SolarWinds has patched four critical remote code execution vulnerabilities in its Serv-U file transfer software that could allow authenticated attackers with high privileges to gain root/admin access.
The flaws (including the most severe tracked as CVE-2025-40538) are now addressed in the latest release. Immediate patching is required.
Vulnerability Details
Affected Product: Serv-U Managed File Transfer, Serv-U File Server versions prior to 15.5.4
Identifier: Four critical RCEs (CVE-2025-40538, -40539, -40540, -40541)
CVSS Score: 9.1 (Critical)
Exploitation Status:Not actively exploited (the separate CVE-2024-28995 path-traversal flaw from 2024 remains actively exploited in the wild)
Risk & Impact
Triage: Urgent.
Attack Vector: Authenticated high-privilege attackers can chain broken access control, type confusion, and IDOR issues to achieve root-level code execution.
Ease of Exploit: Moderate to high (requires valid admin credentials on the Serv-U instance).
Action Plan
Immediate Action: Upgrade to Serv-U 15.5.4 immediately.
Workaround: Place Serv-U behind a VPN or zero-trust gateway; enforce least-privilege admin accounts and monitor for anomalous admin activity.
Detection: Watch for unexpected child processes under the Serv-U service, outbound C2 traffic, and privilege-escalation attempts from internal admin accounts.
Relevant professional terms
Remote Code Execution (RCE)
A class of software vulnerability that allows a malicious actor to execute commands of their choosing on a remote machine over a network, potentially leading to full system compromise.
Directory Traversal
A type of security vulnerability that allows an attacker to access files and directories that are stored outside the intended web root folder by manipulating file paths with "dot-dot-slash" (../) sequences.
A security analysis of ten popular Android mental health applications, with a combined 14.7 million installations, revealed 1,575 vulnerabilities.
These flaws, including 54 high-severity issues, could lead to the exposure of highly sensitive user data, such as therapy records and personal information; it is unclear if the developers have patched the reported flaws.
Vulnerability Details
Affected Product: Ten unnamed Android mental health applications
Identifier: Not Applicable (Multiple vulnerabilities across different apps)
Exploitation Status: No active exploitation has been reported.
Risk & Impact
Triage: High. The potential exposure of sensitive medical and therapy data presents a significant privacy risk to users.
Attack Vector: Attackers could exploit various weaknesses, such as improper URI validation, to access internal app components and authentication tokens. Other issues include a lack of root detection, insecure local data storage, and weak token generation.
Ease of Exploit: Moderate. Many of the discovered flaws, while not critical, could be leveraged to intercept credentials, inject HTML, spoof notifications, or track user locations.
Action Plan
Immediate Action: Users should ensure their applications are always updated to the latest version. Developers of mobile health apps must conduct thorough security audits to identify and remediate insecure coding practices.
Workaround: Users should be cautious on rooted (jailbroken) devices, as apps with root privileges could access data from other applications. Avoid using these apps on public Wi-Fi and consider using a disposable email for sign-up.
Detection: There are no specific Indicators of Compromise (IOCs) for end-users. Developers should implement robust logging and monitoring to detect anomalous activity.
Relevant professional terms
Root Detection
A security measure within a mobile application to check if the device is "rooted" (Android) or "jailbroken" (iOS). A rooted device grants elevated privileges, which can bypass the operating system's normal security controls, potentially allowing malicious apps to access the data of other applications.
Intent (Android)
A messaging object used to request an action from another app component. Insecure handling of intents, such as parsing a URI without proper validation, can allow an attacker to force an app to launch internal activities, potentially leading to unauthorized access to sensitive data like authentication tokens.
Ad tech firm Optimizely disclosed a data breach affecting an undisclosed number of customers after attackers gained access to internal systems through a sophisticated voice phishing (vishing) campaign.
The incident highlights the effectiveness of social engineering tactics targeting the human element to bypass security controls.
Attack Overview
Attack Path: Threat actors used a sophisticated voice-phishing (vishing) attack to manipulate employees, gain initial access, and compromise internal business systems.
Attacker: While not officially confirmed, the tactics are consistent with the ShinyHunters extortion group, known for similar social engineering campaigns.
Impact Assessment
Data Stolen: The breach was confined to internal systems, including CRM records, with attackers accessing "basic business contact information."
Operational Impact: Business operations were not disrupted. The attackers were unable to escalate privileges, install software, or create backdoors.
Strategic Takeaway
This incident underscores that human-centric social engineering remains a primary vector for initial access, bypassing technical controls to target employee trust and identity verification workflows.
Relevant professional terms
Vishing (Voice Phishing)
A type of cyber attack where threat actors use phone calls and social engineering to manipulate individuals into divulging sensitive information, such as credentials or financial details.
