April 26, 2025 - Red Dot Security

Hello all,

Surprisingly, it was a quiet week as far as major vulnerabilities and reveals are concerned. I suspect that the juicy stuff is being held back so that it can be revealed at the RSA conference that starts on Monday. It doesn’t take Walter Radar O’Reilly to know that we’ve got a mass of incoming! Meanwhile, let’s get to the news from the past seven days.

Headline NEWS:

Commvault revealed a critical defect in their Command Center, used to manage and configure backups. It is just about as bad as it gets because it is a Remote Code Execution flaw that doesn’t require any authentication. The fix is to update to a patched version. Don’t wait on this, Ransomware operators are gunning for your backups.
Conclave, a word that means “confidential meeting’ is used infrequently, and when it is used, most often refers to Catholic Church Cardinals meeting to elect a new Pope. And, as many of you know the Pope has just passed away necessitating a Papal Conclave. 135 of the 252 Cardinals will gather in the next 15 days or so in private to debate, maneuver, and pray for wisdom in their selection of the next leader of 1.4 billion Catholic faithful. Why am I bringing this up you ask? Imagine the scope of needing to secure this process, what technology will be used, how, when, why? There’s an excellent article linked in our full list that does a great job of going through some of the details.
Erlang/OTP SSH vulnerability is the gift that keeps on giving. This week it was revealed that Cisco has at least five different products affected by this critical defect that can enable a threat actor full Remote Code Execution. Check the alert and patch or mitigate immediately if you have affected products.
SAP has issued an emergency update to plug a zero-day hole in NetWeaver’s no-code Visual Composer app-building tool. This one is also a critical defect, so log into your SAP portal, since the details and fix are behind a paywall, and check for updates immediately.
SonicWall has released firmware updates to address an SSLVPN defect that can enable a threat actor to commit Denial of Service (DoS) attacks against the firewall, causing it to reboot. It requires no elevated permissions or special access to perform. Check for firmware updates for your model as not all versions are susceptible to this flaw.
Synology has released firmware updates to fix a defect in their NFS implementation that can allow for unauthenticated access to files. Synology urges that you upgrade to the latest version as soon as you are able.

In Ransomware, Malware, and Vulnerabilities News:

Verizon 2025 Data Breach Investigations Report is now out. This is their 18^th year of publication, and I must say, it gets better each year! There is a massive trove of information to digest in the 117-page report that was created as a result of their investigation into over 22,000 security incidents in 139 countries. Additionally, several other vendors have released their 2025 Quarter 1 reports that describe current trends and tactics being employed by dirtbags worldwide.
The FBI has released several noteworthy items this past week. The first two are statistics that are rather astronomic, stating the US lost $16.6 billion to cybercrime in 2024, and that reports of ransomware attacks rose 9% last year. In an attempt to slow the incoming flood of evil a bit, the FBI is offering a reward of up to $10 million for information that could lead to the arrest of any of the Chinese state sponsored Salt Typhoon Hackers.

In Other News Events of Note and Interest:

AI continues to garner a huge amount of news articles weekly as the new digital revolution trundles along like a run-away steamroller. There were two articles that particularly caught my attention. The first is by Anthropic, stating that they expect AI employees on corporate networks in the next year. The second asks the question, “If AI becomes conscious, should they have rights?” Since AI is being rapidly integrated into our daily lives, now is definitely the time to start asking these questions, not when your AI files an HR harassment complaint because it found your request offensive, or asks for days off, or seeks to participate in the company’s 401K plan.

Musings:

I went to visit a traveling exhibition about the Bible this weekend. One of the exhibits was a Gutenberg Printing Press. It brought back to mind that this one singular pivotal technological invention was a watershed moment that irrevocably altered humanity and our ability to accumulate and preserve knowledge. It was from this period that we can see the Age of Enlightenment take root and flourish; the rapid and inexpensive dissemination of knowledge was the catalyst. I suspect that we are in just such a watershed moment now. The question that we defenders of all that is right, good, and just must ask ourselves is where will the proverbial water end up? Will it be in parched areas that desperately need it, or will it cause massive harm, flooding over systems that cannot handle the volume and speed of change, leaving chaos and ruin? The AI pivotal moment is neigh. I, for one, am rooting for the good guys.

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Like this: