April, 2025

• 26 April

  NVIDIA Releases Security Update For GPU Driver Vulnerabilities

  

  NVIDIA has released a software security update for its GPU Display Driver to fix multiple vulnerabilities affecting both the driver and NVIDIA VGPU Software on various operating systems. The security bulletin lists various identified Common Vulnerabilities and Exposures (CVEs). The NVIDIA GPU Driver for Linux has a vulnerability (CVE-2025-23244) that …

  Read More »
• 26 April

  ‘SessionShark’ ToolKit Bypasses Microsoft Office 365 MFA

  

  The SessionShark phishing kit bypasses Office 365 MFA by stealing session tokens. Experts warn about real-time attacks using fake login pages and Telegram alerts. SlashNext security experts have found a new tool, “SessionShark,” used by cyber criminals to steal Microsoft Office 365 login information. It can bypass multi-factor authentication (MFA), …

  Read More »
• 25 April

  159 CVEs Exploited in Q1 2025 : 28.3% Within 24 Hours of Disclosure

  

  In Q1 2025, VulnCheck identified evidence of 159 CVEs publicly disclosed for the first time as exploited in the wild. The disclosure of known exploited vulnerabilities was from 50 different sources. “We continue to see vulnerabilities being exploited at a fast pace with 28.3% of vulnerabilities being exploited within 1-day …

  Read More »
• 25 April

  NVIDIA NeMo Framework Vuln Allow Attackers RCE

  

  The NVIDIA NeMo Framework has three vulnerabilities that could enable attackers to execute remote code, risking AI system compromise and data tampering. The security flaws CVE-2025-23249, CVE-2025-23250, and CVE-2025-23251 have a CVSS base score of 7.6, indicating a significant risk to users of the popular generative AI framework. On April …

  Read More »
• 24 April

  Cisco Issued Urgent Security Advisories For Multiple Products

  

  Cisco issued a security advisory about a remote code execution (RCE) vulnerability (CVE-2025-32433) affecting multiple products in its portfolio due to issues in the Erlang/OTP SSH server. The flaw with a CVSSv3.1 score of 10.0 allows unauthenticated attackers to run arbitrary code on vulnerable systems by misusing SSH message handling …

  Read More »
• 24 April

  SonicWall patched SSLVPN Vuln Allowing Firewall Crashing

  

  SonicWall has revealed a vulnerability in its SonicOS SSLVPN Virtual Office interface that could let remote attackers crash firewall appliances. Identified as CVE-2025-32818, this high-severity vulnerability has a CVSS score of 7.5, posing significant risks for enterprises using SonicWall Gen7 devices for secure network access. The official advisory states that …

  Read More »
• 24 April

  GitLab Releases Security Update For Multiple Vulns

  

  GitLab has announced a security advisory urging users to upgrade their self-managed installations right away. Versions 17.11.1, 17.10.5, and 17.9.7 are now available for both Community Edition (CE) and Enterprise Edition (EE) to fix important bugs and security issues. High-Severity XSS and Account Takeover Risks The advisory highlights several high-severity …

  Read More »
• 23 April

  ISPAB president “whatsapp” got hacked via phishing link

  

  Imdadul Haque, the president of Internet Service Provider of Bangladesh (ISPAB) said, I automatically got back my WhatsApp account. What happened: A media worker from Bangladesh shared a screen shot with infosecbulletin. “Can I urgently send 2000 taka to bKash now? I will give it tomorrow morning, InshaAllah.” The reporter …

  Read More »
• 23 April

  Zyxel released patches 2 vulns in its USG FLEX H series firewalls

  

  Zyxel Networks has issued critical security patches for two high-severity vulnerabilities in its USG FLEX H series firewalls. These flaws could let attackers gain unauthorized access and escalate their privileges on the devices. On April 22, 2025, a security advisory was released outlining patches for CVE-2025-1731 and CVE-2025-1732, affecting various …

  Read More »
• 23 April

  South Korea’s largest SK Telecom Hit by Malware: SIM-related info leaked

  

  South Korea’s largest mobile operator, SK Telecom, is warning that a malware infection allowed threat actors to access sensitive USIM-related information for customers. SK Telecom is the largest mobile network operator in South Korea, holding approximately 48.4% of the mobile phone service market in the country, corresponding to 34 million subscribers. The …

  Read More »