The Load Balancer Kept Working While a Hidden Backdoor Stole Credentials
Two South Korean organisations kept serving traffic through HAProxy while a hidden plugin stole credentials, hijacked sessions and altered pages for selected visitors.
Security
Vulnerabilities, defensive security, architecture and operational security.
One Support Session Could Infect the Next PC
A modified ScreenConnect client can transfer and run malware when a new support session connects. The first infection still needs social engineering, but one trusted remote session can become the bridge to the next PC.
An Unauthenticated Request Can Turn ASUS Control Center Into a Root Console for the Whole Network
ASUS Control Center can manage an entire fleet. One critical flaw can turn that reach against every server, PC and workstation connected to it, without requiring an account or a click.
Your MikroTik Router Can Look Clean After Attackers Take It Over
Four MikroTik RouterOS vulnerabilities now have exploitation evidence across CERT Polska and CISA. The documented MikroTrick chain remains limited to two of them. Patch to the correct branch level, then inspect exposed routers for compromise.
Patching StyleSmuggler Will Not Evict an Attacker From Your Magento Store
Adobe has patched the exploited StyleSmuggler flaw. Magento and Commerce operators still need to check for compromise, verify the right hotfix and rotate exposed credentials.
Millions of Phishing Emails Hid Their Most Suspicious Words in Plain Sight
Millions of messages a day used invisible Unicode characters to split high-signal finance words. Humans saw “funding.” Some security pipelines saw something else.
Cleo’s Login Was Not a Login: Two Flaws Let Low-Privilege Users Reach RCE
Four linked Cleo Harmony weaknesses let a low-privilege user cross SAML and token trust boundaries, become an administrator and reach operating-system command execution.
For 12 Years, PostgreSQL’s Replication Privilege Could Escape the Database
A PostgreSQL account trusted to replicate data could cross into the operating system. The flaw survived for 12 years, but exploitation still requires the powerful REPLICATION privilege.
CrowdStrike’s Own Clean-Up Feature Could Hand an Attacker SYSTEM
FalconFlank turns CrowdStrike Falcon’s Office macro clean-up into a path from a low-privilege Windows account to SYSTEM. The public PoC has been independently reproduced.
A Network Packet Could Give Attackers Root on Cisco Nexus 9000 Switches
A critical Cisco Nexus 9000 flaw exposes root-level remote code execution through TCP ports 43210 and 43211 on affected Silicon One switches.