ADMIN.FOUNDATION

  • Critical Western Digital My Cloud NAS Devices Vulnerability Let Attackers Execute Malicious Code

    ·

    , , ,

    Western Digital has released security updates for a critical vulnerability affecting multiple My Cloud network-attached storage (NAS) devices.

    The flaw, tracked as CVE-2025-30247, could allow a remote attacker to execute arbitrary code on vulnerable systems, potentially leading to a complete device takeover.

    The company addressed the high-severity issue in My Cloud Firmware version 5.31.108, which was released on September 24, 2025.

    A successful exploit of this remote code execution (RCE) vulnerability would enable an unauthenticated attacker to compromise the security of the NAS device.

    This could result in data theft, the deployment of malware or ransomware, or the integration of the compromised device into a botnet for use in further attacks.

    Given that NAS devices often store sensitive personal and business data, the impact of such a compromise could be severe.

    Western Digital has strongly urged all users to promptly update their devices to the latest firmware to mitigate the threat. The update can be applied directly through the firmware update notification within the device’s administrative interface.

    The advisory credits security researcher w1th0ut for discovering and responsibly reporting the vulnerability, allowing the company to develop and issue a patch.

    Affected Devices and Mitigation

    The security update is crucial for a wide range of products in the My Cloud family. Western Digital has confirmed that the following devices are impacted and should be updated to firmware version 5.31.108 or later to be protected against CVE-2025-30247.

    • My Cloud PR2100
    • My Cloud PR4100
    • My Cloud EX4100
    • My Cloud EX2 Ultra
    • My Cloud Mirror Gen 2
    • My Cloud DL2100
    • My Cloud EX2100
    • My Cloud DL4100
    • My Cloud WDBCTLxxxxxx-10
    • My Cloud

    This incident highlights the ongoing security risks associated with internet-connected storage devices. Threat actors frequently scan for and target unpatched NAS systems due to the valuable data they contain.

    Applying security patches as soon as they become available is one of the most effective measures users can take to protect their data from unauthorized access and cyberattacks.

    Users are advised to review their device settings and ensure that automatic updates are enabled, where possible, to maintain security.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Critical Western Digital My Cloud NAS Devices Vulnerability Let Attackers Execute Malicious Code appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • VMware vCenter and NSX Flaws Allow Hackers to Enumerate Usernames

    ·

    , , , ,

    Broadcom released VMSA-2025-0016 to address three key vulnerabilities affecting VMware vCenter Server and NSX products. The vulnerabilities include an SMTP header injection in vCenter (CVE-2025-41250) and two distinct username enumeration flaws in NSX (CVE-2025-41251 and CVE-2025-41252). All three are rated in the Important severity range with CVSSv3 scores between 7.5 and 8.5. CVE ID Description CVSSv3 Affected […]

    The post VMware vCenter and NSX Flaws Allow Hackers to Enumerate Usernames appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Apple Font Parser Vulnerability Enables Malicious Fonts to Crash or Corrupt Process Memory

    ·

    , , ,

    Apple has rolled out security updates across its operating systems to address a vulnerability in the Font Parser component that could allow malicious fonts to crash applications or corrupt process memory.

    The vulnerability, identified as CVE-2025-43400, affects a wide range of products, including the newly released macOS Tahoe and iOS 26, as well as older versions.

    The vulnerability is an out-of-bounds write issue in FontParser. This type of memory safety flaw enables a program to write data beyond the end of an allocated buffer, resulting in unpredictable behavior.

    An attacker could exploit this by embedding a specially crafted font in a document, email, or webpage. When a user interacts with this content, the vulnerable Font Parser component may be triggered, potentially leading to app termination or memory corruption.

    Apple has addressed the issue by implementing improved bounds checking, ensuring the software stays within its designated memory space when processing font data.

    According to Apple’s advisory released on September 29, 2025, there are no known instances of this vulnerability being exploited in the wild.

    It remains unclear whether the flaw could be leveraged for arbitrary code execution, which would be a more severe threat. However, the potential for denial-of-service attacks or memory corruption makes it a critical issue that needs to be addressed.

    The security fix affects a wide range of Apple products, underscoring the shared codebase across its ecosystem.

    While Apple also released updates for watchOS and tvOS, they did not include patches for this vulnerability. Users are strongly encouraged to apply the latest updates to all affected devices to mitigate any potential risk.

