Webtagr - Technology News Summarizer

Popular：

Virtualization DNS security formal verification reachability analysis compiler errors macro conflict web extension development framework Bitmap Graphics API inconsistencies All Tags

GoAnywhere MFT Vulnerability CVE-2025-10035: A CVSS 10.0 Mystery

2025-09-25

watchTowr Labs dissected CVE-2025-10035, a critical vulnerability in Fortra's GoAnywhere MFT with a perfect CVSS score of 10.0. This deserialization vulnerability allows an attacker with a forged license response signature to deserialize arbitrary objects, potentially leading to command injection. While exploitation requires internet exposure, watchTowr Labs discovered an unauthenticated method to obtain a license request token, bypassing authentication. However, a signature verification hurdle remains. The analysis details the exploitation process, raising questions about potential undiscovered signature bypasses or leaked private keys. A detection tool is provided to help users identify vulnerable instances.

Mass Hacking on Autopilot: Exploiting Abandoned Backdoors

2025-01-12

The watchTowr team uncovered a novel attack vector: leveraging vulnerabilities in abandoned web shells (like r57shell and c99shell) to gain access to thousands of systems. These often contain unpatched flaws, allowing attackers to commandeer compromised systems with minimal effort. By registering 40+ domains, they monitored over 4000 live backdoors, targeting governments, universities, and businesses. The research highlights the security risks posed by abandoned infrastructure and underscores the need for continuous security testing.