SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
Showing filtered results from Strapi content.
CVE Research
Silent Lynx Hits CIS Governments With WinRAR Flaw
Silent Lynx (UAT-6275 / TAG-193) is a cyber-espionage actor targeting government organizations across the Commonwealth of Independent States. From June 2025 through August 2026, the group used four infection chains, including macro-enabled documents, PS2EXE downloaders, LNK-based PowerShell loaders, and WinRAR archives that exploit CVE-2025-8088, to deploy custom reverse shells such as FoalShell, Chvost, Laplas, and PickleShell. Activity spans nine countries and focuses on diplomacy, economic development, environmental management, water resources, and energy. This article summarizes the campaign’s delivery methods, infrastructure exposure, indicators of compromise, and practical mitigations for defenders.
CVE Research
The In-Memory Route to Root: Inside The Ivanti Connect Secure Chain
UTA0576 combined an authentication bypass, a short-lived file-write primitive and a separate privilege-escalation flaw to turn unauthenticated HTTPS requests into root commands on a fully patched Ivanti Connect Secure appliance.
CVE Research
Two Zero-Days, 1,407 Microsoft Flaws Fixed: October 2026 Patch Tuesday Delivers a Massive Update
Microsoft’s October 2026 Patch Tuesday addresses 1,407 CVEs, including one actively exploited zero-day in Windows Shell (CVE-2026-96951) that bypasses Mark of the Web protections. A second publicly disclosed zero-day affects .NET Framework. Critical remote code execution issues span DHCP, Hyper-V, Exchange, Outlook, and related services. This article covers the key risks, priority fixes, and end-of-support products.
CVE Research
Critical Atlassian Flaw Exploited Within Hours of Disclosure, Affects Multiple Products
Atlassian has disclosed CVE-2026-21589, a critical unauthenticated arbitrary file access flaw affecting Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center products. Attackers need the exact file path; directory listing is not possible. Cloud is already patched. This article covers impact, fixed versions, and temporary mitigations.
CVE Research
Critical SonicWall SMA 1000 Flaw Lets Unauthenticated Attackers Reach Internal Functionality
SonicWall has disclosed CVE-2026-102255, a critical pre-authentication SSRF vulnerability in SMA 1000 Work Place that can let unauthenticated attackers reach internal functionality and perform unauthorized operations. The advisory also covers three additional SMA 1000 issues. Fixed platform-hotfixes are available; SonicWall reports no evidence of in-the-wild exploitation at publication.