The most critical vulnerability, tracked as CVE-2026-53413, has been named “Zoomsday” by A Security, the research team that discovered the flaw. Zoom has rated the vulnerability as high severity.

The problem is linked to Zoom’s annotation feature, which allows participants to draw, highlight, and add text while someone is sharing their screen. Behind the scenes, this feature uses a proprietary communication protocol to exchange data between participants.

Researchers found that Zoom’s annotation component does not properly validate certain formatting information received over the network. Specifically, the function responsible for processing annotation data uses fixed-size memory buffers while trusting size values provided by the sender.

An attacker could take advantage of this weakness by sending specially crafted data that is larger than the allocated memory space. This can cause a buffer overflow, potentially allowing the attacker to corrupt memory and take control of the application.

A Security demonstrated the issue on macOS by using the vulnerability to launch Safari on a targeted computer without the user taking any action. The demonstration showed that successful exploitation could occur quietly, without obvious signs that the device had been compromised.

The attacker only needs to join or host a Zoom meeting and target another participant.

Three More Zoom Vulnerabilities

Zoom also disclosed three additional security issues as part of the same security update cycle.

CVE-2026-53414 is a medium-severity buffer over-read vulnerability affecting Zoom Clients. Successful exploitation could allow an attacker to access information from areas of memory that should not be exposed.

CVE-2026-53415 is a high-severity use-after-free vulnerability. It can cause memory corruption and could potentially lead to code execution when an attacker causes the application to access memory that has already been released.

CVE-2026-53416 affects the Zoom VDI Client and is caused by a path traversal vulnerability. An attacker could manipulate file paths to access files outside the directories intended by the application.

Zoom published these issues under security bulletins ZSB-26015 through ZSB-26018, with the bulletins published and updated on August 11, 2026.

Zoom Releases Security Fixes

Zoom says the annotation-related vulnerabilities affect its clients across supported platforms, while the path traversal issue is limited to VDI environments.

The company has already released fixes. The affected products should be updated to the following versions:

• Zoom Workplace: 7.1.5 or 7.0.6
• Zoom Rooms: 7.1.5
• Meeting SDK: 7.1.5
• Workplace VDI Client: 7.0.11 or 6.6.16
• VDI Plugin: 7.0.11 or 6.6.15

What Organizations Should Do

Zoom has not reported any confirmed exploitation of these vulnerabilities in the wild, and there is currently no publicly available proof-of-concept exploit.

However, the zero-click nature of CVE-2026-53413 makes the issue particularly important. Successful exploitation does not require the victim to open a file, click a link, or approve a prompt.

Organizations should prioritize updating Zoom across managed devices as soon as possible. IT and security teams should also consider deploying the updated packages centrally rather than depending entirely on users to update their applications themselves.

Keeping centralized installations updated can help prevent vulnerable versions from being reintroduced during future software deployments.

The post Zoom Zero-Click Flaws Put Devices at Risk appeared first on First Hackers News.

Because the vulnerable code has been part of WordPress since version 4.7, millions of websites using one of the world’s most popular content management systems were potentially exposed before security updates were released.

How the Vulnerability Works

The attack begins on WordPress’s standard login page (wp-login.php).

When someone attempts to log in with an invalid username, WordPress displays an error message. Researchers discovered that specially crafted input can bypass the platform’s HTML filtering due to differences in how PHP and WordPress process certain characters.

This allows malicious HTML elements to appear within the login page even though no authentication is required.

Although these injected elements do not contain JavaScript themselves, they can interact with existing WordPress scripts already loaded in the browser.

From XSS to Code Execution

The injected content takes advantage of WordPress’s built-in JavaScript files, which automatically process specific page elements.

By manipulating these interactions, attackers can trigger unauthorized browser requests and eventually execute JavaScript within the WordPress website.

On its own, this reflected Cross-Site Scripting (XSS) vulnerability is already a serious security concern. However, researchers demonstrated that the attack can become far more dangerous when combined with social engineering.

If a logged-in administrator visits a specially crafted website and interacts with it, an attacker may abuse the administrator’s active session to perform privileged WordPress actions without their knowledge.

