Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A new critical vulnerability has been identified in FreePBX, the widely adopted open-source, web-based graphical user interface for managing Asterisk PBX systems. Tracked as CVE-2025-57819, this flaw affects FreePBX versions 15, 16, and 17 and enables unauthenticated attackers to bypass administrator login controls. Once inside, threat actors can perform SQL Injection attacks that lead directly to remote code execution (RCE).

Vulnerability prioritization isn’t just an important piece of any organization’s vulnerability management process. It’s a requirement. With the volume so high, and growing, it’s simply impossible to address every vulnerability an organization encounters. Prioritization comes at a price. Many organizations focus on a small number of the most critical vulnerabilities in their environment, which leads to an important question: What happens to the rest?

On August 26–27, 2025 (UTC), eight malicious Nx and Nx Powerpack releases were pushed to npm across two version lines and were live for ~5 hours 20 minutes before removal. The attack also impacts the Nx Console VS Code extension.

On August 26th, 2025, Citrix patched CVE‑2025‑7775, a memory overflow vulnerability in NetScaler ADC and Gateway appliances that allows unauthenticated remote code execution (RCE) and/or denial-of-service. This threat is confirmed to be actively exploited in the wild. Citrix strongly emphasized that no mitigations exist aside from applying the patch immediately.

On August 26, 2025, Citrix released fixes for a critical vulnerability in Citrix NetScaler ADC and Gateway (CVE-2025-7775) that has been exploited on unpatched appliances. The issue stems from a memory overflow flaw that could allow Remote Code Execution (RCE) and/or Denial of Service (DoS) by remote threat actors.

This blog details how 1Password has addressed clickjacking in the latest version of our browser extension (version 8.11.7). We have no indication that this class of vulnerability directly puts 1Password’s systems at risk. Clickjacking is a technique where a malicious or compromised webpage visually disguises or overlays elements of a page or browser extension, like the autofill menu, so that a user unintentionally clicks on them.

Trustwave, A LevelBlue Company, is a huge proponent of employing offensive security tactics to ensure a client is properly protected. For Trustwave, the reason is obvious. Offensive security is an effective approach to evaluate and enhance an overall security posture. We’ve written about this before (just check here, here, and here), but today we will explore the difference between an Authenticated Scan and an Unauthenticated Scan. Let’s set the stage by defining the two types of scans.

Unrestricted Resource Consumption (API4:2023) is the only threat category in the OWASP API Security Top 10 explicitly dedicated to Denial of Service (DoS) and resource abuse. But despite being just one category, attackers can exploit it in many different ways; from large file uploads and expensive GraphQL queries to abuse of metered third-party services like SMS gateways or AI/LLM APIs.

Prioritizing which vulnerabilities to fix across your application isn't always easy. Is it exploitable? Is it reachable? Will the update introduce breaking changes? Are there any other teams using this library that you should be aware of? What does the backlog look like if other changes need to be made? And that's just this week. Next week, it'll be the same thing all over again, with new discoveries, new version releases, and maybe even a new cybersecurity breach.

A newly discovered zero-day vulnerability, tracked as CVE-2025-54253, affects Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23.0 and earlier. Adobe has responded by issuing an urgent security update to prevent exploitation. Rated critical with a CVSS score of 10.0, this vulnerability can allow attackers to bypass authentication and execute arbitrary code remotely without requiring any user interaction.

We’ve normalized drowning in vulnerabilities. Thousands of findings, weekly scans, red dashboards – it’s all become background noise. And still, attackers slip through. Why? Because we’ve been solving for the wrong variable. The real question isn’t what’s vulnerable, it’s what’s exposed. Not every vulnerability is a threat.

Shadow IT has evolved from an occasional nuisance to a pervasive security challenge that affects every organization. These unauthorized applications, services, and devices operating outside of IT oversight create blind spots in your security posture that attackers are increasingly exploiting. But here’s the reality: your employees aren’t trying to undermine security.

The Jit Team, a group of security pioneers, is dedicated to guiding developers and organizations in their pursuit of seamless and secure cloud app development. Our expertise spans from product security to DevSecOps, enabling you to fortify your software at every stage. Security experts dedicated to shaping insightful editorial content, guiding developers and organizations toward secure cloud app development. Dive into a wealth of knowledge and experience in fortifying software integrity.

When vulnerability scans return thousands or even millions of findings, leading to an avalanche of tickets to evaluate, the real challenge begins: figuring out what to fix first. Exposure prioritization is the critical next phase of a mature exposure management program. After defining what exposure management is and establishing a normalized foundation of aggregated data, the question becomes: how do we cut through the noise and focus on what truly matters?

On August 14, 2025, Cisco released fixes for a maximum-severity vulnerability affecting Cisco Secure Firewall Management Center (FMC) Software, tracked as CVE-2025-20265. FMC is the centralized platform used to manage security settings and network devices across Cisco Firepower and ASA deployments.