    Apple Security Patches

    ProductPatched Version
    iOS & iPadOS26.0.1
    iOS & iPadOS18.7.1
    macOS Tahoe26.0.1
    macOS Sequoia15.7.1
    macOS Sonoma14.8.1
    visionOS26.0.1

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Apple Font Parser Vulnerability Enables Malicious Fonts to Crash or Corrupt Process Memory appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems

    ·

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical security flaw impacting the Sudo command-line utility for Linux and Unix-like operating systems to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerability in question is CVE-2025-32463 (CVSS score: 9.3), which affects Sudo versions prior to

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Harrods Data Breach Leaks Personal Information of 430,000 Customers

    ·

    , ,

    Luxury department store Harrods has become the latest victim of a significant cybersecurity incident after hackers successfully accessed personal data belonging to 430,000 customers. The prestigious London retailer confirmed that threat actors contacted the company following the breach, though Harrods has stated it will not engage with the attackers. Limited Data Exposure The compromised information was obtained from […]

    The post New Harrods Data Breach Leaks Personal Information of 430,000 Customers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • VMware vCenter and NSX Vulnerabilities Let Attackers Enumerate Valid Usernames

    ·

    , , ,

    VMware has disclosed critical security vulnerabilities in vCenter Server and NSX platforms that could allow attackers to enumerate valid usernames and manipulate system notifications. 

    The vulnerabilities, tracked as CVE-2025-41250, CVE-2025-41251, and CVE-2025-41252, affect multiple VMware products, including Cloud Foundation, vSphere Foundation, NSX, NSX-T, and Telco Cloud platforms.

    Broadcom, which acquired VMware, released a security advisory on September 29, 2025, rating the vulnerabilities with CVSS base scores ranging from 7.5 to 8.5, classifying them as “Important” severity. 

    The National Security Agency (NSA) reported two of the three vulnerabilities, highlighting their potential national security implications.

    vCenter SMTP Header Injection Vulnerability

    The first vulnerability, CVE-2025-41250, is an SMTP header injection flaw in VMware vCenter Server with a CVSS score of 8.5. 

    This vulnerability enables malicious actors with non-administrative privileges who have permission to create scheduled tasks to manipulate notification emails sent for those tasks.

    The attack vector requires authenticated access to vCenter with task creation permissions. By exploiting SMTP header injection techniques, attackers can modify email headers, potentially redirecting notifications, inserting malicious content, or bypassing email security filters. 

    This could lead to social engineering attacks, credential harvesting, or unauthorized disclosure of information through manipulated email communications.

    Affected products include vCenter Server versions 7.0, 8.0, and 9.x across various VMware Cloud Foundation and vSphere Foundation deployments. 

    The vulnerability impacts VMware Telco Cloud Platform versions 2.x through 5.x and Telco Cloud Infrastructure versions 2.x and 3.x.

    Per von Zweigbergk receives acknowledgment for responsibly disclosing this vulnerability to Broadcom. No workarounds are available, requiring organizations to apply the provided security patches immediately.

    NSX Username Enumeration Vulnerabilities

    Two separate username enumeration vulnerabilities affect NSX platforms, creating pathways for reconnaissance attacks. 

    CVE-2025-41251, with a CVSS score of 8.1, represents a weak password recovery mechanism vulnerability allowing unauthenticated attackers to enumerate valid usernames through password recovery processes.

    CVE-2025-41252, scoring 7.5 on the CVSS scale, is a direct username enumeration vulnerability that permits unauthenticated malicious actors to identify valid usernames without requiring authentication. 

    Both vulnerabilities can serve as reconnaissance tools for subsequent brute-force attacks or targeted credential stuffing campaigns.

    Username enumeration attacks typically exploit differences in application responses when processing valid versus invalid usernames. 

    Attackers can analyze response times, error messages, HTTP status codes, or other behavioral patterns to determine which usernames exist in the system. 

    This information becomes valuable for password spraying attacks, social engineering campaigns, or targeted phishing attempts.

    The NSX vulnerabilities affect VMware NSX versions 4.0.x through 4.2.x, NSX-T version 3.x, and NSX components within Cloud Foundation and Telco Cloud platforms. 

    Organizations running these platforms face immediate exposure to reconnaissance attacks that could facilitate broader compromise attempts.

    Security patches are available through various fixed versions, including NSX 4.2.2.2, 4.2.3.1, 4.1.2.7, and NSX-T 3.2.4.3. 

