ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Nov 1, 2023 · ZeroDay Catalog

    Critical Use-After-Free Vulnerability in Linux Kernel NVMe/TCP Subsystem

    A critical use-after-free vulnerability has been identified in the NVMe/TCP subsystem of the Linux kernel, potentially allowing remote code execution or local privilege escalation.

    What changed

    A use-after-free vulnerability has been discovered in the NVMe/TCP subsystem of the Linux kernel, specifically in the function `nvmet_tcp_free_crypto`. This flaw arises from a logical error that could allow an attacker to exploit the system.

    The implications of this vulnerability are significant, as it may lead to remote code execution or local privilege escalation, posing a serious risk to affected systems.

    Who is affected

    This vulnerability impacts users of the Linux kernel, particularly those utilizing the NVMe/TCP subsystem.

    Organizations relying on Linux-based systems for their storage solutions may be at risk.

    • Linux kernel users with NVMe/TCP implementations
    • Organizations using Linux for cloud services
    • Data centers employing NVMe/TCP for storage solutions
    • Developers maintaining applications that interface with the Linux kernel

    What to do

    It is crucial for system administrators and security teams to assess their environments for the presence of this vulnerability. Immediate action should be taken to mitigate potential risks.

    Updating to the latest version of the Linux kernel that addresses this vulnerability is highly recommended.

    • Review and apply security patches from the Linux vendor as they become available.
    • Monitor systems for unusual activity that may indicate exploitation attempts.
    • Implement security best practices, including least privilege access and regular system audits.

    Original report

  2. Oct 31, 2023 · ZeroDay Catalog

    Critical Improper Authorization Vulnerability in Atlassian Confluence Data Center and Server

    An improper authorization vulnerability has been identified in all versions of Atlassian Confluence Data Center and Server, allowing potential unauthorized administrative access.

    What changed

    A significant vulnerability has been discovered in Atlassian Confluence Data Center and Server that allows unauthenticated attackers to reset the application and create an administrator account. This vulnerability has not yet been exploited in the wild but poses a serious risk to affected systems.

    Once an attacker gains administrative access, they can execute all administrative functions, resulting in a complete compromise of the system's confidentiality, integrity, and availability.

    Who is affected

    All versions of Atlassian Confluence Data Center and Server are impacted by this vulnerability. Organizations using these products should be particularly vigilant.

    Atlassian Cloud sites are not affected, which provides some assurance to users of the cloud-based service.

    • Atlassian Confluence Data Center
    • Atlassian Confluence Server
    • Organizations using self-hosted Confluence instances

    What to do

    Immediate action is recommended for organizations running affected versions of Confluence Data Center and Server. It is crucial to assess your current version and apply necessary mitigations.

    Ensure that access controls are strictly enforced and monitor for any unauthorized access attempts.

    • Review and update your Confluence instance to the latest version.
    • Implement strict access controls to limit exposure.
    • Monitor logs for unusual activities that may indicate attempts to exploit this vulnerability.

    Original report