December Microsoft Patch Tuesday. A total of 56 vulnerabilities were fixed - 9 fewer than in November. There is one vulnerability with confirmed in-the-wild exploitation:

🔻 EoP - Windows Cloud Files Mini Filter Driver (CVE-2025-62221)

There are currently no vulnerabilities with publicly available exploits. Among the remaining vulnerabilities, the following stand out:

🔹 RCE - Microsoft Office (CVE-2025-62554, CVE-2025-62557), Microsoft PowerShell (CVE-2025-54100), Microsoft Outlook (CVE-2025-62562), GitHub Copilot for JetBrains (CVE-2025-64671)
🔹 EoP - Windows Win32k (CVE-2025-62458), Windows Cloud Files Mini Filter Driver (CVE-2025-62454, CVE-2025-62457), Windows Common Log File System Driver (CVE-2025-62470), Windows Remote Access Connection Manager (CVE-2025-62472), Windows Storage (CVE-2025-59516)

🗒 Full Vulristics report

На русском

@avleonovcom #Vulristics #PatchTuesday #Microsoft #Windows #Office #PowerShell #Outlook #JetBrains #Win32k #cldflt #CLFS #RASMan #WindowsStorage

About Remote Code Execution - expr-eval (CVE-2025-12735) vulnerability. expr-eval is a JavaScript library for parsing and evaluating mathematical expressions, providing safe handling of user-supplied variables. It is used in online calculators, educational programs, modeling tools, financial applications, AI systems, and natural language processing (NLP). Insufficient input validation may allow arbitrary JavaScript code execution in the application's context.

🛠 The vulnerability was discovered on November 5. A PoC has been on GitHub since November 11.

⚙️ The vulnerability is still in the process of being fixed in the main (effectively abandoned 🤷‍♂️) expr-eval project and is not fully fixed in its fork, expr-eval-fork. Secure versions are expected to appear in the corresponding GHSA.

🌐 The library is popular: expr-eval has 800k weekly downloads on npm, and expr-eval-fork has 88k.

👾 No in-the-wild exploitation has been observed so far.

На русском

@avleonovcom #expreval #JavaScript #npm

About Remote Code Execution - Control Web Panel (CVE-2025-48703) vulnerability. Control Web Panel (CWP) is a free web-hosting control panel for RPM-based distributions. This web application provides a convenient interface for configuring and managing web servers (Apache, NGINX), databases (MySQL, MariaDB), mail systems (Postfix, Dovecot, Roundcube), DNS (BIND), and security tools (CSF, ModSecurity).

💡 Essence of the vulnerability: in the changePerm request of the filemanager module, there is a parameter called t_total, and its value is used as an argument to the system command chmod without sufficient validation. 🤷‍♂️ This allows an unauthenticated attacker to execute arbitrary shell commands on the CWP server. 😏

⚙️ Fixed in version 0.9.8.1205 on June 18, 2025.

🛠 On June 22, a detailed write-up appeared, followed soon by GitHub exploits.

👾 On November 4, the vulnerability was added to CISA KEV.

🌐 Shodan detects about 220,000 CWP installations online.

На русском

@avleonovcom #CWP

December "In the Trend of VM" (#22): vulnerabilities in Windows, the expr-eval library, Control Web Panel, and Django. A traditional monthly roundup of trending vulnerabilities - this time, a fairly compact one. 💽

🗞 Post on Habr (rus)
🗞 Post on SecurityLab (rus)
🗒 Digest on the PT website (rus)

Four vulnerabilities in total:

🔻 EoP - Windows Kernel (CVE-2025-62215)
🔻 RCE - expr-eval (CVE-2025-12735)
🔻 RCE - Control Web Panel (CVE-2025-48703)
🔻 SQLi - Django (CVE-2025-64459)

🟥 Trending Vulnerabilities Portal

На русском

@avleonovcom #TrendVulns #PositiveTechnologies #Microsoft #Windows #expreval #JavaScript #npm #CWP #Django

December Linux Patch Wednesday. In December, Linux vendors began fixing 650 vulnerabilities, roughly the same as in November. Of these, 399 are in the Linux Kernel. No vulnerabilities with signs of in-the-wild exploitation were detected.

