Blog

<p>Cybersecurity defenses are only as strong as the measures that keep attackers at bay—even after patches are applied. In a concerning development, Fortinet has warned customers that threat actors are retaining read-only access to compromised FortiGate VPN devices via a symlink-based post-exploitation technique, even after the initial vulnerabilities have been patched.</p><h3>What’s Happening?</h3><p><br>Earlier this week, Fortinet began sending urgent emails to its customers under the title “Notification of device compromise - FortiGate / FortiOS - Urgent action required.” These emails, designated as TLP:AMBER+STRICT, alerted customers that their FortiGate/FortiOS devices might still be compromised. According to these alerts, the issue is not due to any new vulnerability; rather, it stems from remnants left behind by threat actors after exploiting well-known vulnerabilities such as CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762.</p><figure id="figure-rztpt8gofrm9hpl5af"><img id="rztpt8gofrm9hpl5af" src="https://media.gettyimages.com/id/480621795/photo/internet-security.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=fQkPXrUueNzISjmdV1Fynae8yTzK4IHBBIesqOxJY40=" alt="Internet Security" title="Internet Security" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/480621795/photo/internet-security.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=fQkPXrUueNzISjmdV1Fynae8yTzK4IHBBIesqOxJY40=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>The Exploit in Detail</h3><p><br>When threat actors initially exploited vulnerable FortiGate devices using known flaws, they created symbolic links (symlinks) in the language files folder. These symlinks connected the user file system to the root file system on devices that have SSL-VPN enabled. As a result, even after the affected devices have been updated with patched FortiOS versions, the symlinks may remain. This persistence mechanism enables attackers to maintain read-only access to critical files—including device configurations—via the publicly accessible SSL-VPN web panel without being detected.</p><p>Fortinet explained:</p><p>"A threat actor used a known vulnerability to implement read-only access to vulnerable FortiGate devices. This was achieved via creating a symbolic link connecting the user file system and the root file system in a folder used to serve language files for the SSL-VPN. This modification took place in the user filesystem and avoided detection."</p><h3><br>Ongoing Threat and Broader Impact</h3><p><br>According to the Computer Emergency Response Team of France (CERT-FR), this post-exploitation technique has been used in a massive campaign in France dating back to early 2023. Additionally, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged network defenders to report any incidents or anomalous activity related to Fortinet's advisory to their 24/7 Operations Center.</p><p>The persistence of these symlinks is especially alarming because it means that even after immediate vulnerabilities are patched, attackers can continue to access and potentially exploit system configurations. WatchTowr CEO Benjamin Harris warned, “In the wild exploitation is becoming significantly faster than organizations can patch... Attackers deploy capabilities designed to survive the patching, upgrade, and factory reset processes.”</p><figure id="figure-bidqlmjbysm9hpmoui"><img id="bidqlmjbysm9hpmoui" src="https://media.gettyimages.com/id/486818926/photo/cyber-attack-a06.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=Hv_QYDUI63GdrWIz74Pi8Z00pkUtEpvBu7Ps9coRYsQ=" alt="Cyber Attack A06" title="Cyber Attack A06" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/486818926/photo/cyber-attack-a06.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=Hv_QYDUI63GdrWIz74Pi8Z00pkUtEpvBu7Ps9coRYsQ=" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h3>Mitigation Steps and Recommendations</h3><p><br>To reduce the risk posed by these lingering symlinks, Fortinet advises customers to immediately upgrade their FortiGate/FortiOS devices to one of the latest patched versions (7.6.2, 7.4.7, 7.2.11, 7.0.17, or 6.4.16). In addition, administrators should:</p><ul><li>Review Device Configurations: Immediately check for unexpected changes in configurations that might indicate a persistent compromise.</li><li>Reset Exposed Credentials: Focus on resetting any credentials, certificates, identity tokens, and cryptographic keys that might have been exposed.</li><li>Isolate Compromised Devices: Consider isolating affected devices from the network to prevent lateral movement.</li><li>Report Incidents: Follow CISA’s guidance by reporting any suspicious activity to their Operations Center.</li></ul><h3><br>Final Thoughts</h3><p><br>The stealthy nature of this exploit underscores an important lesson: even after applying patches, residual artifacts from previous breaches can leave organizations vulnerable. These findings reinforce the need for continuous monitoring and proactive remediation efforts.</p><p>At TechHorizon Consulting, we understand that evolving cyber threats require a comprehensive and proactive security strategy. We specialize in securing networks, fortifying access controls, and performing detailed configuration reviews to help ensure your infrastructure remains secure.</p><p>Contact TechHorizon Consulting today to assess your security posture and implement advanced protection strategies against emerging cyber threats.</p>

Symlink Exploit Enables Continued Access to Patched FortiGate Devices

Abstract Warning of a detected malware program

<p>Fortinet recently released patches for a critical security vulnerability in its FortiSwitch devices, it was discovered internally and identified as CVE-2024-48887. This flaw allows attackers to create bogus web requests that invoke the device to change its administrator password.</p><h3>Vulnerability Details</h3><p>The vulnerability stems from the FortiSwitch GUI's set_password endpoint, attackers can send an unverified web request to the endpoint&nbsp; to change the administrator password. Exploiting this flaw does not require the attacker have any access to the device, remote or otherwise. This makes it a critical vulnerability for companies using FortiSwitch devices.</p><h3>Affected Versions and Patching Recommendations</h3><p>Fortinet advised customers to patch this vulnerability by updating to the following firmware versions:​</p><p>FortiSwitch 7.6.0: Upgrade to version 7.6.1 or later.​<br>FortiSwitch 7.4.0 through 7.4.4: Upgrade to version 7.4.5 or later.​<br>FortiSwitch 7.2.0 through 7.2.8: Upgrade to version 7.2.9 or later.​<br>FortiSwitch 7.0.0 through 7.0.10: Upgrade to version 7.0.11 or later.​<br>FortiSwitch 6.4.0 through 6.4.14: Upgrade to version 6.4.15 or later.​</p><p><br>Update your FortiSwitch devices to the latest firmware versions as soon as possible to mitigate this security risk. Fortinet recommends disabling the remote admin interface on FortiSwitch devices unless it is absolutely needed.</p><h3>Recent Fortinet Vulnerabilities</h3><p>This disclosure follows another vulnerability that was disclosed in February 2024 which affected FortiOS and FortiProxy systems. Though exploited in 2022 the vulnerability was only disclosed in 2024. This vulnerability allowed attackers bypass authentication and obtain super-admin privileges. Fortinet released patches to address this issue, but some 15,000 devices had their configurations leaked. &nbsp;</p><figure id="figure-kqnoc45nzqm9ah4cmd"><img id="kqnoc45nzqm9ah4cmd" src="https://media.gettyimages.com/id/2020226448/photo/abstract-technology-connections-background.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=_zJRF-f6qp2F-NSPmC4EYaZM1UK0uUVyAPXv5lTZiUg=" alt="Abstract Technology Connections Background" title="Abstract Technology Connections Background" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2020226448/photo/abstract-technology-connections-background.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=_zJRF-f6qp2F-NSPmC4EYaZM1UK0uUVyAPXv5lTZiUg=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Recommendations for Fortinet Users</h3><p>To ensure the security of Fortinet devices:</p><ul><li>Regularly Update Firmware: Always keep Fortinet devices updated with the latest firmware releases to protect against known vulnerabilities.​</li><li>Monitor Official Advisories: Stay informed by regularly checking Fortinet's official security advisories and subscribing to relevant cybersecurity alert services.​<br></li><li>Implement Robust Security Practices: Beyond patching, adopt comprehensive security measures, including strong access controls, network segmentation, and continuous monitoring for suspicious activities.​</li></ul><p>By proactively managing device security and staying informed about potential vulnerabilities, organizations can better protect their networks from emerging threats.</p><h3>Conclusion&nbsp;</h3><p>The recent vulnerabilities in Fortinet products, particularly CVE-2024-48887 in FortiSwitch devices, highlight the critical importance of proactive cybersecurity measures. Organizations must prioritize timely firmware updates and adhere to best security practices to safeguard their networks against potential exploits. If your company is concered about potential threats, visit our "Contact Us" page. With our vCISO services we can provide continous network monitoring for your company as well as a plethora of other services. Staying vigilant and responsive to security advisories ensures the integrity and resilience of network infrastructures.&nbsp;</p>

​FortiNet Addresses Critical FortiSwitch Vulnerability

<p>Scammers are targeting consumers by impersonating well-known toll and transit services. In a renewed phishing campaign, scammers impersonate E-ZPass and other toll agencies to send fraudulent SMS texts aimed at stealing personal and credit card information. This scam, which the FBI warned about back in April 2024, has now experienced a significant resurgence, with many victims reporting up to seven scam texts in a single day.</p><h3>What Is the Scam?</h3><p><br>In this campaign, unsuspecting users receive text messages that appear to be sent from E-ZPass or similar toll authorities. These messages employ urgent language to create a sense of panic. For example, a typical scam text might read:</p><p>"Your toll payment for E-ZPass Lane must be settled by April 4, 2025. To avoid fines and the suspension of your driving privileges, kindly pay by the due date."<br><br>The texts include links that, when clicked, redirect the victim to a phishing website designed to look like a legitimate toll authority site. The site attempts to harvest sensitive information such as names, email addresses, physical addresses, and credit card details. In one twist, because Apple iMessage disables links from unknown senders, the scammers instruct victims to reply to the message to make the links clickable.</p><h3>How Does This Type of Phishing Work?</h3><p><br>This scam is a classic example of SMS phishing (or “smishing”). Unlike email-based phishing, smishing takes advantage of the trust users place in text messages—especially when they appear to come from reputable institutions like toll agencies. The attackers use various tactics to bypass anti-spam measures, including sending messages from seemingly random email addresses and leveraging automated phishing-as-a-service platforms like Lucid and Darcula. These platforms utilize encrypted iMessage and RCS messaging to spread the scam at scale, often under the guise of legitimate traffic, making detection more difficult.</p><p>Once the victim clicks on the link (or replies to enable clickable links), they are redirected to a mobile-optimized phishing page. For desktop users, the phishing site might not even load, which suggests that the attackers are specifically targeting mobile devices—a common tactic in smishing campaigns.</p><figure id="figure-mjol5557mm980t4wa"><img id="mjol5557mm980t4wa" src="https://media.gettyimages.com/id/1490363428/photo/a-woman-receiving-an-alert-message-from-bank-regarding-unauthorised-credit-card-transaction.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=vMkZyAkga1lpSRC3BNPc0juG_0aScqa4vd5_2R4KfLk=" alt="A woman receiving an alert message from bank regarding unauthorised credit card transaction on her smartphone." title="A woman receiving an alert message from bank regarding unauthorised credit card transaction on her smartphone." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1490363428/photo/a-woman-receiving-an-alert-message-from-bank-regarding-unauthorised-credit-card-transaction.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=vMkZyAkga1lpSRC3BNPc0juG_0aScqa4vd5_2R4KfLk=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>What to Do If You Encounter This Scam</h3><p><br>If you receive a text message that appears to come from E-ZPass or another toll authority asking for urgent payment, take the following precautions:</p><ul><li>Do Not Click the Link: Avoid clicking on any links in the text, especially if the message asks you to reply in order to make the link clickable.</li><li>Verify Through Official Channels: Instead of using the link provided, manually visit your toll agency's official website or use a known official app to check for any outstanding payments.</li><li>Block and Report: Block the sender and report the number through your mobile carrier or directly to Apple, if you are using iMessage. This helps authorities track and mitigate the spread of the scam.</li><li>Stay Wary of Urgency: Be skeptical of any text messages urging immediate action, threatening fines, or stating that your driving privileges or services will be suspended if you don’t co mply.</li><li>Educate Yourself and Your Team: Regularly update yourself on common phishing tactics and share this knowledge with colleagues and family members to reduce the risk of falling victim to similar scams.<br></li></ul><figure id="figure-s921ygniccm980v687" class=""><img id="s921ygniccm980v687" src="https://media.gettyimages.com/id/1443021551/photo/cartoon-style-human-hand-clicking-over-a-yellow-push-button-report-word-is-written-on-push.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=pJQv8noT27-sRXxgqmYU_G0d595N21_v8vJlp62Ss6U=" alt="Cartoon Style Human Hand Clicking Over A Yellow Push Button: Report Word Is Written On Push Button" title="Cartoon Style Human Hand Clicking Over A Yellow Push Button: Report Word Is Written On Push Button" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1443021551/photo/cartoon-style-human-hand-clicking-over-a-yellow-push-button-report-word-is-written-on-push.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=pJQv8noT27-sRXxgqmYU_G0d595N21_v8vJlp62Ss6U=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Final Thoughts</h3><p><br>The persistent nature of these phishing campaigns underlines the need for vigilance and proactive security measures. Cybercriminals continually adapt their tactics, and even familiar services and trusted brands like E-ZPass are not immune from exploitation.</p><p>Stay safe and remember: when in doubt, always verify through trusted sources rather than clicking directly on links in unsolicited texts.<br></p>

