ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Jan 27, 2025 · ZeroDay Catalog

    Critical Use-After-Free Vulnerability in Multiple Apple Products

    Apple has addressed a critical use-after-free vulnerability affecting multiple products, which could allow malicious applications to elevate privileges.

    What changed

    Apple has resolved a use-after-free vulnerability through enhanced memory management in various operating systems. This vulnerability could potentially allow malicious applications to gain elevated privileges on affected devices.

    The issue has been fixed in the following versions: iOS 18.3, iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, and watchOS 11.3.

    Who is affected

    The vulnerability impacts a wide range of Apple products, particularly those running outdated versions of iOS and macOS.

    Users of the following products should be particularly vigilant: iPadOS devices, macOS computers, Apple TVs, and Apple Watches.

    • iPadOS devices running versions prior to 18.3
    • macOS devices including Sequoia, Sonoma, and Ventura versions before the latest updates
    • Apple TV devices with tvOS versions prior to 18.3
    • Apple Watch devices running watchOS versions before 11.3

    What to do

    It is crucial for users and administrators to update their devices to the latest versions to mitigate the risk associated with this vulnerability. Regularly applying security updates is a fundamental practice in maintaining device integrity.

    Monitoring for any unusual application behavior is also recommended, especially for devices that may not have been updated promptly.

    • Update all affected Apple devices to the latest software versions immediately.
    • Implement a routine check for software updates to ensure ongoing protection.
    • Educate users about the risks of installing applications from untrusted sources.

    Original report

  2. Jan 7, 2025 · ZeroDay Catalog

    Critical OS Command Injection Vulnerability in Aviatrix Controllers

    A critical OS command injection vulnerability has been identified in Aviatrix Controllers, allowing unauthenticated attackers to execute arbitrary code.

    What changed

    A significant vulnerability has been discovered in Aviatrix Controllers prior to versions 7.1.4191 and 7.2.4996. The flaw arises from improper handling of special elements in OS commands, which can be exploited by attackers.

    This vulnerability enables unauthenticated users to send crafted shell metacharacters to specific API endpoints, potentially leading to arbitrary code execution.

    Who is affected

    Organizations using Aviatrix Controllers are at risk, particularly those operating on versions before the specified updates.

    This vulnerability affects various deployments in cloud environments where Aviatrix solutions are utilized.

    • Aviatrix Controller versions prior to 7.1.4191
    • Aviatrix Controller versions in the 7.2.x series before 7.2.4996
    • Cloud service providers leveraging Aviatrix for network management
    • Enterprises using Aviatrix for multi-cloud networking solutions

    What to do

    It is imperative for affected organizations to upgrade their Aviatrix Controllers to the latest versions to mitigate this vulnerability. Regularly review security practices and ensure that all systems are updated promptly.

    Additionally, consider implementing network segmentation and monitoring to detect any unauthorized access attempts.

    • Upgrade to Aviatrix Controller version 7.1.4191 or later
    • Upgrade to Aviatrix Controller version 7.2.4996 or later
    • Conduct a security audit of existing cloud configurations
    • Monitor API access logs for unusual activity

    Original report