Threat briefs

The Gumlet php-image-resize library before 3.0.1 is vulnerable to a denial-of-service condition via memory exhaustion when processing specially crafted image uploads.

An unrestricted file upload vulnerability in Thelia allows authenticated back-office users to achieve remote code execution by bypassing filename sanitization.

Thirty bees versions up to 1.7.0 are vulnerable to an authentication bypass in PasswordController::resolveCustomer() that enables account takeover via manipulated guest checkout processes.

Square Squash through commit e73f280 is vulnerable to insecure deserialization via the /api/1.0/symbolication endpoint, allowing unauthenticated attackers to achieve arbitrary Ruby object deserialization and potential remote code execution.

Exponent CMS versions up to 3.0.2patch2 contain a SQL injection vulnerability in the userLogin function within xmlrpc.php that allows unauthenticated remote attackers to execute arbitrary SQL commands.

Zoraxy versions up to 3.3.4 are vulnerable to a remote authorization bypass in the Path Exception Matcher component that allows attackers to manipulate PathPrefix arguments.

A critical buffer overflow vulnerability in the Edimax BR-6208AC router allows unauthenticated remote code execution via manipulation of the ifname argument in the /goform/formWlSiteSurvey handler.

Grav Login OAuth plugin before 1.4.3 is vulnerable to account takeover due to the use of deterministic, predictable credentials generated from provider identifiers.

A local privilege escalation vulnerability in Docker Desktop for Windows allows a local attacker to execute arbitrary code with administrative privileges.

CERT-FR reports widespread compromises of Danfoss AK-SM and AK-SC series controllers resulting from the exposure of management interfaces directly to the internet.

CVE-2026-31694 is an out-of-bounds write vulnerability in the Linux kernel FUSE readdir implementation that allows local attackers to corrupt physically adjacent memory pages and achieve privilege escalation.

CVE-2024-21378 is a remote code execution vulnerability in Microsoft Outlook that enables attackers to execute arbitrary code by delivering a malicious email form containing a COM DLL.

The FIN7 threat group utilizes the Windows Management Instrumentation Command-line (WMIC) utility to execute arbitrary code by loading XSL files to bypass application whitelisting.

Adversaries use wmic.exe to enumerate local groups on Windows endpoints to identify targets for privilege escalation and lateral movement.

This brief outlines the detection of potential persistence and privilege escalation via WMI permanent event subscriptions, which attackers use to trigger malicious payloads on system events.

This brief documents the use of Windows Management Instrumentation Command-line (WMIC) for reconnaissance, specifically focusing on the 'wmic computersystem' command used by adversaries to profile system environments.

Ransomware actors, including the Cactus group, utilize the Windows Management Instrumentation Command-line (WMIC) utility to delete volume shadow copies to prevent system recovery.

This brief focuses on identifying the abuse of the WMIC utility for system information discovery, a technique frequently used by adversaries to fingerprint target environments during post-exploitation.

This brief documents the detection of WMI 'process call create' command-line patterns used by adversaries to execute arbitrary payloads and maintain persistence.

Adversaries leverage the native Windows utility quser.exe to enumerate active RDP user sessions, a common reconnaissance technique observed in post-exploitation frameworks like winPEAS and ransomware campaigns.

The DCRat malware uses the Windows time synchronization utility 'w32tm.exe' to introduce arbitrary delays in its execution flow, helping the threat actor evade sandbox analysis and automated detection mechanisms.

Adversaries leverage the signed Windows script Syncappvpublishingserver.vbs via wscript.exe or cscript.exe to execute remote scripts or facilitate defense evasion and privilege escalation.

Adversaries utilize the Windows native 'netsh.exe' utility to perform reconnaissance on firewall rules and network configurations to facilitate post-exploitation activities and security control bypass.

Threat actors, including APT41, abuse the native Windows HTML Help application (hh.exe) to decompile CHM files for staging malicious payloads or bypassing security controls.

The legacy Windows Resource Kit tool SubInAcl is being identified as a potential indicator of unauthorized security descriptor tampering or defense evasion on modern Windows environments.

Adversaries may use the PowerShell cmdlet Export-PfxCertificate to exfiltrate authentication certificates from the Windows Certificate Store, enabling identity impersonation and data decryption.

Adversaries abuse the PowerShell Export-Certificate cmdlet to exfiltrate authentication certificates from the Windows Certificate Store for use in credential theft and man-in-the-middle attacks.

This detection identifies the illicit extraction of authentication certificates by monitoring Windows CAPI2 logs for EventID 70, a technique commonly utilized by attackers to perform credential theft and user impersonation.

Threat actors like CL-STA-0048 abuse the legitimate sqlcmd.exe utility to conduct database reconnaissance, data theft, and unauthorized command execution on compromised Microsoft SQL Server instances.

Snake malware achieves persistence by installing a rogue Windows service named 'WerFaultSvc' that masquerades within the Windows WinSxS directory.