Threat actors have been exploiting a zero-day vulnerability in legacy Sitecore deployments to deploy WeepSteel reconnaissance malware.

The flaw, tracked under CVE-2025-53690, is a ViewState deserialization vulnerability caused by the inclusion of a sample ASP.NET machine key in pre-2017 Sitecore guides.

Some customers reused this key in production, allowing attackers with knowledge of the key to craft valid, but malicious ‘_VIEWSTATE’ payloads that tricked the server into deserializing and executing them, leading to remote code execution (RCE).

The flaw isn’t a bug in ASP.NET itself, but a misconfiguration vulnerability created by reusing publicly documented keys that were never meant for production.

Exploitation activity

Mandiant researchers, who discovered the malicious activity in the wild, report that threat actors have been leveraging the flaw in multi-stage attacks.

The attackers target the ‘/sitecore/blocked. aspx’ endpoint, which contains an unauthenticated ViewState field, and achieve RCE under the IIS NETWORK SERVICE account by leveraging CVE-2025-53690.

The malicious payload they drop is WeepSteel, a reconnaissance backdoor that gathers system, process, disk, and network information, disguising its exfiltration as standard ViewState responses.

Mandiant observed the execution of reconnaissance commands on compromised environments, including whoami, hostname, tasklist, ipconfig /all, and netstat -ano.

In the next stage of the attack, the hackers deployed Earthworm (a network tunneling and reverse SOCKS proxy), Dwagent (a remote access tool), and 7-Zip, which is used to create archives of the stolen data.

Subsequently, they escalated their privileges by creating local administrator accounts (‘asp$,’ ‘sawadmin’), cached (SAM and SYSTEM hives) credentials dumping, and attempted token impersonating via GoTokenTheft.

Persistence was secured by disabling password expiration for these accounts, giving them RDP access, and registering Dwagent as a SYSTEM service.

Mitigating CVE-2025-53690

CVE-2025-53690 impacts Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud, up to version 9.0, when deployed using the sample ASP.NET machine key included in pre-2017 documentation.

XM Cloud, Content Hub, CDP, Personalize, OrderCloud, Storefront, Send, Discover, Search, and Commerce Server are not impacted.

Sitecore published a security bulletin in coordination with Mandiant’s report, warning that multi-instance deployments with static machine keys are also at risk.

The recommended actions for potentially impacted administrators are to immediately replace all static values in web.config with new, unique keys, and ensure the element inside web.config is encrypted.

In general, it is recommended to adopt regular static machine key rotation as an ongoing security measure.

More information on how to protect ASP.NET machine keys from unauthorized access can be found here.

Pi-hole, a popular network-level ad-blocker, has disclosed that donor names and email addresses were exposed through a security vulnerability in the GiveWP WordPress donation plugin.

Pi-hole acts as a DNS sinkhole, filtering out unwanted content before it reaches the users’ devices. While initially designed to run on Raspberry Pi single-board computers, it now supports various Linux systems on dedicated hardware or virtual machines.

The organization stated that they first learned of the incident on Monday, July 28, after donors began reporting that they were receiving suspicious emails at addresses used exclusively for donations.

As explained in a Friday post-mortem, the breach affected users who donated through the Pi-hole website’s donation form to support development, exposing personal information that was visible to anyone who viewed the webpage’s source code due to a GiveWP security flaw.

The vulnerability stemmed from GiveWP, a WordPress plugin used to process donations on the Pi-hole website. The plugin inadvertently made donor information publicly accessible without requiring authentication or special access privileges.

While Pi-hole didn’t disclose the number of affected customers, the ‘Have I Been Pwned’ data breach notification service added the Pi-hole breach, saying that it impacted almost 30,000 donors, with 73% of the exposed records already in its database.

No financial information exposed

Pi-hole added that no donor financial data was compromised, as credit card information and other payment details are handled directly by Stripe and PayPal. It also clarified that the Pi-hole software product itself was not affected in any way.

“We make it clear in the donation form that we don’t even require a valid name or email address, it’s purely for users to see and manage their donations,” Pi-hole said. “It is also important to note that Pi-hole the product is categorically not the subject of this breach. There is no action needed from users with a Pi-hole installed on their network.”

Although GiveWP released a patch within hours of the vulnerability being reported on GitHub, Pi-hole criticized the plugin developer’s response, citing a 17.5-hour delay before notifying users and what it described as insufficient acknowledgment of the security flaw’s potential impact on donor names and email addresses.

