In this post, I learn that instead of fighting myself and trying to control my external environment, I should accept the flow of the present moment. Enjoy!
https://www.planetphoenix.co/post/acceptance-during-redirection
Not really sure why, but I've been stuck a bit today reminiscing about standing up a public security advisory program at a former employer. We had an existing PSIRT, but just were not at all interested to speak publicly about vulnerabilities.
They'd had a handful of CVEs published about them about 10 years before and were not really happy with how the process went. I spent several months advocating that "lack of CVEs != lack of vulnerabilities; we should be speaking authoritatively about this so that customers are reassured and we aren't subject to the whims of the Internet's view of our flaws”. By late 2019, I'd gotten the support from the executives necessary to standup a program and become a CNA.
Starting in 2020, they started to issue CVEs, post about them publicly, etc. It's still going on there to this day, with new CVEs published within the last few months.
I even did a bit of archaeology because the 2010-era CVEs were woefully under-developed entries. I found some internal documentation, some repos, and some long-time employees who helped to get additional details put together to clarify what was actually going on (eg which versions were vulnerable and which were fixed). I'm not entirely sure what happened with those archaeological details, but I fear they're somewhat lost to time.
Still, it was a lot of fun to make it happen and it warms my heart that they've carried on even after I have moved on. Feels good to have left the Internet a little better than when I found it. #vulnerability #cve
But you know what’s worse than failing? Not trying at all.
Because if there’s even one person out there who’s also feeling isolated…who’s also feeling like they’ve lost something vital in all this noise…who’s also ready to build something better—then it’s already worth it.
This is the risk.
This is the work.
This is the invitation.
Let’s start over—together.
ClamAV releases updates patching multiple flaws, at least one critical
ClamAV has released security patches (versions 1.4.3 and 1.0.9) addressing multiple vulnerabilities, including fixing a critical buffer overflow in the PDF parser (CVE-2025-20260) that could allow unauthenticated remote attackers to execute arbitrary code in enterprise environments with specific configuration settings. Organizations are strongly urged to upgrade to the patched versions.
**If you're running ClamAV antivirus, update to version 1.4.3 or 1.0.9. There's a flaw that can be exploited with a malicious PDF attachment sent to email, allowing for remote code execution. Prioritize this update in enterprise environments where ClamAV is configured with higher scan limits, as these are the most vulnerable configurations.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/clamav-releases-updates-patching-multiple-flaws-at-least-one-critical-h-1-s-c-5/gD2P6Ple2L
Is Earth sentient? In this post, I explore this question by revisiting a well known theory and playfully utilizing a childhood carton to express my perspective.
https://www.planetphoenix.co/post/our-sentient-earth-her-representatives
In this post, I highlight how my new job has been the emotional thunderbolt I've needed to continue to integrate my self-doubt and evolve it into self-confidence.
#Phoenix #Vulnerability #Consciousness #Meditation #Blog #PlanetPhoenix #SelfDoubt #Confidence
https://www.planetphoenix.co/post/walking-through-self-doubt
AgentSmith flaw in LangSmith’s Prompt Hub exposed user API keys and data via malicious AI agents using hidden proxies, researchers reveal.
https://hackread.com/agentsmith-flaw-langsmith-prompt-hub-api-keys-data/
Chaining two LPEs to get “root”: Most Linux distros vulnerable (CVE-2025-6018, CVE-2025-6019) https://www.helpnetsecurity.com/2025/06/18/chaining-two-lpes-to-get-root-most-linux-distros-vulnerable-cve-2025-6018-cve-2025-6019/ #vulnerability #Don'tmiss #Hotstuff #openSUSE #Debian #Fedora #Qualys #Ubuntu #Linux #News
« A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part of the root group in the context of that SSH session. »
"𝑇ℎ𝑒𝑟𝑒 𝑖𝑠 𝑠𝑜𝑚𝑒𝑡ℎ𝑖𝑛𝑔 𝑢𝑛𝑑𝑒𝑛𝑖𝑎𝑏𝑙𝑦 𝑝𝑜𝑤𝑒𝑟𝑓𝑢𝑙 𝑖𝑛 ℎ𝑜𝑝𝑒!" - Futurist Jim Carroll
(What a stage! But that's not me - that's something undeniably powerful from Ideogram.AI!)
Lots of folks are struggling. For countless people, 2025 has proven to be a less-than-magical year.
In that context, have you ever thought one of the best ways to give yourself some hope is by giving some back? That you can best move forward by helping others do the same?
Let's think about the power of kindness.
There's something undeniably powerful in hope. You can spend a small moment to spark a belief in someone else that there is a brighter future, and maybe encourage them to take their next step.
There's something undeniably powerful in truth. In an error in which it is becoming in short supply, staking a moral ground truth and encouraging others to do so can, in the long run, help lay the groundwork for real solutions and progress.
There's something undeniably powerful in empathy. When you spend more time understanding another perspective and showing that you care, you will give someone the exact support they need.
There's something undeniably powerful in vulnerability. When you dare to share your own experiences openly, you will encourage others to trust you and seek the help they need.
There's something undeniably powerful in kindness. At this moment in time, extending a helping hand or a thoughtful gesture can directly brighten someone's day.
There's something undeniably powerful in giving. Whether it's your time, resources, or funds, know that you always have the chance to make a tangible difference in someone's life.
