ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. May 28, 2024 · ZeroDay Catalog

    Critical Type Confusion Vulnerability in Google Chromium V8

    A significant type confusion vulnerability has been identified in Google Chromium V8, potentially allowing remote code execution through malicious HTML content.

    What changed

    A type confusion vulnerability has been discovered in the Google Chromium V8 engine, which is integral to several web browsers. This flaw could enable an attacker to execute arbitrary code by leveraging specially crafted HTML pages.

    Who is affected

    The vulnerability impacts various web browsers that rely on the Chromium engine, posing a risk to users across multiple platforms.

    • Google Chrome users
    • Microsoft Edge users
    • Opera browser users
    • Any organization utilizing Chromium-based applications

    What to do

    Organizations and users should prioritize updating their browsers to the latest versions that include patches for this vulnerability. Regular monitoring for updates and applying them promptly is essential to mitigate the risk of exploitation.

    • Update Google Chrome to the latest version immediately.
    • Ensure Microsoft Edge and Opera are also updated.
    • Educate users about the risks of clicking on untrusted links or visiting suspicious websites.

    Original report

  2. May 2, 2024 · ZeroDay Catalog

    Critical Authentication Bypass Vulnerability in TP-Link TL-WR841N Routers

    A significant authentication bypass vulnerability has been identified in TP-Link TL-WR841N routers, allowing attackers to access sensitive information without authentication.

    What changed

    A newly discovered vulnerability in the TP-Link TL-WR841N routers allows network-adjacent attackers to exploit an authentication bypass flaw. This vulnerability is particularly concerning as it does not require authentication to access sensitive information.

    The flaw is rooted in the httpd service, which operates on TCP port 80 by default, leading to potential disclosure of stored credentials.

    Who is affected

    The vulnerability impacts users of TP-Link TL-WR841N routers, particularly those who have not updated their firmware to mitigate this issue.

    Network administrators and organizations utilizing these routers in their infrastructure should be particularly vigilant.

    • TP-Link TL-WR841N routers
    • Home users relying on TP-Link for network connectivity
    • Small to medium-sized businesses using TP-Link devices

    What to do

    It is crucial for affected users to take immediate action to secure their devices. Updating the firmware to the latest version provided by TP-Link is strongly recommended to mitigate this vulnerability.

    Network administrators should review their security policies and consider additional measures to protect against unauthorized access.

    • Update the firmware of TP-Link TL-WR841N routers as soon as possible.
    • Monitor network traffic for any unusual activity that may indicate exploitation attempts.
    • Consider implementing additional security measures, such as firewalls or intrusion detection systems.

    Original report