Author: HackWatchit

Over 80,000 servers hit as Roundcube RCE bug gets rapidly exploited Pierluigi Paganini June 11, 2025 A critical remote code execution (RCE) vulnerability in Roundcube was exploited days after patch, impacting over 80,000 servers. Threat actors exploited a critical remote code execution (RCE) flaw in Roundcube, tracked as CVE-2025-49113, just days after the patch was released, targeting over 80,000 servers. Roundcube is a popular webmail platform and has been repeatedly targeted by advanced threat groups like APT28 and Winter Vivern. In the past, attackers exploited these vulnerabilities to steal login credentials and spy on sensitive communications. These campaigns show how unpatched systems remain…

Cody Smith* // As information security professionals we’re not invincible to breaches. Even the most robust security system can’t make up for a lack of user education, which I was painfully reminded of in December of 2016. My “… !@$#” Moment: Late one Sunday night, I was sitting at my desk working toward an empty inbox when a client of mine called me. “Hey, do you have a minute? I can’t seem to open my files.” “Sure, what’s going on?” “Well, I can see where my files should be, but I can’t open anything. None of them look like they’re…

In an era where our lives are increasingly lived online, our digital identities are sprawling networks of accounts and personal data. A simple email address or phone number—often considered a secondary identifier—can serve as the key to this entire web of information. Privacy advocates warn that if an attacker or unauthorized person discovers just one of these identifiers, it could trigger a chain reaction, exposing a trove of connected accounts and sensitive details. This article explores how a single digital identity marker (like your phone number) can unravel your whole online presence, the cybersecurity implications of this vulnerability, and what…

Actively Exploited Zero-Day Vulnerability in Web Distributed Authoring and Versioning  CVE-2025-33053 is an Important remote code execution vulnerability affecting Web Distributed Authoring and Versioning (WebDAV) with a CVSS score of 8.8. This vulnerability allows attackers to control file names or paths in WebDAV implementations, enabling them to execute arbitrary code remotely on affected systems without requiring authentication. The flaw exists in how WebDAV handles file and path operations, allowing attackers to manipulate these elements to achieve code execution.While WebDAV is primarily server software, it requires client software to interact with it.  CVE-2025-33053 specifically affects the server-side implementation, making internet-facing WebDAV…

For June 2025 Patch Tuesday, Microsoft has fixed 66 new CVEs, including a zero-day exploited in the wild (CVE-2025-33053). Also, Adobe Commerce and Magento Open Source users are urged to update quickly. About CVE-2025-33053 CVE-2025-33053 is a remote code execution vulnerability in Web Distributed Authoring and Versioning (WebDAV), which is a protocol for extending HTTP protocol functionality for interacting with files. Flagged by Check Point researchers, the vulnerability has been exploited in March 2025 to deliver a custom-built espionage tool (Horus Agent) to a major defense organization in Turkey, by an APT group known as Stealth Falcon. “The attack began…

“I think there’s a real chance numbers will deteriorate soon,” J.P. Morgan Chase CEO Jamie Dimon said in reference to indicators like the labor market Tuesday (June 10), noting major upheaval in things such as trade and global politics. “There’s a lot of moving parts,” said Dimon, whose comments at the Morgan Stanley US Financials Conference were reported by Seeking Alpha. “We see it a little bit today. The tariffs are hitting.” Dimon predicted large impacts happening in “maybe July, August, September, October….hopefully, it will not be dramatic. Maybe it’ll be a little softer of a soft landing.” “None of…

New research from Bitsight reveals that thousands of internet-connected cameras, originally intended for protection, are now creating serious security risks. The latest findings from the Bitsight TRACE team identified more than 40,000 exposed cameras streaming live over the internet. Found across various sectors, including manufacturing, transportation, and healthcare, these devices lack passwords or any meaningful security controls, leaving them openly accessible, enabling anyone to view their live footage without restriction.  The U.S. and Japan top the list for exposed internet-connected cameras, ranking first and second in global exposure. In many cases, attackers only need a web browser and the correct…

A legislative proposal to establish a regulatory framework for digital assets in the United States, the Digital Asset Market Clarity Act, has advanced through two key House committees with bipartisan support.The bill, also known as H.R. 3633, cleared the House Financial Services Committee with a 32-19 vote and the House Agriculture Committee with a 47-6 vote, positioning it for consideration by the full House of Representatives.The legislation seeks to end jurisdictional ambiguity by assigning regulatory oversight of digital assets to either the Securities and Exchange Commission or the Commodity Futures Trading Commission.What is the CLARITY Act?The CLARITY Act introduces a new classification system…

Luke Baggett // Imagine a scenario where a Penetration Tester is trying to set up command and control on an internal network blocking all outbound traffic, except traffic towards a few specific servers the tester has no access to. In this situation, there is still a last-ditch option the tester can use, that being DNS command and control. If you’re unfamiliar with DNS command and control, the basic idea involves a C2 client sending data inside DNS queries. These DNS queries are forwarded across the internet’s DNS hierarchy to an authoritative DNS server, where the C2 server is located. The…