    CVETitleCVSS 3.1 ScoreSeverity
    CVE-2025-41250vCenter SMTP Header Injection Vulnerability8.5Important
    CVE-2025-41251NSX Weak Password Recovery Mechanism Vulnerability8.1Important
    CVE-2025-41252NSX Username Enumeration Vulnerability7.5Important

    VMware Cloud Foundation users should implement asynchronous patching procedures documented in KB88287. Meanwhile, Telco Cloud Platform and Infrastructure users should refer to KB411518 for update guidance.

    The NSA’s involvement in reporting these vulnerabilities underscores their significance for enterprise and government environments where VMware infrastructure provides critical virtualization and networking services. 

    Broadcom has already released patches that organizations should prioritize to address these vulnerabilities, as username enumeration could enable more sophisticated attack campaigns targeting virtualized infrastructure.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post VMware vCenter and NSX Vulnerabilities Let Attackers Enumerate Valid Usernames appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Lunar Spider Infected Windows Machine in Single Click and Harvested Login Credentials

    ·

    , ,

    A sophisticated cybercriminal group known as Lunar Spider successfully compromised a Windows machine through a single malicious click, establishing a foothold that allowed them to harvest credentials and maintain persistent access for nearly two months. The intrusion, which began in May 2024, demonstrates the evolving threat landscape where initial access can rapidly escalate to full […]

    The post Lunar Spider Infected Windows Machine in Single Click and Harvested Login Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Distribute Malicious Microsoft Teams Build to Steal Remote Access

    ·

    , ,

    Cybersecurity researchers have identified a sophisticated campaign where threat actors are using malicious advertisements and search engine optimization poisoning to distribute fake Microsoft Teams installers containing the Oyster backdoor malware. The campaign targets users searching for legitimate Microsoft Teams downloads through search engines. When users search for terms like “teams download,” they encounter fraudulent sponsored […]

    The post Hackers Distribute Malicious Microsoft Teams Build to Steal Remote Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Don’t let the ‘unequal dialogue’ become a partisan one

    ·

    Those who study civilian-military relations talk frequently about the unequal dialogue between America’s civilian and uniformed leaders. Civilian leaders sit atop the chain of command and have the final word on defense policy and strategy matters. In return, they have the responsibility to respect—in the sense of listen closely to, not defer to—the military advice of those in uniform. Without this respect, the dialogue ceases to be a conversation and becomes a series of partisan orders.

    Defense Secretary Pete Hegseth’s short-notice, no-explanation summoning of more than 800 general and flag officers from command positions around the world demonstrates a lack of respect for their time and their jobs. It suggests a concomitant lack of respect for their advice. 

    Perhaps this was unintentional, in which case Secretary Hegseth could apologize and cancel the meeting. Short of that, he could take the opportunity at Quantico to acknowledge and underscore the respect due to general and flag officers. 

    First, he should vow to respect the non-partisan nature of military service. General and flag officers have taken an oath to the support and defend the U.S. Constitution from their earliest days in uniform, and reaffirmed that oath with each subsequent promotion. Hegseth should cease and disavow any initiative to separate these officers from their oath, especially by inserting hints of partisanship into key actions such as promotions or intelligence reporting, 

    Second, the secretary should acknowledge the professionalism of general and flag officers, who have spent years acquiring expertise and assuming increased responsibility for recruiting, organizing, training, equipping, and employing the American military, in peace and war. They know their subordinates need to be ready to fight today and tomorrow, and do not need to be reminded of this fundamental responsibility. 

    Third, as a corollary, if senior civilians feel obligated to fire general and flag officers, they need to state the reason for the firing. The secretary has removed nearly a dozen general and flag officers over the past nine months without explanation. Many of those fired have been women or people of color. Absent an explanation, it seems these flag offers were fired for who they are rather than how they did their job. Such targeted actions will undermine trust between senior civilians and flag officers, and send a chilling message to these groups about whether or not leadership sees any value in their service.

    Finally, senior civilian leaders should show respect for general and flag officers as people. They are busy people doing critical work; their time should be appropriately respected and their efforts disrupted only when necessary. This is, or should be, basic to a leader of a large organization. 

    But what if the short-notice summons was intentionally disrespectful, an odd attempt to display dominance? This would indicate that the unequal dialogue has already begun to shift toward the partisan—and a fundamental change in civilian-military relations in the United States.

