Blog

Abstract Warning of a detected malware program

<p>Fortinet recently released patches for a critical security vulnerability in its FortiSwitch devices, it was discovered internally and identified as CVE-2024-48887. This flaw allows attackers to create bogus web requests that invoke the device to change its administrator password.</p><h3>Vulnerability Details</h3><p>The vulnerability stems from the FortiSwitch GUI's set_password endpoint, attackers can send an unverified web request to the endpoint&nbsp; to change the administrator password. Exploiting this flaw does not require the attacker have any access to the device, remote or otherwise. This makes it a critical vulnerability for companies using FortiSwitch devices.</p><h3>Affected Versions and Patching Recommendations</h3><p>Fortinet advised customers to patch this vulnerability by updating to the following firmware versions:​</p><p>FortiSwitch 7.6.0: Upgrade to version 7.6.1 or later.​<br>FortiSwitch 7.4.0 through 7.4.4: Upgrade to version 7.4.5 or later.​<br>FortiSwitch 7.2.0 through 7.2.8: Upgrade to version 7.2.9 or later.​<br>FortiSwitch 7.0.0 through 7.0.10: Upgrade to version 7.0.11 or later.​<br>FortiSwitch 6.4.0 through 6.4.14: Upgrade to version 6.4.15 or later.​</p><p><br>Update your FortiSwitch devices to the latest firmware versions as soon as possible to mitigate this security risk. Fortinet recommends disabling the remote admin interface on FortiSwitch devices unless it is absolutely needed.</p><h3>Recent Fortinet Vulnerabilities</h3><p>This disclosure follows another vulnerability that was disclosed in February 2024 which affected FortiOS and FortiProxy systems. Though exploited in 2022 the vulnerability was only disclosed in 2024. This vulnerability allowed attackers bypass authentication and obtain super-admin privileges. Fortinet released patches to address this issue, but some 15,000 devices had their configurations leaked. &nbsp;</p><figure id="figure-kqnoc45nzqm9ah4cmd"><img id="kqnoc45nzqm9ah4cmd" src="https://media.gettyimages.com/id/2020226448/photo/abstract-technology-connections-background.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=_zJRF-f6qp2F-NSPmC4EYaZM1UK0uUVyAPXv5lTZiUg=" alt="Abstract Technology Connections Background" title="Abstract Technology Connections Background" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2020226448/photo/abstract-technology-connections-background.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=_zJRF-f6qp2F-NSPmC4EYaZM1UK0uUVyAPXv5lTZiUg=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Recommendations for Fortinet Users</h3><p>To ensure the security of Fortinet devices:</p><ul><li>Regularly Update Firmware: Always keep Fortinet devices updated with the latest firmware releases to protect against known vulnerabilities.​</li><li>Monitor Official Advisories: Stay informed by regularly checking Fortinet's official security advisories and subscribing to relevant cybersecurity alert services.​<br></li><li>Implement Robust Security Practices: Beyond patching, adopt comprehensive security measures, including strong access controls, network segmentation, and continuous monitoring for suspicious activities.​</li></ul><p>By proactively managing device security and staying informed about potential vulnerabilities, organizations can better protect their networks from emerging threats.</p><h3>Conclusion&nbsp;</h3><p>The recent vulnerabilities in Fortinet products, particularly CVE-2024-48887 in FortiSwitch devices, highlight the critical importance of proactive cybersecurity measures. Organizations must prioritize timely firmware updates and adhere to best security practices to safeguard their networks against potential exploits. If your company is concered about potential threats, visit our "Contact Us" page. With our vCISO services we can provide continous network monitoring for your company as well as a plethora of other services. Staying vigilant and responsive to security advisories ensures the integrity and resilience of network infrastructures.&nbsp;</p>

