SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
SonicWall Disclosure: Active Attacks Target SMA 100, CVE-2025-40602 Patched
SonicWall has released security updates to remediate an actively exploited local privilege escalation vulnerability, tracked as CVE-2025-40602, affecting Secure Mobile Access (SMA) 100 series appliances. The flaw exists in the Appliance Management Console (AMC) and has been confirmed to be exploited...
CVE Research
CVE-2025-13223: The Chrome Vulnerability You Can’t Afford to Ignore
Heads up, Chrome users! An actively exploited zero-day vulnerability, CVE-2025-13223, has been identified in Google Chrome’s V8 JavaScript and WebAssembly engine. This vulnerability could allow attackers to execute arbitrary code or cause program crashes. Google has already released security updates...
CVE Research
Under UNC6384’s LNK: CVE-2025-9491 Powers PlugX Espionage Attacks
A Windows LNK (shortcut) UI-misrepresentation vulnerability (CVE-2025-9491, ZDI-CAN-25373) is being actively exploited by a China-linked threat actor tracked as UNC6384 to deliver the PlugX Remote Access Trojan (RAT) against European diplomatic and government targets. The flaw enables malicious .LNK...
CVE Research
Critical Security Update: SolarWinds Remediates Multiple Serv-U Vulnerabilities
SolarWinds has issued an urgent security update for its Serv-U file transfer software, patching three critical remote code execution (RCE) vulnerabilities, each rated CVSS 9.1. These flaws could allow attackers with administrative access to execute arbitrary code and compromise vulnerable systems. T...
CVE Research
ShadowPad’s Silent Invasion: Crafting Persistence Through WSUS Exploitation
The ShadowPad malware campaign represents an urgent and advanced cybersecurity threat, exploiting a critical vulnerability in Microsoft’s WSUS service to gain full system access. This highly modular backdoor is being actively leveraged by state-aligned threat actors to target key sectors globally, e...
CVE Research
APT24’s BADAUDIO: A Deep Dive into China-Nexus Espionage Against Taiwan
A China-nexus threat actor has been conducting a sophisticated, multi-year espionage campaign using a custom malware downloader, compromising regional infrastructure and reaching over 1,000 global domains through strategic supply chain attacks. At the core of this operation is BADAUDIO, a highly obf...
CVE Research
7-Zip Users at Risk: Symbolic Link Vulnerability Triggers RCE Attacks
A security vulnerability in the widely used 7-Zip file archiver has recently come under active exploitation. The flaw, identified as CVE-2025-11001, poses a significant risk as it allows for remote code execution. This issue has prompted warnings from cybersecurity entities, including NHS England Di...
CVE Research
WrtHug Abuse of ASUS WRT Vulnerabilities Exposes Thousands of EoL Routers
Operation WrtHug refers to a widespread compromise of end-of-life (EoL) ASUS routers, where attackers exploit previously disclosed vulnerabilities to gain control over large numbers of unsupported devices. The activity has impacted tens of thousands of systems, with most cases identified in Taiwan, ...
CVE Research
One Key to Rule Them All: Apache Syncope Flaw Leaves Passwords Wide Open
A critical vulnerability, identified as CVE-2025-65998, has been discovered in Apache Syncope, a widely-used open-source identity management system, potentially exposing sensitive password information. This flaw highlights the risks associated with hard-coded encryption keys and the importance of pr...