Social Engineering
The psychological manipulation of people into performing actions or divulging confidential information. It relies on human interaction to break normal security procedures.
A Russian-speaking hacker used commercial generative AI to compromise over 600 FortiGate firewalls across 55 countries.
The campaign targeted credentials and backups, likely as a precursor to ransomware attacks, by exploiting weak credentials on exposed management ports.
Key TTPs
Initial Access: Brute-forcing weak or reused credentials on internet-exposed FortiGate management interfaces.
Execution: Used AI-assisted Python and Go scripts to parse, decrypt, and organize stolen device configuration files for credential harvesting.
Campaign Analysis
This campaign demonstrates how generative AI lowers the barrier for less-skilled actors to achieve operational scale, automating well-known attack techniques rather than creating novel exploits.
The focus on backup infrastructure suggests a clear financial motive aimed at disabling recovery before deploying ransomware.
Targeting & Infrastructure
Target Profile: Opportunistic, targeting any organization with exposed FortiGate management interfaces and weak, single-factor authentication.
Infrastructure: Over 600 compromised FortiGate devices across 55 countries, with concentrations in South Asia, Latin America, and Africa.
Relevant Terms
Generative AI: Artificial intelligence capable of generating new content, such as text, images, or code, based on patterns learned from existing data.
Firewall: A network security device that monitors and filters incoming and outgoing network traffic based on an organization's previously established security policies.
Threat actors are using a convincing, fake Zoom meeting page to automatically trigger a bogus update, which silently installs commercial surveillance software onto victim's machines.
This campaign targets unsuspecting users by exploiting their trust in the popular video conferencing platform.
Key TTPs
Initial Access: Lures victims to a fake Zoom waiting room, often through social engineering. The page uses scripted audio and deliberate "network issues" to build a pretext for an update.
Execution: An "Update Available" prompt appears and automatically downloads a malicious installer without user interaction.
Defense Evasion: The installer executes silently via the Windows Installer, installing a covert build of the Teramind monitoring tool without any visible interface.
Campaign Analysis
This attack relies on psychological manipulation rather than technical exploits, creating a believable scenario to trick users into accepting a malicious download.
The use of legitimate, commercial monitoring software makes detection more challenging for traditional security tools.
Actionable Intelligence
Domains:uswebzoomus[.]com
Relevant Terms
Social Engineering: A manipulation technique used to trick individuals into divulging confidential information or performing specific actions, such as downloading malware.
Surveillance Software: Software designed to secretly monitor a user's computer activities, capturing data like keystrokes, screenshots, and communications.
Threat actors are using a fraudulent website impersonating Avast to trick users into providing their full credit card details.
The scam lures victims with a fake €499.99 charge, promising a refund while actually harvesting their financial and personal information.
Key TTPs
Initial Access: Social engineering through a phishing website that convincingly mimics the official Avast brand.
Execution: A live chat feature, using a legitimate support platform, engages visitors to build trust and manipulate them into entering their payment details.
Campaign Analysis
This operation combines a static phishing page with interactive fraud by using live chat agents to overcome victim hesitation.
The use of JavaScript to display the current date for the fake transaction adds a layer of urgency and believability to the scam.
Targeting & Infrastructure
Target Profile: The campaign primarily targets French-speaking users of Avast security products.
Infrastructure: The operation utilizes a lookalike domain and integrates a legitimate third-party live chat service (Tawk.to) to interact with victims.
Relevant Terms
Phishing: A cyberattack where threat actors send messages pretending to be from a reputable source to trick individuals into revealing sensitive information like passwords or credit card numbers.
Social Engineering: The psychological manipulation of people into performing actions or divulging confidential information.
A dramatic surge in ATM "jackpotting" attacks in 2025 led to over $20 million in losses from more than 700 incidents, as criminals successfully used well-established tools and tactics to force ATMs to dispense cash.
Key Findings
Financial institutions suffered losses exceeding $20 million across more than 700 jackpotting incidents in 2025 alone.
Attackers are exploiting known physical and software vulnerabilities, often using malware like Ploutus, which has been in use for over a decade.
The primary attack methods require physical access to the ATM, either to install malware via USB or to connect a "black box" device directly to the cash dispenser.
The Bottom Line
The resurgence of these decade-old attack methods indicates a significant gap in the physical security and legacy system oversight for distributed financial assets.
This trend underscores that a failure to maintain fundamental security controls, such as restricting physical access and hardening systems against known malware, can be just as costly as a novel zero-day exploit.
Relevant Terms
ATM Jackpotting: A cyberattack where criminals use malicious software or hardware to force an ATM to dispense large volumes of cash on demand, bypassing transaction authorization.
Black Box Attack: A method of jackpotting where attackers physically connect an external electronic device to the ATM's cash dispenser, sending direct commands to release cash without interacting with the ATM's core software.
