc.), Manuel Fernandez (Stackhopper Security), and IBM Cloud Red Team members Robert Houtenbrink, Faris Mohammed, and Harsh Yadav reported these issues.
Administrators unable to upgrade should, at a minimum, disable HTTP/2 and restrict access to log files to prevent exploitation.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
Researchers have uncovered a zero-day vulnerability in TP-Link routers that allows attackers to bypass Address Space Layout Randomization (ASLR) and execute arbitrary code remotely. Tracked as CVE-2025-9961, this flaw resides in the CWMP (TR-069) binary and can be triggered through malformed SOAP requests, granting full control of affected devices. A detailed technical walkthrough of discovery, […]
WatchGuard released an advisory detailing a critical vulnerability in its Firebox line of network security appliances. Tracked as CVE-2025-9242, the flaw resides in the iked component of WatchGuard’s Fireware OS. An out-of-bounds write in the IKEv2 handling routine can allow a remote, unauthenticated attacker to execute arbitrary code on affected devices. Overview of the Vulnerability […]
In the rapidly evolving cyber threat landscape, understanding the true nature of ransomware operations has become increasingly complex. Gone are the days when security teams could treat each ransomware family as a discrete, unified entity. The “post-Conti era” has ushered in a fractured marketplace of mutations, in which allegiances shift, identities blur, and hidden connections […]
On August 4, 2025, Zscaler ThreatLabz uncovered two malicious Python packages—sisaws and secmeasure—that deliver SilentSync, a Python-based remote access trojan (RAT), to unsuspecting developers. Both packages leverage typosquatting to impersonate legitimate libraries in the Python Package Index (PyPI), posing a serious supply-chain risk to projects that install them. SilentSync’s versatile capabilities include remote command execution, […]
The newly publicized Pixie Dust attack has once again exposed the critical vulnerabilities inherent in the Wi-Fi Protected Setup (WPS) protocol, enabling attackers to extract the router’s WPS PIN offline and seamlessly join the wireless network.
By targeting weak randomization in the registrar’s nonces, this exploit subverts the intended security of WPS without requiring proximity or sophisticated hardware.
Network defenders and home users alike must urgently update or disable WPS features to mitigate the risk of unauthorized access.
Pixie Dust Wi-Fi Attack
WPS was designed to simplify Wi-Fi setup by allowing devices to join a network using a short 8-digit PIN rather than the full WPA2-PSK.
According to NetRise, in the Pixie Dust attack, adversaries leverage two critical flaws in the four-way WPS handshake:
Routers issue 128-bit registrar nonces (Nonce-1 and Nonce-2) during the EAP-TLS exchange.
Due to flawed random number implementation, these nonces can be predicted or repeated across sessions. Attackers intercept the initial EAPoL frames and calculate the registrar nonces offline.
Offline PIN Recovery
Once nonces are known, the attacker reconstructs the HMAC-MD5 values used to verify the PIN.
By iterating through only 11,000 possibilities for the first half of the PIN and 1,000 for the second, the full 8-digit PIN is discovered in minutes far faster than brute-forcing WPA2.
Technical tools such as Reaver and Bully have been extended with a pixie-dust flag to automate nonce analysis. A typical attack command looks like:
Here, -i wlan0mon specifies the monitor-mode interface, -b designates the target BSSID, and -vv enables verbose output to track nonce recovery and PIN cracking progress.
After successfully recovering the WPS PIN, the attacker sends a final EAP-TLS EAP-Response containing the correct PIN, prompting the router to return the EAP-Success message and allow the registrar role.
At this point, the attacker can derive the WPA2 Pre-Shared Key (PSK) directly from the router:
The attacker requests the WSC NVS PIN attribute.
The router reveals the Network Key, which is the WPA2-PSK.
With the PSK in hand, the adversary connects to the network like any legitimate client.
Because the Pixie Dust vulnerability occurs entirely in the WPS protocol, WPA2 itself remains intact; however, the bypass of PIN authentication nullifies its protection.
Patching firmware to ensure proper nonce randomization or outright disabling WPS is the only reliable defense. Users should verify router settings or apply vendor updates that remove WPS PIN support.
Additionally, enabling 802.11w Protected Management Frames can raise the bar against attempted nonce interception and message forging.
With millions of home and small-office routers still shipping with WPS enabled by default, the Pixie Dust attack underscores the importance of rigorous protocol design and the dangers of convenience features in security systems.
Organizations should audit their wireless infrastructure immediately, and home users must change or disable vulnerable configurations to stay safe.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
A critical zero-day remote code execution (RCE) vulnerability, identified as CVE-2025-9961, has been discovered in TP-Link routers.
Security research firm ByteRay has released a proof-of-concept (PoC) exploit, demonstrating how attackers can bypass Address Space Layout Randomization (ASLR) protections to gain full control over affected devices.
The vulnerability resides in the router’s Customer Premises Equipment (CPE) WAN Management Protocol (CWMP) binary, a component of the TR-069 protocol used by service providers for remote device management.
Technical Breakdown of the Exploit
The core of the vulnerability is a stack-based buffer overflow within the cwmp process. Researchers at ByteRay found that by sending a malicious request, they could overwrite the program counter (PC) and seize control of the execution flow.
However, the presence of ASLR, a security feature that randomizes the memory addresses of key data areas, presented a significant hurdle.
Since the exploit did not involve an information leak to disclose memory layouts, the researchers devised a brute-force strategy. They repeatedly guessed the base address of the standard C library (libc) to locate the system() function.
Attack Scenario
An incorrect guess would crash the cwmp service, but the researchers noted that an attacker with access to the TP-Link web panel could simply restart the service, making the brute-force attack practical.
The attack workflow requires the router to be configured to accept the attacker’s custom Auto Configuration Server (ACS). The exploit is delivered through a SetParameterValues request containing the payload.
The final payload uses a return-to-libc (ret2libc) technique to call the system() function with a command argument.
This command instructs the router to download and execute a malicious binary (e.g., a reverse shell) from an attacker-controlled server, granting the attacker complete remote access.
Discovery and PoC Release
The ByteRay research team made the discovery. During their analysis, they encountered a problem where the standard GenieACS platform corrupted the binary payload, preventing successful exploitation. This forced them to develop a custom ACS emulator capable of faithfully transmitting the exploit code.
The team has published a detailed technical write-up and the full exploit code on GitHub. They state the release is intended for educational purposes and security research, allowing administrators to test their own devices. Unauthorized use of other systems is illegal.
PoC Exploit
This vulnerability is critical, as successful exploitation allows for complete remote code execution on the router. This could enable an attacker to intercept traffic, launch further attacks on the local network, or enlist the device in a botnet.
The research underscores the security risks associated with network-facing management protocols like TR-069, where even minor parsing errors can escalate into severe threats.
The exploit highlights that security mitigations like ASLR can sometimes be bypassed with creative attack strategies.
Users of TP-Link routers are advised to monitor for firmware updates from the vendor and apply them as soon as they become available to patch this vulnerability.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
A critical security vulnerability in the popular Greenshot screenshot utility has been discovered that allows local attackers to execute arbitrary malicious code within the trusted application process. The vulnerability, tracked as CVE-2025-59050, affects Greenshot versions up to 1.3.300 and has been patched in version 1.3.301 released on September 16, 2025. Greenshot image editor interface showing capture […]
.webp)
.webp)