Pi-hole apologized to affected donors and acknowledged potential reputation damage stemming from this security incident, saying that while the vulnerability was unforeseeable, they accept accountability for the resulting data breach.

“The names and email addresses of anyone that had ever donated via our donation page was there for the entire world to see (provided they were savvy enough to right click->View page source). Within a couple of hours of this report, they had patched the bad code and released 4.6.1,” Pi-hole added in a blog post analyzing the incident.

“We take full responsibility for the software we deploy. We placed our trust in a widely-used plugin, and that trust was broken.”

Hackers have started to exploit a critical remote code execution vulnerability in Wing FTP Server just one day after technical details on the flaw became public.

The observed attack ran multiple enumeration and reconnaissance commands followed by establishing persistence by creating new users.

The exploited Wing FTP Server vulnerability is tracked as CVE-2025-47812 and received the highest severity score. It is a combination of a null byte and Lua code injection that allows remote a unauthenticated attacker to execute code with the highest privileges on the system (root/SYSTEM).

Wing FTP Server is a powerful solution for managing secure file transfers that can execute Lua scripts, which is widely used in enterprise and SMB environments.

On June 30, security researcher Julien Ahrens published a technical write-up for CVE-2025-47812, explaining that the flaw stems from unsafe handling of null-terminated strings in C++ and improper input sanitization in Lua.

The researcher demonstrated how a null byte in the username field could bypass authentication checks and enable Lua code injection into session files.

When those files are subsequently executed by the server, it is possible to achieve arbitrary code execution as root/SYSTEM.

Along with CVE-2025-47812, the researcher presented another three flaws in Wing FTP:

• CVE-2025-27889 – allows exfiltrating user passwords via a crafted URL if the user submits a login form, due to unsafe inclusion of the password in a JavaScript variable (location)
• CVE-2025-47811 – Wing FTP runs as root/SYSTEM by default, with no sandboxing or privilege drop, making RCEs far more dangerous
• CVE-2025-47813 – supplying an overlong UID cookie reveals file system paths

All the flaws impact Wing FTP versions 7.4.3 and earlier. The vendor fixed the issues by releasing version 7.4.4 on May 14, 2025, except for CVE-2025-47811, which was deemed unimportant.

Threat researchers at managed cybersecurity platform Huntress created a proof-of-concept exploit for CVE-2025-47812 and show in the video below how hackers could leverage it in attacks:

Huntress researchers found that on July 1st, a day after technical details for CVE-2025-47812 appeared, at least one attacker exploited the vulnerability at one of their customers.

The attacker sent malformed login requests with null-byte-injected usernames, targeting ‘loginok.html.’ These inputs created malicious session .lua files that injected Lua code into the server.

The injected code was designed to hex-decode a payload and execute it via cmd.exe, using certutil to download malware from a remote location and execute it.

Huntress says that the same Wing FTP instance was targeted by five distinct IP addresses within a short time frame, potentially indicating mass-scanning and exploitation attempts by several threat actors.

The commands observed in these attempts were for reconnaissance, obtaining persistence in the environment, and data exfiltration using the cURL tool and webhook endpoint.

The hacker failed the attack “maybe due to their unfamiliarity with them, or because Microsoft Defender stopped part of their attack,” Huntress says. Nevertheless, the researchers observed clear exploitation of the critical Wing FTP Server vulnerability.

Even if Huntress observed failed attacks at their customers, hackers are likely to scan for reachable Wing FTP instances and try to take advantage of vulnerable servers.

Companies are strongly advised to upgrade to version 7.4.4 of the product as soon as possible.

If switching to a newer, secure version is not possible, the researchers’ recommendation is to disable or restrict HTTP/HTTPs access to the Wing FTP web portal, disable anonymous logins, and monitor the session directory for suspicious additions.

Technical details about a maximum-severity Cisco IOS XE WLC arbitrary file upload flaw tracked as CVE-2025-20188 have been made publicly available, bringing us closer to a working exploit.

The write-up by Horizon3 researchers does not contain a ‘ready-to-run’ proof of concept RCE exploit script, but it does provide enough information for a skilled attacker or even an LLM to fill in the missing pieces.

Given the immediate risk of weaponization and widespread use in attacks, it is recommended that impacted users take action now to protect their endpoints.

The Cisco IOS XE WLC flaw

Cisco disclosed the critical flaw in IOS XE Software for Wireless LAN Controllers on May 7, 2025, which allows an attacker to take over devices.

