Jesus ESCOLAR

Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM

77

URGENT: CISA Calls on Organizations to Swiftly Embrace Microsegmentation On July 29, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) published “Microsegmentation in Zero Trust, Part One: Introduction and Planning” — setting a renewed standard for securing modern IT environments under the Zero Trust principle. Microsegmentation is central to Zero Trust Architecture, dramatically reducing attack surfaces, limiting lateral movement, and boosting visibility. CISA recommends a risk‑based, phased approach: from asset discovery to dependency mapping, policy design, and incremental deployment. This is not guidance for next year—it’s a mission-critical directive for today. Whether you're in public or private sector IT, the time to plan and act is now. At Stratejm, a Bell Canada company, we're proud to partner with Illumio, the original microsegmentation specialist and leading Zero Trust Segmentation platform recognized by Forrester. Together, we are bridging theory and action. How Stratejm + Illumio empower your Zero Trust journey: 1. Instant visibility: Rapid insight into application and workload communication patterns . 2. Automated policy recommendations: AI-driven guidance helps eliminate guesswork . 3. Resilient enforcement: Real‑time segmentation across data centers, hybrid cloud, containers, endpoints, IoT and OT.   4. Breach containment: Minimize blast radius during active threats with adaptive policies . Key Steps You Should Take Now: 1. Join cross-functional teams to manage asset mapping and policy design Prioritize segmentation of your critical assets. 2. Start with a low‑risk or non‑production pilot, refine policies based on actual traffic flows. 3. Deploy Illumio with Stratejm’s guidance to operationalize safe, scalable segmentation. 4. Monitor continuously and iterate to adapt as your environment evolves. Stratejm + Illumio deliver CISA‑aligned, zero‑trust‑ready microsegmentation—fast. In a threat landscape where breaches can escalate in minutes, delaying is not an option. Ready to act? Let's talk about how Stratejm and Illumio can help you implement zero trust microsegmentation that works from day one. #ZeroTrust #Microsegmentation #CISA #Cybersecurity #Stratejm #Illumio #BreachContainment #SecurityResilience

75

6 Comments

Urgent: Microsoft SharePoint Zero-Day Vulnerabilities (CVE-2025-53770 & CVE-2025-53771) Actively Exploited Since July 7, 2025, critical zero-day vulnerabilities in Microsoft SharePoint (CVE-2025-53770 and CVE-2025-53771) have been exploited, targeting government, telecom, and tech sectors. These vulnerabilities, bypassing earlier patches (CVE-2025-49704 and CVE-2025-49706) from the July update ( these vulns were found on Pwn2Own Berlin 2025) , enable unauthenticated remote code execution (RCE) via the ToolShell exploit chain, allowing attackers to steal cryptographic keys and forge access even post-patch. Vulnerability Details: CVE-2025-53770 (ToolShell RCE) A critical deserialization flaw allows unauthenticated attackers to execute arbitrary code through crafted POST requests to /_layouts/15/ToolPane.aspx with an HTTP Referer header set to /_layouts/SignOut.aspx. Attackers extract MachineKey configurations to generate valid __VIEWSTATE payloads, enabling RCE with a single HTTP request. Over 54 organizations have been impacted. Microsoft’s Response Microsoft has released an emergency out-of-band update for: - Microsoft SharePoint Subscription Edition - SharePoint Server 2019 - SharePoint Server 2016 Action Required Apply the Update: Immediately install the latest Microsoft security patches. Regenerate Machine Keys: Post-update, regenerate SharePoint machine keys to prevent further exploitation. Method 1: PowerShell Set-SPMachineKey -WebApplication <SPWebApplicationPipeBind> Update-SPMachineKey -WebApplication <SPWebApplicationPipeBind> Method 2: Central Administration Navigate to Central Administration > Monitoring > Review job definitions > Run the “Machine Key Rotation Job” > Execute iisreset.exe on all SharePoint servers. Check for Compromise: - Verify if the file C:\Program Files\Microsoft Office Servers\16.0\TEMPLATE\LAYOUTS\spinstall0.aspx exists. - Review IIS logs for POST requests to /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx with an HTTP Referer of /_layouts/SignOut.aspx. Resources Research:https://lnkd.in/epCHVPqb Proof of Concept:https://lnkd.in/eqPJDM39 Exploit Details:https://lnkd.in/eGVU_3Zc #Cybersecurity #SharePoint #ZeroDay #MicrosoftSecurity

44

1 Comment

🚨 July 21 Update on Microsoft SharePoint 0-day (CVE-2025-53770 and CVE-2025-53771) Threat Campaigns 🚨 Here are some initial observations from the past 48 hours: ☣️ Microsoft just released security updates for all supported versions of Microsoft SharePoint. Patch now. ☣️ The early 0-day exploitation was broad and opportunistic. We're aware of victims in several sectors and global geographies. The activity primarily involved the theft of machine key material which could be used to access victim environments after the patch has been applied. ☣️ We assess that at least one of the actors responsible for the early exploitation is a China-nexus threat actor.  ☣️ Multiple threat actors are actively exploiting this vulnerability now. New threat actors with diverse motivations will continue to exploit these vulnerabilities over time. ☣️ Several security researchers are actively scanning for vulnerable SharePoint servers and looking for evidence of compromise. Some security vendors are exploiting the vulnerability to determine if the SharePoint server is still vulnerable.  ☣️ There is a lot of noise in logs. Organizations will likely see multiple discrete sets of activity. Some may be associated with threat actors, some may be security researchers/scanners. Every organization with on-premises Microsoft SharePoint should do the following: 1️⃣ Apply the patches right away. 2️⃣ Rotate SharePoint Server ASP.NET machine keys. 3️⃣ Enable additional security controls such as Windows Antimalware Scan Interface (AMSI) and EDR. 4️⃣ Forensically examine your SharePoint system to determine if it was already compromised❗

259

10 Comments