​FortiNet Addresses Critical FortiSwitch Vulnerability

<p>Scammers are targeting consumers by impersonating well-known toll and transit services. In a renewed phishing campaign, scammers impersonate E-ZPass and other toll agencies to send fraudulent SMS texts aimed at stealing personal and credit card information. This scam, which the FBI warned about back in April 2024, has now experienced a significant resurgence, with many victims reporting up to seven scam texts in a single day.</p><h3>What Is the Scam?</h3><p><br>In this campaign, unsuspecting users receive text messages that appear to be sent from E-ZPass or similar toll authorities. These messages employ urgent language to create a sense of panic. For example, a typical scam text might read:</p><p>"Your toll payment for E-ZPass Lane must be settled by April 4, 2025. To avoid fines and the suspension of your driving privileges, kindly pay by the due date."<br><br>The texts include links that, when clicked, redirect the victim to a phishing website designed to look like a legitimate toll authority site. The site attempts to harvest sensitive information such as names, email addresses, physical addresses, and credit card details. In one twist, because Apple iMessage disables links from unknown senders, the scammers instruct victims to reply to the message to make the links clickable.</p><h3>How Does This Type of Phishing Work?</h3><p><br>This scam is a classic example of SMS phishing (or “smishing”). Unlike email-based phishing, smishing takes advantage of the trust users place in text messages—especially when they appear to come from reputable institutions like toll agencies. The attackers use various tactics to bypass anti-spam measures, including sending messages from seemingly random email addresses and leveraging automated phishing-as-a-service platforms like Lucid and Darcula. These platforms utilize encrypted iMessage and RCS messaging to spread the scam at scale, often under the guise of legitimate traffic, making detection more difficult.</p><p>Once the victim clicks on the link (or replies to enable clickable links), they are redirected to a mobile-optimized phishing page. For desktop users, the phishing site might not even load, which suggests that the attackers are specifically targeting mobile devices—a common tactic in smishing campaigns.</p><figure id="figure-mjol5557mm980t4wa"><img id="mjol5557mm980t4wa" src="https://media.gettyimages.com/id/1490363428/photo/a-woman-receiving-an-alert-message-from-bank-regarding-unauthorised-credit-card-transaction.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=vMkZyAkga1lpSRC3BNPc0juG_0aScqa4vd5_2R4KfLk=" alt="A woman receiving an alert message from bank regarding unauthorised credit card transaction on her smartphone." title="A woman receiving an alert message from bank regarding unauthorised credit card transaction on her smartphone." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1490363428/photo/a-woman-receiving-an-alert-message-from-bank-regarding-unauthorised-credit-card-transaction.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=vMkZyAkga1lpSRC3BNPc0juG_0aScqa4vd5_2R4KfLk=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>What to Do If You Encounter This Scam</h3><p><br>If you receive a text message that appears to come from E-ZPass or another toll authority asking for urgent payment, take the following precautions:</p><ul><li>Do Not Click the Link: Avoid clicking on any links in the text, especially if the message asks you to reply in order to make the link clickable.</li><li>Verify Through Official Channels: Instead of using the link provided, manually visit your toll agency's official website or use a known official app to check for any outstanding payments.</li><li>Block and Report: Block the sender and report the number through your mobile carrier or directly to Apple, if you are using iMessage. This helps authorities track and mitigate the spread of the scam.</li><li>Stay Wary of Urgency: Be skeptical of any text messages urging immediate action, threatening fines, or stating that your driving privileges or services will be suspended if you don’t co mply.</li><li>Educate Yourself and Your Team: Regularly update yourself on common phishing tactics and share this knowledge with colleagues and family members to reduce the risk of falling victim to similar scams.<br></li></ul><figure id="figure-s921ygniccm980v687" class=""><img id="s921ygniccm980v687" src="https://media.gettyimages.com/id/1443021551/photo/cartoon-style-human-hand-clicking-over-a-yellow-push-button-report-word-is-written-on-push.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=pJQv8noT27-sRXxgqmYU_G0d595N21_v8vJlp62Ss6U=" alt="Cartoon Style Human Hand Clicking Over A Yellow Push Button: Report Word Is Written On Push Button" title="Cartoon Style Human Hand Clicking Over A Yellow Push Button: Report Word Is Written On Push Button" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1443021551/photo/cartoon-style-human-hand-clicking-over-a-yellow-push-button-report-word-is-written-on-push.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=pJQv8noT27-sRXxgqmYU_G0d595N21_v8vJlp62Ss6U=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Final Thoughts</h3><p><br>The persistent nature of these phishing campaigns underlines the need for vigilance and proactive security measures. Cybercriminals continually adapt their tactics, and even familiar services and trusted brands like E-ZPass are not immune from exploitation.</p><p>Stay safe and remember: when in doubt, always verify through trusted sources rather than clicking directly on links in unsolicited texts.<br></p>