E-ZPass Toll Payment Texts Return in Massive Phishing Wave

Quantum Computing Futuristic Technology Digital Cyberspace

<p>As quantum computing advances, it brings both groundbreaking opportunities and significant challenges, particularly in the realm of cybersecurity. Traditional encryption methods, foundational to securing digital communications, face potential obsolescence in the face of quantum capabilities. Understanding this looming threat and preparing for a quantum-resistant future is imperative for safeguarding sensitive information.​</p><h3>Understanding Quantum Computing's Impact on Encryption</h3><p>Quantum computers leverage principles of quantum mechanics to process information in ways that classical computers cannot. This allows them to solve complex mathematical problems more efficiently. Notably, Shor's algorithm enables quantum computers to factor large integers and solve discrete logarithms exponentially faster than classical methods. These capabilities directly undermine the security of widely-used public-key cryptographic systems like RSA and ECC, which rely on the difficulty of these mathematical problems for their strength.</p><h3>Impact of Quantum Computing on the Financial Industry</h3><p>The financial sector, heavily reliant on robust encryption to protect transactions, customer data, and communications, faces significant challenges with the advent of quantum computing. Quantum computers possess the potential to break widely used cryptographic algorithms, such as RSA and ECC, which underpin the security of financial systems. This vulnerability could lead to unauthorized access to sensitive information, fraud, and systemic risks within global financial markets.</p><p><strong>Specific Risks to Financial Institutions:</strong></p><ul><li><strong>Data Breaches:</strong> Quantum capabilities could decrypt previously secure data, exposing customer information and transaction details.</li><li><strong>Transaction Fraud:</strong> Compromised encryption may allow attackers to alter transaction data, leading to financial losses and undermining trust in financial systems. ​</li><li><strong>Regulatory and Compliance Challenges:</strong> Financial institutions must navigate evolving regulations related to quantum security, ensuring compliance while implementing new cryptographic standards.</li></ul><p> </p><h3>The 'Harvest Now, Decrypt Later' Threat</h3><p>A pressing concern is the "Harvest Now, Decrypt Later" strategy employed by malicious actors. In this approach, encrypted data is collected and stored with the anticipation that future quantum computers will decrypt it once they become sufficiently powerful. This tactic poses a significant risk to data with long-term confidentiality requirements, such as government communications, financial records, and personal information. ​</p><figure id="figure-uq8t4v9r9m8z13e98"><img id="uq8t4v9r9m8z13e98" src="https://media.gettyimages.com/id/1492456388/photo/business-processes-quantum-computing-data-cloud-computing-digital-technology.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=8ViJlSytzFUkMMoVwHbqdS_UgiLB_e23k6cAsna-nWU=" alt="Business Processes, Quantum Computing, Data, Cloud Computing, Digital Technology" title="Business Processes, Quantum Computing, Data, Cloud Computing, Digital Technology" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1492456388/photo/business-processes-quantum-computing-data-cloud-computing-digital-technology.