The flaw shows how attackers can partially escape the macOS app sandbox using Apple’s RemoteViewServices framework.

The issue lies in how macOS handles inter-process communication (IPC). Attackers can exploit this weakness to run code outside of the sandbox, bypassing some security restrictions.

The PoC reveals that RemoteViewServices doesn’t properly validate data during certain view-hosting operations. A malicious app can abuse the createViewProxyWithOptions API to trigger a race condition, leading to unauthorized code execution in the system’s ViewBridge service, which runs as root.

This results in partial sandbox escape—allowing access to restricted folders like ~/Library and limited command execution. While it doesn’t grant full system (kernel) access, experts warn that chaining it with another kernel flaw could lead to a full device takeover.

With the PoC now public, there’s increased risk of attacks on unpatched systems. Apple has not yet released a fix.

A newly disclosed vulnerability, CVE-2025-31258, weakens the macOS App Sandbox—Apple’s key security feature that limits what apps can access. This flaw is especially dangerous for enterprise users, where sandboxed apps often handle sensitive data.

The bug affects macOS Ventura 13.4 through Sonoma 14.2. It requires users to open a malicious app, but once triggered, it can break out of the sandbox and access restricted parts of the system.

While no active attacks have been seen yet, a proof-of-concept (PoC) is now public, raising the risk of real-world exploitation. If abused, this flaw could:

• Bypass macOS privacy and permission controls (TCC)
• Steal encryption keys from password managers
• Modify protected system files and logs

Even though it’s a partial sandbox escape, security experts warn it could still be chained with other tools to exfiltrate data or launch ransomware.

Mitigation and Patch Status

Apple has rated this a high-severity issue (CVSS 7.8) and plans to patch it in macOS 14.3. Until then, security teams should:

• Block unknown apps and binaries using endpoint protection tools
• Review apps that use the RemoteViewServices API
• Watch for suspicious activity from the ViewBridge service

Developers are also being urged to review how they handle inter-process communication (IPC) and secure their XPC handlers.

For now, users should avoid installing unverified apps and ensure strict code-signing policies are in place.

This vulnerability is a reminder of the growing threats targeting macOS internals and the need for layered defenses—even inside the sandbox.

The post VMware Tools Vulnerability: File Modification & Malicious Ops appeared first on First Hackers News.

The issue affects how VMware Tools handles files and could let non-admin users in guest virtual machines (VMs) perform unauthorized file operations.

The flaw only affects Windows and Linux systems. macOS systems are not impacted.

CVE-2025-22247 stems from insecure file handling in VMware Tools, a utility suite that improves guest OS performance in virtual machines. Improper validation of file operations could allow privilege escalation or unauthorized file changes.

VMware explained that a local attacker with limited access on a guest VM could manipulate local files to trigger these insecure operations.

While the attack requires local access, it still poses a risk—especially in shared environments with multiple VM users.

The flaw was privately reported by Sergey Bliznyuk from Positive Technologies, and details were published in VMware’s advisory VMSA-2025-0007 on May 12, 2025.

Affected Systems and Risk

The vulnerability affects VMware Tools versions 11.x.x and 12.x.x on Windows and Linux. macOS systems are not impacted.

Rated as “Moderate” with a CVSS score of 6.1, the flaw allows local users with limited privileges to carry out unauthorized file operations. While the attack is local and needs no user interaction, it can significantly impact system integrity.

Environments with shared virtual machines face higher risk, especially when multiple users have different access levels.

Patching and Mitigation

VMware has released Tools version 12.5.2 to fix the issue.

• For Windows 32-bit, the fix is in version 12.4.7 (included in 12.5.2).
• Linux users should update via their distro’s open-vm-tools package.

No workaround exists—patching is the only fix. VMware urges organizations to update as soon as possible, especially in shared VM environments. Patches and documentation are available through VMware’s official support portal.

VMware also stressed the importance of keeping VM tools up to date, as virtual machine security goes beyond just the hypervisor.

The post VMware Patches Security Flaw in VMware Tools (CVE-2025-22247) appeared first on First Hackers News.

What is Bifrost malware?

Bifrost is a type of malware known as a Remote Access Trojan (RAT). It allows attackers to gain unauthorized access to infected computers remotely.

Once installed on a victim’s system, Bifrost enables attackers to perform various malicious activities, such as stealing sensitive information, monitoring user activity, executing commands, and even controlling the infected computer remotely. Bifrost has been utilized by cybercriminals in targeted attacks against individuals, businesses, and organizations worldwide.