E-ZPass Toll Payment Texts Return in Massive Phishing Wave

Quantum Computing Futuristic Technology Digital Cyberspace

<p>As quantum computing advances, it brings both groundbreaking opportunities and significant challenges, particularly in the realm of cybersecurity. Traditional encryption methods, foundational to securing digital communications, face potential obsolescence in the face of quantum capabilities. Understanding this looming threat and preparing for a quantum-resistant future is imperative for safeguarding sensitive information.​</p><h3>Understanding Quantum Computing's Impact on Encryption</h3><p>Quantum computers leverage principles of quantum mechanics to process information in ways that classical computers cannot. This allows them to solve complex mathematical problems more efficiently. Notably, Shor's algorithm enables quantum computers to factor large integers and solve discrete logarithms exponentially faster than classical methods. These capabilities directly undermine the security of widely-used public-key cryptographic systems like RSA and ECC, which rely on the difficulty of these mathematical problems for their strength.</p><h3>Impact of Quantum Computing on the Financial Industry</h3><p>The financial sector, heavily reliant on robust encryption to protect transactions, customer data, and communications, faces significant challenges with the advent of quantum computing. Quantum computers possess the potential to break widely used cryptographic algorithms, such as RSA and ECC, which underpin the security of financial systems. This vulnerability could lead to unauthorized access to sensitive information, fraud, and systemic risks within global financial markets.</p><p><strong>Specific Risks to Financial Institutions:</strong></p><ul><li><strong>Data Breaches:</strong> Quantum capabilities could decrypt previously secure data, exposing customer information and transaction details.</li><li><strong>Transaction Fraud:</strong> Compromised encryption may allow attackers to alter transaction data, leading to financial losses and undermining trust in financial systems. ​</li><li><strong>Regulatory and Compliance Challenges:</strong> Financial institutions must navigate evolving regulations related to quantum security, ensuring compliance while implementing new cryptographic standards.</li></ul><p> </p><h3>The 'Harvest Now, Decrypt Later' Threat</h3><p>A pressing concern is the "Harvest Now, Decrypt Later" strategy employed by malicious actors. In this approach, encrypted data is collected and stored with the anticipation that future quantum computers will decrypt it once they become sufficiently powerful. This tactic poses a significant risk to data with long-term confidentiality requirements, such as government communications, financial records, and personal information. ​</p><figure id="figure-uq8t4v9r9m8z13e98"><img id="uq8t4v9r9m8z13e98" src="https://media.gettyimages.com/id/1492456388/photo/business-processes-quantum-computing-data-cloud-computing-digital-technology.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=8ViJlSytzFUkMMoVwHbqdS_UgiLB_e23k6cAsna-nWU=" alt="Business Processes, Quantum Computing, Data, Cloud Computing, Digital Technology" title="Business Processes, Quantum Computing, Data, Cloud Computing, Digital Technology" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1492456388/photo/business-processes-quantum-computing-data-cloud-computing-digital-technology.