Aevum News' dedicated cybersecurity desk monitors, analyzes, and reports on zero-day vulnerabilities, exploit kits, and active cyber threats before they escalate into global incidents.
Unauthenticated RCE allowing full server compromise via crafted SMTP requests
Local privilege escalation via race condition in cgroup subsystem
Cross-site scripting vulnerability in block editor affecting admin users
Memory corruption during certificate verification enables remote exploit
Authentication bypass via JWT token manipulation in web management UI
Cluster metadata leakage through improperly restricted admin endpoints
Reflected cross-origin resource sharing policy allows unauthorized access
Aevum News investigators have uncovered a sophisticated multi-stage exploit chain targeting Microsoft Exchange Server deployments worldwide. Dubbed "SilentMail" by our research team, this weaponized framework exploits a previously unknown deserialization vulnerability to achieve remote code execution with SYSTEM-level privileges.
Active exploitation observed targeting financial institutions and government agencies in North America and Western Europe. Aevum News was the first to report the campaign's attribution to a known state-sponsored APT group.
Local privilege escalation vulnerability affecting all distributions running kernel 6.x. Exploit proof-of-concept code published on GitHub within hours of initial disclosure.
Critical heap-based buffer overflow during TLS 1.3 certificate verification. Affects millions of servers worldwide. Emergency advisory issued by OpenSSL security team.
Stored cross-site scripting vulnerability in the block editor allowing persistent attacks against administrators. Affects over 40% of all websites globally.
Authentication bypass in SD-WAN module enables unauthorized access to network management. Fortinet releases emergency firmware update within 6 hours.
Out-of-band patch expected within 72 hours. Mitigation: disable SMTP submission via port 587, restrict Exchange Admin Center access.
Kernel team reviewing proposed fix. Backport to 6.x series expected in next stable release. Mitigation: disable cgroup v2 namespace.
Emergency release 3.4.10 available. Update immediately if using 3.0.x through 3.4.9. Distribution patches rolling out.
Version 6.7.2 includes fix. Auto-update enabled for majority of installations. Plugin developers advised to review input sanitization.
FortiOS 7.4.5 and 7.2.13 contain fix. FortiGuard automatically pushed updates to enrolled deployments.
Apache Kafka team investigating root cause. Temporary mitigation: restrict admin API to internal networks only.
A deep forensic analysis of the SilentMail campaign's technical infrastructure, revealing a multi-stage weaponization pipeline that has evolved over at least 18 months of active development.
From cgroup escapes to page cache overflows, we examine the pattern of critical kernel vulnerabilities and what it reveals about the challenges of securing modern operating systems.
The latest OpenSSL vulnerability raises fundamental questions about concentrated risk in cryptographic libraries. We trace the blast radius across cloud providers, CDNs, and enterprise networks.
An investigation into the economics of vulnerability disclosure, zero-day markets, and the growing movement toward coordinated disclosure that could transform how we handle critical exploits.
Receive real-time zero-day alerts, expert analysis, and actionable mitigation guidance delivered before mainstream coverage.
Join 180,000+ security professionals. Unsubscribe anytime.