Windows users should update 7-Zip to version 25.00 or later to fix two significant “path traversal” vulnerabilities (CVE-2025-11001 and CVE-2025-11002) that can allow remote code execution, caused by the handling of symbolic links in ZIP files.
https://alternativeto.net/news/2025/10/two-major-security-vulnerabilities-discovered-in-7-zip-affecting-windows-users/

🚨CVE-2025–27636 & CVE-2025-29891: Apache Camel PoC affecting versions: 4.10.0-4.10.1, 4.8.0-4.8.4, 3.10.0-3.22.3. Exploitation of these vulnerabilities can enable attackers to execute internal Camel methods.

GitHub: https://github.com/akamai/CVE-2025-27636-Apache-Camel-PoC

Advisory: https://camel.apache.org/security/CVE-2025-29891.html

Write-up: https://www.akamai.com/blog/security-research/march-apache-camel-vulnerability-detections-and-mitigations

🚨 F5 Breach Ignites Global Scanning Frenzy: 300% Spike Detected by the CrowdSec Network

The CrowdSec Network has detected a dramatic surge in scanning activity targeting all F5 BIG-IP vulnerabilities following F5 Networks' disclosure of a nation-state security breach on October 15th, 2025. Attack volumes across the entire F5 CVE landscape peaked on October 16th at three times normal levels, highlighting how public security incidents immediately attract opportunistic threat actors seeking to exploit enterprise infrastructure.

🔍Key findings:

🔹Comprehensive F5 targeting: All F5 CVE scanning activity increased 300% within 24 hours of F5's breach disclosure on October 15th, peaking on October 16th across the entire vulnerability portfolio.
🔹Critical infrastructure targeting: CVE-2022-1388 (authentication bypass) shows 577 active exploiting IPs with "surging attack volumes" - making your load balancer an open door for attackers.
🔹Legacy threat persistence: CVE-2020-5902 (RCE) maintains 11,622 exploiting IPs despite being a 5-year-old vulnerability, proving enterprise infrastructure remains attractive regardless of patch status.

📊Trend analysis:

The timing is no coincidence. When a major infrastructure vendor discloses a nation-state breach, it creates a "feeding frenzy" effect among cybercriminals who assume other organizations using the same technology might have similar vulnerabilities. CrowdSec data shows this pattern repeatedly: public security incidents trigger immediate surges in scanning activity as attackers race to exploit the publicity window before organizations can respond.

The fact that CVE-2020-5902 still shows over 11,000 active exploiting IPs demonstrates why these disclosure-driven attacks work - attackers target the entire F5 ecosystem, knowing that organizations often struggle with comprehensive protection across their critical infrastructure.

🛡️How to protect your systems:

🔹Real-time threat intelligence: Deploy CrowdSec CTI intelligence to automatically identify and block the 577+ IP addresses actively exploiting CVE-2022-1388 and 11,622+ IPs targeting CVE-2020-5902. This creates an immediate protective shield around your F5 infrastructure regardless of patch status: https://app.crowdsec.net/cti
🔹Behavioral protection layer: Implement CrowdSec's Web Application Firewall to detect and block F5-specific attack patterns, authentication bypass attempts, and exploitation behaviors in real-time. Our WAF provides virtual patching capabilities with over 100 rules that protect against vulnerabilities affecting F5 and all other major product vendors: https://doc.crowdsec.net/docs/next/appsec/intro

For more information, visit http://crowdsec.net

🚨 F5 Breach Ignites Global Scanning Frenzy: 300% Spike Detected by the CrowdSec Network

The CrowdSec Network has detected a dramatic surge in scanning activity targeting all F5 BIG-IP vulnerabilities following F5 Networks' disclosure of a nation-state security breach on October 15th, 2025. Attack volumes across the entire F5 CVE landscape peaked on October 16th at three times normal levels, highlighting how public security incidents immediately attract opportunistic threat actors seeking to exploit enterprise infrastructure.

🔍Key findings:

🔹Comprehensive F5 targeting: All F5 CVE scanning activity increased 300% within 24 hours of F5's breach disclosure on October 15th, peaking on October 16th across the entire vulnerability portfolio.
🔹Critical infrastructure targeting: CVE-2022-1388 (authentication bypass) shows 577 active exploiting IPs with "surging attack volumes" - making your load balancer an open door for attackers.
🔹Legacy threat persistence: CVE-2020-5902 (RCE) maintains 11,622 exploiting IPs despite being a 5-year-old vulnerability, proving enterprise infrastructure remains attractive regardless of patch status.

📊Trend analysis:

The timing is no coincidence. When a major infrastructure vendor discloses a nation-state breach, it creates a "feeding frenzy" effect among cybercriminals who assume other organizations using the same technology might have similar vulnerabilities. CrowdSec data shows this pattern repeatedly: public security incidents trigger immediate surges in scanning activity as attackers race to exploit the publicity window before organizations can respond.

The fact that CVE-2020-5902 still shows over 11,000 active exploiting IPs demonstrates why these disclosure-driven attacks work - attackers target the entire F5 ecosystem, knowing that organizations often struggle with comprehensive protection across their critical infrastructure.

🛡️How to protect your systems:

🔹Real-time threat intelligence: Deploy CrowdSec CTI intelligence to automatically identify and block the 577+ IP addresses actively exploiting CVE-2022-1388 and 11,622+ IPs targeting CVE-2020-5902. This creates an immediate protective shield around your F5 infrastructure regardless of patch status: https://app.crowdsec.net/cti
🔹Behavioral protection layer: Implement CrowdSec's Web Application Firewall to detect and block F5-specific attack patterns, authentication bypass attempts, and exploitation behaviors in real-time. Our WAF provides virtual patching capabilities with over 100 rules that protect against vulnerabilities affecting F5 and all other major product vendors: https://doc.crowdsec.net/docs/next/appsec/intro

For more information, visit http://crowdsec.net

🚨CVE-2025–27636 & CVE-2025-29891: Apache Camel PoC affecting versions: 4.10.0-4.10.1, 4.8.0-4.8.4, 3.10.0-3.22.3. Exploitation of these vulnerabilities can enable attackers to execute internal Camel methods.

GitHub: https://github.com/akamai/CVE-2025-27636-Apache-Camel-PoC

Advisory: https://camel.apache.org/security/CVE-2025-29891.html

Write-up: https://www.akamai.com/blog/security-research/march-apache-camel-vulnerability-detections-and-mitigations