Vulnerability management is the continuous, proactive process of identifying, evaluating, remediating, and reporting on security weaknesses across systems, networks, and software to reduce attack surface and minimize cyber risk.

On August 13, security researchers at Tel Aviv University disclosed a new HTTP/2 denial-of-service (DoS) vulnerability that they are calling MadeYouReset (CVE-2025-8671). This vulnerability exists in a limited number of unpatched HTTP/2 server implementations that do not sufficiently enforce restrictions on the number of times a client may send malformed frames. If you’re using Cloudflare for HTTP DDoS mitigation, you’re already protected from MadeYouReset.

We're witnessing a paradigm shift from reactive security tools to proactive, intelligent defenders. AI agents represent the next evolution beyond traditional security systems, fundamentally changing how we approach cybersecurity.

CVE-2025-53770 and CVE-2025-53771 are critical remote code execution vulnerabilities (CVSS base score 9.8) impacting Microsoft SharePoint, a widely deployed enterprise collaboration and content management platform. In this blog, we will simulate the exploitation of this SharePoint RCE vulnerability and analyze the resulting telemetry inside Graylog.

This release raises the bar for enterprise-grade vulnerability and exposure management. We’re delivering on the promise of smarter, faster risk reduction powered by automation, enriched data, and operational depth. From fix-level SLA tracking to scalable API workflows and stakeholder-ready reporting, every enhancement is designed to help teams do more with less, and prove it. Here’s a breakdown of some of the major product updates from Q2 2025.

Did developers steal the spotlight of agentic workflows with the wave of AI coding assistants sweeping the media, startups, and tech? What about DevOps workflows, container security, and operating system vulnerability scanning? One of the most time consuming tasks of application security engineers and those responsible for production artifacts is tracking Common Vulnerabilities and Exposures (CVEs) and in what way they impact a bundled application.

Driving along on a dark highway late at night, you feel a jolt and hear a metallic crushing sound as your car hits an unknown object in the road. You nervously continue on your journey, until you see a bright light flashing on your dashboard. Your oil pressure is low because your car has been leaking oil since you hit that unknown object on the highway. Much like an unknown object in the road that leads to a slow leak, a network vulnerability can lead to a devastating data leakage or breach.

Despite ongoing investment in detection tools, vulnerability management continues to underdeliver. Security teams don’t lack data. They lack the systems to act on it. According to our latest research, 91% of organizations report delays in remediation, and 41% say they struggle to make findings actionable. The result is a persistent backlog of exploitable vulnerabilities, compounded by manual workflows and poor coordination between teams.

The recent alert issued by the US Cybersecurity and Infrastructure Security Agency (CISA) about vulnerabilities in SimpleHelp remote support software highlights the growing risk in the software supply chain, making it a real threat to MSPs and their clients.

2025 has been a summer of high-profile breaches. This post will focus on four notable and high-profile victims: Chanel, Google, Air France, and KLM. Although the companies and exact data sets differ, these breaches share a clear pattern: attackers compromised third-party CRM / customer-service platforms as part of a wider Salesforce-focused vishing/social-engineering campaign. From there, they exfiltrated customer-care records such as contact details, loyalty IDs, and customer-service email content.

The Trustwave SpiderLabs CTI team began correlating telemetry from multiple enterprise environments in response to a rapidly developing threat landscape involving the widespread exploitation of Microsoft SharePoint on-premises infrastructure. In this blog, we share key findings from several observed intrusions across our monitored environments.

On August 6, 2025, Microsoft disclosed a high-severity post-authentication vulnerability affecting on-premises Microsoft Exchange servers configured for hybrid-joined environments, tracked as CVE-2025-53786. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Emergency Directive 25-02, requiring federal agencies to patch the vulnerability by Monday, August 11.

Federal agencies are moving fast to unlock AI's potential—from improving citizen services to driving mission outcomes. But with all that innovation comes a new wave of complexity and risk. Security, trust, and transparency can’t be afterthoughts. They need to be part of the build and AI adoption process from day one. AI-driven development is exponentially increasing both code speed and code insecurity, as AI generates code with up to 40% more vulnerabilities than human developers.

Adobe Experience Manager (AEM) Forms on Java Enterprise Edition (JEE) has suffered two critical vulnerabilities CVE‑2025‑54253 and CVE‑2025‑54254 disclosed in early August 2025. According to Adobe, both flaws carry public proof-of-concept (PoC) exploits, though there are no known in-the-wild attacks as of today.

In our recent webinar featuring Enterprise Strategy Group Principal Analyst, Tyler Shields, we discussed the widening gap between vulnerabilities organizations know about and what they can realistically fix. Most teams are swamped. Too much data, too many tools, and not enough people. Naturally, automation and AI come up as potential solutions. One comment from Tyler has stuck with me since watching and subsequently reviewing the webinar recording.

Azure CSPM (Cloud Security Posture Management) helps users maintain secure cloud setups. This post covers the basics, including the role of scanning virtual machines, various scan methods, and methods for viewing results.

