282 casos · pág. 8/15
Trend Micro announced that contestants at Pwn2Own Ireland 2025 discovered and disclosed 73 unique zero-day vulnerabilities across printers, network storage systems, smart home devices, surveillance equipment, home networking equipment, flagship smartphones and wearables. A total of $1,024,750 was awarded from a prize pool of over $2 milli…
TrendAI™ (Trend Micro) published its H1 2026 APT Activity Roundup on July 29, 2026. It finds nation-state actors used AI in more stages of the intrusion lifecycle than in any prior half-year the company has tracked. China-aligned actors used generative AI to refine exploits and iteratively build malware through "vibe coding", and one AI a…
F5 Labs assesses the security risks and rewards of Chinese open-weight LLMs (Qwen, GLM, Kimi, MiMo, MiniMax, DeepSeek). It finds that strong offensive and defensive cyber capability does not translate into consistent resistance to attack. Cited examples include Kimi K3 finding 19 vulnerabilities in Redis and GLM 5.2 being self-hosted by H…
F5 Labs honeynet telemetry shows overall hostile activity rising 55.5% month over month in June 2026, a return to the levels of the earlier-year spike. Highlighted is CVE-2024-44000, an unauthenticated account takeover flaw (CVSS 9.8, CWE-522) in the LiteSpeed Cache WordPress plugin, which rose by 1,128 to 2,603 attacks (8). Scanning is i…
F5 Labs published a "canary exploit" generator for CVE-2025-30065, a CVSS 10.0 flaw in the Apache Parquet Java parquet-avro Maven module. The tool lets defenders test whether their environments are vulnerable and confirm that patches and configuration are effective. F5's analysis finds the flaw far less severe than the CVSS score and earl…
The F5 Labs 2026 State of PQC on the Web report scanned the top 1 million domains with TLS 1.3 handshakes. It found that 54% support post-quantum (hybrid) key exchange, but the figure is driven mainly by CDNs, especially Cloudflare and Fastly, which enable PQC by default. Excluding Cloudflare-hosted domains, adoption falls to 22%. Sectors…
F5 Labs, using Efflux sensor telemetry, reports that CVE-2023-1389, an RCE in TP-Link Archer AX21 routers, was the most scanned-for CVE in December 2024 for the fifth consecutive month, with traffic far above any other tracked CVE. Other heavily scanned flaws include CVE-2022-24847 (GeoServer), CVE-2022-22947 (Spring Cloud Gateway), CVE-2…
F5 Labs' 2025 Advanced Persistent Bots Report analyzes more than 200 billion web and mobile API transactions from F5 Bot Defense customers between November 2023 and September 2024. It finds that 10.2% (21.22 billion) of requests were bots or automation. Of these, 4.8% were unwanted bots mitigated by F5, 3.5% were flagged automation and 2.…
F5 Labs, using attack telemetry from Efflux sensors, reports that CVE-2017-9841 (PHPUnit eval-stdin.php RCE) remained the most targeted vulnerability in May 2025 with over 54,000 instances. CVE-2020-8958 (Guangzhou ONU command injection RCE) shows near-exponential targeting growth for a third consecutive month. CVE-2024-3721 (TBK DVR OS c…
F5 Labs, with Efflux sensor telemetry, profiled a persistent information-disclosure scanner operating from 78.153.140.203 in a netblock of AS202306 (HOSTGLOBAL.PLUS LTD), a UK ISP. The IP was first seen on 10 January 2025, vanished on 10 April, and returned on 11 July 2025. It scans 130 unique URLs: 80.23% are variations of /.env, 11.45% …
F5 Labs reports a scanning campaign observed on its Honeynet in March 2026. It recorded 1,897 session-grouped attempts (2,821 raw events) tied to CVE-2018-14028, a WordPress 4.9.7 unrestricted file upload flaw, and the CVE entered the monthly top 10 after being absent in February. Instead of exploiting the upload flaw, the operator probes…
F5 Labs published research on SparkRAT, a freely available, Go-based open-source Remote Access Trojan with a C2 server and builds for Windows, Linux and macOS. Public reporting since January 2023 shows use by a widening set of actors: Chinese-speaking groups, Winnti (APT41), Patchwork, TAG-100, suspected UAC-0194 against Ukraine, and Cybe…
F5 Labs published its November 2025 AI Security Insights, drawn from the Comprehensive AI Security Index (CASI) and Agentic Resistance Scoring (ARS). Anthropic models took the whole top tier of the CASI leaderboard (Claude Haiku 4.5 at 95.89, Claude Sonnet 4.5 at 95.86, Claude Sonnet 4 at 95.33), while the GPT-5 family slipped, with GPT-5…
FortiGuard Labs analyzed a TrickBot variant that carries command-and-control (C2) traffic over DNS tunneling, embedding encoded data in DNS queries and responses, instead of the HTTP used by earlier variants. The malware persists through Windows Task Scheduler, stores its configuration in NTFS Alternate Data Streams, and hinders analysis …
Cisco has disclosed multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) that could let a remote attacker access or manipulate data, obtain sensitive information, or cause a reload of certificate and key material on an affected device. The advisory (cisco-sa-ise-multiauth-bypa…
Cisco disclosed CVE-2026-20173, a medium-severity vulnerability in Cisco NX-OS Software that lets an unauthenticated, remote attacker exhaust system resources and cause a denial of service (DoS). The flaw exists because rate limiting is improperly applied to some protocols. The DoS condition clears without manual intervention soon after t…
Cisco disclosed CVE-2026-20038, a medium-severity vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode. An unauthenticated, remote attacker could bypass configured EPG contracts, undermining segmentation policy enforced by the fabric. The flaw stems from improper control w…
Cisco disclosed CVE-2026-20321, a command injection vulnerability in the web-based management API of Cisco Application Policy Infrastructure Controller (APIC). An authenticated, remote attacker with valid administrative credentials could execute arbitrary commands as root on the underlying operating system. Cisco rates the Security Impact…
Cisco disclosed CVE-2026-76488, a medium-severity vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC). An authenticated remote attacker with valid administrative credentials could read sensitive files from the underlying file system of an affected device. The files include key ma…
Cisco disclosed CVE-2026-20032, a Medium-rated vulnerability in the Python interpreter of Cisco NX-OS Software. An authenticated local attacker with low privileges and Python execution rights can escape the Python sandbox and reach the underlying operating system of the device. The flaw stems from insufficient validation of user-supplied …