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=8ViJlSytzFUkMMoVwHbqdS_UgiLB_e23k6cAsna-nWU=" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h3>Advancements in Post-Quantum Cryptography</h3><p>To counteract quantum threats, the development and adoption of post-quantum cryptography (PQC) are underway. PQC encompasses cryptographic algorithms designed to be secure against both quantum and classical computers. The National Institute of Standards and Technology (NIST) has initiated a process to standardize these quantum-resistant algorithms, marking a pivotal step toward securing digital communications in the quantum era. ​</p><h3>Recent Developments in Quantum Computing</h3><p>Recent breakthroughs in quantum computing have accelerated concerns regarding encryption vulnerabilities. For instance, Quantinuum announced the successful generation of "genuine randomness" using their 56-qubit System Model H2, a task unattainable by classical computers.&nbsp;In addition, Microsoft has unveiled the "Majorana 1" chip, a significant breakthrough in quantum computing. This processor utilizes a novel state of matter called topological superconductivity to create more stable and reliable qubits. Microsoft's innovation aims to accelerate the development of functional quantum computers, potentially reducing the timeline from decades to just a few years.</p><p>These developments highlight the rapid progress in quantum computing and the pressing need to develop quantum-resistant encryption methods to protect sensitive information in the impending quantum era.</p><h3>Proactive Measures for Organizations</h3><ul><li><strong>Assessing Vulnerabilities:</strong> Identify and evaluate systems and data susceptible to quantum attacks, focusing on those relying on public-key cryptography.​</li><li><strong>Developing Migration Strategies:</strong> Create comprehensive plans to transition to quantum-resistant algorithms, considering factors like implementation timelines, resource allocation, and potential operational impacts.​</li><li><strong>Staying Informed:</strong> Keep abreast of advancements in quantum computing and evolving cryptographic standards to ensure timely and effective responses to emerging threats.</li><li><strong>Collaborating with Experts:</strong> Engage with cybersecurity professionals and industry groups to share insights, strategies, and best practices for navigating the quantum transition.</li></ul><figure id="figure-breaytmufm8z1guge"><img id="breaytmufm8z1guge" src="https://media.gettyimages.com/id/1492457274/photo/business-computing-solution-artificial-intelligence-quantum-computing-data-technology-digital.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=BYZj2PY1R4ZtPWRy-9XSUqR3eQufmRMFeoSdV-dlJjY=" alt="Business Computing Solution, Artificial Intelligence, Quantum Computing, Data, Technology, Digital Transformation" title="Business Computing Solution, Artificial Intelligence, Quantum Computing, Data, Technology, Digital Transformation" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1492457274/photo/business-computing-solution-artificial-intelligence-quantum-computing-data-technology-digital.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=BYZj2PY1R4ZtPWRy-9XSUqR3eQufmRMFeoSdV-dlJjY=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Conclusion</h3><p>The advent of quantum computing represents a paradigm shift in information security. While the full realization of quantum capabilities may still be years away, the time to act is now. By understanding the risks, investing in research, and preparing for a transition to quantum-resistant cryptography, we can safeguard our digital infrastructure against the quantum challenges on the horizon.</p>