    How might such a shift manifest itself? You might see senior officers putting in for early retirement, thus removing themselves from any dialogue; choosing to keep quiet amid confused and confusing actions by civilian leaders; preemptively complying with implied, but not issued, orders; aggressively implementing the secretary’s agenda to demonstrate fealty to him; and publicly embracing partisanship for reasons ranging from strong personal support for the administration to hopes for further advancement. 

    Should such actions continue, they might add up to profound culture change in the general and flag officer corps—one shaped by partisanship rather than the Constitution. That would be catastrophic for the civilian-military dialogue, the military itself, and the country.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Shutdown could erode cyber defenses by sidelining critical staff, experts warn

    ·

    A shutdown would sideline federal cyber defenders just as a bedrock cybersecurity data-sharing law expires, leaving the government unusually vulnerable, cybersecurity experts warn.

    “The absence of security personnel working to protect the nation from these threats can create a security gap and an opportunity for malicious actors to exploit weaknesses,” said Ilona Cohen, chief legal and policy officer at HackerOne and former general counsel at the Office of Management and Budget.

    Cohen said infrastructure owners and operators would be less able to reach officials and data, and the government's cyber workforce would suffer if no funding bill is passed by Oct. 1.

    Only an estimated 889 of 2,540 employees would continue to work at the Cybersecurity and Infrastructure Security Agency, the nation’s main cyber defense office tasked with defending government networks, according to a planning document posted Saturday.

    Among them would be people confronting an emerging cyber threat group, believed linked to China, exploiting vulnerabilities in Cisco devices, Chris Butera, CISA’s acting deputy executive assistant director for cybersecurity, told reporters last week.

    There are risky domino effects of having a diminished federal cyber workforce, said one former U.S. official who requested anonymity because they weren’t authorized to publicly speak about the impact of a shutdown. Specifically, younger cyber staffers can’t learn from their more experienced peers because they will not be able to come into work.

    “They’re losing time to upskill, to get trained and to get on-the-job training because they’re not there. It hurts not only the current workforce but the future workforce as well,” the former official said.

    Gary Barlet, the public-sector chief technology officer at Illumio, echoed those concerns. 

    “This year, the challenge is sharper because agencies are already stretched thin,” Barlet told Nextgov/FCW in a written statement. “Many of the employees who guided past shutdowns aren’t there anymore, leaving fewer people who know how to manage through the disruption — exposing critical gaps and reducing the ability to respond quickly.”

    The 2015 Cybersecurity Information Sharing Act, which lets private-sector providers transmit cyber threat intelligence with government partners while receiving key legal protections, is also set to lapse on Tuesday evening unless renewed by Congress. 

    House appropriators earlier this month unveiled a temporary funding plan that would keep the law alive through Nov. 21 and fund the government until the same date. That would have given Congress simultaneous time to work out funding snags and reconcile any debate about changes needed for the cyber law that was first enacted 10 years ago. But that continuing resolution failed to pass in the Senate.

    The agreement etched between the public and private sectors for information-sharing is “really important,” Tim Brennan, the VP for technology policy and government relations at the Professional Services Council, told reporters Monday.

    “You’re going to get less information-sharing, which means delayed response times,” he said, adding that it would impact mission functions inside agencies like the Department of Homeland Security, which houses CISA.

    The liability coverage provided by the data-sharing law is critically important to the private sector because it makes companies more comfortable with transmitting cyber threat data, Morgan Adamski, the former executive director of U.S. Cyber Command, told Nextgov/FCW in an interview.

    “When you have a tool like CISA 2015 that’s valuable in contributing to information-sharing between the public sector and the private sector, why wouldn’t you want to have it in place to really encourage that collaboration?” added Adamski, now U.S. leader in PwC’s Cyber, Data & Technology Risk business.

    “Something has to be put in place to enable that collaboration, or you’re potentially going to see an impact on information sharing, which collectively hurts us from better understanding what’s happening in the cyberspace domain,” she said.

    On Monday, congressional Democrats said they were unable to reach an agreement with Republican counterparts and the White House, upping the odds of a shutdown occurring.

    Last week, OMB told agencies to consider issuing reduction notices to employees whose work is funded by regular appropriations and doesn’t align with President Donald Trump’s priorities if annual spending lapses Tuesday evening. The Office of Personnel Management issued new guidance Sunday, telling agencies that it can tweak those plans once the government reopens.

    Nextgov/FCW Staff Reporter Natalie Alms contributed to this report.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