A critical Server-Side Request Forgery (SSRF) vulnerability has been discovered in the popular PhpSpreadsheet library, allowing attackers to inject malicious HTML input when processing spreadsheet documents. The vulnerability, assigned CVE-2025-54370, affects multiple versions of the phpoffice/phpspreadsheet package and carries a high severity rating with CVSS v3.1 score of 7.5 and CVSS v4.0 score of 8.7. Vulnerability Details The security flaw was discovered by Aleksey […]
Before a patch could be rolled out to all users, proof-of-concept (PoC) exploit code had been published, and active exploitation had been observed in targeted campaigns.
Key Takeaways 1. CVE-2025-5419 lets attackers exploit V8 OOB read/write for remote code execution. 2. Public PoC shows array backing‐store corruption and function‐pointer hijack; real‐world attacks reported. 3. Update Chrome, block exploit domains, or disable JIT on untrusted sites.
Security teams and administrators are urged to upgrade to Chrome 137.0.7151.68 or later immediately to mitigate ongoing attacks.
Out-of-Bounds (OOB) Flaw
CVE-2025-5419 is an out-of-bounds (OOB) read and write flaw in V8’s array handling routines.
An attacker can craft a malicious HTML page embedding specially structured JavaScript arrays that trigger heap corruption when parsed by the engine.
This corruption allows arbitrary read and write primitives within the renderer process, paving the way for remote code execution under the context of the logged-in user.
Exploit chains typically begin with the OOB primitive to leak addresses of critical V8 objects, then escalate to an arbitrary write to overwrite function pointers.
Once exploited, the attacker can drop a second-stage payload or deliver ransomware, keyloggers, or other malware.
Risk Factors
Details
Affected Products
Google Chrome prior to 137.0.7151.68
Impact
Arbitrary code execution
Exploit Prerequisites
Victim must visit a malicious webpage
CVSS 3.1 Score
9.8 (Critical)
PoC Exploit
A PoC script has been published by security researcher mistymntncop on GitHub. The key snippet demonstrating the OOB write appears as follows:
This code corrupts the backing store of arr, enabling controlled overwrites of adjacent memory. The PoC then leverages these primitives to hijack the V8 function dispatch table, achieving arbitrary code execution in the renderer.
Active exploitation in the wild has been reported, with targeted spear-phishing campaigns luring victims to compromised sites. Organizations should:
Ensure all endpoints run version 137.0.7151.68 or newer.
Block known exploit domains and monitor unusual V8 process behavior.
Look for JavaScript exceptions or suspicious heap layout anomalies.
Google’s official patch addresses the root cause by correcting the bounds check logic in V8’s array implementation.
With the rapid publication of PoC code and confirmed in-the-wild attacks, defenders must act swiftly to eliminate this high-severity threat.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
A critical security risk has emerged for Windows users of WhatsApp Desktop who also have Python installed. Attackers can exploit a flaw in how WhatsApp Desktop handles .pyz (Python archive) files, delivering arbitrary code execution on the victim’s machine with a single click. Researchers have discovered that a maliciously crafted .pyz file—normally used to bundle Python applications—can be disguised […]
Cyber threats and attacks like ransomware continue to increase in volume and complexity with the endpoint typically being the most sought after and valued target. With the rapid expansion and adoption of AI, it is more critical than ever to ensure the endpoint is adequately secured by a platform capable of not just keeping pace, but staying ahead of an ever-evolving threat landscape.
A new large-scale campaign has been observed exploiting over 100 compromised WordPress sites to direct site visitors to fake CAPTCHA verification pages that employ the ClickFix social engineering tactic to deliver information stealers, ransomware, and cryptocurrency miners.
The large-scale cybercrime campaign, first detected in August 2025, has been codenamed ShadowCaptcha by the Israel National
The cybersecurity landscape has been significantly impacted by the discovery and active exploitation of two critical zero-day vulnerabilities in WinRAR, one of the world’s most widely used file compression utilities.
CVE-2025-6218 and CVE-2025-8088 represent sophisticated attack vectors that have enabled threat actors to achieve remote code execution and establish persistent access to compromised systems through maliciously crafted archive files.
These vulnerabilities, with CVSS scores of 8.8 and 7.8, respectively, demonstrate the critical importance of maintaining updated compression software and implementing robust security measures around file handling processes.
The exploitation of these vulnerabilities has been observed across multiple threat campaigns, affecting both individual users and enterprise environments, highlighting the urgent need for comprehensive vulnerability management and user awareness programs.