The Impending Quantum Threat to Modern Encryption

<p>Cybersecurity researchers have uncovered three distinct bypass methods that undermine Ubuntu Linux’s unprivileged user namespace restrictions. These bypasses allow local unprivileged users to create user namespaces with full administrative capabilities—opening the door to exploiting vulnerabilities in key kernel components. This issue impacts Ubuntu versions 23.10 (where these restrictions are enabled) and 24.04 (where they are active by default).</p><h3>Understanding the Vulnerability</h3><p><br>Linux user namespaces allow users to operate with root-like privileges inside isolated containers without having the same level of control over the host system. To limit the risks associated with this powerful feature, Ubuntu introduced AppArmor-based restrictions starting in version 23.10 and enforced them by default in 24.04. However, researchers at Qualys have now discovered three bypasses that enable local attackers to sidestep these restrictions:</p><ul><li>Bypass via aa-exec:<ul><li>Attackers exploit the aa-exec tool, which runs programs under specific AppArmor profiles. Some profiles—such as those for Trinity, Chrome, or Flatpak—are permissive enough to allow unrestricted user namespace creation. By invoking the unshare command through aa-exec under these profiles, an attacker can effectively bypass the restrictions and obtain full administrative capabilities within a namespace.</li></ul></li><li>Bypass via BusyBox:<ul><li>BusyBox, the lightweight shell included by default in Ubuntu Server and Desktop, is bound to an AppArmor profile that permits full user namespace creation. By launching a shell via BusyBox and executing the unshare command, an attacker can successfully create a user namespace with elevated privileges.</li></ul></li><li>Bypass via LD_PRELOAD:<ul><li>Leveraging the dynamic linker’s LD_PRELOAD environment variable, attackers can inject custom shared libraries into trusted processes. For instance, by injecting a shell into a program like Nautilus—which runs under a permissive AppArmor profile—an attacker can initiate a privileged namespace from within that process, thereby circumventing the intended restrictions.</li></ul></li></ul><figure id="figure-hccfzpblqpm8xjr2zz"><img id="hccfzpblqpm8xjr2zz" src="https://media.gettyimages.com/id/2173061198/photo/3d-computer-bug-icon-on-the-glossy-futuristic-surface-with-abstract-glowing-dots-and-lines.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=6DwpSOELJNoL0BSpygB8gI45biHo5w1HAay9XFE-5No=" alt="3D computer bug icon on the glossy futuristic surface with abstract glowing dots and lines" title="3D computer bug icon on the glossy futuristic surface with abstract glowing dots and lines" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2173061198/photo/3d-computer-bug-icon-on-the-glossy-futuristic-surface-with-abstract-glowing-dots-and-lines.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=6DwpSOELJNoL0BSpygB8gI45biHo5w1HAay9XFE-5No=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>The Broader Implications</h3><p><br>While these bypasses do not grant complete control of the system by themselves, they significantly lower the bar for exploiting other kernel vulnerabilities that require elevated privileges. The combined effect can be dangerous, especially when attackers can reinfect systems or leverage these bypasses to launch further attacks.</p><h3>Canonical’s Response and Mitigations</h3><p><br>Canonical, the company behind Ubuntu Linux, has acknowledged the findings and is actively working on enhancing AppArmor protections. Although these bypasses are seen as limitations in a defense-in-depth mechanism rather than critical vulnerabilities, administrators should take immediate steps to mitigate the risks.</p><p>Canonical recommends the following hardening measures:</p><ul><li>Enable the Kernel Parameter:<ul><li>Set kernel.apparmor_restrict_unprivileged_unconfined=1 to block aa-exec abuse. (Note: This is not enabled by default.)</li></ul></li><li>Disable Broad AppArmor Profiles:<ul><li>Consider disabling permissive profiles for BusyBox and Nautilus that allow unrestricted namespace creation.<br></li></ul></li><li>Apply Stricter Profiles:<ul><li>Optionally, apply a more stringent Bubblewrap (bwrap) AppArmor profile for applications like Nautilus that rely on user namespaces.</li></ul></li><li>Review Active Profiles:<ul><li>Use the aa-status command to identify and disable any risky AppArmor profiles.</li></ul></li></ul><figure id="figure-v5yhj2dp2fm8xjfl7a"><img id="v5yhj2dp2fm8xjfl7a" src="https://media.gettyimages.com/id/489002840/photo/it-concept-system-protection-a02.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=SaW6oEY7pCKcM7pWIRh-PII51hbfkF6cEwhPvJsXsNo=" alt="IT Concept System Protection A02" title="IT Concept System Protection A02" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/489002840/photo/it-concept-system-protection-a02.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=SaW6oEY7pCKcM7pWIRh-PII51hbfkF6cEwhPvJsXsNo=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Conclusion</h3><p><br>The discovery of these bypass methods underscores the ongoing challenges in securing complex operating systems like Ubuntu Linux. As cyber threats evolve, even well-established defense mechanisms such as user namespaces and AppArmor restrictions require continuous reassessment and hardening.</p><p>Staying proactive with manual mitigations and keeping systems updated is essential to minimizing the risk of exploitation. While Canonical works on long-term improvements, administrators must implement these recommended measures to safeguard their environments.</p><p><br></p><p><br>At TechHorizon Consulting, we understand that evolving cyber threats demand a proactive approach to security. We specialize in securing your IT infrastructure by identifying vulnerabilities, enforcing strict security measures, and providing continuous monitoring to protect your digital assets. If your organization relies on Linux systems or other critical infrastructure, now is the time to assess your security posture.</p><p>Contact TechHorizon Consulting today to implement advanced protection strategies and safeguard your organization against emerging cyber threats.</p>