Potential Impact

Successful exploitation could allow attackers to:

• Execute malicious JavaScript.
• Create new WordPress application passwords.
• Publish unauthorized content.
• Upload malicious plugins.
• Deploy PHP web shells.
• Achieve remote code execution on the server.

Since these actions are performed using legitimate administrator privileges, detecting the attack can be more challenging.

Who Is Affected?

The vulnerability affects WordPress Core versions dating back to 4.7, making it one of the broadest WordPress security issues disclosed in recent years.

Given WordPress powers a significant portion of websites worldwide, organizations running outdated installations should review their environments immediately.

Security Update Available

The WordPress security team addressed the issue in WordPress 7.0.3 and also released security updates for older supported branches.

The vulnerability was assigned a CVSS score of 8.9 (High) due to its potential impact. While the full attack chain requires administrator interaction, the possibility of remote code execution makes prompt patching essential.

At the time of disclosure, researchers reported no confirmed evidence of active exploitation in real-world attacks.

How to Protect Your WordPress Site

Website owners and administrators should take the following steps:

• Update WordPress to the latest supported version.
• Apply all available security patches.
• Restrict administrator access to trusted users.
• Review installed plugins and themes regularly.
• Enable multi-factor authentication (MFA) for administrator accounts.
• Monitor login activity and unexpected administrative actions.
• Use a Web Application Firewall (WAF) to help block suspicious requests.

Conclusion

The XSS2Shell vulnerability demonstrates how a seemingly minor login page weakness can evolve into a much more serious attack when combined with browser behavior and administrator interaction.

Although exploitation requires specific conditions, the potential for remote code execution makes this vulnerability a high priority for WordPress administrators. Keeping WordPress updated and following security best practices remain the most effective ways to reduce the risk of compromise.

The post Critical WordPress Flaw Enables Remote Code Execution appeared first on First Hackers News.

According to security researchers, the vulnerability is caused by unsafe deserialization of user-controlled data, allowing specially crafted input to be executed on the server.

How the Vulnerability Works

The issue exists in the way Splunk Secure Gateway processes alert data stored in its KV Store. A low-privileged authenticated user can submit a specially crafted JSON payload through the Splunk REST API.

Due to weaknesses in the application’s validation process, the malicious data is accepted as legitimate and passed to the deserialization component. This enables attackers to execute arbitrary Python code with the privileges of the Splunk service account.

Researchers found that the validation logic fails to inspect all fields within the submitted JSON document. As a result, attackers can bypass security checks by embedding malicious content inside otherwise valid data structures.

A successful attack requires only a valid low-privileged Splunk account and does not rely on user interaction, making the vulnerability particularly dangerous in shared enterprise environments.

Below is a simplified proof-of-concept (PoC) demonstrating how the vulnerability can be exploited using a benign command:

import jsonpickle

import subprocess

payload = {     

“py/object”: “spacebridgeapp.data.alert_data.Alert”,

    “notification”:         

“py/reduce”:

[             

{“py/function”: “subprocess.check_output”},             

{“py/tuple”: [[“uname”, “-a”]]}         

]     

}

}

encoded = jsonpickle.encode(payload)

decoded = jsonpickle.decode(encoded, safe=True)

print(decoded)

subprocess.check_output(["uname", "-a"]) command during data deserialization. This confirms that enabling the safe=True option in jsonpickle does not fully prevent exploitation.

The flaw affects Splunk Secure Gateway versions 3.8.x, 3.9.x, and 3.10.x, along with Splunk Enterprise versions released before 10.0.7, 10.2.4, and 10.4.0. Splunk has fixed the issue in Secure Gateway versions 3.8.67, 3.9.20, and 3.10.6.

Security Recommendations

To reduce the risk of exploitation, organizations should:

• Apply the latest Splunk Secure Gateway security patches immediately.
• Upgrade to the fixed versions: SSG 3.8.67, 3.9.20, or 3.10.6, and supported Splunk Enterprise releases.
• Disable the Secure Gateway app if it is not actively being used.
• Restrict KV Store write permissions to trusted administrators only.
• Enforce the principle of least privilege by limiting access to authorized users.
• Avoid deserializing untrusted data with jsonpickle or similar libraries without proper validation.
• Implement input validation and class allow-listing to prevent unsafe deserialization.
• Monitor Splunk logs for unusual activity or unauthorized changes to the KV Store.

