433 Central Ave., 4th Floor, St. Petersburg, FL 33701 | info@poseidon-us.com | Office: (813) 563-2652

SonicWall SMA devices persistently infected with stealthy OVERSTEP backdoor and rootkit

Unknown intruders are targeting fully patched end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances and deploying a novel, persistent backdoor / rootkit, analysts with Google’s Threat Intelligence Group (GTIG) have warned. The analysts say UNC6148 – as they dubbed the threat group – is likely financially motivated. “An organization targeted by UNC6148 in May 2025 was posted to the ‘World Leaks’ data leak site (DLS) in June 2025, and UNC6148 activity overlaps with publicly … More → The post SonicWall SMA devices persistently infected with stealthy OVERSTEP backdoor and rootkit appeared first on Help Net Security.
http://news.poseidon-us.com/TLy77P

Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by uploading arbitrary files to an affected device. A successful exploit could allow the attacker to store malicious files on the system and execute arbitrary commands on the operating system. The Security Impact Rating (SIR) of this advisory has been raised to High because an attacker could elevate privileges to root. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Report Designer. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-file-upload-UhNEtStm Security Impact Rating: High CVE: CVE-2025-20274
http://news.poseidon-us.com/TLy27P

Cisco Prime Infrastructure and Evolved Programmable Network Manager Blind SQL Injection Vulnerability

A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected API. A successful exploit could allow the attacker to view data in some database tables on an affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb Security Impact Rating: Medium CVE: CVE-2025-20272
http://news.poseidon-us.com/TLy277

Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to issue commands on the underlying operating system as the root user and allow IP access filters to be bypassed. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. For more information about these vulnerabilities, see the Details section of this advisory. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO Security Impact Rating: Medium CVE: CVE-2025-20283,CVE-2025-20284,CVE-2025-20285
http://news.poseidon-us.com/TLy26r

Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-ssrf-JSuDjeV Security Impact Rating: Medium CVE: CVE-2025-20288
http://news.poseidon-us.com/TLy259

Update Google Chrome to fix actively exploited zero-day (CVE-2025-6558)

For the fifth time this year, Google has patched a Chrome zero-day vulnerability (CVE-2025-6558) exploited by attackers in the wild. About CVE-2025-6558 CVE-2025-6558 is a high-severity vulnerability that stems from incorrect validation of untrusted input in ANGLE – the Almost Native Graphics Layer Engine used by the browser – and GPU, Chrome’s Graphics Processing Unit that accelerates rendering tasks. Reported on June 23 by Google Threat Analysis Group researchers Clément Lecigne and Vlad Stolyarov, CVE-2025-6558 … More → The post Update Google Chrome to fix actively exploited zero-day (CVE-2025-6558) appeared first on Help Net Security.
http://news.poseidon-us.com/TLxwZ0

Immersive unveils role-specific cybersecurity capabilities

Immersive announced its Immersive One AI-powered Lab Builder feature to give customers and partners new ways to improve cyber skills across teams through customized labs and learning experiences. With this new tool supporting Immersive’s Prove, Improve, Benchmark, and Report (PIBR) approach, cyber leaders will be able to create hands-on exercises and simulations for their technical workforce, including offensive, defensive, and secure-coding-based simulations to improve readiness against real-world threats. With the majority of cyber attacks involving … More → The post Immersive unveils role-specific cybersecurity capabilities appeared first on Help Net Security.
http://news.poseidon-us.com/TLxwYl

Global crackdown hits pro-Russian cybercrime, 100+ systems taken down worldwide

In a major blow to pro-Russian cybercrime, authorities across Europe and the United States launched a sweeping international crackdown on the hacking group NoName057(16) between 14 and 17 July. The coordinated operation, codenamed Eastwood and led by Europol and Eurojust, targeted the group’s members and infrastructure. Law enforcement and judicial authorities from Czechia, France, Finland, Germany, Italy, Lithuania, Poland, Spain, Sweden, Switzerland, the Netherlands, and the United States took part in the simultaneous actions. The … More → The post Global crackdown hits pro-Russian cybercrime, 100+ systems taken down worldwide appeared first on Help Net Security.
http://news.poseidon-us.com/TLxwYY

10 Best Issue Tracking Software for Project Management

Finding the right issue tracking software is key to successful project management, especially when managing complex workflows or collaborating across teams. The best tools not only help log and monitor issues but also integrate with project plans to keep everything… Read More The post 10 Best Issue Tracking Software for Project Management appeared first on ProjectManager.
http://news.poseidon-us.com/TLxvCZ

More Free File Sharing Services Abuse, (Wed, Jul 16th)

A few months ago, I wrote a diary about online services used to exfiltrate data[1]. In this diary, I mentioned some well-known services. One of them was catbox.moe[2]. Recently, I found a sample that was trying to download some payload from this website. I performed a quick research and collected more samples!
http://news.poseidon-us.com/TLxtJV