The latest version of Bifrost aims to circumvent security measures and infiltrate target systems.

The cybersecurity industry is alarmed by the recent surge in Linux variants of Bifrost, suggesting a rise in attacks targeting Linux-based systems.

Bifrost Implements Innovative User-Deception Technique

The most recent iteration of Bifrost communicates with a command and control (C2) domain using the deceptive name download.vmfare[.]com, closely resembling a legitimate VMware domain.

“This practice is commonly referred to as typosquatting,” Palo Alto Networks explained to Cyber Security News. Researchers have detected the latest Bifrost sample on a server.

The sample binary is x86-compiled and seems to be stripped, meaning both symbol tables and debugging information have been removed. Attackers typically utilize this tactic to impede analysis.

Initially, the malware employs the setSocket method to establish a socket for communication. Subsequently, it collects user data and sends it to the attacker’s server.

After creating the socket, the malware proceeds to collect user information to transmit it to the attacker’s server.

The latest sample encrypts gathered victim data using RC4 encryption. Subsequently, the malware endeavors to connect with a public DNS resolver situated in Taiwan.

Using the public DNS resolver, the malware initiates a DNS query to resolve the domain download.vmfare[.]com. This step is crucial to ensure the malware can establish a connection with its target location.

In efforts to evade detection, the malware frequently employs deceptive domain names like C2 instead of IP addresses.

Researchers uncovered that a malicious IP address also hosts an ARM version of Bifrost. This version’s presence indicates the attacker’s endeavor to broaden the scope of their attacks.

Therefore, it is paramount to identify and eradicate malware like Bifrost to safeguard sensitive information and uphold the integrity of computer systems. By doing so, the likelihood of unauthorized access and the subsequent damage can be significantly reduced.

Indicators of Compromise

Domain and IP Addresses

• download.vmfare[.]com
• 45.91.82[.]127

The post New Bifrost malware for Linux mimics VMware domain for evasion appeared first on First Hackers News.

Designated as CVE-2023-34060, this vulnerability presents a substantial risk, boasting a CVSSv3 score of 9.8, signifying its critical severity. Dustin Hartle from Ideal Integrations Inc. initially reported this issue to VMware on November 14, 2023.

Critical CVE-2023-34060 Vulnerability in VMware Cloud

The Cybersecurity and Infrastructure Security Agency (CISA) has released a security alert advising users about the issue and urging prompt implementation of patch updates.

Identified as CVE-2023-34060, this authentication bypass vulnerability is present in VMware Cloud Director Appliance, especially in cases where the appliance underwent an upgrade to version 10.5 from a prior version.

VMware has assessed the severity of this issue as critical, assigning a maximum CVSSv3 base score of 9.8 to underscore its significant potential impact.

The critical nature of the vulnerability lies in its capacity to enable malicious actors with network access to circumvent login restrictions. This bypass is specifically viable on ports 22 (SSH) and 5480 (appliance management console) in upgraded versions of VMware Cloud Director Appliance 10.5.

Notably, as outlined in VMware’s advisory, the vulnerability is absent in new installations of version 10.5 and does not affect port 443 (VCD provider and tenant login).

The impacted product is VMware Cloud Director Appliance, specifically version 10.5 that has undergone an upgrade from version 10.4.x or earlier. This vulnerability does not affect new installations of version 10.5 or versions 10.4.x and below.

The post Critical CVE-2023-34060 Vulnerability in VMware Cloud Director Appliance: CISA Advises Immediate Patching appeared first on First Hackers News.

CVE-2023-20869

The first vulnerability (CVE-2023-20869) is a stack-based buffer-overflow vulnerability in the device sharing functionality Bluetooth, which allows local attackers to execute code as a VMX process of the virtual machine running on the host.

CVE-2023-20870

The second bug fixed today (CVE-2023-20870) is an information disclosure vulnerability in the Bluetooth host device sharing functionality with the VM, which allows malicious actors read privileged information contained in hypervisor memory from a VM.

For administrators who can’t instantly apply updates for the two issues on their systems, VMware has also given a temporary workaround.

By unchecking the “Share Bluetooth devices with the virtual machine” option on the impacted devices, you may also disable Bluetooth support on the virtual machine to eliminate the attack vector (further information on how to accomplish so can be found here).