The vendor said it is caused by a hard-coded JSON Web Token (JWT) that allows an unauthenticated, remote attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.

The bulletin noted that CVE-2025-20188 is only dangerous when the ‘Out-of-Band AP Image Download’ feature is enabled on the device, in which case, the following device models are at risk:

• Catalyst 9800-CL Wireless Controllers for Cloud
• Catalyst 9800 Embedded Wireless Controller for Catalyst 9300, 9400, and 9500 Series Switches
• Catalyst 9800 Series Wireless Controllers
• Embedded Wireless Controller on Catalyst APs

Horizon3’s attack example

Horizon3’s analysis shows that the flaw exists due to a hardcoded JWT fallback secret (“notfound”) used by the backend Lua scripts for upload endpoints combined with insufficient path validation.

Specifically, the backend uses OpenResty (Lua + Nginx) scripts to validate JWT tokens and handle file uploads, but if the ‘/tmp/nginx_jwt_key’ file is missing, the script falls back to the string “notfound” as the secret to verify JWTs.

This basically allows attackers to generate valid tokens without knowing any secrets by simply using ‘HS256’ and ‘notfound.’

Horizon3’s example sends an HTTP POST request with a file upload to the ‘/ap_spec_rec/upload/’ endpoint via port 8443 and uses filename path traversal to drop an innocuous file (foo.txt) outside the intended directory.

To escalate the file upload flaw to remote code execution, the attacker could overwrite configuration files loaded by backend services, drop web shells, or abuse monitored files to trigger unauthorized actions.

Horizon3’s example abuses the ‘pvp.sh’ service that monitors specific directories, overwrites the config files it depends on, and triggers a reload even to run attacker commands.

Given the elevated risk of exploitation, users are recommended to upgrade to a patched version (17.12.04 or newer) as soon as possible.

As a temporary workaround, admins can turn off the Out-of-Band AP Image Download feature to close the vulnerable service.

Two critical vulnerabilities affecting the open-source forum software vBulletin have been discovered, with one confirmed to be actively exploited in the wild.

The flaws, tracked under CVE-2025-48827 and CVE-2025-48828, and rated critical (CVSS v3 score: 10.0 and 9.0 respectively), are an API method invocation and a remote code execution (RCE) via template engine abuse flaws.

They impact vBulletin versions 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 when the platform runs on PHP 8.1 or later.

The vulnerabilities were likely patched quietly last year with the release of Patch Level 1 for all versions of the 6.* release branch, and version 5.7.5 Patch Level 3, but many sites remained exposed due to not upgrading.

Public PoC and active exploitation

The two issues were discovered on May 23, 2025, by security researcher Egidio Romano (EgiX), who explained how to exploit it via a detailed technical post on his blog.

The researcher showed that the flaw lies in vBulletin’s misuse of PHP’s Reflection API, which, due to behavioral changes introduced in PHP 8.1, allows protected methods to be invoked without explicit accessibility adjustments.

The vulnerability chain lies in the ability to invoke protected methods via crafted URLs and the misuse of template conditionals inside vBulletin’s template engine.

By injecting crafted template code using the vulnerable ‘replaceAdTemplate’ method, attackers bypass “unsafe function” filters using tricks like PHP variable function calls.

This results in fully remote, unauthenticated code execution on the underlying server — effectively granting attackers shell access as the web server user (www-data on Linux, for example).

On May 26, security researcher Ryan Dewhurst reported seeing exploitation attempts on honeypot logs showing requests to the vulnerable ‘ajax/api/ad/replaceAdTemplate’ endpoint.

Dewhurst traced one of the attackers to Poland, seeing attempts to deploy PHP backdoors to execute system commands.

The researcher noted that the attacks appear to be leveraging the exploit published earlier by Romano, though there have been Nuclei templates available for the flaw since May 24, 2025.

It is important to clarify that Dewhurst only observed exploitation attempts for CVE-2025-48827, but no evidence exists yet that attackers have successfully chained it to the full RCE, although this is highly likely.

vBulletin troubles

vBulletin is one of the most widely used commercial PHP/MySQL-based forum platforms, powering thousands of online communities globally.

Its modular design, including mobile APIs and AJAX interfaces, makes it a complex and flexible platform. However, it also exposes a broad attack surface.

In the past, hackers have leveraged severe flaws in the platform to breach popular forums and steal the sensitive data of large numbers of users.

Forum administrators are recommended to apply the security updates for their vBulletin installation or move to the latest release, version 6.1.1, which is not affected by the said flaws.