Today, Snyk is launching a powerful enhancement to our API discovery capabilities through a strategic partnership with Akamai. This integration is designed to solve one of the most significant challenges in modern application security: the difficulty of providing API schemas for DAST scanning. By directly ingesting API inventories and their corresponding schemas from Akamai, we are transforming a difficult manual process into a seamless, automated workflow within the Snyk platform.

On August 5, 2025, Trend Micro released a short-term mitigation tool addressing two critical command injection vulnerabilities (CVE-2025-54948 and CVE-2025-54987) in Apex One. These flaws affect the on-premise Apex One Management Console and have been exploited in the wild. Both stem from a command injection issue that allows unauthenticated, remote threat actors to execute arbitrary code on vulnerable systems. While the vulnerabilities are similar, they differ based on the targeted CPU architectures.

For years, the cybersecurity community has discussed the theoretical risks of artificial intelligence. We’ve imagined biased algorithms and adversarial attacks, but these conversations usually stayed hypothetical. That era is over. It’s time to move beyond the theory and into the practical “how-to” of finding and exploiting vulnerabilities in AI systems. To execute this, the new OWASP AI Testing Guide (AITG) is indispensable.

Generative AI is reshaping how software is made, secured, and scaled. At Snyk’s Lighthouse event in Silicon Valley, leaders from engineering, security, and platform teams gathered to explore one big question: How do we build AI-powered systems that move fast, without breaking trust? For many, that future is already here — 60% of organizations at the Summit reported building agentic apps internally. The answers weren’t just technical. They were cultural. Organizational. Strategic.

In this article Chief Information Security Officers (CISOs) face the daunting task of balancing technical cybersecurity risks with the financial realities of their organization. One critical component in this balancing act is the use of vulnerability scoring systems, in particular, the CVSS score. This article provides a detailed guide on how to translate CVSS scores into tangible financial impact estimates using proven methods of risk quantification.

Tech companies love a good framework, especially ones that promise structure, transparency, and alignment with internal standards. Zoom’s Vulnerability Impact Scoring System (VISS) is one of those. It’s designed to translate internal security policies into a scoring model that supports impact-based decision making, particularly for bug bounty programs and external disclosure workflows. On paper, that sounds useful. But in practice, it doesn’t scale.

When we talk about healthcare today, it’s impossible not to consider application security. As healthcare providers increasingly lean on digital solutions to deliver patient care, they are creating an explosion of healthcare data requiring protection to ensure its confidentiality, integrity, and availability.

As the Chief Information Security Officer at Snyk, my primary role is to ensure the security and integrity of our products, our systems, and our customers' data. But my responsibility extends beyond our walls. It involves championing a vision for a more secure digital world—a vision I am proud to say we share with the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

The recent revelation of a critical vulnerability in Base44, a prominent vibe coding platform, has spotlighted the intricate relationship between innovation and security in AI-assisted development. Researchers at Wiz uncovered a flaw in the platform that allowed unauthorized access to private enterprise applications, exposing sensitive data and raising urgent questions about the security of vibe coding practices.

At Snyk, we believe you should never have to choose between speed and security. As the age of AI transforms software development, our goal is to extend our developer-first security approach to this new era, providing the essential tools your teams need to build with confidence. Today at Black Hat, we are delivering on that vision with three tangible innovations that offer a comprehensive solution to secure the entire code lifecycle with AI.

xx.

xx.

Imagine financial analysts watching stock prices suddenly drop. Dashboards show misaligned data, market confidence disappears, and trading screens across the NASDAQ turn red. But this time, the disruption isn’t caused by politics or economic shifts. It starts with a cyberattack. We reveal how a simple and overlooked flaw in Streamlit’s file upload feature, part of a widely used open-source framework for building stock market dashboards, could be used to cause this kind of financial chaos.

Non-human identities. It seems like every technology conference that I’ve attended over the past year or so has had NHIs as a primary topic. And it’s no wonder. What have become powerful tools in the new world of hyper-automation, dynamic IT infrastructures, and complex security processes, have also led to new vulnerabilities within many IT environments. For just a moment, let’s look at why NHIs are important to focus on from a security perspective. I have 3 primary vulnerabilities.

In late July 2025, users discovered that ChatGPT chats, initially shared via link, were appearing in search engine results on platforms such as Google, Bing, and DuckDuckGo. These shared conversations included personal content relating to mental health, career concerns, legal issues, and more, without any indication of a data breach. Instead, the exposure resulted from a now-removed feature that enabled discoverability via search indexing.

In today’s hyperconnected world, a single misleading LinkedIn or X post gone viral can cause problems for the most well established brand in a matter of minutes. Digital Risk Protection plays a vital role in uncovering and neutralizing these hidden dangers before they escalate. We’ll run through some real-world examples with Outpost24’s CompassDRP solution to show how you can proactively monitor for social media threats before they damage your brand.