SAP has released out-of-band emergency NetWeaver updates to fix a suspected remote code execution (RCE) zero-day flaw actively exploited to hijack servers.

The vulnerability, tracked under CVE-2025-31324 and rated critical (CVSS v3 score: 10.0), is an unauthenticated file upload vulnerability in SAP NetWeaver Visual Composer, specifically the Metadata Uploader component.

It allows attackers to upload malicious executable files without needing to log in, potentially leading to remote code execution and full system compromise.

Though the vendor’s bulletin isn’t public, ReliaQuest reported earlier this week about an actively exploited vulnerability on SAP NetWeaver Visual Composer, specifically the ‘/developmentserver/metadatauploader’ endpoint, which aligns with CVE-2025-31324.

ReliaQuest reported that multiple customers were compromised via unauthorized file uploads on SAP NetWeaver, with the attackers uploading JSP webshells to publicly accessible directories.

These uploads enabled remote code execution via simple GET requests to the JSP files, allowing command execution from the browser, file management actions (upload/download), and more.

In the post-exploitation phase, the attackers deployed the ‘Brute Ratel’ red team tool, the ‘Heaven’s Gate’ security bypassing technique, and injected MSBuild-compiled code into dllhost.exe for stealth.

ReliaQuest noted in the report that exploitation did not require authentication and that the compromised systems were fully patched, indicating that they were targeted by a zero-day exploit.

Security firm watchTowr also confirmed to BleepingComputer they are seeing active exploitation linked to CVE-2025-31324.

“Unauthenticated attackers can abuse built-in functionality to upload arbitrary files to an SAP NetWeaver instance, which means full Remote Code Execution and total system compromise,” stated watchTowr CEO Benjamin Harris.

“watchTowr is seeing active exploitation by threat actors, who are using this vulnerability to drop web shell backdoors onto exposed systems and gain further access.”

“This active in-the-wild exploitation and widespread impact makes it incredibly likely that we’ll soon see prolific exploitation by multiple parties.”

BleepingComputer contacted SAP with questions about the active exploitation but has not received a response at this time.

Protect against attacks now

The vulnerability impacts the Visual Composer Framework 7.50 and the recommended action is to apply the latest patch.

This emergency security update was made available after SAP’s regular ‘April 2025’ update, so if you applied that update earlier this month (released on April 8, 2025), you’re still vulnerable to CVE-2025-31324.

Moreover, the emergency update includes fixes for two more critical vulnerabilities, namely CVE-2025-27429 (code injection in SAP S/4HANA) and CVE-2025-31330 (code injection in SAP Landscape Transformation).

Those unable to apply the updates that address CVE-2025-31324 are recommended to perform the following mitigations:

1. Restrict access to the /developmentserver/metadatauploader endpoint.
2. If Visual Composer is not in use, consider turning it off entirely.
3. Forward logs to SIEM and scan for unauthorized files in the servlet path.

ReliaQuest recommends performing a deep environment scan to locate and delete suspect files before applying the mitigations.

Binance says it has suspended an employee for insider trading after launching an investigation that was prompted by a complaint.

In a new announcement, the world’s largest crypto exchange platform by volume says that an employee committed insider trading when working in a development role on its BNB Chain, prior to joining the Binance Wallet team.

Says Binance,

“Leveraging information from his former position as well as his familiarity with on-chain projects, the employee was aware the project was planning a Token Generation Event (TGE) and anticipated it would generate significant community interest. Prior to the project’s public token launch announcement, the staff member used multiple linked wallet addresses to purchase a large volume of the project’s tokens.

Following the announcement, the staff member quickly sold part of his holdings to realize significant profits, while the remaining tokens retained considerable unrealized gains. This behavior constitutes front-running based on non-public information obtained from his previous role and is a clear breach of company policy.”

Binance’s internal audit team uncovered the employee’s wrongdoing after conducting an investigation triggered by a March 23rd complaint. As a result of the preliminary investigation, the employee was “suspended immediately” and may face additional disciplinary action, which could include legal action.

“We will proactively cooperate with the relevant authorities in the employee’s jurisdiction and take appropriate legal action in accordance with applicable laws.”

Binance is also rewarding the four people who submitted information that brought the incident to its attention.

“For those who submitted valid reports via Binance’s official whistleblowing channel (audit@binance.com), we have completed the verification and de-duplication process. As committed, a total reward of $100,000 will be equally distributed.”

