The achievement highlights how artificial intelligence is changing vulnerability research by reducing the time needed to discover complex software flaws.

How Kimi K3 Found the Vulnerabilities

The AI was given a simple task: search for memory-related security issues such as buffer overflows and use-after-free bugs in the Redis source code.

To complete the task, Kimi K3 automatically:

• Cloned the Redis source code.
• Performed fuzz testing to trigger unexpected behavior.
• Analyzed application crashes.
• Used debugging tools to identify the root cause.
• Generated proof-of-concept (PoC) exploits in a controlled testing environment.

The entire process was completed without manual intervention, showing how AI can automate complex security research.

Redis Versions Affected

The reported vulnerabilities were found in the following Redis versions:

• Redis 6.2.22
• Redis 7.4.9
• Redis 8.6.4
• Redis 8.8.0

Researchers shared the proof-of-concept findings publicly for validation and further analysis.

Key Vulnerabilities Identified

The AI agent reportedly discovered multiple critical issues, including:

• A double-free vulnerability related to Redis stream consumer groups (CVE-2026-25589).
• A heap overflow vulnerability in the RedisBloom module.

These types of memory corruption vulnerabilities can allow attackers to manipulate application memory and may eventually lead to remote code execution if successfully exploited.

Why This Matters

Finding serious vulnerabilities has traditionally required experienced researchers spending days or even weeks reviewing source code and performing extensive testing.

AI-powered tools are now changing that process by:

• Reducing vulnerability discovery time.
• Automating repetitive security testing.
• Identifying bugs across large codebases much faster.
• Helping security teams strengthen software before attacks occur.

Opportunities and Risks

While AI offers significant advantages for defenders, it also introduces new concerns.

Potential benefits include:

• Faster vulnerability detection.
• Improved software security.
• More efficient penetration testing.
• Better support for security researchers.

However, the same technology could also be used by attackers to accelerate exploit discovery, making timely patching and responsible disclosure more important than ever.

The Future of AI in Cybersecurity

The Kimi K3 demonstration shows that AI is becoming an important tool in modern cybersecurity. As large language models continue to improve, they are expected to assist with vulnerability research, code analysis, and automated security testing at a much larger scale.

Organizations should prepare by:

• Applying security updates quickly.
• Continuously monitoring critical systems.
• Using AI-assisted security tools alongside traditional defenses.
• Strengthening vulnerability management programs.

Conclusion

Although these findings are still being reviewed by the security community, they demonstrate how quickly AI-powered security research is evolving. Kimi K3’s ability to discover complex Redis vulnerabilities in minutes signals a major shift in how software security testing may be performed in the future, making AI an increasingly valuable asset for both cybersecurity researchers and defenders.

The post Kimi K3 AI Discovers Redis RCE Flaws appeared first on First Hackers News.

How the Attacks Work

Threat actors are abusing vulnerabilities such as:

• Unauthenticated file upload
• Remote Code Execution (RCE)
• Server-Side Request Forgery (SSRF)
• Deserialization flaws

These vulnerabilities allow attackers to upload webshells, giving them persistent remote access to compromised websites.

Impact on Organizations

Organizations worldwide, including small and medium-sized businesses, have already been affected. Once attackers gain access, they can:

• Execute commands remotely
• Install additional malware
• Steal sensitive data
• Harvest user credentials
• Move laterally within internal networks
• Use compromised websites for defacement or hosting scams

Incident Response Recommendations

If you suspect your website has been compromised, assume the system is affected until proven otherwise.

Security teams should:

• Inspect plugin directories for suspicious or unknown files.
• Review web server logs for unusual GET or POST requests.
• Isolate affected servers immediately.
• Preserve logs for forensic investigation.
• Audit user accounts, authentication logs, and network activity.
• Look for persistence mechanisms and signs of lateral movement or data exfiltration.

If a webshell is found, remove malicious files, eliminate persistence mechanisms, and restore the website from a recent trusted backup before bringing services back online.