Google has released emergency security updates to patch a high-severity vulnerability in the Chrome web browser that could lead to full account takeover following successful exploitation.

While it’s unclear if this security flaw has been used in attacks, the company warned that it has a public exploit, which is how it usually hints at active exploitation.

“Google is aware of reports that an exploit for CVE-2025-4664 exists in the wild,” Google said in a Wednesday security advisory.

The vulnerability was discovered by Solidlab security researcher Vsevolod Kokorin and is described as an insufficient policy enforcement in Google Chrome’s Loader component that lets remote attackers leak cross-origin data via maliciously crafted HTML pages.

“You probably know that unlike other browsers, Chrome resolves the Link header on subresource requests. But what’s the problem? The issue is that the Link header can set a referrer-policy. We can specify unsafe-url and capture the full query parameters,” Kokorin explained.

“Query parameters can contain sensitive data – for example, in OAuth flows, this might lead to an Account Takeover. Developers rarely consider the possibility of stealing query parameters via an image from a 3rd-party resource.”

​Google fixed the flaw for users in the Stable Desktop channel, with patched versions (136.0.7103.113 for Windows/Linux and 136.0.7103.114 for macOS) rolling out to users worldwide.

Although the company says the security updates will roll out over the coming days and weeks, they were immediately available when BleepingComputer checked for updates.

Users who don’t want to update Chrome manually can also let the browser automatically check for new updates and install them after the next launch.

In March, ​Google also fixed a high-severity Chrome zero-day bug (CVE-2025-2783) that was abused to deploy malware in espionage attacks targeting Russian government organizations, media outlets, and educational institutions.

Kaspersky researchers who discovered the actively exploited zero-day said that the attackers use CVE-2025-2783 exploits to bypass Chrome sandbox protections and infect targets with malware.

Last year, Google patched 10 zero-days disclosed during the Pwn2Own hacking competition or exploited in attacks.

SAP has released patches to address a second vulnerability exploited in recent attacks targeting SAP NetWeaver servers as a zero-day.

The company issued security updates for this security flaw (CVE-2025-42999) on Monday, May 12, saying it was discovered while investigating zero-day attacks involving another unauthenticated file upload flaw (tracked as CVE-2025-31324) in SAP NetWeaver Visual Composer that was fixed in April.

“SAP is aware of and has been addressing vulnerabilities in SAP NETWEAVER Visual Composer,” a SAP spokesperson told BleepingComputer. “We ask all customers using SAP NETWEAVER to install these patches to protect themselves. The Security Notes can be found here: 3594142 & 3604119.”

ReliaQuest first detected the attacks exploiting CVE-2025-31324 as a zero-day in April, reporting that threat actors were uploading JSP web shells to public directories and the Brute Ratel red team tool after breaching customers’ systems through unauthorized file uploads on SAP NetWeaver. The hacked instances were fully patched, indicating the attackers used a zero-day exploit.

This malicious activity was also confirmed by cybersecurity firms watchTowr and Onapsis, who also observed the attackers uploading web shell backdoors on unpatched instances exposed online. Forescout’s Vedere Labs has linked some of these attacks to a Chinese threat actor it tracks as Chaya_004.

Onyphe CTO Patrice Auffret told BleepingComputer in late April that “Something like 20 Fortune 500/Global 500 companies are vulnerable, and many of them are compromised,” adding that there were 1,284 vulnerable instances exposed online at the time, 474 already compromised.

The Shadowserver Foundation is now tracking over 2040 SAP Netweaver servers exposed on the Internet and vulnerable to attacks.

New flaw also exploited in zero-day attacks

While SAP did not confirm that CVE-2025-42999 was exploited in the wild, Onapsis CTO Juan Pablo Perez-Etchegoyen told BleepingComputer that the threat actors were chaining both vulnerabilities in attacks since January.

“The attacks we observed during March 2025 (that started with basic proves back in January 2025) are actually abusing both, the lack of authentication (CVE-2025-31324) as well as the insecure de-serialization (CVE-2025-42999),” Perez-Etchegoyen told BleepingComputer.

“This combination allowed attackers to execute arbitrary commands remotely and without any type of privileges on the system. This residual risk is basically a de-serialization vulnerability only exploitable by users with VisualComposerUser role on the SAP target system.”

SAP admins are advised to immediately patch their NetWeaver instances and consider disabling the Visual Composer service if possible, as well as restrict access to metadata uploader services and monitor for suspicious activity on their servers.