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

Crypto experts at Bubblemaps have recently stated their suspicion that the development team behind the Official Melania Meme ($MELANIA) coin may have sniped it (used automated tools to instantly buy new tokens when they launch to flip them for profit).

The analysts point at the blockchain activity of a Solana wallet address they called ‘0xcEA.’ Anonymous investors capitalized on Melania Trump’s new crypto release on January 19 and bagged $2.4M.

They then transferred the funds to another wallet on Avalanche and distributed them across multiple Solana wallets through several cross-chain transfers. This shows an effort to hide the transaction history.

The Link Between $MELANIA Coin and $LIBRA Crypto Scam

According to Bubblemaps analysts, the 0xcEA wallet is also linked to another notorious crypto fiasco, Libra ($LIBRA), which happened on February 15.

The modus operandi was almost identical. The investor(s) cashed in approximately $6M, then moved the funds through several wallets between Arbitrum and Avalanche.

This led the analyst team to conclude that the two events were sniped by the same actors. Moreover, the consensus is that the investor is either a member of the development team behind $LIBRA or someone closely associated with them.

Bubblemaps representatives also stated that the same actor is behind a handful of other pump-and-dump projects.

The official $MELANIA coin surged to $13B within four hours of its release and lost 99% of its value over the course of the following eight hours.

The Official Trump ($TRUMP) token suffered a similar fate with 38% of its value being wiped out in just 40 minutes.

The Presidential Crypto Scam Trend

The case of $TRUMP and $MELANIA crypto failures is not singular, as there are several other examples of presidentially supported coins crashing overnight.

Javier Milei’s $LIBRA Controversy

Javier Milei, the president of Argentina, found himself in hot waters after promoting $LIBRA on his X account.

At the time that Milei endorsed $LIBRA, most of the project’s tokens were held in a handful of digital wallets. The token itself had been created merely minutes before Milei’s X endorsement.

According to analysts, several investors cashed in over $4M, with one investor making up to $87M in profits in the hours before $LIBRA crashed.

Following the fiasco, Milei apologized for endorsing the failed project and deleted his X post. Still, several Argentinian lawyers have filed criminal fraud charges against the president, accusing him of rug-pull and ‘illicit association to commit fraud.’

Central African Republic’s President Launches Suspicious National Meme Coin

President Faustin-Archange Touadera announced the release of the Central African Republic Meme ($CAR) token in an X post on February 9.

The announcement was immediately met with skepticism for several reasons. The first one is that deepfake detection tools immediately flagged the president’s video as suspicious, yet some users argued that AI verification platforms are unreliable.

The second, and most important one, is that the $CAR token lost 60% of its value shortly after reaching its $900M market cap. The situation doesn’t look much better today.

These cases show that relying on high-profile figures to inform your investment strategies isn’t the wisest choice. But there are ways to find reliable meme coins and minimize the risk of losing your investment.

Best Wallet ($BEST) Filters Out Suspicious Projects

Best Wallet ($BEST) is a non-custodial platform that provides users with full control over their wallet security and asset management. $BEST holders enjoy lower transaction fees and early access to the best presales.

Instead of surfing the web in the search of new meme coins on presale, you can now find and buy vetted projects in Best Wallet’s Upcoming Tokens section.

On top of that, Best Wallet lets you claim tokens directly from your account instead of visiting the project’s website.

The platform’s Best DEX decentralized exchange allows for swift cross-chain transactions and only lists verified crypto projects and the best altcoins.

The $BEST token currently costs $0.024025, and the presale has accumulated over $10M in funding. Investors receive dynamic staking of up to 162% APY rewards based on the number of stakers.

Best Wallet Protects Investors From Potential Scams Like the $MELANIA Coin

Celebrities endorsing suspicious crypto projects or outright scams is nothing new, but there are ways to avoid these pitfalls.

Platforms like Best Wallet ($BEST) offer a secure ecosystem for you to diversify your portfolio and manage your assets safely.

$BEST holders can also use the Community Governance feature to vote on proposed features for the Best Wallet ecosystem.

This makes Best Wallet a community-driven platform with a strong foundation and user-oriented philosophy.

As always, you should DYOR (Do Your Own Research) before investing. The crypto market remains volatile and risky.