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=8ViJlSytzFUkMMoVwHbqdS_UgiLB_e23k6cAsna-nWU=" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h3>Advancements in Post-Quantum Cryptography</h3><p>To counteract quantum threats, the development and adoption of post-quantum cryptography (PQC) are underway. PQC encompasses cryptographic algorithms designed to be secure against both quantum and classical computers. The National Institute of Standards and Technology (NIST) has initiated a process to standardize these quantum-resistant algorithms, marking a pivotal step toward securing digital communications in the quantum era. ​</p><h3>Recent Developments in Quantum Computing</h3><p>Recent breakthroughs in quantum computing have accelerated concerns regarding encryption vulnerabilities. For instance, Quantinuum announced the successful generation of "genuine randomness" using their 56-qubit System Model H2, a task unattainable by classical computers.&nbsp;In addition, Microsoft has unveiled the "Majorana 1" chip, a significant breakthrough in quantum computing. This processor utilizes a novel state of matter called topological superconductivity to create more stable and reliable qubits. Microsoft's innovation aims to accelerate the development of functional quantum computers, potentially reducing the timeline from decades to just a few years.</p><p>These developments highlight the rapid progress in quantum computing and the pressing need to develop quantum-resistant encryption methods to protect sensitive information in the impending quantum era.</p><h3>Proactive Measures for Organizations</h3><ul><li><strong>Assessing Vulnerabilities:</strong> Identify and evaluate systems and data susceptible to quantum attacks, focusing on those relying on public-key cryptography.​</li><li><strong>Developing Migration Strategies:</strong> Create comprehensive plans to transition to quantum-resistant algorithms, considering factors like implementation timelines, resource allocation, and potential operational impacts.​</li><li><strong>Staying Informed:</strong> Keep abreast of advancements in quantum computing and evolving cryptographic standards to ensure timely and effective responses to emerging threats.</li><li><strong>Collaborating with Experts:</strong> Engage with cybersecurity professionals and industry groups to share insights, strategies, and best practices for navigating the quantum transition.</li></ul><figure id="figure-breaytmufm8z1guge"><img id="breaytmufm8z1guge" src="https://media.gettyimages.com/id/1492457274/photo/business-computing-solution-artificial-intelligence-quantum-computing-data-technology-digital.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=BYZj2PY1R4ZtPWRy-9XSUqR3eQufmRMFeoSdV-dlJjY=" alt="Business Computing Solution, Artificial Intelligence, Quantum Computing, Data, Technology, Digital Transformation" title="Business Computing Solution, Artificial Intelligence, Quantum Computing, Data, Technology, Digital Transformation" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1492457274/photo/business-computing-solution-artificial-intelligence-quantum-computing-data-technology-digital.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=BYZj2PY1R4ZtPWRy-9XSUqR3eQufmRMFeoSdV-dlJjY=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Conclusion</h3><p>The advent of quantum computing represents a paradigm shift in information security. While the full realization of quantum capabilities may still be years away, the time to act is now. By understanding the risks, investing in research, and preparing for a transition to quantum-resistant cryptography, we can safeguard our digital infrastructure against the quantum challenges on the horizon.</p>

