ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Nov 29, 2023 · ZeroDay Catalog

    Google Skia Integer Overflow Vulnerability Discovered

    A newly identified integer overflow vulnerability in Google Skia could allow remote attackers to escape the sandbox, impacting multiple Google products.

    What changed

    An integer overflow vulnerability has been identified in Google Skia, a graphics library used in various Google products. This flaw could allow remote attackers to exploit the renderer process, potentially leading to a sandbox escape through specially crafted files.

    Who is affected

    The vulnerability impacts several key products and platforms from Google, which may expose users and organizations to risks if not addressed promptly.

    • Google Chrome
    • ChromeOS
    • Android devices
    • Flutter applications

    What to do

    Organizations using affected Google products should prioritize updating to the latest versions to mitigate the risk associated with this vulnerability. Continuous monitoring for any related security advisories is also recommended.

    • Update Google Chrome and ChromeOS to the latest version.
    • Ensure Android devices are running the most recent updates.
    • Monitor Flutter applications for any patches or updates related to this vulnerability.

    Original report

  2. Nov 1, 2023 · ZeroDay Catalog

    Critical Use-After-Free Vulnerability in Linux Kernel NVMe/TCP Subsystem

    A critical use-after-free vulnerability has been identified in the NVMe/TCP subsystem of the Linux kernel, potentially allowing remote code execution or local privilege escalation.

    What changed

    A use-after-free vulnerability has been discovered in the NVMe/TCP subsystem of the Linux kernel, specifically in the function `nvmet_tcp_free_crypto`. This flaw arises from a logical error that could allow an attacker to exploit the system.

    The implications of this vulnerability are significant, as it may lead to remote code execution or local privilege escalation, posing a serious risk to affected systems.

    Who is affected

    This vulnerability impacts users of the Linux kernel, particularly those utilizing the NVMe/TCP subsystem.

    Organizations relying on Linux-based systems for their storage solutions may be at risk.

    • Linux kernel users with NVMe/TCP implementations
    • Organizations using Linux for cloud services
    • Data centers employing NVMe/TCP for storage solutions
    • Developers maintaining applications that interface with the Linux kernel

    What to do

    It is crucial for system administrators and security teams to assess their environments for the presence of this vulnerability. Immediate action should be taken to mitigate potential risks.

    Updating to the latest version of the Linux kernel that addresses this vulnerability is highly recommended.

    • Review and apply security patches from the Linux vendor as they become available.
    • Monitor systems for unusual activity that may indicate exploitation attempts.
    • Implement security best practices, including least privilege access and regular system audits.

    Original report