For 29 vulnerabilities, public exploits are available or there are indications of their existence. The following can be highlighted:

🔸 RCE - JupyterLab Extension Template (CVE-2024-39700), fontTools (CVE-2025-66034), Cacti (CVE-2025-66399), CUPS (CVE-2025-64524)
🔸 XXE - Apache Tika (CVE-2025-66516)
🔸 SQLi - phpPgAdmin (CVE-2025-60797, CVE-2025-60798)
🔸 AuthBypass - cpp-httplib (CVE-2025-66570)
🔸 OpenRedirect - Chromium (CVE-2024-13983)

🗒 Full Vulristics report

На русском

@avleonovcom #LinuxPatchWednesday #Vulristics #Linux #JupyterLab #fontTools #Cacti #CUPS #ApacheTika #phpPgAdmin #cpphttplib #Chromium

About Remote Code Execution - React Server Components "React2Shell" (CVE-2025-55182) vulnerability. React is a popular open-source JavaScript framework; to improve application performance, it allows part of the logic to be executed on the server via React Server Components (RSC). By exploiting insecure deserialization in RSC, an unauthenticated attacker can achieve server-side code execution via a crafted HTTP request.

⚙️ React fixes were released on December 3. Other frameworks that embed React are also vulnerable, including Next.js, React Router, Expo, Redwood SDK, Waku, and others.

🛠 Public exploits have been available since December 3; by December 19, GitHub hosted 250+ exploit and scanner projects. 😮

👾 Attacks are widespread and have been observed since December 5; listed in CISA KEV Dec 9.

🌐 Shadowserver reports 100k+ vulnerable hosts; RuNet estimates range from 10k to 40k+. 🤔

На русском

@avleonovcom #React2Shell #RSC #React

January Microsoft Patch Tuesday. A total of 114 vulnerabilities, twice as many as in December. There is one vulnerability with evidence of in-the-wild exploitation:

🔻 InfDisc - Desktop Window Manager (CVE-2026-20805)

There are also two vulnerabilities with public exploits:

🔸 RCE - Windows Deployment Services (CVE-2026-0386)
🔸 EoP - Windows Agere Soft Modem Driver (CVE-2023-31096)

Other notable vulnerabilities include:

🔹 RCE - Microsoft Office (CVE-2026-20952, CVE-2026-20953), Windows NTFS (CVE-2026-20840, CVE-2026-20922)
🔹 EoP - Desktop Windows Manager (CVE-2026-20871), Windows Virtualization-Based Security (VBS) Enclave (CVE-2026-20876)
🔹 SFB - Secure Boot Certificate Expiration (CVE-2026-21265)

Also noteworthy, reported by Positive Technologies:

🟥 EoP - Windows Telephony Service (CVE-2026-20931)

🗒 Full Vulristics report

На русском

@avleonovcom #Vulristics #PositiveTechnologies #PatchTuesday #Microsoft #Windows #Office #NTFS #DWM #VBSEnclave #SecureBoot #TelephonyService

About Elevation of Privilege - Windows Cloud Files Mini Filter Driver (CVE-2025-62221) vulnerability. cldflt.sys is the Windows Cloud Files Mini Filter driver whose purpose is to present files and folders stored in the cloud as if they were located on the local computer. A vulnerability in this driver, fixed as part of Microsoft's December Patch Tuesday, allows a local attacker to obtain SYSTEM privileges. The root cause of the vulnerability is a Use After Free issue (CWE-416).

⚙️ The vulnerability was discovered by Microsoft researchers (from MSTIC and MSRC). Updates are available for Windows 10/11 and Windows Server 2019/2022/2025.

👾 The vulnerability has been exploited in the wild and added to the CISA KEV catalog. No attack details are available yet.