Securing Ubuntu: How to Mitigate New User Namespace Bypasses

Digital security concept. protect data. lock sign on CPU. copy space

<p><br></p><p>A serious security flaw has been discovered in Next.js, one of the most popular frameworks for building modern websites and web applications. This vulnerability, officially designated CVE-2025-29927, allows attackers to bypass important security checks, potentially granting unauthorized access to sensitive areas of a website.</p><p>If your website or application is built with Next.js, it is essential to update immediately to mitigate the risk.</p><h3>What Is Next.js and Why Does This Matter?</h3><p>For those unfamiliar, Next.js is a framework used by developers to build high-performance websites and applications. It is widely adopted due to its ability to improve development speed, efficiency, and scalability. Many well-known companies rely on Next.js to power their digital platforms.</p><p>A security vulnerability in a widely used framework like this is significant because it could affect thousands of websites, potentially exposing user data, sensitive business information, and administrative controls to attackers.</p><h3>Understanding the Vulnerability</h3><p>The issue stems from a special internal security mechanism that Next.js uses to manage how requests are processed in an application. This mechanism relies on the <strong>x-middleware-subrequest</strong> header to ensure that certain system processes function correctly.</p><p>By manipulating this header, an attacker can trick Next.js into skipping critical security checks. This could allow unauthorized access to areas of a website that should be protected, including admin panels, user accounts, and restricted content.</p><p>In simpler terms, this vulnerability is comparable to a faulty security gate. If someone discovers how to bypass it, they can gain access to areas that are supposed to be restricted—without triggering any alarms.</p><figure id="figure-2jfc4pf1xmm8rgzip0"><img id="2jfc4pf1xmm8rgzip0" src="https://media.gettyimages.com/id/1324696780/photo/search-bar-concept.jpg?b=1&s=2048x2048&w=0&k=20&c=8ulHymcF102lQwDHPfRaOHyl1Lgv3splGfgmMyK_CGw=" alt="Search bar concept" title="Search bar concept" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><h3>Who Is Affected?</h3><p>Not every Next.js website is vulnerable, but many are. The issue specifically affects websites that are self-hosted, use the next start command for deployment, and are deployed using the ‘standalone’ output option, which is common in production environments.</p><p>However, websites hosted on platforms such as Vercel or Netlify are not affected because these providers implement their own security measures.</p><h3>Severity of the Threat</h3><p>Security experts have assigned this vulnerability a CVSS score of 9.1 out of 10, categorizing it as critical. This rating indicates that attackers could actively exploit this issue to bypass authentication systems and other protective measures, potentially leading to data theft, account takeovers, or even full website compromise.</p><h3>Recommended Actions</h3><p>If your website or application uses Next.js, it is crucial to update to a secure version as soon as possible. The following Next.js versions contain the necessary security patch:</p><ul><li><strong>12.3.5</strong></li><li><strong>13.5.9</strong></li><li><strong>14.2.25</strong></li><li><strong>15.2.3</strong></li></ul><p>For organizations that cannot update immediately, a temporary workaround involves configuring the web server or reverse proxy (such as Nginx, Apache, or Cloudflare) to block external requests containing the x-middleware-subrequest header. This measure can prevent attackers from exploiting the vulnerability while an update is being planned.</p><figure id="figure-vmucwf4gpm8rgyctc"><img id="vmucwf4gpm8rgyctc" src="https://media.gettyimages.com/id/1560590937/photo/global-communication.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=NEXWOkBiwYSbaeRIYW8puCDrRUcrwPMenSau08kg6PQ=" alt="Global Communication (World Map Credits To NASA)" title="Global Communication (World Map Credits To NASA)" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1560590937/photo/global-communication.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=NEXWOkBiwYSbaeRIYW8puCDrRUcrwPMenSau08kg6PQ=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>How This Was Discovered</h3><p>This vulnerability was first reported on February 27, 2025, by a security researcher. The response from the Next.js team was swift, with a structured rollout of security patches.</p><p><strong>Timeline of Events</strong></p><ul><li>February 27, 2025 – Vulnerability reported to the Next.js security team.</li><li>March 14, 2025 – The issue was confirmed, and patch development began.</li><li>March 18, 2025 – The first set of security updates was released.</li><li>March 21, 2025 – A public security advisory was issued to notify developers.</li><li>March 22-23, 2025 – Additional updates were provided for older versions of Next.js.</li></ul><p>The quick response from the Next.js team has helped mitigate widespread exploitation, but any website that has not yet updated remains at risk.</p><h3>Conclusion</h3><p>This incident serves as an important reminder of the need for regular software updates and proactive security practices. Cybercriminals continually seek out vulnerabilities, and even widely trusted frameworks like Next.js can be exposed to security risks.</p><p>For organizations using Next.js, the recommended course of action is clear: update to the latest patched version immediately, work with your development team to review security settings and configurations, and monitor for any unusual activity to detect potential unauthorized access attempts.</p><p>If you and your buisness would like to prevent attacks like these before they happen, vist our "Contact Us page". With our vCISO service we can provide you with continuous network monitoring to mitigate threats. Taking these steps will help safeguard your website, protect user data, and maintain trust in your platform.</p><p><br></p>

