ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Apr 22, 2024 · ZeroDay Catalog

    Critical Vulnerability in CrushFTP Allows Remote Code Execution

    A severe vulnerability in CrushFTP enables unauthenticated attackers to escape the VFS Sandbox, potentially leading to unauthorized access and remote code execution.

    What changed

    A significant server-side template injection vulnerability has been identified in CrushFTP, affecting all versions prior to 10.7.1 and 11.1.0. This flaw allows attackers to escape the VFS Sandbox, leading to serious security implications.

    Exploiting this vulnerability can enable unauthenticated remote attackers to access files outside the designated sandbox, bypass authentication mechanisms, and execute arbitrary code on the server.

    Who is affected

    The vulnerability impacts all users of CrushFTP, particularly those running versions before the specified updates. Organizations utilizing this software should be aware of the risks associated with this flaw.

    Given the nature of the vulnerability, any entity relying on CrushFTP for file management and transfer may be at risk of unauthorized access and potential data breaches.

    • CrushFTP users on versions prior to 10.7.1 and 11.1.0
    • Organizations managing sensitive data with CrushFTP
    • IT departments responsible for server security and maintenance

    What to do

    It is crucial for affected users to update their CrushFTP installations to the latest versions immediately to mitigate the risk posed by this vulnerability. Regularly reviewing and applying security patches will help maintain system integrity.

    Additionally, organizations should conduct a thorough security assessment to identify any potential exploitation of this vulnerability and implement monitoring to detect unauthorized access attempts.

    • Upgrade to CrushFTP version 10.7.1 or 11.1.0 or later
    • Perform security assessments to identify potential breaches
    • Implement monitoring for unauthorized access attempts

    Original report

  2. Mar 5, 2024 · ZeroDay Catalog

    Apple Addresses Memory Corruption Vulnerability Across Multiple Products

    Apple has released updates to address a critical memory corruption vulnerability that could allow attackers to bypass kernel memory protections across several products.

    What changed

    Apple has resolved a memory corruption vulnerability that could enable an attacker to gain arbitrary read and write access to kernel memory. This flaw was addressed through improved validation mechanisms.

    The vulnerability has been fixed in the following versions: iOS 16.7.6, iPadOS 16.7.6, iOS 17.4, iPadOS 17.4, macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5, tvOS 17.4, visionOS 1.1, and watchOS 10.4.

    Who is affected

    The vulnerability impacts a wide range of Apple products, potentially affecting users and organizations relying on these systems for daily operations.

    Specifically, the affected products include:

    • iOS devices running versions prior to 16.7.6 and 17.4
    • iPadOS devices running versions prior to 16.7.6 and 17.4
    • macOS systems including Monterey, Sonoma, and Ventura versions prior to the latest updates
    • tvOS, visionOS, and watchOS devices with outdated software versions

    What to do

    Users and administrators are urged to promptly update their devices to the latest software versions to mitigate the risk associated with this vulnerability.

    Regularly applying security updates is essential to protect against potential exploitation.

    • Update iOS to version 16.7.6 or 17.4
    • Update iPadOS to version 16.7.6 or 17.4
    • Update macOS to Monterey 12.7.4, Sonoma 14.4, or Ventura 13.6.5
    • Update tvOS, visionOS, and watchOS to the latest available versions

    Original report