Since the attacks started, CISA has added the CVE-2025-31324 flaw to its Known Exploited Vulnerabilities Catalog, ordering federal agencies to secure their systems by May 20, as mandated by Binding Operational Directive (BOD) 22-01.

“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA warned.

A maximum severity remote code execution (RCE) vulnerability has been discovered impacting all versions of Apache Parquet up to and including 1.15.0.

The problem stems from the deserialization of untrusted data that could allow attackers with specially crafted Parquet files to gain control of target systems, exfiltrate or modify data, disrupt services, or introduce dangerous payloads such as ransomware.

The vulnerability is tracked under CVE-2025-30065 and has a CVSS v4 score of 10.0. The flaw was fixed with the release of Apache version 1.15.1.

It should be noted that to exploit this flaw, threat actors must convince someone to import a specially crafted Parquet file.

Severe threat to “big data” environments

Apache Parquet is an open-source, columnar storage format designed for efficient data processing. Unlike row-based formats (like CSV), Parquet stores data by columns, which makes it faster and more space-efficient for analytical workloads.

It is widely adopted across the data engineering and analytics ecosystem, including big data platforms like Hadoop, AWS, Amazon, Google, and Azure cloud services, data lakes, and ETL tools.

Some large companies that use Parquet include Netflix, Uber, Airbnb, and LinkedIn.

The security problem in Parquet was disclosed on April 1, 2025, following a responsible disclosure by its finder, Amazon researcher Keyi Li.

“Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code,” warned the short bulletin published on Openwall.

“Users are recommended to upgrade to version 1.15.1, which fixes the issue.”

A separate bulletin by Endor Labs highlights the risk of CVE-2025-30065 exploitation more clearly, warning that the flaw can impact any data pipelines and analytics systems that import Parquet files, with the risk being significant for files sourced from external points.

Endor Labs believes the problem was introduced in Parquet version 1.8.0, though older releases might also be impacted. The firm suggests coordinated checks with developers and vendors to determine what Praquet versions are used in production software stacks.

“If an attacker tricks a vulnerable system into reading a specially crafted Parquet file, they could gain remote code execution (RCE) on that system,” warns Endor Labs.

However, the security firm avoids over-inflating the risk by including the note, “Despite the frightening potential, it’s important to note that the vulnerability can only be exploited if a malicious Parquet file is imported.”

That being said, if upgrading to Apache Parquet 1.15.1 immediately is impossible, it is suggested to avoid untrusted Parquet files or carefully validate their safety before processing them. Also, monitoring and logging on systems that handle Parquet processing should be increased.

Although no active exploitation has been discovered yet, the risk is high due to the flaw’s severity and the widespread use of Parquet files in big data applications.

Administrators of impacted systems are recommended to upgrade to Parquet version 1.15.1, which addresses CVE-2025-30065, as soon as possible.

Facebook is warning that a FreeType vulnerability in all versions up to 2.13 can lead to arbitrary code execution, with reports that the flaw has been exploited in attacks.

FreeType is a popular open-source font rendering library used to display text and programmatically add text to images. It provides functionality to load, rasterize, and render fonts in various formats, such as TrueType (TTF), OpenType (OTF), and others.

The library is installed in millions of systems and services, including Linux, Android, game engines, GUI frameworks, and online platforms.

The vulnerability, tracked under CVE-2025-27363 and given a CVSS v3 severity score of 8.1 (“high”), was fixed in FreeType version 2.13.0 on February 9th, 2023.

Facebook disclosed the flaw yesterday, warning that the vulnerability is exploitable in all versions of FreeType up to version 2.13 and that there are reports of it actively being exploited in attacks.

“An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files,” reads the bulletin.

“The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer.”

“The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution.”

Facebook may rely on FreeType in some capacity, but it is unclear if the attacks seen by its security team took place on its platform or if they discovered them elsewhere.

Considering the widespread use of FreeType across multiple platforms, software developers and project administrators must upgrade to FreeType 2.13.3 (latest version) as soon as possible.

Although the latest vulnerable version (2.13.0) dates two years, older library versions can persist in software projects for extended periods, making it important to address the flaw as soon as possible.

BleepingComputer asked Meta about the flaw and how it was exploited, and was sent the following statement.

“We report security bugs in open source software when we find them because it strengthens online security for everyone,” Facebook told BleepingComputer.

“We think users expect us to keep working on ways to improve security. We remain vigilant and committed to protecting people’s private communications.”