There's something undeniably powerful in patience. Knowing that everyone is in a different stage on their journey, and so offering them the support of waiting can encourage them to keep going.
There's something undeniably powerful in trust. If you take a moment to show confidence in the abilities of others, you will be empowered. them to act and succeed on their own.
There's something undeniably powerful in forgiveness. The simple fact is, that we all make mistakes, and the act will allow others to move forward from past hurts and achieve what they need to.
There's something undeniably powerful in listening. In an era in which everyone is shouting, taking the time to truly hear what someone else is saying, shows the respect they might need at this difficult moment.
There's something undeniably powerful in purpose. Because you will find meaning in serving others, turning your good intentions into impactful actions.
There's something undeniably powerful in all of us.
Futurist Jim Carroll has always found that there is something powerful in writing.
**#Hope** **#Kindness** **#Power** **#Truth** **#Empathy** **#Vulnerability** **#Giving** **#Purpose** **#Forgiveness** **#Listening**
In response to popular demand, we've added some offensive security channel to the MalwareTech Discord. Interested in pentesting, red teaming, or implant development? Check out channels #offensive-security, #vulnerability-research, and #implant-development.
https://discord.gg/MalwareTech
A researcher uncovered a flaw in Google’s recovery system that could expose users’ phone numbers in seconds—fueling risks like SIM swapping. Google has since patched the issue.
#Privacy
#Vulnerability 
https://thehackernews.com/2025/06/researcher-found-flaw-to-discover-phone.html
Graphite Caught: First Forensic Confirmation of Paragon's iOS Mercenary Spyware Finds Journalists Targeted
An investigation reveals that two journalists were targeted with Paragon's Graphite mercenary spyware on iOS devices. Forensic analysis confirmed the use of a zero-click attack exploiting a vulnerability (CVE-2025-43200) in iOS 18.2.1. The same attacker targeted both victims, suggesting a coordinated effort against media professionals. The spyware was linked to a specific server and iMessage account. This discovery is part of a broader pattern of spyware use against European journalists, raising concerns about press freedom and digital security. The Italian government acknowledged using Graphite in some cases but denied involvement in targeting certain journalists. The incident highlights the ongoing threat of mercenary spyware to civil society and the need for greater accountability.
Pulse ID: 684b4dfdc754eff94f8e1f53
Pulse Link: https://otx.alienvault.com/pulse/684b4dfdc754eff94f8e1f53
Pulse Author: AlienVault
Created: 2025-06-12 22:00:29
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
A zero-click flaw in #Microsoft365Copilot, dubbed #EchoLeak, lets attackers steal company data through a single email, no user action needed. AI assistants now pose real risks.
Read: https://hackread.com/zero-click-ai-flaw-microsoft-365-copilot-expose-data/
External control of file name or path in WebDAV allows an unauthorized attacker to execute code over a network.
https://vulnerability.circl.lu/vuln/CVE-2025-33053#sightings
#webdav #vulnerabilitymanagement #cve #vulnerability #cybersecurity
CVE-2025-33053
Critical vulnerability discovered in ManageEngine Exchange Reporter Plus
ManageEngine addressed a critical vulnerability (CVE-2025-3835) in its Exchange Reporter Plus email monitoring solution that allows authenticated attackers to execute arbitrary commands through the Content Search module, affecting all builds numbered 5721 and below.
**If you're running ManageEngine Exchange Reporter Plus build 5721 or older, you have a critical vulnerability that lets attackers take over your server completely. You are not safe just because this tool is internal to your organizations - hackers can breach credentials, and malicious insiders can abuse the system. Update to build 5722 or later ASAP.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-vulnerability-discovered-in-manageengine-exchange-reporter-plus-c-x-a-d-0/gD2P6Ple2L
#vulnerability #UEFI #CVE #SecureBoot
Hydroph0bia (CVE-2025-4275) — тривиальный обход SecureBoot в UEFI-совместимых прошивках на базе платформы Insyde H2O / Хабр
https://habr.com/ru/articles/916268/
> В этой статье я расскажу про найденную мной не так давно серьезную уязвимость в UEFI -совместимых прошивках на базе платформы Insyde H2O , которая присутствует в них примерно с 2012 года и (на большинстве существующих ныне систем) продолжает присутствовать.
Уязвимость эта позволяет надежно (и незаметно для средств мониторинга стандартных переменных UEFI SecureBoot вроде db, KEK и PK) обойти механизм проверки подписей UEFI-драйверов и UEFI-загрузчиков, а для её успешной эксплуатации требуется только возможность записи в UEFI NVRAM (доступная и в Windows, и в Linux после локального повышения привилегий).
SQL Injection despite using prepared statements? 
Turns out that SQL syntax can be ambiguous! Learn how this has led to vulnerabilities in several popular PostgreSQL client libraries:
Endor Labs emailed me with an analysis of this Llama index SQL Injection vulnerability. Yeah, it's an ad, but it's a good writeup.
NICKNAME: Zero-Click iMessage Exploit Targeted Key Figures in US, EU https://hackread.com/nickname-zero-click-imessage-exploit-figures-us-eu/ #Cybersecurity #Vulnerability #CyberAttack #ZeroClick #Security #iMessage #NICKNAME #iPhone #China #EU #US
