Rapid7

Replace Barracuda ESG appliances, company urges

June 9, 2023

Barracuda Networks is urging customers running phyisical Email Security Gateway (ESG) appliances to replace them immediately, “regardless of patch version level.” …

MOVEit Transfer hack fallout: BBC, Aer Lingus, Boots among the victims

June 6, 2023

The fallout of the MOVEit Transfer hack via CVE-2023-34362 by the Cl0p gang is expanding, as several UK-based companies have now confirmed that some of their data has been …

MOVEit Transfer zero-day was exploited by Cl0p gang (CVE-2023-34362)

June 5, 2023

The zero-day vulnerability attackers have exploited to compromise vulnerable Progress Software’s MOVEit Transfer installations finally has an identification number: …

MOVEit Transfer zero-day attacks: The latest info

June 2, 2023

There’s new information about the zero-day vulnerability in Progress Software’s MOVEit Transfer solution exploited by attackers and – more importantly – …

Zyxel firewalls under attack by Mirai-like botnet

June 1, 2023

CVE-2023-28771, the critical command injection vulnerability affecting many Zyxel firewalls, is being actively exploited by a Mirai-like botnet, and has been added to …

Vulnerability in Zyxel firewalls may soon be widely exploited (CVE-2023-28771)

May 22, 2023

A recently fixed command injection vulnerability (CVE-2023-28771) affecting a variety Zyxel firewalls may soon be exploited in the wild, Rapid7 researchers have warned, after …

Microsoft fixes two actively exploited bugs, one used by BlackLotus bootkit (CVE-2023-29336, CVE-2023-24932)

May 9, 2023

For May 2023 Patch Tuesday, Microsoft has delivered fixes for 38 CVE-numbered vulnerabilities, including a patch for a Windows bug (CVE-2023-29336) and a Secure Boot bypass …

Prevent and detect Adobe ColdFusion exploitation (CVE-2023-26360, CVE-2023-26359)

April 4, 2023

When Adobe released security updates for its ColdFusion application development platform last month, it noted that one of the vulnerabilities (CVE-2023-26360) had been …

Ransomware gangs are exploiting IBM Aspera Faspex RCE flaw (CVE-2022-47986)

March 30, 2023

Attackers are exploiting a critical vulnerability (CVE-2022-47986) in the IBM Aspera Faspex centralized file transfer solution to breach organizations. About CVE-2022-47986 …

Attackers are developing and deploying exploits faster than ever

March 3, 2023

While there was a reduction in the widespread exploitation of new vulnerabilities in 2022, the risk remains significant as broad and opportunistic attacks continue to pose a …

PoC for critical ManageEngine bug to be released, so get patching! (CVE-2022-47966)

January 17, 2023

If your enterprise is running ManageEngine products that were affected by CVE-2022-47966, check now whether they’ve been updated to a non-vulnerable version because …

Tracking the adversary

January 3, 2023

Raj Samani, SVP, Chief Scientist, Rapid7, discusses the tactics observed from a recent case of espionage, and what can be learned from such observations. This video was …