InfoSecBulletin Cybersecurity for mankind
CISA announced on Tuesday that a security flaw in SolarWinds Web Help Desk is now listed in its Known Exploited Vulnerabilities catalog, indicating it is actively being targeted in attacks.
The vulnerability, CVE-2025-40551 (CVSS score: 9.8), allows untrusted data deserialization that could enable remote code execution.
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
Web Help Desk is widely used by government agencies, large corporations, healthcare organizations, and schools. SolarWinds reports over 300,000 customers globally for its IT management products.
SolarWinds released fixes for a vulnerability last week, including CVE-2025-40536 (CVSS 8.1), CVE-2025-40537 (CVSS 7.5), CVE-2025-40552 (CVSS 9.8), CVE-2025-40553 (CVSS 9.8), and CVE-2025-40554 (CVSS 9.8), in WHD version 2026.1.
There are no public reports on how the vulnerability is being used in attacks, who the targets are, or the scale of these efforts. This highlights how fast threat actors exploit newly revealed flaws.
Also added to the KEV catalog are three other vulnerabilities:
CVE-2019-19006 (CVSS score: 9.8): A vulnerability in Sangoma FreePBX that lets unauthorized users access services without a password.
CVE-2025-64328 (CVSS score: 8): An OS command injection vulnerability in Sangoma FreePBX allows authenticated users to execute commands through the testconnection -> check_ssh_connect() function, potentially gaining remote access as an asterisk user.
CVE-2021-39935 (CVSS score: 7.5/6.8): A security flaw in GitLab that lets unauthorized users make requests to external servers through the CI Lint API.
GreyNoise reported the exploitation of CVE-2021-39935 in March 2025, amid increasing SSRF vulnerability abuses across platforms like DotNetNuke, Zimbra, VMware vCenter, DocumentLocator, BerriAI LiteLLM, and Ivanti Connect Secure.