🛠 Since December 10, alleged exploit repositories briefly appeared on GitHub and were later removed; exploit sale offers have also been observed (possibly fraudulent).

На русском

@avleonovcom #Microsoft #Windows #cldflt

About Information Disclosure - MongoDB "MongoBleed" (CVE-2025-14847) vulnerability. MongoDB is a popular NoSQL database that stores data as JSON-like documents with an optional schema. The project is licensed under the SSPL. A flaw in MongoDB’s handling of the data length parameter during zlib compression allows a remote, unauthenticated attacker to access uninitialized memory and, consequently, sensitive data (credentials, keys, customer data, etc.).

⚙️ "Critical fix" was released on December 19. The vulnerability is fixed in versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30.

🛠👾 A public exploit appeared on GitHub on December 26. Exploiting it only requires specifying a host, port, and memory read offsets. Immediately after the exploit was published, mass exploitation began, according to Wiz. The vulnerability was added to the CISA KEV on December 29.

🌐 Censys reports ~86k vulnerable servers online, including ~2k in Russia.

На русском

@avleonovcom #MongoDB #MongoBleed #Wiz #Censys

About Authentication Bypass - GNU Inetutils (CVE-2026-24061) vulnerability. GNU Inetutils is a collection of common network programs, including, among other things, a Telnet server (telnetd). A vulnerability in GNU Inetutils telnetd allows a remote attacker to obtain a root shell on the host without any credentials by sending a crafted USER environment variable containing the value "-f root".

⚙️ A patch fixing the vulnerability was released on January 20. Versions 1.9.3–2.7 are vulnerable; the issue went undisclosed for 10+ years. 🤷‍♂️

🛠 A detailed write-up and exploit were published by SafeBreach on January 22.

👾 Exploitation in the wild has been observed by GreyNoise since January 21.

🌐 Shodan estimates ~212,396 Telnet servers online in total. How many of them use GNU Inetutils and are vulnerable is still unclear. CyberOK discovered around 500 potentially vulnerable Telnet servers in the Russian Internet segment.

На русском

@avleonovcom #Inetutils #Telnet #SafeBreach #CyberOK #Shodan #telnetd

About Information Disclosure - Desktop Window Manager (CVE-2026-20805) vulnerability. Desktop Window Manager is a compositing window manager that has been part of Windows since Windows Vista. Exploitation of the vulnerability, which was addressed in the January Microsoft Patch Tuesday, allows a local attacker to disclose the "section address from a remote ALPC port which is user-mode memory".

👾 Microsoft noted that this vulnerability is being exploited in attacks. The vulnerability was added to CISA’s KEV catalog on January 13. There are no public details about the attacks yet, but Rapid7 experts suggest that the disclosed memory address can be used to bypass ASLR, "increasing the chance of developing a stable elevation of privilege exploit for DWM".

🛠 Public exploit PoCs have been available on GitHub since January 14.

На русском

@avleonovcom #Microsoft #Windows #DWM #ALPC #ASLR

Our PR team awarded me the “The Best Positive Speaker 2025” metal pin for public speaking, articles, and media commentary. Huge thanks to my colleagues for this! I’m very pleased. 😇 The collection is growing. 😉

This time, the pin is styled like the Friends sitcom logo. It’s made of metal, coated with colored enamel, quite hefty, measures 5×2 cm, and fastens with two butterfly clasps. Very nice. 👍

PS: I hope there wasn’t any hidden hint in the pin’s style. 😉

So no one told you life was going to be this way. 👏👏
Your job's a joke, you're broke, your love life's DOA. 😅

На русском

@avleonovcom #PositiveTechnologies #PR #Award #present #TBPS2025

January Linux Patch Wednesday. In January, Linux vendors started fixing 918 vulnerabilities, one and a half times more than in December. Of these, 616 are in the Linux Kernel. Three show signs of exploitation in the wild:

🔻 AuthBypass - GNU Inetutils (telnetd) (CVE-2026-24061)
🔻 RCE - Safari (CVE-2025-43529); fixed in Linux distributions in webkit packages
🔻 MemCor - Chromium (CVE-2025-14174)

Another 97 vulnerabilities have public exploits or signs of their existence. Key examples:

🔸 MemCor - libpng (CVE-2026-22695)
🔸 XSS - Roundcube (CVE-2025-68461)
🔸 RCE - expr-eval (CVE-2025-13204)
🔸 ComInj - cpp-httplib (CVE-2026-21428), httparty (CVE-2025-68696), Miniflux (CVE-2026-21885)
🔸 SQLi - parsl (CVE-2026-21892)
🔸 SFB - OWASP CRS (CVE-2026-21876), Authlib (CVE-2025-68158)
🔸 AFW - node-tar (CVE-2026-23745)
🔸 PathTrav - GNU Wget2 (CVE-2025-69194), Tar (CVE-2025-45582)

🗒 Full Vulristics Report

На русском

@avleonovcom #LinuxPatchWednesday #Vulristics #Linux #telnetd #Inetutils #Safari #webkit #Chromium #libpng

January "In the Trend of VM" (#23): vulnerabilities in Windows, React and MongoDB. Traditional monthly roundup of trending vulnerabilities. Launching the 2026 season. 🙂

🗞 Post on Habr (rus)
🗒 Digest on the PT website (rus)

In total, three vulnerabilities:

🔻 EoP - Windows Cloud Files Mini Filter Driver (CVE-2025-62221)
🔻 RCE - React Server Components "React2Shell" (CVE-2025-55182)
🔻 InfDisc - MongoDB "MongoBleed" (CVE-2025-14847)

🟥 Trending Vulnerabilities Portal

На русском

@avleonovcom #TrendVulns #PositiveTechnologies #Microsoft #Windows #cldflt #React2Shell #RSC #React #MongoDB #MongoBleed #Wiz #Censys

About Remote Code Execution - Microsoft Office (CVE-2026-21509) vulnerability. The vulnerability was urgently fixed on January 26, outside the regular Microsoft Patch Tuesday. Microsoft classified it as a Security Feature Bypass, but in fact, it is more of a Remote Code Execution. The vulnerability involves bypassing OLE (Object Linking and Embedding) security features in Microsoft 365 and Microsoft Office. It is exploited when opening malicious Office files (Preview Pane is safe).

⚙️ In Office 2021+, protection is enabled automatically via server-side changes after restarting the applications. For Office 2016/2019, updates must be installed or registry changes applied.

👾 Microsoft reports that the vulnerability is being exploited in the wild.

🛠 No public exploits are available yet.

На русском

@avleonovcom #Microsoft #Office #OLE

I released Vulristics 1.0.11: added Server-Side Request Forgery (SSRF) as a distinct vulnerability type. I try to use a very small set of base vulnerability types (around 20) in Vulristics and map everything else to them. With a few exceptions, these are the same types Microsoft uses - and Microsoft doesn't like SSRF.

SSRF is a vulnerability that allows an attacker to make network requests to arbitrary destinations.

Microsoft usually classifies SSRFs as EoP, Information Disclosure, or RCE. 🤯

I used to map SSRF to Command Injection, based on the logic that crafting a request can be considered a form of command execution. But, of course, that's... questionable. 🙄

So I decided to add a dedicated SSRF type (with a severity of 0.87) and stopped doing mental gymnastics. 🙂 For the icon, I drew an anvil (a play on words with "forge"). I also uploaded the icon to avleonov.com so that Vulristics HTML reports render correctly.