Affected Software and Plugins

Security Recommendations

Organizations should:

• Apply the latest security patches immediately.
• Enable automatic updates where practical.
• Identify vulnerable plugins and CMS components.
• Remove unused or unsupported plugins.
• Monitor websites for suspicious activity and unauthorized file changes.
• Investigate any unusual web traffic or unexpected server behavior promptly.

Keeping WordPress plugins and other CMS components fully updated remains the most effective way to reduce the risk of exploitation.

The post WordPress Plugin Vulnerabilities Enable RCE appeared first on First Hackers News.

Security researchers demonstrated that the flaws can be chained together to achieve remote code execution with root privileges through a single specially crafted request. The vulnerabilities affect UniFi OS Server installations and pose a significant risk to organizations using exposed management interfaces, highlighting the importance of addressing UniFi OS Vulnerabilities.

Because the attack requires no authentication, security experts are urging administrators to patch affected systems immediately.

How the Attack Works

The exploit begins with vulnerabilities that allow attackers to bypass UniFi OS authentication protections.

Researchers discovered that inconsistencies in how requests are processed can allow specially crafted URLs to access internal functions that should normally require authentication. Once inside, attackers can target a separate command injection flaw within the system’s update mechanism.

The attack chain allows threat actors to:

• Bypass authentication controls
• Execute commands remotely
• Gain root-level access
• Install malicious software
• Maintain long-term access to the system

Researchers confirmed that the exploit can be executed remotely against vulnerable devices running affected versions of UniFi OS.

Potential Impact on Organizations

A successful compromise gives attackers complete control over the UniFi management platform.

With root access, attackers may be able to:

• Create persistent administrator accounts
• Access sensitive network data
• Steal encryption and authentication keys
• Extract database information
• Modify system configurations
• Maintain access even after password changes

In environments using UniFi Access and UniFi Protect, the risks extend beyond traditional IT systems.

Researchers warn that attackers could potentially:

• Unlock connected doors
• Access surveillance systems
• Monitor live camera feeds
• Delete security footage
• Access stored credential information

This makes the vulnerabilities especially concerning for organizations that rely on UniFi products for both network and physical security management.

Recommended Mitigation Steps

Administrators should immediately upgrade to the latest patched UniFi OS versions provided by Ubiquiti.

Additional security measures include:

• Restrict management interfaces from internet access
• Rotate authentication and signing keys
• Change administrative credentials
• Review systems for suspicious activity
• Rebuild potentially compromised servers
• Audit access logs and configurations

Security experts advise treating any internet-exposed, unpatched UniFi OS instance as potentially compromised due to the severity of the vulnerabilities and the ease of exploitation.

The post Critical UniFi OS Vulnerabilities Allow Root RCE appeared first on First Hackers News.

The issues affect the Angular.ng-template extension and stem from unsafe handling of user-controlled input and insecure loading of configuration files. Researchers warned that simply opening a malicious project in VS Code could be enough to trigger an attack.

The vulnerabilities mainly target developers working with Angular projects and could lead to full system compromise if exploited successfully.

Malicious JSDoc Comments Can Trigger Command Execution

One of the vulnerabilities involves the way the extension processes JSDoc comments inside TypeScript and JavaScript files.

Researchers found that the extension enables trusted Markdown rendering, allowing embedded command links to run inside hover previews. Because the Angular language server does not properly sanitize JSDoc content, attackers can insert malicious command URIs into project files.

In a possible attack scenario:

• An attacker adds a malicious JSDoc comment to a project
• The developer opens the file in VS Code
• Hovering over the affected symbol displays the malicious link
• Clicking the link executes commands on the host system

This creates a practical path for remote code execution through normal development workflows.

Workspace Configuration Flaw Allows Silent Code Execution

A second vulnerability affects how the extension handles the TypeScript SDK (tsdk) configuration.

The extension reads settings directly from the project’s .vscode/settings.json file and loads the specified tsserverlibrary.js file without properly checking workspace trust or requesting user approval.

Attackers can abuse this behavior by:

• Placing a malicious tsserverlibrary.js file inside the repository
• Modifying workspace settings to reference the file
• Triggering automatic execution when the project is opened

Unlike the JSDoc attack, this method requires no user interaction and can run silently during extension initialization.

