Gogs 0-Day RCE Exploited in the Wild (CVE-2025-8110)
High
Executive Summary
A critical 0-day Remote Code Execution (RCE) vulnerability, CVE-2025-8110, affects Gogs and is being actively exploited in the wild. Immediate patching and enhanced monitoring are crucial.
Vulnerability Details
Affected Product: Gogs (All versions are likely affected)
Identifier:CVE-2025-8110
CVSS Score:8.7 (High)
Exploitation Status:Actively Exploited
Risk & Impact
Triage: Critical; patch immediately.
Attack Vector: Improper handling of symbolic links in the PutContents API allows local execution of code. An attacker can write a file to an arbitrary path on the server and gain SSH access.
Ease of Exploit: Exploitation is considered easy due to low attack complexity.
Action Plan
Immediate Action: Patch Gogs instances immediately. Upgrade to the latest version once a fix is available.
Workaround: Implement enhanced monitoring for exploitation attempts and associated Indicators of Compromise.
Detection: Monitor for unauthorized file writes and SSH access attempts.
Relevant professional terms
Remote Code Execution (RCE)
A type of vulnerability that allows an attacker to execute arbitrary code on a target system.
Indicators of Compromise (IOCs)
Artifacts observed on a network or in an operating system that indicate a computer security intrusion.
A critical zero-day vulnerability in Chrome, identified as CVE-2025-13223, involving a V8 type-confusion issue, is actively being exploited, potentially leading to remote code execution (RCE). Immediate patching is crucial to mitigate this severe threat.
Vulnerability Details
Affected Product: Google Chrome (V8 Engine) prior to versions 142.0.7444.175/.176 for Windows, 142.0.7444.176 for macOS, and 142.0.7444.175 for Linux
Identifier: CVE-2025-13223
CVSS Score: 8.8 (High)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching is required due to active exploitation.
Attack Vector: Exploitation occurs when a user visits a malicious webpage, leading to potential remote code execution.
Ease of Exploit: Trivial, as simply visiting a compromised site can trigger the vulnerability.
Action Plan
Immediate Action: Update Chrome to version 142.0.7444.175/.176
Workaround: There is no known workaround; patching is the primary mitigation.
Detection: Monitor for exploitation attempts and indicators of compromise.
Relevant professional terms
Remote Code Execution (RCE)
The ability to execute arbitrary code on a target system from a remote location, often leading to full system compromise.
Type Confusion
A vulnerability that occurs when a program incorrectly assumes the type of an object, leading to memory corruption and potential code execution.
The React2Shell vulnerability (CVE-2025-55182) allows for unauthenticated Remote Code Execution (RCE) and is being actively exploited in the wild. Immediate patching of React-based applications and monitoring for IOCs is crucial.
Vulnerability Details
Affected Product: React Server Components in React 19.x and Next.js 15.x/16.x with App Router
Identifier: CVE-2025-55182
CVSS Score: 10.0 (Critical)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching is required due to the high severity and ease of exploitation.
Attack Vector: An unauthenticated remote attacker can send a crafted HTTP request to a server function endpoint, leading to remote code execution.
Ease of Exploit: Exploitation is straightforward, with a near 100% success rate in default configurations.
Action Plan
Immediate Action: Patch to versions 19.0.1, 19.1.2, and 19.2.1
Workaround: If patching is not immediately possible, consider deploying a web application firewall (WAF).
Detection: Monitor for associated IOCs.
Relevant professional terms
Remote Code Execution (RCE)
A type of cyberattack where an attacker can remotely execute commands on an organization's computers or network.
Indicators of Compromise (IOCs)
Data that indicates a system may have been infiltrated by a cyber threat. These are clues or evidence of a data breach.
Possible Exploit Variant for CVE-2024-9042 (Kubernetes OS Command Injection)
Medium
Executive Summary
A new exploit variant has emerged for CVE-2024-9042, a Kubernetes OS Command Injection vulnerability, potentially bypassing previous mitigations; organizations should verify their Kubernetes environments are fully patched against new exploitation methods. This vulnerability can lead to Remote Code Execution (RCE) or privilege escalation within Kubernetes clusters.
Vulnerability Details
Affected Product: Kubernetes Windows nodes, specifically the Kubelet component versions v1.32.0, v1.31.0 to v1.31.4, v1.30.0 to v1.30.8, and versions less than or equal to v1.29.12
Identifier:CVE-2024-9042
CVSS Score:5.9 (Medium)
Exploitation Status:Likely being exploited, given the emergence of a new variant
Risk & Impact
Triage: High urgency to investigate and patch given potential for RCE and privilege escalation
Attack Vector: Attackers exploit the `/logs` endpoint of a node to inject malicious commands. This is achieved by sending a NodeLogQuery request with a malformed value in a pattern parameter.
Ease of Exploit: Requires high privileges and has high attack complexity. However, a Kubernetes cluster v1.28.15 was used to reproduce the exploit.
Action Plan
Immediate Action: Upgrade Kubelet on Windows worker nodes to patched versions v1.32.1, v1.31.5, v1.30.9, or v1.29.13
Workaround: Restrict access to the `/logs` endpoint on Kubernetes Windows nodes. Implement strong authentication and authorization mechanisms for accessing node endpoints.
Detection: Examine cluster's audit logs for node 'logs' queries with suspicious inputs. Monitor and audit access to node endpoints, especially the '/logs' endpoint.
Relevant professional terms
Remote Code Execution (RCE)
The ability to execute arbitrary code on a remote system or device.
Privilege Escalation
Exploiting a bug or design flaw to gain elevated access to resources that are normally protected from an application or user.
December Patch Tuesday Fixes Windows Device Hijacking Vulnerability
Executive Summary
The December Patch Tuesday addresses an actively exploited zero-day vulnerability in Windows systems that allows for device hijacking, potentially leading to Remote Code Execution (RCE) or privilege escalation. Immediate patching is crucial to mitigate the severe risk associated with CVE-2025-62215, which is actively exploited.
Vulnerability Details
Affected Product: Windows Kernel
Identifier: CVE-2025-62215
CVSS Score: A similar vulnerability, CVE-2025-62221 affecting Windows Cloud Files Mini Filter Driver, has a CVSS score of 7.8
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching of all affected Windows devices is required.
Attack Vector: Local attackers can escalate privileges to SYSTEM level.
Ease of Exploit: Low attack complexity, requiring low privileges and no user interaction.
Action Plan
Immediate Action: Apply the available Microsoft security update to protect against exploitation.
Workaround: Implement Microsoft mitigations as an immediate defensive measure.
Detection: Monitor for exploitation attempts.
Relevant professional terms
Remote Code Execution (RCE)
The ability to execute arbitrary code on a target machine from a remote location.
Privilege Escalation
Exploiting a vulnerability to gain higher-level access to resources than an unauthorized user is normally permitted.