WinRAR 0-Day Vulnerabilities
WinRAR, developed by win.rar GmbH, has maintained its position as a dominant force in the file compression software market for over two decades, with an estimated user base exceeding 500 million installations worldwide.
The software’s ubiquity across personal and corporate environments has made it an attractive target for cybercriminals seeking to exploit fundamental weaknesses in archive processing mechanisms.
The emergence of CVE-2025-6218 and CVE-2025-8088 represents a significant escalation in the sophistication of attacks targeting compression software, moving beyond traditional social engineering tactics to leverage deep technical vulnerabilities in the application’s core functionality.
The architectural design of WinRAR’s extraction engine, which processes complex archive structures and metadata, has historically presented numerous attack surfaces for malicious actors.
These vulnerabilities specifically target the filename parsing routines and path traversal protection mechanisms that are fundamental to secure archive extraction.
The discovery of these vulnerabilities coincided with increased threat actor interest in supply chain attacks and living-off-the-land techniques, making WinRAR an ideal vector for initial access and lateral movement within target networks.
Modern threat landscapes have demonstrated that compression software vulnerabilities can serve as powerful enablers for multi-stageattack campaigns, allowing adversaries to bypass traditional security controls while maintaining a low detection profile.
The integration of these exploits into advanced persistent threat (APT) toolkits and commodity malware families has amplified their impact, creating cascading security incidents across multiple industry sectors.
The technical complexity of these vulnerabilities also presents significant challenges for detection and mitigation, requiring organizations to implement comprehensive monitoring and response capabilities.
WinRAR Exploit Flow.
Technical Breakdown of the Vulnerabilities
CVE-2025-6218 represents a critical path traversal vulnerability within WinRAR’s archive extraction functionality, characterized by insufficient validation of file paths during the decompression process.
This vulnerability enables attackers to craft malicious RAR archives containing specially formatted filenames that canescape the intended extraction directory and write arbitrary files to sensitive system locations.
The vulnerability operates by exploiting weaknesses in the path normalization routines, allowing the use of directory traversal sequences (../) that bypass existing security controls and enable unauthorized file system access.
The technical implementation of CVE-2025-6218 centers around the manipulation of archive headers and filename entries that are processed during extraction.
Attackers leverage Unicode encoding techniques and null byte injectionto create filenames that appear legitimate to initial validation routines but are interpreted differently during the actual file creation process.
This discrepancy allows malicious files to be written to critical system directories such as the Windows startup folder, system32 directory, or user profile locations, enabling immediate or persistent code execution upon system restart or user login.
CVE-2025-8088 presents a complementary attack vector through a buffer overflow vulnerability in WinRAR’s filename parsing engine. This vulnerability occurs when the application processes archive entries with exceptionally long filenames or malformed Unicode sequences, causing memory corruption that can be leveraged to achieve arbitrary code execution.
The vulnerability manifests during the initial parsing phase of archive processing, before any user interaction or security warnings are displayed, making it particularly dangerous for automated extraction scenarios or when email security gateways process archives.
The exploitation mechanism for CVE-2025-8088 involves careful manipulation of heap memory structures and return-orientedprogramming (ROP) techniques to bypass modern memory protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP).
Successful exploitation results in the attacker gaining the same privilege level as the WinRAR process, typically enabling full user-level access to the compromised system. When combined with CVE-2025-6218, these vulnerabilities create a powerful attack chain that provides both immediate code execution and persistent system access.
WinRAR CVE-2025-8088 via RAR file delivering a malicious LNK file.(Source: ESET)
The initial discovery of these vulnerabilities emerged from security research conducted by multiple independent security firms during routine analysis of file format handling in popular compression software.
The research methodology involved comprehensive fuzzing operations against WinRAR’s parsing engines, utilizing both mutation-based and generation-based fuzzing techniques to identify edge cases in filename processing and archive structure validation.
Initial indicators of the vulnerabilities surfaced when researchers observed abnormal memory consumption patterns and unexpected file system operations during controlled extraction tests.
The first confirmed exploitation attempts were detected in early 2025 through advanced threat detection platforms monitoring for unusual file system activities associated with archive extraction processes.
Threat intelligence analysts identified a correlation between suspiciousRAR file attachments in targeted phishing campaigns and subsequent indicators of compromise on victim systems.
These initial detections revealed a sophisticated attack infrastructure utilizing dynamic DNS services and compromised legitimate websites to host malicious archive files disguised as software updates, document collections, and media files.