Researchers noted that this behavior effectively bypasses VS Code’s Workspace Trust protections, which are intended to prevent untrusted projects from executing code automatically.

High Risk for Developers

Successful exploitation could allow attackers to:

• Execute arbitrary system commands
• Access sensitive development data
• Install persistent malware
• Compromise developer environments

A developer cloning and opening a malicious repository could unknowingly trigger the attack immediately after loading the project in VS Code.

The vulnerabilities were disclosed under GitHub advisory GHSA-ccq4-xmxr-8hcq and impact all extension versions before 21.2.4.

The issues have now been fixed in the latest release, and developers are strongly advised to upgrade immediately.

Security Recommendations

To reduce risk, developers should:

• Update Angular Language Service to version 21.2.4 or later
• Avoid opening untrusted repositories
• Carefully review .vscode/settings.json files
• Use VS Code Workspace Trust features
• Monitor suspicious extension behavior
• Follow secure coding and repository validation practices

The findings highlight growing security risks targeting software development environments and trusted developer tools.

The post Angular Language Service Vulnerabilities Enable RCE Attacks appeared first on First Hackers News.

The flaw, known as “MonikerLink,” allows attackers to bypass Outlook’s Protected View and execute malicious code or steal credentials. The PoC release highlights the continuing risk and provides security teams with insight into the attack vector.

Understanding the MonikerLink Flaw

This vulnerability, rated with a CVSS score of 9.8, originates from the way Outlook parses special hyperlinks called Moniker Links.

Protected View is designed to restrict suspicious files by running them in a limited, read‑only mode. However, attackers can bypass this protection by embedding a crafted file:// link containing an exclamation mark and additional text.

How the Exploit Triggers in Outlook

When a user clicks a malicious Moniker Link, Outlook attempts to access the referenced file without presenting any security warning.

This silent lookup can trigger an SMB connection to an attacker‑controlled server, resulting in the leakage of the victim’s NTLM credentials. In advanced attack scenarios, this behavior can escalate to remote code execution, giving attackers high‑level control over the compromised system.

The newly published Python-based PoC illustrates how this vulnerability can be exploited in a controlled lab setup. Available on GitHub, the script is designed to work with a specific configuration involving hMailServer and targets a user running a vulnerable version of Outlook.

It automates the process of sending an email that embeds the crafted Moniker Link, ensuring the malicious payload lands directly in the victim’s inbox.

According to the PoC author, the script assumes a simplified testing environment, including the absence of TLS authentication, to make the learning process easier. While the code is intentionally basic and aimed at users exploring the “MonikerLink” room on TryHackMe, it effectively demonstrates the core attack mechanics.

For researchers looking for more advanced tooling, the author also recommends alternative repositories, such as the one maintained by security researcher Xaitax.

Impact and Security Considerations

Beyond credential theft, the MonikerLink bypass can lead to full remote code execution when combined with other exploitation techniques.

This makes the flaw one of the most critical Outlook vulnerabilities disclosed in recent years. Organizations are urged to apply available patches and review email security controls to reduce exposure.

Mitigations:

• Watch for unusual email patterns that may indicate someone trying to trigger this weakness. A new YARA rule from researcher Florian Roth can help spot emails containing the file:\ path trick.
• Using this rule allows defenders to catch risky emails early, before they reach users.
• Microsoft has published security fixes for CVE-2024-21413, and updating systems right away is strongly recommended.
• Since exploit examples are now public, attackers are more likely to copy and use them.
• Make sure every Microsoft Office installation is running the latest security updates.
• Blocking outbound SMB connections on port 445 can help prevent NTLM credentials from leaking to outside servers.

‍Follow Us on: Linkedin, Instagram, Facebook to get the latest security news!

The post PoC Released for Critical Outlook Zero-Click RCE Bug appeared first on First Hackers News.

