Yo, fellow Linuxers, #CVE20256019 has been published and updates are available. The TL;DR. A Local Privilege Escalation to root via libblockdev. Notice the local. So you need to be able to be on the machine. Still, update now.

https://nvd.nist.gov/vuln/detail/CVE-2025-6019

Dear @Gargron — Can we take another, fresh look at https://github.com/mastodon/mastodon/issues/20694 ? Hashtags should ultimately support full UTF8, IMHO, but adding at the very least the dash would be very helpful. It's not just band or artist names. CVEs are a better example. It would be really helpful when I can use #CVE-2025-6019 instead of #CVE20256019 or #CVE_2025_6019 as I am forced to do now. I guess hashtags are not in scope of the ActivityPub protocol, @evan ?

@jwildeboer @Gargron @evan Is #cve_2025_6019 an option for you?

(Edit: had to remove the / variant, #Mastodon doesn't do nested-obsidian-style variants either :)

@mina Sure. But it doesn't explain why the dash is not allowed. my example is an official CVE. Which is CVE-YEAR-Number, example: CVE-2025-6019. It is NOT CVE_2025_6019. So why is underscore allowed in a hashtag but the dash isn't? @Gargron @evan

#Zyxel devices are under active attack via CVE-2023-28771. Researchers spotted a sudden spike in exploit attempts from 244 IPs, possibly tied to #Mirai botnet variants.

🔗 https://hackread.com/zyxel-devices-active-exploits-cve-2023-28771-vulnerability/

#CyberSecurity #Vulnerability #IoT #CyberAttack #Botnet

Zyxel Devices Hit by Active Exploits Targeting CVE-2023-28771 Vulnerability https://hackread.com/zyxel-devices-active-exploits-cve-2023-28771-vulnerability/?utm_source=dlvr.it&utm_medium=%5Binfosec.exchange%5D

A critical remote code execution flaw (CVE-2023-28771) in Zyxel devices is being actively exploited by a Mirai-like botnet. The vulnerability, affecting Zyxel networking devices, allows attackers to run their own programs on vulnerable devices. Security experts urge immediate action, including blocking malicious IP addresses and applying security patches.
https://hackread.com/zyxel-devices-active-exploits-cve-2023-28771-vulnerability/

Crash di massa su Windows: la falla in OpenVPN che può mandare KO le infrastrutture

https://www.redhotcyber.com/post/crash-di-massa-su-windows-la-falla-in-openvpn-che-puo-mandare-ko-il-tuo-pc/

> È stata scoperta una vulnerabilità critica in OpenVPN per Windows (CVE-2025-50054) che consente a utenti locali non privilegiati di mandare in crash il sistema tramite un attacco di tipo buffer overflow.

Critical OpenVPN Driver Vulnerability Allows Attackers to Crash Windows
Systems
https://cybersecuritynews.com/openvpn-driver-vulnerability/

A critical buffer overflow vulnerability in OpenVPN’s data channel offload
driver for Windows has been discovered, allowing local attackers to crash
Windows systems by sending maliciously crafted control messages.

The vulnerability, identified as CVE-2025-50054, affects the ovpn-dco-win
driver versions 1.3.0 and earlier, as well as version 2.5.8 and earlier, which
has been the default virtual network adapter in OpenVPN since version 2.6.

Citrix has fixed a critical vulnerability (CVE-2025-5777) in NetScaler ADC and NetScaler Gateway, similar to CitrixBleed. The vulnerability allows unauthorized attackers to access session tokens from internet-facing devices, potentially gaining access to the appliances. Customers are urged to upgrade to the latest versions and terminate active sessions to mitigate the risk.
https://www.helpnetsecurity.com/2025/06/23/critical-citrix-netscaler-bug-fixed-upgrade-asap-cve-2025-5777/

#Citrix Critical Netscaler #vulnerability CVE-2025-5777 patch released!
Like CtirixBleed this vulnerability allows attackers to grab valid session tokens from the memory of internet-facing #Netscaler devices by sending malformed request:

https://www.helpnetsecurity.com/2025/06/23/critical-citrix-netscaler-bug-fixed-upgrade-asap-cve-2025-5777/

Nu har den kommit, den första sårbarheten i Copilot som kan användas för att genom att skicka ett mail extrahera känslig information från en organisation.

Mer information om sårbarheten echoleak (CVE-2025-32711) finns här:
https://www.aim.security/lp/aim-labs-echoleak-m365

#Sårbarhet #echoleak #Copilot #AI

It's 2025. We can use emojis in hashtags in some apps. But we still cannot use "-". So, no. still no #CVE-2025-0619. Will this ever be possible? Le sigh.

Canadian Telco not patching year old RCE 🙄

“The Canadian Centre for Cyber Security and the FBI confirm that the Chinese state-sponsored 'Salt Typhoon' hacking group is also targeting Canadian telecommunication firms, breaching a telecom provider in February.

During the February 2025 incident, Salt Typhoon exploited the CVE-2023-20198 flaw, a critical Cisco IOS XE vulnerability allowing remote, unauthenticated attackers to create arbitrary accounts and gain admin-level privileges.”

https://www.bleepingcomputer.com/news/security/canada-says-salt-typhoon-hacked-telecom-firm-via-cisco-flaw/

Jika kamu menggunakan roundcube, mungkin kamu ingin mengecek apakah kata sandimu telah terekspos.

https://www.cve.org/CVERecord?id=CVE-2025-49113

Mattermostの任意コード実行の脆弱性、CVSS v3のスコアが9.9

NVD - CVE-2025-4981 : 👀
---
https://nvd.nist.gov/vuln/detail/CVE-2025-4981

WinRAR 7.12 Beta behebt kritische Sicherheitslücke CVE-2025-6218. Die Traversal-Schwachstelle ermöglicht Angreifern, durch manipulierte Archive Schadcode ohne Authentifizierung auszuführen. #WinRAR #Sicherheit https://winfuture.de/news,151767.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia