InfoSecBulletin Cybersecurity for mankind
More than 28,000 unpatched Microsoft Exchange servers are publicly accessible and vulnerable to the critical security flaw CVE-2025-53786, as reported by The Shadowserver Foundation on August 7, 2025.
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
CISA’s Emergency Directive 25-02 on August 7 requires federal agencies to fix a critical vulnerability in Microsoft Exchange hybrid setups by 9:00 AM ET on August 11.
Vulnerability scans show that the US, Germany, and Russia have the most exposed vulnerable servers. These findings come as Microsoft and CISA warn of “significant, unacceptable risk” to organizations operating Exchange hybrid configurations that have not implemented the April 2025 security guidance.
The vulnerability originated on April 18, 2025, when Microsoft announced security changes for Exchange Server Hybrid Deployments along with a non-security hotfix.
The company recommends installing the April 2025 hotfix or later and making configuration changes in Exchange Server hybrid environments.
Security researcher Dirk-Jan Mollema from Outsider Security revealed a vulnerability at Black Hat USA 2025, showing how attackers can create forged authentication tokens that are valid for 24 hours, bypassing access policies.
Microsoft has labeled the vulnerability as “Exploitation More Likely” despite no confirmed active exploitation as of the disclosure date.
CISA Acting Director Madhu Gottumukkala highlighted the urgent need to address a vulnerability that poses a serious risk to crucial federal systems.
Organizations should apply the April 2025 Exchange Server hotfix updates, set up dedicated Exchange hybrid applications, and remove old service principal credentials.