Detailed forensic analysis of captured exploit samples revealed the technical sophistication employed by threat actors in weaponizing these vulnerabilities.
The malicious archives demonstrated advanced anti-analysis techniques, including the use of password protection, nestedarchive structures, and decoy files designed to evade automated security scanning systems.
Researchers discovered that successful exploitation campaigns employed social engineering themes related to current events, software updates, and business communications to increase the likelihood of user interaction with malicious archives.
The attack infrastructure supporting these exploitation campaigns exhibited characteristics consistent with organized cybercriminal operations, featuring redundant command and control networks, cryptocurrency-based payment systems, and sophisticated victim targeting mechanisms.
Analysis of network telemetry data revealed that successful compromises were followed by rapid lateral movement activities, credential harvesting operations, and deployment of secondary malware payloads designed to establish long-term persistence and facilitate data exfiltration.
Detection and Indicators of Compromise (IoCs)
Comprehensive detection of CVE-2025-6218 and CVE-2025-8088 exploitation requires implementation of multi-layered monitoring strategies that encompass file system operations, network communications, and process execution patterns.
Security teams should focus on detecting anomalous file creation activities outside standard application directories, particularly focusing on writes to system folders, startup locations, and user profile directories that occur during or immediately after archive extraction processes.
File integrity monitoring systems should be configured to alert on unexpected modifications to critical system files, especially DLL files in application directories that may indicate hijacking attempts.
Network-based detection mechanisms should monitor for unusual DNS queries and HTTP/HTTPS connections initiated shortly after archive file processing, particularly focusing on connections to recently registered domains, dynamic DNS services, and IP addresses with poor reputation scores.
Behavioral analysis engines should correlate archive extraction events with subsequent network activity to identify potential command and control communications.
Security information and event management (SIEM) systems should implement rules to detect the temporal correlation between WinRAR process execution and suspicious network connections or file system modifications.
Endpoint detection and response (EDR) solutions should be configured to monitor for specific process execution patterns associated with these exploits, including the creation of child processes from WinRAR, unusual DLL loading activities, and registry modifications related to persistence mechanisms.
Critical indicators include the execution of processes from temporary directories, PowerShell or CMD executions initiated by compression software, and the creation of scheduled tasks or startup entries during archive processing operations.
Organizations should implement proactive threat hunting activities focused on identifying historical indicators of compromise that may have evaded initial detection systems.
The comprehensive threat landscape surrounding CVE-2025-6218 and CVE-2025-8088 demonstrates the evolving sophistication of attacks targeting fundamental software components. It highlights the critical importance of maintaining current security practices around file handling and compression software management.
Organizations must implement robust detection capabilities, maintain updated software versions, and educate users about the risks associated with processing untrusted archive files to mitigate these emerging threats effectively.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
Major French retail chain Auchan announced on August 21, 2025, that it suffered a significant cybersecurity incident resulting in the unauthorized access and theft of personal data from “several hundred thousand” customer loyalty accounts.
The breach represents another critical example of retail sector vulnerabilities to Advanced Persistent Threats (APTs) targeting customer databases containing Personally Identifiable Information (PII).
Le Monde reports that the cyberattack compromised multiple data fields within Auchan’s customer relationship management system, including first and last names, email addresses, postal addresses, telephone numbers, and loyalty card numbers.
Security analysts note that this data profile suggests attackers gained access to the retailer’s Customer Loyalty Management (CLM) database, likely through SQL injection vulnerabilities or privileged account compromise.
Notably, Auchan confirmed that financial data, authentication credentials (passwords), loyalty card PIN codes, and customer reward balances remained secure, indicating the breach was contained to specific database tables rather than achieving full system compromise.
This suggests the implementation of a defense-in-depth architecture with data segmentation protocols that prevent lateral movement to more sensitive systems.
The attack methodology appears consistent with data harvesting operations commonly executed by cybercriminal groups targeting retail Point-of-Sale (POS) networks and customer databases for subsequent credential stuffing attacks or Business Email Compromise (BEC) campaigns.
Auchan’s Response
Auchan immediately initiated incident response protocols, notifying affected customers and filing mandatory breach reports with France’s Commission Nationale de l’Informatique et des Libertés (CNIL).
The company warned customers about increased phishing risks, specifically smishing (SMS phishing) and email-based social engineering attacks exploiting the stolen contact information.
This incident marks Auchan’s second major cybersecurity breach within nine months, following a similar attack in November 2024.
The repeated targeting suggests threat actors may have maintained persistent access or identified systemic vulnerabilities within the retailer’s infrastructure.
Security researchers recommend implementing Zero Trust Architecture (ZTA), Multi-Factor Authentication (MFA), and enhanced Security Information and Event Management (SIEM) monitoring to prevent future intrusions.
The attack aligns with France’s challenging cybersecurity landscape in 2025, which has witnessed major breaches, including the Bouygues Telecom incident affecting over six million customers with compromised banking details.
These incidents underscore the critical need for enhanced threat intelligence sharing and proactive vulnerability management across France’s retail and telecommunications sectors.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
Google Threat Intelligence Group (GTIG) has uncovered a multifaceted cyber espionage operation attributed to the PRC-nexus threat actor UNC6384, believed to be associated with TEMP.Hex (also known as Mustang Panda). This campaign, aligned with China’s strategic interests, primarily targeted diplomats in Southeast Asia alongside global entities, employing advanced tactics such as adversary-in-the-middle (AitM) attacks, captive […]
A comprehensive analysis of the top 10 social media platforms reveals that X (formerly Twitter) stands out as the most invasive collector of user location information, gathering both precise and coarse location data across all categories listed in Apple’s App Store privacy framework.
This extensive data harvesting raises significant privacy concerns as location tracking can expose intimate details about users’ personal and professional lives.
Key Takeaways 1. X collects both precise and coarse location data for every use case. 2. Location tracking can uncover sensitive personal details. 3. Only Reddit avoids identity linkage; mitigate via disabling services, VPNs, and permission audits.
Location Data Harvesting
Unlike its competitors, X collects location data for every possible purpose outlined in App Store privacy policies.
The platform gathers both precise location data coordinates with three or more decimal places in latitude and longitude, and coarse location data with lower resolution accuracy.
This comprehensive approach includes third-party advertising, internal marketing, analytics, product personalization, app functionality, user tracking, and unspecified “other purposes.”
A visual breakdown highlighting how various social media platforms, including X, collect users’ precise location data for multiple purposes. (Source: Surfshark)
The study reveals that 60% of analyzed social media platforms collect precise location data for third-party advertising, including X, Instagram, Threads, Facebook, Pinterest, and Snapchat.
However, X’s approach extends beyond advertising into tracking territory, where it may combine location information with data from other applications or websites. This practice potentially enables data sharing with data brokers who can subsequently sell user information to third-party businesses.
Surfshark reports that the location tracking methodologies employed by these platforms utilize various geolocation vectors including Global Positioning System (GPS) coordinates, Bluetooth Low Energy (BLE) beacons, Wi-Fi access point triangulation, cellular tower positioning, and Internet Protocol (IP) address geolocation.
Even when users disable precise location sharing through system settings, platforms can still derive approximate locations through these alternative data sources.
The privacy implications of aggressive location tracking extend far beyond simple geographical awareness.
Continuous location monitoring at 30-minute intervals can construct detailed behavioral profiles revealing employment locations, salary brackets inferred from workplace addresses, medical conditions through healthcare facility visits, and potentially compromising personal relationships through overnight location correlations.
Among the analyzed platforms, only Reddit implements user-centric privacy protections by declaring that location data will not be linked to user identity.
TikTok and Reddit demonstrate more conservative approaches by exclusively collecting coarse location data rather than precise coordinates.
In contrast, X’s comprehensive data collection strategy encompasses both precision levels across all functional categories.
The study methodology examined App Store privacy labels for X, Instagram, Threads, Facebook, Pinterest, Snapchat, LinkedIn, TikTok, YouTube, and Reddit as of August 11, 2025.
While 90% of platforms collect coarse location data and 60% gather precise coordinates for internal advertising purposes, X’s universal collection approach represents the most extensive location data harvesting among major social media applications.
Technical mitigation strategies for users include disabling location services at the operating system level, utilizing Virtual Private Network (VPN) services to mask IP-based geolocation, and regularly auditing app permissions through system privacy settings.
However, complete location privacy remains challenging given the multiple data vectors available to determined platforms.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
Maryland’s transit network experienced widespread disruption this week after a sophisticated cyberattack targeted critical information systems, forcing the Maryland Transit Administration (MTA) and the Department of Information Technology (DoIT) to scramble containment efforts. While most core services remain operational, significant impacts to scheduling and real-time information have left thousands of commuters seeking alternative arrangements. DoIT […]