Administrators must “remove the CD/DVD device from the virtual machine or configure the virtual machine NOT to use a virtual SCSI controller” to temporarily fix CVE-2023-20872, which prevents exploitation attempts.

The vulnerabilities affect the following product versions:

• VMware Workstation versions 17.0 through 17.0.1
• VMware Fusion versions 13.0 through 13.0.1

Conclusion

Users and administrators of affected product versions are advised to update to the latest versions immediately.

Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post VMware Resolves Crucial Pwn2Own Zero-Day Exploit Chain appeared first on First Hackers News.

Affected Carbon Black App Control Versions 

The following versions of VMware Carbon Black App Control, running on Microsoft Windows operating systems, are vulnerable to CVE-2023-20858: 

• 8.7.x before 8.7.8 
• 8.8.x before 8.8.6 
• 8.9.x before 8.9.4 

About CVE-2023-20858

To exploit CVE-2023-20858 – an injection vulnerability that could allow a malicious actor to gain access to the underlying server operating system – the attacker must have privileged access to the App Control administration console and use specially crafted input.

Another advisory by VMware includes a high-severity vulnerability in its vRealize Orchestrator, vRealize Automation, and Cloud Foundation products. It is an XML External Entity (XXE) vulnerability tracked as CVE-2023-20855, with a CVSS score of 8.8. 

Simultaneously, VMware has also released updates for:

• VMware vRealize Orchestrator (data center workflow automation platform)
• VMware vRealize Automation (multi-cloud and data center automation platform), and
• VMware Cloud Foundation (platform for managing on-premises VM and container workloads)

The post VMware Fixes Critical Vulnerability in Carbon Black App Control (CVE-2023-20858) appeared first on First Hackers News.

Successful exploitation of these vulnerabilities may result in denial-of-service condition. The effected versions are spring cloud version 3.2.5 older, unsupported versions are also affected.

At the time of writing of this CVE such interaction is only possible via spring-cloud-function-web module.

Applying the security update from the below link will remediate the above mentioned vulnerabilitis.

Mitigation for VMware Spring Cloud Function

Users of affected versions should upgrade to 3.2.6. Releases that have fixed this issue include:

• Spring Cloud Function
  • 3.2.6

Follow us for more, Facebook, Twitter, LinkedIn and Instagram

The post VMware Spring Cloud Function Dos Vulnerability appeared first on First Hackers News.

These vulnerabilities affect certain VMware versions

• Workspace ONE Access
• Identity Manager (vIDM)
• vRealize Automation (vRA)
• loud Foundation
• VRealize Suite Lifecycle Manager.

Exploiting these vulnerabilities permits malicious actors to trigger a server-side template injection that may result in remote code execution (RCE) (CVE-2022-22954) .

According to trusted third-party reporting, threat actors may chain these vulnerabilities. At one compromised organization, an unauthenticated actor with network access to the web interface leveraged CVE-2022-22954 to execute an arbitrary shell command as a VMware user. The actor then exploited CVE-2022-22960 to escalate the user’s privileges to root. With root access, the actor could wipe logs, escalate permissions, and move laterally to other systems. 

“VMware is a very common cloud software service which is also widely present in private-sector organizations including health care. Although the emergency advisory issued by CISA only applies to government agencies, it is strongly recommended that health care entities and their life-critical and mission-critical third parties implement the provided patches as soon as possible,” John Riggi, national advisor for cybersecurity and risk at the American Hospital Association (AHA) explained in a statement in response to the emergency directive.

These methods are especially concerning because threat actors were able to adapt and develop new capabilities quickly

Incident Response for VMware vulnerabilities

If administrators discover system compromise, CISA recommends they:

1. Immediately isolate affected systems. 
2. Collect and review relevant logs, data, and artifacts.
3. Consider soliciting support from a third-party incident response organization to provide subject matter expertise.
4. Report incidents to CISA via CISA’s 24/7 Operations Center .

Mitigations

CISA recommended that organizations using the impacted VMware products work quickly to update to the latest version or remove impacted versions from organizational networks.

File Hash

• 5b0bfda041e0d8dcb0255dc4e56e6a
• 74805fa847acac6adc89698421ec9e
• 4cd8366345ad4068feca4d417738b4bd

Follow us for more, Facebook, Twitter, LinkedIn and Instagram

The post Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control appeared first on First Hackers News.