InfoSecBulletin Cybersecurity for mankind
BIND9 DNA Cache poisoning impact 267 IPs in Bangladesh via CVE: 2025-40778. The high severity flaw can allow remote attackers to inject forged DNS records into resolver caches.
BGD e-GOV CIRT published an advisory stating all organizations operating BIND 9 resolvers in Bangladesh (ISPs, data centers, government, enterprises) must upgrade to ISC (Internet Systems Consortium) patched releases 9.18.41, 9.20.15, 9.21.14 (or S1 variants) immediately. If cannot patch immediately, restrict recursion to trusted networks, enable DNSSEC validation where possible, and monitor DNS logs for anomalous answers.
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
The vulnerability (CVSS 8.6) in BIND 9 lets attackers inject fake DNS records into resolver caches through regular queries. It affects BIND versions 9.11.0–9.16.50, 9.18.0–9.18.39, 9.20.0–9.20.13, and 9.21.0–9.21.12 (including S1 previews). This can lead to DNS cache poisoning and redirect users to harmful sites.
Researchers released the PoC that demonstrates how an unauthenticated, remote attacker could poison DNS caches in vulnerable BIND 9 resolvers.
Mitigation & Recommended Actions:
Immediate Actions:
* Upgrade resolver instances to the patched BIND releases that correspond to respective
branch: 9.18.41, 9.20.15, 9.21.14 (and S1 variants 9.18.41-S1, 9.20.15-S1 where
applicable). If any affected 9.x version is running, upgrade to the closest patched release
from ISC immediately.
* ISP/recursive resolver operator or host a resolver for many clients (e.g., public DNS, ISP,
cloud provider), schedule an emergency update window and announce it to customers;
treat this as an urgent operational priority.
* If BIND instance is authoritative-only and does not perform recursion, it is likely not
directly exploitable, confirm configuration and ensure recursion is disabled for public
networks. (But verify with named -V and configurations)
Temporary mitigations (until you patch): (These reduce risk but are not full fixes)
* Restrict recursion to trusted IP ranges only (use allow-recursion and allow-query-cache to
trusted networks). This prevents external attackers from triggering recursive queries
against your resolver.
* Disable recursion on servers that must be authoritative-only (recursion no;) if possible
* If environment allows, reduce cache lifetime (TTL) temporarily to reduce window of
poisoned entries (shorter TTL means forged entries expire sooner). Note: this is disruptive
and should be used carefully.
* Use DNSSEC validation on resolvers (enable validation with a validating resolver or dnssec
enable/dnssec-validation in BIND); while this doesn’t protect all record types, DNSSEC
validation prevents signed zones from being silently replaced by unsigned forged records.
Note: enabling DNSSEC validation requires configuration and trust-anchor setup.
* Use upstream, validated recursive resolvers from trustworthy providers if local resolver
cannot be patched immediately (need to ensure clients are protected).
* Firewall / rate-limit DNS responses from the outside where practical, and monitor for
unusual DNS answer patterns/TTL/unknown authoritative servers.
DDoS Scandals Hit Bangladesh ISP Sector: BTRC Prepares Crackdown