Following these best practices can help organizations reduce the risk of remote code execution and strengthen the overall security of their Splunk environment.

The post Splunk Secure Gateway RCE Vulnerability Discovered appeared first on First Hackers News.

The campaign highlights a growing trend where threat actors abuse trusted administrative tools to blend into normal network activity, making detection significantly more difficult. Once access is established, attackers focus on identifying sensitive documents, privileged communications, intellectual property, and client-related information that can later be leaked or used for extortion.

Threat Actor Profile

Who is UNC3753?

UNC3753 is known for targeting organizations that handle valuable confidential information. Researchers observed the group using legitimate remote administration software instead of custom malware, reducing the likelihood of triggering traditional security controls.

Primary Targets

• Law firms
• Legal service providers
• Corporate legal departments
• Financial organizations
• Professional service firms

Primary Objectives

• Data theft
• Extortion
• Information brokerage
• Intelligence gathering

Initial Access Through Social Engineering

Unlike many ransomware groups that rely on vulnerability exploitation, UNC3753 often gains access through direct interaction with victims.

• Fake IT support requests
• Help desk impersonation
• Remote assistance invitations
• Phishing emails

Victims are convinced to join remote sessions or install legitimate RMM software under the assumption they are receiving technical support.

RMM Tools as an Attack Vector

After gaining initial trust, attackers deploy legitimate RMM software to maintain access.

• Persistent remote access
• File transfer capabilities
• Command execution
• Session monitoring

By leveraging legitimate software, attackers can avoid many traditional malware-based detections.

Data leak portal used by threat actors to advertise stolen information and pressure victims into complying with extortion demands.

Living-Off-The-Land Techniques

UNC3753 relies heavily on legitimate tools already trusted within enterprise environments.

• Remote access software
• File synchronization tools
• Screen-sharing applications
• Cloud storage platforms

Indicators of Compromise (IOCs)

The researchers identified multiple infrastructure indicators associated with UNC3753 operations, including attacker-controlled IP addresses, phishing support domains, and data leak platforms used for victim extortion and disclosure.

Security Recommendations

• Strengthen User Awareness
• Restrict RMM Usage
• Implement MFA
• Monitor Sensitive Data Repositories

The UNC3753 campaign demonstrates how threat actors can successfully compromise organizations without relying heavily on malware. By abusing screen-sharing sessions, legitimate RMM software, and social engineering techniques, attackers gain access to highly sensitive legal information while remaining difficult to detect. Organizations should focus on monitoring remote access activity, restricting unauthorized administrative tools, and strengthening employee awareness to reduce the risk of similar attacks.

The post UNC3753 Exploits Screen-Sharing Sessions and RMM Tools to Steal Sensitive Legal Data appeared first on First Hackers News.

The campaign primarily focused on compromising REDCap (Research Electronic Data Capture) servers, a widely used platform for managing clinical research databases and surveys. After gaining access, the attackers deployed custom malware called INFINITERED, harvested credentials, established persistence, and later abused enterprise email compliance rules to exfiltrate sensitive communications.

Campaign Overview

The operation demonstrates a sophisticated attack chain combining exploitation of public-facing applications, credential theft, malware deployment, persistence mechanisms, and stealthy data exfiltration.

Key Objectives

• Medical research intelligence
• Artificial Intelligence research
• Defense-related information
• Military health research Public health policy data

Researchers observed the activity from September 2023 through November 2025, indicating a highly patient and well-resourced espionage operation.

High-level attack flow used by UNC6508 to compromise research institutions and steal sensitive information.

Initial Access Through REDCap Servers

Why REDCap Was Targeted

REDCap is extensively used across:

• Hospitals
• Clinical research organizations
• Universities
• Government research programs
• Military health institutions

Because REDCap stores large volumes of research and patient-related information, it provides an attractive entry point for espionage-focused threat actors.

Researchers observed the attackers probing and exploiting vulnerable or legacy REDCap deployments exposed to the internet. Once access was obtained, they began internal reconnaissance and credential discovery activities.

Web Shell Deployment and Persistence

Following successful compromise, UNC6508 deployed a web shell identified as:

help.php

The web shell served multiple purposes:

• Persistent access
• File uploads
• Command execution
• Further malware deployment

This allowed the attackers to maintain long-term access even if passwords were changed or some security controls were implemented.

INFINITERED Malware Analysis

Three months after the initial intrusion, researchers observed deployment of a custom malware family called INFINITERED. This malware was specifically engineered to operate inside REDCap environments.

Modular architecture of INFINITERED malware used by UNC6508 to maintain persistence, harvest credentials, and execute commands within compromised REDCap environments.

Component 1 – Upgrade Interceptor

The malware monitors REDCap upgrade activities.

When administrators update REDCap, the malware automatically injects itself into newer versions, ensuring persistence across software upgrades

Component 2 – Credential Harvester

This module captures usernames and passwords entered into REDCap login pages.

Stolen credentials are stored within REDCap database tables and later retrieved by attackers.

Component 3 – Command-and-Control Backdoor

The third module acts as a fully functional backdoor.

Researchers found it could:

• Execute shell commands
• Upload files
• Download files
• Run SQL queries

Communication was hidden within HTTP cookie values, helping evade traditional detection mechanisms.

Abuse of Google Workspace for Data Exfiltration

One of the most interesting aspects of the campaign was the attackers’ use of legitimate Google Workspace functionality.

After obtaining administrative access, UNC6508 created a content compliance rule named:

Patroit

The rule automatically monitored emails containing specific keywords and forwarded matching messages to attacker-controlled Gmail accounts.

Attack Chain Breakdown

• External Reconnaissance
• Initial Compromise
• Persistence
• Privilege Escalation
• Intelligence Gathering

Potential Impact on Organizations

Organizations affected by this campaign could experience:

Research Theft

Loss of valuable intellectual property and scientific research.

Strategic Intelligence Exposure

Disclosure of defense and geopolitical information.

Credential Compromise

Unauthorized access to enterprise systems.

Regulatory Risks

Exposure of regulated healthcare and research data.

Alternative Indicators of Compromise (IOCs)

Security Recommendations

Upgrade REDCap Immediately

Remove legacy versions and apply the latest security updates.

Conduct Threat Hunting

Search for:

• help.php
• INFINITERED artifacts
• Unauthorized admin activity
• Credential harvesting indicators

The UNC6508 campaign highlights how modern nation-state threat actors are increasingly targeting research ecosystems to obtain strategic intelligence. By exploiting REDCap servers, deploying INFINITERED malware, and abusing legitimate cloud email features, the attackers maintained access for more than a year while collecting sensitive medical, defense, and technology research data. Organizations operating research platforms should prioritize patching, continuous monitoring, and proactive threat hunting to defend against similar espionage campaigns.

The post PRC-Linked Threat Actors Target REDCap Servers to Spy on U.S. Medical Research Organizations appeared first on First Hackers News.

Security researchers observed exploitation attempts within days of the vulnerability becoming public, highlighting how quickly attackers move to abuse flaws in widely used infrastructure software.

How the NGINX Vulnerability Works

The issue is caused by a heap buffer overflow in the NGINX worker process. Attackers can trigger the flaw by sending specially crafted HTTP requests to vulnerable servers.

Because the vulnerability does not require authentication, exposed systems are at higher risk. In many cases, attackers can crash the NGINX worker process, leading to service disruption. Under specific conditions, the flaw could also be leveraged for remote code execution.

Researchers noted that full remote code execution is more likely on systems where protections such as Address Space Layout Randomization (ASLR) are disabled.

The vulnerability mainly affects servers using specific rewrite configurations, meaning not every NGINX deployment is directly exploitable. However, identifying vulnerable systems at internet scale remains difficult.

Large Exposure and Security Recommendations

Security researchers estimate that millions of internet-facing NGINX servers could potentially be affected. Even if only a fraction of those systems meet the exact exploitation conditions, the overall attack surface remains significant.

Attackers are already scanning for vulnerable or misconfigured servers, increasing the urgency for organizations to respond quickly.

To reduce risk, security teams should:

• Apply the latest NGINX patches and updates
• Review rewrite configurations carefully
• Enable protections such as ASLR
• Monitor for suspicious or unusual HTTP requests

The incident highlights how vulnerabilities in widely deployed technologies can quickly become major security threats, even when exploitation depends on specific configurations.

With active exploitation already underway, rapid patching and continuous monitoring are critical to preventing compromise.

The post NGINX Vulnerability Enables Remote Code Execution appeared first on First Hackers News.

Researchers from Carnegie Mellon University identified this flaw as CVE-2025-12120, affecting Lite XL versions 2.1.8 and earlier. The issue lies in how the editor handles project configuration files.

How the Vulnerability Works

When a user opens a project folder, Lite XL automatically runs the .lite_project.lua file inside that directory — without asking for any confirmation.

This file is designed to store project-specific settings, but it can also contain executable Lua code. Because there’s no verification step before execution, an attacker can embed malicious Lua code inside this file.

If a user opens a malicious project directory, the code executes instantly with the same privileges as the Lite XL application.

Impact and Risk

Attackers can share infected project folders through GitHub, file-sharing services, or other developer platforms. Once opened in Lite XL, the malicious file runs silently, allowing attackers to:

• Steal sensitive data
• Modify or delete files
• Install malware
• Further compromise the system

This makes the vulnerability especially dangerous, as many developers trust files from familiar sources or repositories without closely checking them.

The level of impact depends on the user’s permissions — if Lite XL runs with elevated privileges, the attacker gains the same access.

Affected Versions

How to Stay Safe

• Update Lite XL to the latest version as soon as a patch becomes available.
• Avoid opening untrusted project directories in Lite XL.
• Check the .lite_project.lua file for suspicious code before using projects from unknown or public sources.
• Developers recommend that Lite XL should include a confirmation prompt before running project files or disable automatic execution completely.

This vulnerability highlights the importance of understanding how configuration files work — especially when they can execute code.

The post Lite XL Text Editor Vulnerability Allows Remote Code Execution appeared first on First Hackers News.

The issue was reported by security researcher Matei “Mal” Badanoiu from Deloitte, and F5 has now released patches to fix the problem.

The vulnerability stems from improper input handling in an internal iControl REST endpoint and the TMOS Shell (tmsh), which lets attackers execute bash commands if they have admin access.

Exploiting this flaw lets attackers create or delete files and run system commands through the BIG-IP management port or self IPs. While this affects the control plane, F5 confirmed there’s no impact on the data plane.

Who’s Affected and How Severe Is It?

This flaw affects BIG-IP systems in Appliance mode, including those licensed for it or running on vCMP guest instances. It carries a high severity score—8.7 under CVSS v3.1.

F5 tracked the issue under internal IDs 1778741, 1702565, and 15832011.

Other F5 products are not affected, including:

• BIG-IP Next
• BIG-IQ Centralized Management
• F5 Distributed Cloud
• F5OS
• NGINX

Recommended Mitigation Steps

F5 has released updates to fix the vulnerability in BIG-IP:

• 17.x branch: update to 17.1.2.2
• 16.x branch: update to 16.1.6
• 15.x branch: update to 15.1.10.7

Admins are strongly encouraged to upgrade as soon as possible.

If you can’t update right away, F5 recommends temporary workarounds:

• Limit admin access to trusted users only, since the attack requires authentication.
• Block iControl REST access from self IPs by setting Port Lockdown to “Allow None.”
• Restrict SSH access using similar network rules.
• Use firewalls or packet filters to limit access to the management interface.

F5 provides full guidance in support articles K46122561 and K693540491.

Note: Some of these steps may affect high availability (HA) setups, so review carefully before applying changes.

The post Critical Command Injection Flaw Found in F5 BIG-IP Systems (CVE-2025-31644) appeared first on First Hackers News.

Wazuh SIEM vulnerability

It allows attackers with API access to remotely execute arbitrary Python code, potentially compromising the system. The issue arises from unsafe deserialization of Distributed API (DAPI) parameters used for communication between Wazuh components, according to CVE reports.

The table below shows key details about the CVE-2025-24016 vulnerability and the affected Wazuh products:

The vulnerability is found in the as_wazuh_object function within the framework/wazuh/core/cluster/common.py file. This function deserializes JSON data from the Distributed API. The code snippet before the patch is shown below:

def as_wazuh_object(dct: Dict):
try:
if ‘wazuh_datetime‘ in dct:
return datetime.datetime.fromisoformat(dct[‘wazuh_datetime‘])
elif ‘unhandled_exc‘ in dct:
exc_data = dct[‘unhandled_exc‘]
return eval(exc_data[‘class‘])(*exc_data[‘args‘])
return dct
except (KeyError, AttributeError):
return dct

This code uses the eval function to run arbitrary Python code from the class and args fields, making it highly exploitable.