This flaw, caused by a stack-based buffer overflow, allows unauthenticated attackers to remotely execute arbitrary code on affected systems. It has already been actively exploited in the wild, raising concerns across the cybersecurity community.

Exploitation in the Wild

As of April 6, 2025, the Shadowserver Foundation reported that 5,113 Ivanti Connect Secure devices are still unpatched and vulnerable to a critical remote code execution (RCE) flaw—CVE-2025-22457.

This serious vulnerability allows attackers to take full control of affected devices without needing a password. Due to its severity, it has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, highlighting the urgent need for organizations to take action.

Attackers can use this flaw to steal data, install ransomware, or create persistent backdoors into networks.

Shadowserver’s scan data shows these vulnerable devices are spread across IPv4 and IPv6 spaces, with high concentrations in North America, Europe, and Asia.

Ivanti first disclosed the issue in March 2025 and released patches to fix it. However, many organizations have yet to update, leaving them open to attack.

Recommendation

• Apply Ivanti’s patch immediately if you’re using Connect Secure.
• Check access logs for any unusual activity that could indicate compromise.
• Scan your infrastructure to make sure no vulnerable devices are exposed online.

Experts stress that unpatched systems are actively being targeted. Delays in applying security updates can lead to serious consequences, including breaches, downtime, and regulatory issues.

This situation is a clear reminder of how crucial timely patching and proactive cybersecurity practices are in today’s threat landscape.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post Ivanti RCE flaw affects over 5,000 devices appeared first on First Hackers News.

All about the vulnerability

The February update addressed:

• 25 Remote Code Execution flaws
• 14 Elevation of Privilege vulnerabilities
• 6 Denial of Service issues
• 4 Security Feature Bypass flaws
• 2 Spoofing vulnerabilities
• 1 Information Disclosure vulnerability

Microsoft Patch Tuesday – February 2025

This update addresses 61+ vulnerabilities, including critical and important flaws:

Critical Vulnerabilities:

• CVE-2025-21376: Remote code execution via LDAP protocol.
• CVE-2025-21379: RCE risk via crafted DHCP packets.
• CVE-2025-21381, 21386, 21387: Excel vulnerabilities allowing code execution via malicious files.
• CVE-2025-21406, 21407: RCE vulnerabilities in Windows Telephony Service.

Exploited in the Wild:

• CVE-2023-24932: Secure Boot bypass risk.
• CVE-2025-21391: Elevated privileges for attackers.
• CVE-2025-21418: SYSTEM privileges gained via exploit.

Other Notable Fixes:

• Visual Studio RCE (CVE-2025-21176, 21178): Immediate updates needed for RCE risks.
• Azure Network Watcher Elevation of Privilege (CVE-2025-21188): Update for Azure cloud admins.
• Microsoft Office RCE (CVE-2025-21392, 21397): Fix for Office document exploit risks.

Here’s a table of 61 vulnerabilities addressed in Microsoft’s February 2025 Patch Tuesday, based on the provided data and search results.

With two vulnerabilities actively exploited, delaying updates could leave systems vulnerable to threats.

Microsoft stresses the need to install the latest servicing stack updates (ADV990001) for smooth patch deployment.

How to Update:

• Windows Update: Go to Settings > Update & Security > Windows Update.
• Microsoft Update Catalog: Download individual patches for offline installation.
• WSUS: For enterprise environments.

The February 2025 Patch Tuesday highlights the growing complexity of cybersecurity threats. IT teams must act quickly to deploy these critical patches and stay vigilant against phishing and other exploits targeting unpatched systems.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post Microsoft Patch Tuesday (Feb 2025): 61 Vulnerabilities, 25 RCE, 3 Zero-Day appeared first on First Hackers News.

1-Click RCE Flaw

The flaw in Voyager comes from an arbitrary file write issue in its media upload function. The app checks MIME types against a predefined list, but this check is flawed.

Attackers can exploit this by creating polyglot files, like disguising a PHP script as an image or video. Since file extensions aren’t properly verified, the malicious file could be uploaded, allowing arbitrary PHP code execution on the server.

