News

Mon 15 Dec 2025· 51 articles

1. 01:49

   Unpatched Windows RasMan Flaw Allows Unprivileged Crash, Enabling Local System Privilege Escalation Exploit

   Researchers at 0patch have identified an unpatched vulnerability in the Windows Remote Access Connection Manager (RasMan) service, discovered while investigating CVE-2025-59230, an elevation of privilege vulnerability Microsoft addressed in its October 2025…

   SecurityOnline
   
2. 00:45

   Critical pgAdmin RCE (CVE-2025-13780) Flaw Bypasses Fix, Allowing Server Takeover Via Malicious Database Restore

   A critical pgAdmin vulnerability (CVE-2025-13780) has been disclosed, permitting remote code execution by abusing a flaw in how file encoding is processed during a server-side database restore. The flaw scores 9.1 on the CVSS scale and enables an attacker to…

   SecurityOnline
   
3. 00:42

   New NANOREMOTE Backdoor Uses Google Drive API for Covert C2 and Links to FINALDRAFT Espionage Group

   Elastic Security Labs has uncovered a sophisticated Windows backdoor, dubbed NANOREMOTE, that leverages the trusted infrastructure of Google Drive to hide its command-and-control traffic and exfiltrate data, with the infection chain first observed in October…

   SecurityOnline
   
4. 00:38

   SHADOW-VOID-042 Impersonates Trend Micro in Phishing Campaign to Breach Critical Infrastructure

   A new analysis details a targeted spear-phishing campaign attributed to the group tracked as SHADOW-VOID-042, which impersonated Trend Micro to breach defence, energy and chemical organisations, as well as to infiltrate Trend Micro and its subsidiaries using…

   SecurityOnlineSHADOW-VOID-042
   
5. 00:32

   Critical Plesk Flaw (CVE-2025-66430) Risks Full Server Takeover via LPE and Apache Config Injection

   A critical vulnerability in Plesk, tracked as CVE-2025-66430, could allow full server takeover via local privilege escalation and Apache configuration injection, with a CVSS of 9.1. The flaw lies in Plesk for Linux within the Password-Protected Directories…

   SecurityOnline
   
6. 00:26

   Hamas-Affiliated APT Ashen Lepus Unveils AshTag Malware Suite for Wider Cyber-Espionage

   According to Unit 42, Ashen Lepus (also known as WIRTE), a Hamas-affiliated APT, has upgraded its cyber‑espionage toolkit with a modular .NET malware suite named AshTag. The report notes that AshTag employs custom payload encryption and in‑memory execution…

   SecurityOnlineWIRTE
   
7. 00:20

   GOLD SALEM Abuses Velociraptor DFIR Tool as Ransomware Precursor Following SharePoint ToolShell Exploitation

   A sophisticated cybercriminal group has been observed repurposing a legitimate digital forensics tool as a precursor for ransomware attacks, according to the CTU Research Team at Sophos. The group, tracked as GOLD SALEM, is using the open-source Velociraptor…

   SecurityOnlineGOLD SALEM
   
8. 00:16

   Apache StreamPark Flaw Risks Data Decryption & Token Forgery via Hard-Coded Key and AES ECB Mode

   The Apache StreamPark vulnerability report highlights a cryptographic hygiene failure that could allow token forgery and data decryption due to hard-coded keys and the use of AES in ECB mode. The flaws affect versions 2.0.0 through 2.1.7, with administrators…

   SecurityOnline
   
9. 00:11

   Storm-0249 Abuses EDR Process via DLL Sideloading to Cloak Ransomware Access

   Storm-0249, an initial access broker, has shifted from broad phishing to surgical strikes that weaponise trusted security tools, according to ReliaQuest’s Threat Research Team. The group now abuses legitimate EDR processes—specifically components of…

   SecurityOnlineStorm-0249
   
10. 00:05

    ImageMagick Flaw Risks Arbitrary Memory Disclosure via PSX TIM File Integer Overflow on 32-bit Systems

    ImageMagick has a high-severity flaw, CVE-2025-66628, that could enable Arbitrary Memory Disclosure on 32-bit systems by abusing the TIM image format, with CVSS 7.5. The issue lies in the ReadTIMImage function, which calculates image_size as 2 * width *…

    SecurityOnline
    
11. 00:00

    VS Code Supply Chain Attack: 19 Extensions Used Typosquatting & Steganography to Deploy Rust Trojan

    According to ReversingLabs researchers, a sophisticated VS Code supply chain campaign has been active since February 2025 and was discovered on 2 December 2025, involving 19 malicious extensions that bypassed standard detection by burying payloads inside…

    SecurityOnline