Impact and Exploitation

An attacker can exploit this vulnerability by sending a malicious JSON payload to the Wazuh server via the API. The payload must include the unhandled_exc key, along with class and args values to specify the code to execute. For example:

When processed by the as_wazuh_object function, the payload executes the command os.system("touch /tmp/pwned"), creating a /tmp/pwned file on the Wazuh server.

{
“unhandled_exc“: {
“class“: “os.system”,
“args“: [“touch /tmp/pwned”]
}
}

Mitigation

The vulnerability was fixed in Wazuh version 4.9.1 by replacing the unsafe eval function with ast.literal_eval, which safely evaluates a string containing a Python literal to prevent arbitrary code execution. Here’s the updated code snippet:

def as_wazuh_object(dct: Dict):
try:
if ‘wazuh_datetime‘ in dct:
return datetime.datetime.fromisoformat(dct[‘wazuh_datetime‘])
elif ‘unhandled_exc‘ in dct:
exc_data = dct[‘unhandled_exc‘]
exc_dict = {exc_data[‘class‘]: exc_data[‘args‘]}
return ast.literal_eval(json.dumps(exc_dict))
return dct
except (KeyError, AttributeError):
return dct

To reduce the risk of CVE-2025-24016, organizations should take the following actions:

• Upgrade to Wazuh version 4.9.1 or later.
• Restrict API access to authorized users and systems.
• Implement strong authentication, such as multi-factor authentication.
• Monitor API traffic for unusual activity.
• Regularly review and update security settings.
• Use network segmentation to limit attack impact.
• A Web Application Firewall (WAF) can help detect and block malicious requests before they reach the Wazuh server.

Exploiting CVE-2025-24016 can lead to severe consequences, including:

• Full control of the Wazuh server, allowing attackers to access sensitive data and change configurations.
• Compromise of the entire Wazuh cluster by taking over the master server.
• Disruption of security monitoring, enabling further undetected attacks.
• Theft of sensitive data, including logs and alerts.
• Using the Wazuh server as a launch point for other network attacks.

Timely patching and strong security measures are essential to prevent such attacks.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!

The post Wazuh SIEM vulnerability enables remote code execution appeared first on First Hackers News.

Known as CVE-2025-0912, this bug lets attackers take over sites without logging in by exploiting a deserialization issue in versions 3.19.4 and earlier.

All about the plugin vulnerability

The flaw comes from improper handling of the card_address field in donation forms.

Hackers can inject harmful PHP objects, using a technique called POP (Property-Oriented Programming) to run their own code and take full control of affected sites.

With a critical CVSS score of 9.8, this bug allows attackers to steal donor data, install backdoors, or hijack payments without needing to log in.

Researcher dream hard found the issue while reviewing the plugin’s code, warning that it’s easy to exploit and could lead to defaced sites, stolen funds, or full admin access within minutes.

GiveWP, used by nonprofits, religious groups, and political campaigns, handles millions in donations each year. A compromised site could face:

• Payment fraud through altered gateways
• Donor data leaks (names, emails, billing info)
• SEO poisoning with malicious redirects
• Full site takeover for phishing attacks

Wordfence detected active scans for vulnerable sites starting March 4, with at least three different attack methods seen. The plugin’s wide use by critical organizations makes timely patching essential.

Mitigation and Response

GiveWP released version 3.20.0 on March 4, fixing the flaw. Site admins should:

• Update to version 3.20.0
• Check logs for suspicious POST requests to /wp-json/give/v1/donations
• Revoke and regenerate payment API keys

Wordfence warns older versions should assume compromise and recommends full malware scans and donor account monitoring.

Critics noted the patch came 48 hours after public disclosure, raising concerns about plugin security.

As of March 5, over 7,000 sites are still unpatched, while proof-of-concept exploits are already circulating. Immediate action is crucial to avoid major damage.

The post 10,000+ WordPress sites exposed by donation plugin vulnerability appeared first on First Hackers News.