The vulnerability is worsened by a reflected XSS flaw. Attackers can trick authenticated users into clicking a malicious link on the /admin/compass endpoint, executing arbitrary JavaScript and increasing the risk of server compromise.

These vulnerabilities pose significant risks, especially for applications using the popular Voyager package, which has over 11,000 stars on GitHub. While the threat is lower for users with the proper permissions, the potential for unauthorized code execution is high, especially in compromised admin contexts.

Despite outreach attempts, Voyager has not provided a fix, leaving version 1.8.0 unpatched. Users should carefully assess the risks before using it in production. The discovery of these flaws emphasizes the need for vigilance.

Organizations are advised to audit Voyager usage, enforce strict permissions, and consider alternatives until patches are released. Regular monitoring and proactive security measures are essential.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post 1-Click RCE Flaw in Voyager PHP Lets Attackers Run Arbitrary Code appeared first on First Hackers News.

All about the vulnerability

The vulnerability originates from improper handling of UVC_VS_UNDEFINED frames in the UVC driver’s uvc_parse_format function, leading to buffer size miscalculations and out-of-bounds memory writes.

Attackers can exploit this flaw by inserting malicious USB devices or manipulating video streams, causing buffer overflows that overwrite adjacent memory regions. This can enable local privilege escalation without requiring additional execution privileges.

While the flaw is not directly exploitable remotely, attackers can use USB device spoofing to bypass security measures, making it a serious risk to system integrity. Google has reported signs of limited, targeted exploitation, highlighting the urgency of applying security patches.

Affected Kernel Versions

The vulnerability impacts all Linux kernel versions from 2.6.26 to the latest patched releases. Users should update their devices to security patch levels 2025-02-01 or 2025-02-05 to protect against this and other vulnerabilities.

Fixed Kernel Versions

• 4.19.324 (LTS) – 95edf13a48e7
• 5.4.286 (LTS) – 684022f81f12
• 5.10.230 (LTS) – faff5bbb2762
• 5.15.172 (LTS) – 467d84dc78c9
• 6.1.117 – beced2cb09b5
• 6.6.61 – 575a562f7a3e
• 6.11.8 – 622ad10aae5f
• 6.12.1 – 1ee9d9122801
• 6.13-rc1 – ecf2b43018da

The update also fixes vulnerabilities in Qualcomm components and third-party drivers, stressing the need for timely security updates. Given the severity of CVE-2024-53104, Android users should apply the latest patches immediately to prevent potential exploits.

The Android Security Bulletin highlights the importance of staying vigilant against threats that could lead to unauthorized access and device compromise. Users should follow their device manufacturer’s instructions to apply updates as soon as possible.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post Android Update Fixes Linux Kernel RCE Flaw appeared first on First Hackers News.

Critical RCE Vulnerabilities

The bulletin highlights critical Remote Code Execution (RCE) vulnerabilities in the Android System component. These flaws could allow attackers to run malicious code without extra privileges, posing significant risks if security mitigations are bypassed.

Android partners were notified a month before the bulletin’s release. Patches will be added to the Android Open Source Project (AOSP) repository within 48 hours, with updated links to follow.

The following critical vulnerabilities are grouped by component, listed with their CVE IDs, severity, and affected AOSP versions.

The Android security platform, combined with Google Play Protect, offers essential safeguards to minimize the risk of exploiting these vulnerabilities. These measures work together to protect devices from potential threats and harmful applications.

Users are strongly encouraged to stay proactive by regularly updating their devices to the latest Android version. Updates not only patch known vulnerabilities but also enhance overall system security, reducing the risk of exploitation.

Google Play Protect, enabled by default on devices with Google Mobile Services, is a critical line of defense. It scans apps in real-time, identifies potentially harmful applications, and removes threats to keep users safe.

By ensuring devices are up-to-date with the latest security patches, Android users can significantly enhance their mobile security and enjoy a safer, more reliable experience. Regular updates are not just a recommendation—they’re a necessity in today’s evolving threat landscape.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post Android Security Update Fixes Critical RCE Vulnerabilities appeared first on First Hackers News.