SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
BadCandy: Stealth Implant Converts IOS XE into a Persistent Surveillance Node
Cybercriminals and advanced persistent threat (APT) actors continue to evolve toward stealthier, persistence-focused, and profit-driven operations. Recent intelligence reports reveal a coordinated exploitation campaign combining high-severity vulnerabilities—the Cisco IOS XE privilege escalation fla...
CVE Research
Breaking the Kernel: How Hackers Can Gain Root Access on Ubuntu
A critical vulnerability has been discovered in Ubuntu’s Linux kernel, potentially allowing local attackers to escalate their privileges and gain root access on vulnerable systems. This flaw stems from a reference count imbalance within the af_unix subsystem, leading to a use-after-free (UAF) condit...
CVE Research
RDSEED Vulnerability in AMD Zen 5: A Threat to Hardware Randomness Integrity
AMD has confirmed a significant flaw in the RDSEED instruction used for hardware-level random number generation on Zen 5 CPUs. The vulnerability, cataloged as AMD-SB-7055 and assigned CVE-2025-62626, can cause the 16-bit and 32-bit RDSEED variants to return zero instead of genuine entropy, which sof...
CVE Research
Act Fast! SMB Vulnerability Lets Attackers Gain SYSTEM-Level Access
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a high-severity privilege escalation vulnerability in Windows Server Message Block (SMB) that is now being actively exploited in the wild. This vulnerability, tracked as CVE-2025-33073, could allow attackers t...
CVE Research
Critical RCE Flaw Hits Motex LANSCOPE, CISA Issues Warning
The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-61932, a critical security flaw in Motex LANSCOPE Endpoint Manager, to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. This vulnerability allows remote attackers to execute a...
CVE Research
Threat Analysis: Bitter APT Uses C# Implant “cayote.log” in Espionage Operations
A targeted phishing campaign is exploiting a security flaw, CVE-2025-8088, to attack government, military, and electric power sectors in China and Pakistan. The operation is attributed to the cyber-espionage group Bitter APT. Attackers use phishing emails containing malicious Microsoft Excel or RAR ...
CVE Research
ToolShell Unlocked: Chinese-Aligned Hackers Weaponize SharePoint Zero-Day for Global Espionage
A critical vulnerability in Microsoft-SharePoint-Server (tracked as CVE-2025-53770 and part of the “ToolShell” chain) has been actively exploited by multiple China-aligned threat actors including Linen-Typhoon, Violet-Typhoon, and Storm-2603. The flaw enables unauthenticated remote code execution an...
CVE Research
Double Zero-Day Trouble: Microsoft Races to Contain Active Windows Exploits
In the ever-evolving landscape of cybersecurity, staying ahead of emerging threats is paramount. This October, Microsoft’s Patch Tuesday addressed a staggering 183 security flaws, a clear indication of the persistent challenges faced by software vendors in safeguarding their products. Among these fi...
CVE Research
Triple Threat: Dell Storage Manager Flaws Put Systems at Risk
On October 24, 2025, Dell Technologies addressed three critical vulnerabilities in its Storage Manager software. These vulnerabilities could allow an attacker to bypass authentication, expose sensitive data, and gain unauthorized system access.