July 12, 2025 - Red Dot Security

Header image for the Red Dot Weekly Cyber Security News https://reddotsecurity.news

Hello all,

Wow, another Patch Tuesday for the records! Microsoft offered up fixes for 137 flaws, with at least one zero-day in the mix. Adobe patched 58 vulnerabilities across multiple products, Ivanti plugged more holes, Fortinet patched just about everything they make. Splunk released fixes, and the list goes on. Basically, if your software or hardware item can receive updates, you should check if yours has any pending.

This email and video commentary is from the RedDotSecurity.news website that contains a plethora of links to other items, not mentioned here, that are worth skimming to see if they interest you or pertain to your particular environment or of those you support. There is a lot more than what is provided in these opening comments. So, on to the headline news.

Headline NEWS:

Citrix NetScaler has a defect that’s been named “CitrixBleed 2”, after a similar defect from 2023 that saw widespread compromise. This one allows for attackers to steal information from the device’s memory, allowing sessions to be hijacked without the victim’s knowledge. Proof of Concept (PoC) code is out in the wild already and these devices have been under active exploitation for weeks. If you have a NetScaler and haven’t patched it for this vulnerability yet, you’re likely compromised. Contact your support vendor for help.
Fortinet patched just about everything this week. Their PSIRT alert lists at least 9 different products affected by this round of notifications. As I’ve mentioned before, Fortinet products are very popular with threat actors, so patch quickly.
Microsoft has unleashed updates for a whopping 137 defects, including one zero-day in SQL Server. As usual, vet the updates quickly so that you can roll them out to your devices. Threat actors are already decompiling code, looking for what was fixed so that they can exploit unpatched systems. The race is on.
Palo Alto Global Protect VPN has been found to have a Local Privilege Escalation (LPE) defect. If a threat actor manages to get low-level access to a system, they can then escalate to root on Mac or Linux, and System on Windows. Once a threat actor has that level of access it is usually only a matter of time until they compromise the entire network. Update to the latest version of Global Protect quickly.
Ruckus Networks has ignored requests for comments and has not responded to reports of vulnerabilities in their Ruckus Wireless Virtual SmartZone (vSZ) and Ruckus Network Director (RND). Nine separate CVEs were issued, yet still no response or patches from the vendor. The CERT Coordination Center recommends, “To mitigate risk, network administrators should limit access to the wireless management environments that use these affected products, allowing a limited set of trusted users and their authenticated clients to manage Ruckus infrastructure via a secure protocol such as HTTPS or SSH.” If the silence continues, you should seriously consider replacing any Ruckus products.
Wing FTP Server is one that I’m unfamiliar with, but there are at least 8,000 of these out there on the internet, with at least 5,000 of them vulnerable to a defect that allows for complete takeover via the web interface. As reported by Huntress Labs, this is under active exploitation, readers are urged to immediately update their Wing FTP Server to version of 7.4.4 or higher to mitigate this defect, and then search of evidence of compromise.

In Ransomware, Malware, and Vulnerabilities News:

McFail from the world’s favorite fast food burger place. McDonalds, taking advantage of the amazing capability of artificial intelligence, created an AI hiring platform named McHire. Catchy, right? It seems that the firm that used an AI to create the site for Mickey D’s might need a bit of remedial security instruction. Security researchers Ian Carroll and Sam Curry found that an account with the password of “123456” had full access to the database of over 64 million applicants. Yep, the same password that was found 3 million times in a massive password database of leaks and cyber incidents. In fact, it is the number one bad password out there, followed closely by “123456789”. If you’re using that for your password, sorry to break the news to you, but it is time to change it.
macOS SMBClient Flaw Enables Remote Code Execution and Kernel Crashes. This affects all recent versions of the operating system and requires little to no user interaction to execute. It can be triggered remotely via a URL in a message, email or poisoned webpage. All it takes is for the recipient to click the link to trigger the defect, among other methods of exploitation. Users are urged to check for and update their macOS to the latest available version as soon as possible.

In Other News Events of Note and Interest:

Alphabet’s Isomorphic Labs wants to “solve all diseases”. In 2021, DeepMind was used to create AlphaFold, an AI that was able to save months, if not years, off of determining how proteins interact with other molecules. It was a very well documented process, with exacting steps that took extensive time to run through. By utilizing AI, that time was cut down to nearly instantaneous results in predicting protein structures. In 2024 Isomorphic Labs began in earnest and are now on the cusp of human trials of radical new drugs that can be tailor designed to target the exact variant, strain, and mutation of disease to efficiently eradicate it, leaving other cells untouched. This is a very cool application of AI technology!

Musings:

When did EULA’s (End User License Agreements) begin requiring opt-out from various information siphoning schemes? Was I just asleep at that wheel and didn’t notice that subtle shift, or has it always been that way? Have developers, corporations, and online marketplaces always wanted access to everything that you’ve ever created or even thought about?

It seems that now with AI voraciously gobbling up anything available, content creators have begun fighting back. Cloudflare has announced that they’re blocking AI bot scraping, unless there is an agreement allowing it. Many content creators are resorting to putting their works behind paywalls, and some are eschewing digital altogether and going back to distribution of content via print medium. I wonder though, is it a case of the horse already being out of the barn and it being too late to close the doors? We’ll have to wait and see. For now, I think I’ll continue to store my most important notes on my trusty paper composition book.

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Like this: