https://vulnerability.circl.lu/sightings/feed 2026-09-17T08:23:01.906589+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c65aa4c5-2b28-4b91-a379-8253519a6f3c/export 2026-09-17T08:23:01.954295+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c65aa4c5-2b28-4b91-a379-8253519a6f3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-66516", "type": "published-proof-of-concept", "source": "Telegram/HpvRlDBORm0kLsO1zg2R5Kugqpwi6YO_LawI6LgE5lPyRWI", "content": "", "creation_timestamp": "2026-09-15T00:00:30.940711Z"} 2026-09-15T00:00:30.940711+00:00 https://vulnerability.circl.lu/sighting/cb0add48-23cd-4c7c-80ec-4b15e16690cb/export 2026-09-17T08:23:01.957320+00:00 Cédric Bonhomme https://vulnerability.circl.lu/user/cedric {"uuid": "cb0add48-23cd-4c7c-80ec-4b15e16690cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2025-66208", "type": "seen", "source": "https://github.com/CollaboraOnline/richdocumentscode/issues/354", "content": "", "creation_timestamp": "2026-09-14T09:20:41.961328Z"} 2026-09-14T09:20:41.961328+00:00 https://vulnerability.circl.lu/sighting/9e6007a4-6cd4-4d1e-bcdb-0c4d4eccdbec/export 2026-09-17T08:23:01.958569+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9e6007a4-6cd4-4d1e-bcdb-0c4d4eccdbec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-66516", "type": "seen", "source": "Telegram/HpvRlDBORm0kLsO1zg2R5Kugqpwi6YO_LawI6LgE5lPyRWI", "content": "", "creation_timestamp": "2026-09-14T03:00:06.609306Z"} 2026-09-14T03:00:06.609306+00:00 https://vulnerability.circl.lu/sighting/7c37804d-8834-4df5-a86f-259caa27260c/export 2026-09-17T08:23:01.958697+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "7c37804d-8834-4df5-a86f-259caa27260c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-66039", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/freepbx_firmware_file_upload.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Noah King\", \"msutovsky-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"The FreePBX versions prior to 16.0.44,16.0.92 and 17.0.6,17.0.23 are vulnerable to multiple CVEs, specifically CVE-2025-66039 and CVE-2025-61678, in the context of this module. The versions before 16.0.44 and 17.0.23 are vulnerable to CVE-2025-66039, while versions before 16.0.92 and 17.0.6 are vulnerable to CVE-2025-61678. The former represents an authentication bypass: when FreePBX uses Webserver Authorization Mode (an option the admin can enable), it allows an attacker to authenticate as any user. The latter allows unrestricted file uploads via firmware upload, including path traversal. These vulnerabilities allow unauthenticated remote code execution by bypassing authentication and placing a webshell in the web server's directory.\", \"disclosure_date\": \"2025-12-11\", \"fullname\": \"exploit/unix/http/freepbx_firmware_file_upload\", \"is_install_path\": true, \"mod_time\": \"2026-01-28 06:08:47 +0000\", \"name\": \"FreePBX firmware file upload\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/unix/http/freepbx_firmware_file_upload.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"unix/http/freepbx_firmware_file_upload\", \"references\": [\"CVE-2025-66039\", \"CVE-2025-61678\", \"URL-https://horizon3.ai/attack-research/the-freepbx-rabbit-hole-cve-2025-66039-and-others/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:36.280474Z"} 2026-09-08T06:50:36.280474+00:00 https://vulnerability.circl.lu/sighting/f1965b54-894d-4aa6-b996-363dcc512e68/export 2026-09-17T08:23:01.958827+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f1965b54-894d-4aa6-b996-363dcc512e68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-66039", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/freepbx_custom_extension_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Noah King\", \"msutovsky-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"FreePBX is an open-source IP PBX management tool that provides a modern phone system for businesses that use\\n VoIP to make and receive phone calls. Versions before 16.0.44 and 17.0.23 are vulnerable to CVE-2025-66039,\\n while versions before 16.0.92 and 17.0.6 are vulnerable to CVE-2025-61675. The former represents an\\n authentication bypass: when FreePBX uses Webserver Authorization Mode (an option the admin can enable), it\\n allows an attacker to authenticate as any user. The latter CVE describes multiple SQL injections; this module\\n exploits the SQL injection in the custom extension component. The module chains these vulnerabilities into an\\n unauthenticated SQL injection attack and gains remote code execution by injecting an SQL record into th\\n cron_jobs table. The cron_jobs database contains cron tasks that FreePBX executes in the context of the\\n operating system.\", \"disclosure_date\": \"2025-12-11\", \"fullname\": \"exploit/unix/http/freepbx_custom_extension_rce\", \"is_install_path\": true, \"mod_time\": \"2026-01-28 20:15:25 +0000\", \"name\": \"FreePBX endpoint SQLi to RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/unix/http/freepbx_custom_extension_rce.rb\", \"platform\": \"Linux\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"unix/http/freepbx_custom_extension_rce\", \"references\": [\"CVE-2025-66039\", \"CVE-2025-61675\", \"URL-https://horizon3.ai/attack-research/the-freepbx-rabbit-hole-cve-2025-66039-and-others/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:36.028965Z"} 2026-09-08T06:50:36.028965+00:00 https://vulnerability.circl.lu/sighting/6569ae43-06a3-4556-9b39-12b1a8cae651/export 2026-09-17T08:23:01.958947+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6569ae43-06a3-4556-9b39-12b1a8cae651", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-66478", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Maksim Rogov\", \"Valentin Lobstein \", \"Lachlan Davidson\", \"maple3142\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"A critical unauthenticated Remote Code Execution (RCE) vulnerability exists in React Server\\n Components (RSC) Flight protocol. The vulnerability allows attackers to achieve prototype\\n pollution during deserialization of RSC payloads by sending specially crafted multipart\\n requests with \\\"__proto__\\\", \\\"constructor\\\", or \\\"prototype\\\" as module names.\\n\\n This module supports multiple vulnerable frameworks including Next.js and Waku.\", \"disclosure_date\": \"2025-12-03\", \"fullname\": \"exploit/multi/http/react2shell_unauth_rce_cve_2025_55182\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"Unauthenticated RCE in React Server Components (React2Shell)\", \"needs_cleanup\": null, \"notes\": {\"AKA\": [\"React2Shell\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/react2shell_unauth_rce_cve_2025_55182\", \"references\": [\"CVE-2025-55182\", \"EDB-52506\", \"CVE-2025-66478\", \"URL-https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components\", \"URL-https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3\", \"URL-https://www.vulncheck.com/blog/react2shell-beyond-nextjs\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Next.js - Unix Command\", \"Next.js - Windows Command\", \"Waku - Unix Command\", \"Waku - Windows Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:11.013545Z"} 2026-09-08T06:50:11.013545+00:00 https://vulnerability.circl.lu/sighting/9bd97668-7ee2-498d-b351-13ae147f0f64/export 2026-09-17T08:23:01.959072+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9bd97668-7ee2-498d-b351-13ae147f0f64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-66301", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/grav_twig_ssti_sandbox_bypass_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Tarek Nakkouch\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a Server-Side Template Injection (SSTI)\\n vulnerability (CVE-2025-66294) in Grav CMS that allows bypassing the\\n Twig sandbox to achieve remote code execution. The cleanDangerousTwig\\n method uses weak regex that fails to sanitize nested Twig calls within\\n the evaluate_twig function. To inject the payload, this module leverages\\n CVE-2025-66301, a broken access control flaw that allows users with page\\n editing privileges to modify the form's YAML frontmatter process section.\", \"disclosure_date\": \"2025-12-01\", \"fullname\": \"exploit/multi/http/grav_twig_ssti_sandbox_bypass_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/grav_twig_ssti_sandbox_bypass_rce.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/grav_twig_ssti_sandbox_bypass_rce\", \"references\": [\"CVE-2025-66294\", \"URL-https://github.com/advisories/GHSA-662m-56v4-3r8f\", \"CVE-2025-66301\", \"URL-https://github.com/advisories/GHSA-v8x2-fjv7-8hjh\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\", \"Windows Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:49.695320Z"} 2026-09-08T06:49:49.695320+00:00 https://vulnerability.circl.lu/sighting/6319e46c-e4cf-47f2-bfa6-eff4863baa23/export 2026-09-17T08:23:01.959184+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6319e46c-e4cf-47f2-bfa6-eff4863baa23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-66294", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/grav_twig_ssti_sandbox_bypass_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Tarek Nakkouch\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a Server-Side Template Injection (SSTI)\\n vulnerability (CVE-2025-66294) in Grav CMS that allows bypassing the\\n Twig sandbox to achieve remote code execution. The cleanDangerousTwig\\n method uses weak regex that fails to sanitize nested Twig calls within\\n the evaluate_twig function. To inject the payload, this module leverages\\n CVE-2025-66301, a broken access control flaw that allows users with page\\n editing privileges to modify the form's YAML frontmatter process section.\", \"disclosure_date\": \"2025-12-01\", \"fullname\": \"exploit/multi/http/grav_twig_ssti_sandbox_bypass_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/grav_twig_ssti_sandbox_bypass_rce.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/grav_twig_ssti_sandbox_bypass_rce\", \"references\": [\"CVE-2025-66294\", \"URL-https://github.com/advisories/GHSA-662m-56v4-3r8f\", \"CVE-2025-66301\", \"URL-https://github.com/advisories/GHSA-v8x2-fjv7-8hjh\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\", \"Windows Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:49.606734Z"} 2026-09-08T06:49:49.606734+00:00 https://vulnerability.circl.lu/sighting/f42cc50a-1c4f-46dc-93c9-0b3560d12c8d/export 2026-09-17T08:23:01.959291+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f42cc50a-1c4f-46dc-93c9-0b3560d12c8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-66039", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/freepbx_custom_extension_injection.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Noah King\", \"msutovsky-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"FreePBX versions prior to 16.0.44,16.0.92 and 17.0.23,17.0.6 are vulnerable to multiple CVEs, specifically CVE-2025-66039 and CVE-2025-61675, in the context of this module. The versions before 16.0.44 and 17.0.23 are vulnerable to CVE-2025-66039, while versions before 16.0.92 and 17.0.6 are vulnerable to CVE-2025-61675. The former represents an authentication bypass: when FreePBX uses Webserver Authorization Mode (an option the admin can enable), it allows an attacker to authenticate as any user. The latter CVE describes multiple SQL injections; this module exploits the SQL injection in the custom extension component. The module chains these vulnerabilities into an unauthenticated SQL injection attack that creates a new administrative user.\", \"disclosure_date\": \"2025-12-11\", \"fullname\": \"auxiliary/gather/freepbx_custom_extension_injection\", \"is_install_path\": true, \"mod_time\": \"2026-01-28 11:14:24 +0000\", \"name\": \"FreePBX Custom Extension SQL Injection\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/freepbx_custom_extension_injection.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"gather/freepbx_custom_extension_injection\", \"references\": [\"CVE-2025-66039\", \"CVE-2025-61675\", \"URL-https://horizon3.ai/attack-research/the-freepbx-rabbit-hole-cve-2025-66039-and-others/\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:14.549844Z"} 2026-09-08T06:47:14.549844+00:00 https://vulnerability.circl.lu/sighting/6bddddc2-d721-4907-b41b-3b92ba556be7/export 2026-09-17T08:23:01.959401+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6bddddc2-d721-4907-b41b-3b92ba556be7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-66376", "type": "seen", "source": "https://t.me/SecLabNews/17979", "content": "\ud83d\ude9416 \u0440\u0430\u0437\u0432\u0435\u0434\u043e\u043a \u041d\u0410\u0422\u041e \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u043b\u0438\u0441\u044c, \u0447\u0442\u043e\u0431\u044b \u043c\u0430\u0441\u0441\u043e\u0432\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0440\u0443\u0441\u0441\u043a\u043e\u044f\u0437\u044b\u0447\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \n\n\u0420\u0430\u0437\u0432\u0435\u0434\u043a\u0438 16 \u0441\u0442\u0440\u0430\u043d \u0434\u0440\u0443\u0436\u043d\u043e \u0441\u043e\u0431\u0440\u0430\u043b\u0438\u0441\u044c \u0432 \u043a\u0440\u0443\u0436\u043e\u043a \u0438 \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043f\u0430\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043e\u0442\u0447\u0451\u0442. \u0414\u0435\u0441\u043a\u0430\u0442\u044c, \u0441\u0443\u0440\u043e\u0432\u044b\u0435 \u043f\u0430\u0440\u043d\u0438 \u0438\u0437 Laundry Bear \u043e\u0431\u043d\u0435\u0441\u043b\u0438 \u0446\u0435\u043b\u0443\u044e \u0440\u043e\u0441\u0441\u044b\u043f\u044c \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u044b\u0445 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439, \u0433\u043e\u0441\u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0439 \u0438 IT-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439. \u0421\u0430\u043c\u043e\u0435 \u0441\u043c\u0435\u0448\u043d\u043e\u0435 \u0432 \u044d\u0442\u043e\u0439 \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u0432\u0435\u043a\u0442\u043e\u0440\u043e\u043c \u0430\u0442\u0430\u043a\u0438. \u0425\u0430\u043a\u0435\u0440\u044b \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f CVE-2025-66376 \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u0438\u043a\u0435 Zimbra. \u0416\u0435\u0440\u0442\u0432\u0435 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0437\u0430\u0439\u0442\u0438 \u0432 \u0432\u0435\u0431-\u043a\u043b\u0438\u0435\u043d\u0442 \u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u043e. \u041d\u0438\u043a\u0430\u043a\u0438\u0445 \u043a\u043b\u0438\u043a\u043e\u0432 \u043f\u043e \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0441\u044b\u043b\u043a\u0430\u043c \u0438\u043b\u0438 \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u043d\u0438\u044f \u0430\u0440\u0445\u0438\u0432\u043e\u0432 \u0441 \u0432\u0438\u0440\u0443\u0441\u0430\u043c\u0438. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 JS-\u0441\u043a\u0440\u0438\u043f\u0442 ZimReaper \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0441\u044f \u043f\u0440\u044f\u043c\u043e \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435, \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u0432\u044b\u0433\u0440\u0435\u0431\u0430\u043b \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0443 \u0437\u0430 \u0442\u0440\u0438 \u043c\u0435\u0441\u044f\u0446\u0430, \u043f\u043e\u0445\u0438\u0449\u0430\u043b \u043a\u043e\u0434\u044b 2FA \u0438 \u0432\u044b\u0442\u044f\u0433\u0438\u0432\u0430\u043b \u043f\u0430\u0440\u043e\u043b\u0438 \u0447\u0435\u0440\u0435\u0437 \u0441\u043a\u0440\u044b\u0442\u044b\u0435 \u0444\u043e\u0440\u043c\u044b \u0430\u0432\u0442\u043e\u0437\u0430\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f.\n\n\u0417\u0430\u043f\u0430\u0434\u043d\u044b\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0443\u0441\u0435\u0440\u0434\u043d\u043e \u0434\u0435\u043b\u0430\u044e\u0442 \u0432\u0438\u0434, \u0431\u0443\u0434\u0442\u043e \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u0438\u043d\u043e\u043f\u043b\u0430\u043d\u0435\u0442\u043d\u044b\u043c\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f\u043c\u0438, \u0445\u043e\u0442\u044f \u0433\u043e\u0434\u0430\u043c\u0438 \u0441\u0430\u043c\u0438 \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0431\u0430\u0437\u043e\u0432\u0443\u044e \u0446\u0438\u0444\u0440\u043e\u0432\u0443\u044e \u0433\u0438\u0433\u0438\u0435\u043d\u0443. \u0426\u0420\u0423 \u0438 CISA \u043e\u0431\u0432\u0438\u043d\u044f\u044e\u0442 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0432 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u043d\u0435\u0439\u0440\u043e\u0441\u0435\u0442\u0435\u0439, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0432 \u043a\u043e\u0434\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Flowerbed \u043d\u0430\u0448\u043b\u0438 \u0441\u043b\u0435\u0434\u044b \u0433\u0435\u043d\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0418\u0418. \u0421\u043c\u0435\u0445 \u0441\u043c\u0435\u0445\u043e\u043c, \u043d\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u0432\u0437\u044f\u043b\u0438 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0439 \u0418\u0418-\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0438 \u0441\u043e\u0431\u0440\u0430\u043b\u0438 \u043d\u0430 \u043a\u043e\u043b\u0435\u043d\u043a\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430\u0433\u043d\u0443\u043b\u0430 \u043e\u0431\u043e\u0440\u043e\u043d\u043a\u0443 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u044b \u041d\u0410\u0422\u041e. Docker-\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b, \u043f\u0440\u043e\u043a\u0441\u0438 \u0447\u0435\u0440\u0435\u0437 Cloudflare, \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043f\u043e\u0434 \u043f\u0438\u043a\u0441\u0435\u043b\u044c\u043d\u044b\u0435 \u043a\u0430\u0440\u0442\u0438\u043d\u043a\u0438, \u0432\u0441\u0451 \u0434\u0451\u0448\u0435\u0432\u043e, \u0441\u0435\u0440\u0434\u0438\u0442\u043e \u0438 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e.\n\n\u041f\u0430\u043d\u0438\u043a\u0430 \u043e\u0442\u043b\u0438\u0447\u043d\u043e \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0433\u043b\u0430\u0432\u043d\u044b\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u043f\u0440\u043e\u0432\u0430\u043b \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u0418\u0411. \u0417\u0430\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u0440\u043e\u0433\u0438\u0435 \u0430\u0443\u0434\u0438\u0442\u044b \u0438 \u043f\u043e\u043a\u0443\u043f\u0430\u0442\u044c \u043c\u043e\u043d\u0441\u0442\u0440\u0443\u043e\u0437\u043d\u044b\u0435 EDR-\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0430\u0443\u0447\u0438\u043b\u0438\u0441\u044c \u0432\u0441\u0435, \u0430 \u0432\u043e\u0432\u0440\u0435\u043c\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u0442\u0447 \u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u0437\u0430\u0434\u0430\u0447\u0435\u0439 \u043a\u043e\u0441\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438. \u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u043f\u0440\u043e\u0438\u0433\u043d\u043e\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0435\u0449\u0451 \u0432 \u043d\u043e\u044f\u0431\u0440\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430, \u0438 \u0432 \u0438\u0442\u043e\u0433\u0435 \u043f\u043e\u0434\u0430\u0440\u0438\u043b\u0438 \u0430\u0437\u0438\u0430\u0442\u0441\u043a\u0438\u043c \u0438 \u0441\u043b\u0430\u0432\u044f\u043d\u0441\u043a\u0438\u043c \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430\u043c \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u043c \u0442\u0430\u0439\u043d\u0430\u043c. \u0415\u0441\u043b\u0438 \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441\u0442\u0430\u0440\u0430\u044f Zimbra (\u0438\u043b\u0438 \u0438\u043c\u043f\u043e\u0440\u0442\u043e\u0437\u0430\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 \u043d\u0430 \u0435\u0451 \u043e\u0441\u043d\u043e\u0432\u0435), \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0439\u0442\u0435 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441, \u043e\u0447\u0438\u0449\u0430\u0439\u0442\u0435 localStorage \u0438 \u043c\u0435\u043d\u044f\u0439\u0442\u0435 \u043f\u0430\u0440\u043e\u043b\u0438, \u043f\u043e\u043a\u0430 \u0437\u0430\u043f\u0430\u0434\u043d\u044b\u0435 \u0441\u043f\u0435\u0446\u0441\u043b\u0443\u0436\u0431\u044b \u043f\u0438\u0448\u0443\u0442 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u0441\u043b\u0435\u0437\u043b\u0438\u0432\u044b\u0439 \u043e\u0442\u0447\u0451\u0442.\n\n#Zimbra, #LaundryBear, #\u041a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c @SecLabNews", "creation_timestamp": "2026-09-03T00:00:41.156882Z"} 2026-09-03T00:00:41.156882+00:00