The Impending Quantum Threat to Modern Encryption

<p>Cybersecurity researchers have uncovered three distinct bypass methods that undermine Ubuntu Linux’s unprivileged user namespace restrictions. These bypasses allow local unprivileged users to create user namespaces with full administrative capabilities—opening the door to exploiting vulnerabilities in key kernel components. This issue impacts Ubuntu versions 23.10 (where these restrictions are enabled) and 24.04 (where they are active by default).</p><h3>Understanding the Vulnerability</h3><p><br>Linux user namespaces allow users to operate with root-like privileges inside isolated containers without having the same level of control over the host system. To limit the risks associated with this powerful feature, Ubuntu introduced AppArmor-based restrictions starting in version 23.10 and enforced them by default in 24.04. However, researchers at Qualys have now discovered three bypasses that enable local attackers to sidestep these restrictions:</p><ul><li>Bypass via aa-exec:<ul><li>Attackers exploit the aa-exec tool, which runs programs under specific AppArmor profiles. Some profiles—such as those for Trinity, Chrome, or Flatpak—are permissive enough to allow unrestricted user namespace creation. By invoking the unshare command through aa-exec under these profiles, an attacker can effectively bypass the restrictions and obtain full administrative capabilities within a namespace.</li></ul></li><li>Bypass via BusyBox:<ul><li>BusyBox, the lightweight shell included by default in Ubuntu Server and Desktop, is bound to an AppArmor profile that permits full user namespace creation. By launching a shell via BusyBox and executing the unshare command, an attacker can successfully create a user namespace with elevated privileges.</li></ul></li><li>Bypass via LD_PRELOAD:<ul><li>Leveraging the dynamic linker’s LD_PRELOAD environment variable, attackers can inject custom shared libraries into trusted processes. For instance, by injecting a shell into a program like Nautilus—which runs under a permissive AppArmor profile—an attacker can initiate a privileged namespace from within that process, thereby circumventing the intended restrictions.</li></ul></li></ul><figure id="figure-hccfzpblqpm8xjr2zz"><img id="hccfzpblqpm8xjr2zz" src="https://media.gettyimages.com/id/2173061198/photo/3d-computer-bug-icon-on-the-glossy-futuristic-surface-with-abstract-glowing-dots-and-lines.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=6DwpSOELJNoL0BSpygB8gI45biHo5w1HAay9XFE-5No=" alt="3D computer bug icon on the glossy futuristic surface with abstract glowing dots and lines" title="3D computer bug icon on the glossy futuristic surface with abstract glowing dots and lines" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2173061198/photo/3d-computer-bug-icon-on-the-glossy-futuristic-surface-with-abstract-glowing-dots-and-lines.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=6DwpSOELJNoL0BSpygB8gI45biHo5w1HAay9XFE-5No=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>The Broader Implications</h3><p><br>While these bypasses do not grant complete control of the system by themselves, they significantly lower the bar for exploiting other kernel vulnerabilities that require elevated privileges. The combined effect can be dangerous, especially when attackers can reinfect systems or leverage these bypasses to launch further attacks.</p><h3>Canonical’s Response and Mitigations</h3><p><br>Canonical, the company behind Ubuntu Linux, has acknowledged the findings and is actively working on enhancing AppArmor protections. Although these bypasses are seen as limitations in a defense-in-depth mechanism rather than critical vulnerabilities, administrators should take immediate steps to mitigate the risks.</p><p>Canonical recommends the following hardening measures:</p><ul><li>Enable the Kernel Parameter:<ul><li>Set kernel.apparmor_restrict_unprivileged_unconfined=1 to block aa-exec abuse. (Note: This is not enabled by default.)</li></ul></li><li>Disable Broad AppArmor Profiles:<ul><li>Consider disabling permissive profiles for BusyBox and Nautilus that allow unrestricted namespace creation.<br></li></ul></li><li>Apply Stricter Profiles:<ul><li>Optionally, apply a more stringent Bubblewrap (bwrap) AppArmor profile for applications like Nautilus that rely on user namespaces.</li></ul></li><li>Review Active Profiles:<ul><li>Use the aa-status command to identify and disable any risky AppArmor profiles.</li></ul></li></ul><figure id="figure-v5yhj2dp2fm8xjfl7a"><img id="v5yhj2dp2fm8xjfl7a" src="https://media.gettyimages.com/id/489002840/photo/it-concept-system-protection-a02.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=SaW6oEY7pCKcM7pWIRh-PII51hbfkF6cEwhPvJsXsNo=" alt="IT Concept System Protection A02" title="IT Concept System Protection A02" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/489002840/photo/it-concept-system-protection-a02.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=SaW6oEY7pCKcM7pWIRh-PII51hbfkF6cEwhPvJsXsNo=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Conclusion</h3><p><br>The discovery of these bypass methods underscores the ongoing challenges in securing complex operating systems like Ubuntu Linux. As cyber threats evolve, even well-established defense mechanisms such as user namespaces and AppArmor restrictions require continuous reassessment and hardening.</p><p>Staying proactive with manual mitigations and keeping systems updated is essential to minimizing the risk of exploitation. While Canonical works on long-term improvements, administrators must implement these recommended measures to safeguard their environments.</p><p><br></p><p><br>At TechHorizon Consulting, we understand that evolving cyber threats demand a proactive approach to security. We specialize in securing your IT infrastructure by identifying vulnerabilities, enforcing strict security measures, and providing continuous monitoring to protect your digital assets. If your organization relies on Linux systems or other critical infrastructure, now is the time to assess your security posture.</p><p>Contact TechHorizon Consulting today to implement advanced protection strategies and safeguard your organization against emerging cyber threats.</p>