На русском

@avleonovcom #Vulristics #SSRF

February Microsoft Patch Tuesday. A total of 55 vulnerabilities, half as many as in January. There are as many as six (❗️) vulnerabilities being exploited in the wild:

🔻 SFB - Windows Shell (CVE-2026-21510)
🔻 SFB/RCE - Microsoft Word (CVE-2026-21514)
🔻 SFB - MSHTML Framework (CVE-2026-21513)
🔻 EoP - Windows Remote Desktop Services (CVE-2026-21533)
🔻 EoP - Desktop Window Manager (CVE-2026-21519)
🔻 DoS - Windows Remote Access Connection Manager (CVE-2026-21525)

There is also one vulnerability with a public exploit:

🔸 DoS - libjpeg (CVE-2023-2804)

Among the remaining vulnerabilities, the following stand out:

🔹 RCE - Windows Notepad (CVE-2026-20841)
🔹 Spoofing - Outlook (CVE-2026-21511)
🔹 EoP - Windows Kernel (CVE-2026-21231, CVE-2026-21239, CVE-2026-21245), Windows AFD.sys (CVE-2026-21236, CVE-2026-21238, CVE-2026-21241)

🗒 Full Vulristics report

На русском

@avleonovcom #Vulristics #PatchTuesday #Microsoft #Windows #WindowsShell #Word #MSHTML #RDS #DWM #RACM #libjpeg #Notepad #AFDsys #WinKernel #Outlook

February "In the Trend of VM" (#24): vulnerabilities in Microsoft products. A traditional monthly roundup of trending vulnerabilities. This time, compact and all-Microsoft.

🗞 Post on Habr (rus)
🗒 Digest on the PT website (rus)

In total, two vulnerabilities:

🔻 RCE - Microsoft Office (CVE-2026-21509)
🔻 InfDisc - Desktop Window Manager (CVE-2026-20805)

🟥 Trending Vulnerabilities Portal

На русском

@avleonovcom #TrendVulns #PositiveTechnologies #Microsoft #Office #OLE #Windows #DWM #ALPC #ASLR

February Linux Patch Wednesday. In February, Linux vendors addressed 632 vulnerabilities - 1.5× fewer than in January, including 305 in the Linux Kernel. Two vulnerabilities show signs of in-the-wild exploitation:

🔻 RCE - Chromium (CVE-2026-2441)
🔻 InfDisc - MongoDB "MongoBleed" (CVE-2025-14847)

Public exploits are available or suspected for 56 more vulnerabilities. Notable ones include:

🔸 RCE - OpenSSL (CVE-2025-15467, CVE-2025-69421, CVE-2025-11187), pgAdmin (CVE-2025-12762, CVE-2025-13780), DiskCache (CVE-2025-69872), PyTorch (CVE-2026-24747), Wheel (CVE-2026-24049)
🔸 AuthBypass - M/Monit (CVE-2020-36968)
🔸 EoP - Grafana (CVE-2025-41115, CVE-2026-21721), M/Monit (CVE-2020-36969)
🔸 AFR - Proxmox Virtual Environment (CVE-2024-21545)
🔸 SFB - Chromium (CVE-2026-1504), Roundcube (CVE-2026-25916)

🗒 Full Vulristics report

На русском

@avleonovcom #LinuxPatchWednesday #Vulristics #Linux #MongoBleed #MongoDB #Chromium #OpenSSL #pgAdmin #PyTorch #Grafana #MMonit #Roundcube #DiskCache #Wheel #ProxmoxVE

About Remote Code Execution - Microsoft Word (CVE-2026-21514) vulnerability. This vulnerability is from February Microsoft Patch Tuesday. Reliance on Untrusted Inputs in a Security Decision (CWE-807) in Microsoft Office Word allows an unauthenticated attacker to bypass OLE security features when opening a malicious file. The vulnerability is NOT exploitable via the Preview Pane.

👾 Microsoft reports that the vulnerability is being exploited in the wild. It has been listed in CISA KEV since February 10.

💬 Microsoft has classified the vulnerability as a Security Feature Bypass, but given that exploiting such vulnerabilities can lead to arbitrary code execution, it seems reasonable to classify it as Remote Code Execution, similar to the actively exploited CVE-2026-21509.

🛠 No public exploits are available yet.

На русском

@avleonovcom #Microsoft #Office #OLE