Skip to content

Vulnerability Management Platform

Weekly Report: New Hacking Techniques and Critical CVEs July 14-21, 2025

The week of July 14-21, 2025, witnessed an unprecedented escalation in cybersecurity threats with multiple critical zero-day vulnerabilities under active exploitation, sophisticated state-sponsored attacks, and a major international law enforcement operation against Russian cybercriminals. The period was characterized by maximum-severity vulnerabilities achieving immediate weaponization, advanced persistent threat campaigns deploying next-generation malware, and coordinated international cybercrime… Read More »Weekly Report: New Hacking Techniques and Critical CVEs July 14-21, 2025

Weekly Cybersecurity Intelligence Report Cyber Threats & Breaches July 14-21, 2025

The week of July 14-21, 2025, marked an unprecedented surge in critical cybersecurity incidents, characterized by multiple zero-day exploitations, state-sponsored campaigns, and a significant data breach affecting millions of individuals. The security landscape witnessed five critical-severity incidents, including active exploitation of Microsoft SharePoint servers, CrushFTP file transfer systems, and Citrix NetScaler appliances. Concurrently, Chinese APT… Read More »Weekly Cybersecurity Intelligence Report Cyber Threats & Breaches July 14-21, 2025

HPE Networking Instant On Access Points Vulnerabilities (CVE-2025-37103, CVE-2025-37102): Hardening Network Infrastructure

Overview On July 18, 2025, HPE disclosed two vulnerabilities in its Networking Instant On Access APs: CVE-2025-37103 (CVSS 9.8, hard-coded credentials) and CVE-2025-37102 (CVSS 7.2, authenticated command injection). These flaws allow attackers to bypass authentication and execute arbitrary commands with elevated privileges. Explanation CVE-2025-37103 involves hard-coded credentials in HPE Instant On Access Points, enabling attackers… Read More »HPE Networking Instant On Access Points Vulnerabilities (CVE-2025-37103, CVE-2025-37102): Hardening Network Infrastructure

CrushFTP Vulnerability (CVE-2025-54309): Securing File Transfer Services

Overview On July 18, 2025, CrushFTP disclosed a critical vulnerability (CVE-2025-54309, CVSS 9.0) in versions 10 before 10.8.5 and 11 before 11.3.4_23, exploited via HTTP(S) to gain admin access. The flaw, related to AS2 validation mishandling, allows remote attackers to bypass authentication when the DMZ proxy feature is disabled. Explanation The vulnerability arises from improper… Read More »CrushFTP Vulnerability (CVE-2025-54309): Securing File Transfer Services

Microsoft SharePoint Server Zero-Day (CVE-2025-53770): Urgent Patching Required

Overview On July 19, 2025, Microsoft disclosed a critical zero-day vulnerability in SharePoint Server (CVE-2025-53770, CVSS 9.8), actively exploited in large-scale attacks, breaching over 75 organizations. The flaw, a variant of CVE-2025-49704, allows unauthenticated remote code execution (RCE) via deserialization of untrusted data. CISA added it to its Known Exploited Vulnerabilities catalog, urging immediate action.… Read More »Microsoft SharePoint Server Zero-Day (CVE-2025-53770): Urgent Patching Required