Securing Ubuntu: How to Mitigate New User Namespace Bypasses

Digital security concept. protect data. lock sign on CPU. copy space

<p><br></p><p>A serious security flaw has been discovered in Next.js, one of the most popular frameworks for building modern websites and web applications. This vulnerability, officially designated CVE-2025-29927, allows attackers to bypass important security checks, potentially granting unauthorized access to sensitive areas of a website.</p><p>If your website or application is built with Next.js, it is essential to update immediately to mitigate the risk.</p><h3>What Is Next.js and Why Does This Matter?</h3><p>For those unfamiliar, Next.js is a framework used by developers to build high-performance websites and applications. It is widely adopted due to its ability to improve development speed, efficiency, and scalability. Many well-known companies rely on Next.js to power their digital platforms.</p><p>A security vulnerability in a widely used framework like this is significant because it could affect thousands of websites, potentially exposing user data, sensitive business information, and administrative controls to attackers.</p><h3>Understanding the Vulnerability</h3><p>The issue stems from a special internal security mechanism that Next.js uses to manage how requests are processed in an application. This mechanism relies on the <strong>x-middleware-subrequest</strong> header to ensure that certain system processes function correctly.</p><p>By manipulating this header, an attacker can trick Next.js into skipping critical security checks. This could allow unauthorized access to areas of a website that should be protected, including admin panels, user accounts, and restricted content.</p><p>In simpler terms, this vulnerability is comparable to a faulty security gate. If someone discovers how to bypass it, they can gain access to areas that are supposed to be restricted—without triggering any alarms.</p><figure id="figure-2jfc4pf1xmm8rgzip0"><img id="2jfc4pf1xmm8rgzip0" src="https://media.gettyimages.com/id/1324696780/photo/search-bar-concept.jpg?b=1&s=2048x2048&w=0&k=20&c=8ulHymcF102lQwDHPfRaOHyl1Lgv3splGfgmMyK_CGw=" alt="Search bar concept" title="Search bar concept" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><h3>Who Is Affected?</h3><p>Not every Next.js website is vulnerable, but many are. The issue specifically affects websites that are self-hosted, use the next start command for deployment, and are deployed using the ‘standalone’ output option, which is common in production environments.</p><p>However, websites hosted on platforms such as Vercel or Netlify are not affected because these providers implement their own security measures.</p><h3>Severity of the Threat</h3><p>Security experts have assigned this vulnerability a CVSS score of 9.1 out of 10, categorizing it as critical. This rating indicates that attackers could actively exploit this issue to bypass authentication systems and other protective measures, potentially leading to data theft, account takeovers, or even full website compromise.</p><h3>Recommended Actions</h3><p>If your website or application uses Next.js, it is crucial to update to a secure version as soon as possible. The following Next.js versions contain the necessary security patch:</p><ul><li><strong>12.3.5</strong></li><li><strong>13.5.9</strong></li><li><strong>14.2.25</strong></li><li><strong>15.2.3</strong></li></ul><p>For organizations that cannot update immediately, a temporary workaround involves configuring the web server or reverse proxy (such as Nginx, Apache, or Cloudflare) to block external requests containing the x-middleware-subrequest header. This measure can prevent attackers from exploiting the vulnerability while an update is being planned.