SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
Joint Threat to Safari and Chrome Users – Patch CVE-2025-6558 Now
Apple has rolled out critical security updates across its platforms to address a high-severity vulnerability in the WebKit engine. This flaw, tracked as CVE-2025-6558, was exploited as a zero-day in Google Chrome and could potentially impact Safari and other Apple applications relying on WebKit. The...
CVE Research
Hackers Weaponize SharePoint 0-Day: Widespread Exploitation Ongoing
A critical zero-day vulnerability chain, called “ToolShell,” is actively exploited in Microsoft SharePoint Server on-premises environments. This sophisticated attack vector leverages vulnerabilities to achieve unauthenticated remote code execution (RCE), bypass multi-factor authentication, and enabl...
CVE Research
Microsoft Uncovers Sploitlight: How a Spotlight Plugin Flaw Evades macOS TCC Protections
Microsoft Threat Intelligence recently disclosed a serious macOS vulnerability dubbed Sploitlight. It tracked as CVE-2025-31199 that leverages Spotlight importer plugins to bypass Apple’s Transparency, Consent, and Control (TCC) framework and exfiltrate files normally off-limits, including Apple Int...
CVE Research
Hackers Beware: Dell Laptop Firmware Vulnerabilities Put Credentials at Risk
A firmware-level security nightmare is unfolding across millions of Dell laptops worldwide. The devices trusted by government agencies, cybersecurity professionals, and enterprise organizations to protect their most sensitive data are now vulnerable to a sophisticated attack vector that could render...
CVE Research
Critical: Raspberry Robin Deploys CLFS Exploit to Escalate Privileges on Windows
The Raspberry Robin malware, a sophisticated and evolving threat, actively exploits a new vulnerability in Windows systems. First identified in 2021, this malware, also known as Roshtyak, has moved beyond its initial distribution via infected USB drives. It now incorporates a critical privilege esca...
CVE Research
Resource Categorization is Not Just Labelling
Managing cloud environments can become overwhelming with 1000+ resource types and around 200+ AWS services. To control costs, mitigate risks, and reduce operational complexity, it becomes essential to organize resources into meaningful categories. Cloud Security Asset Exposure categories provide a s...
CVE Research
What is Malware? Understanding the Threat Lurking Behind the Screen
In today’s hyper-connected digital world, cyber threats have grown in complexity, scale, and destructiveness. At the heart of many of these threats lies one potent tool: malware. Short for “malicious software,” malware refers to any software intentionally designed to cause damage to a computer, serv...
CVE Research
Automating Patch and Compliance Updates Safely with Test and Deploy for Automation
Rolling out patches and configuration fixes across hundreds or thousands of systems is a constant balancing act. IT and security teams need to act quickly to remediate vulnerabilities and enforce policies, but rushing an untested update can lead to unexpected outages or compliance drift. Traditional...
CVE Research
DDoS Attack – Everything You Need to Know
Imagine your business website grinding to a halt. But it’s not the usual suspects, a technical glitch or human error, but because thousands of hijacked devices are hammering it with traffic, second after second. Not a single request is legitimate, yet your servers are overwhelmed and your customers ...