</p><figure id="figure-vmucwf4gpm8rgyctc"><img id="vmucwf4gpm8rgyctc" src="https://media.gettyimages.com/id/1560590937/photo/global-communication.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=NEXWOkBiwYSbaeRIYW8puCDrRUcrwPMenSau08kg6PQ=" alt="Global Communication (World Map Credits To NASA)" title="Global Communication (World Map Credits To NASA)" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1560590937/photo/global-communication.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=NEXWOkBiwYSbaeRIYW8puCDrRUcrwPMenSau08kg6PQ=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>How This Was Discovered</h3><p>This vulnerability was first reported on February 27, 2025, by a security researcher. The response from the Next.js team was swift, with a structured rollout of security patches.</p><p><strong>Timeline of Events</strong></p><ul><li>February 27, 2025 – Vulnerability reported to the Next.js security team.</li><li>March 14, 2025 – The issue was confirmed, and patch development began.</li><li>March 18, 2025 – The first set of security updates was released.</li><li>March 21, 2025 – A public security advisory was issued to notify developers.</li><li>March 22-23, 2025 – Additional updates were provided for older versions of Next.js.</li></ul><p>The quick response from the Next.js team has helped mitigate widespread exploitation, but any website that has not yet updated remains at risk.</p><h3>Conclusion</h3><p>This incident serves as an important reminder of the need for regular software updates and proactive security practices. Cybercriminals continually seek out vulnerabilities, and even widely trusted frameworks like Next.js can be exposed to security risks.</p><p>For organizations using Next.js, the recommended course of action is clear: update to the latest patched version immediately, work with your development team to review security settings and configurations, and monitor for any unusual activity to detect potential unauthorized access attempts.</p><p>If you and your buisness would like to prevent attacks like these before they happen, vist our "Contact Us page". With our vCISO service we can provide you with continuous network monitoring to mitigate threats. Taking these steps will help safeguard your website, protect user data, and maintain trust in your platform.</p><p><br></p>

Articles

Symlink Exploit Enables Continued Access to Patched Forti...

FortiNet Addresses Critical FortiSwitch Vulnerability

E-ZPass Toll Payment Texts Return in Massive Phishing Wave

The Impending Quantum Threat to Modern Encryption

Securing Ubuntu: How to Mitigate New User Namespace Bypasses

Critical Next.js Web Vulnerability Allows Attackers to By...

Articles

Symlink Exploit Enables Continued Access to Patched Forti...

​FortiNet Addresses Critical FortiSwitch Vulnerability

E-ZPass Toll Payment Texts Return in Massive Phishing Wave

The Impending Quantum Threat to Modern Encryption

Securing Ubuntu: How to Mitigate New User Namespace Bypasses

Critical Next.js Web Vulnerability Allows Attackers to By...

FortiNet Addresses Critical FortiSwitch Vulnerability