Critical Next.js Web Vulnerability Allows Attackers to Bypass Protections

<p>Cloudflare has taken a significant security step by closing all HTTP connections to its API endpoints. As of today, any unencrypted connection to api.cloudflare.com will be completely rejected, ensuring that only secure HTTPS connections are allowed. This move is designed to eliminate the risk of sensitive information being exposed over plaintext traffic, even if only momentarily before redirection.</p><h3>Why This Change Matters</h3><p><br>Previously, Cloudflare's API could be accessed over both HTTP and HTTPS. While HTTP requests were eventually redirected or rejected, the process still posed a risk—unencrypted API keys and tokens could be intercepted, particularly on public or shared Wi-Fi networks where man-in-the-middle attacks are easier to execute. By disabling HTTP ports entirely at the transport layer, Cloudflare ensures that no plaintext data is ever exchanged.</p><figure id="figure-0t8u2fso5m8nsko00"><img id="0t8u2fso5m8nsko00" src="https://media.gettyimages.com/id/1737084975/photo/api-application-programming-interface-function-and-procedure-development-technology.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=Xbmk-u0md0fDU2RGIJBycLIaemDUuhZ2qKqGAY82pS8=" alt="API, application programming interface function and procedure development technology" title="API, application programming interface function and procedure development technology" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1737084975/photo/api-application-programming-interface-function-and-procedure-development-technology.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=Xbmk-u0md0fDU2RGIJBycLIaemDUuhZ2qKqGAY82pS8=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>What the Announcement Says</h3><p><br>Cloudflare's recent announcement makes it clear:<br>“Starting today, any unencrypted connection to api.cloudflare.com will be completely rejected. Developers should not expect a 403 Forbidden response any longer for HTTP connections, as we will prevent the underlying connection to be established by closing the HTTP interface entirely. Only secure HTTPS connections will be allowed to be established.”</p><p>This means that scripts, bots, legacy systems, IoT devices, and other automated clients that rely on HTTP for API access will need to update their configurations to use HTTPS, or risk breaking functionality.</p><h3>The Impact on Developers and Businesses</h3><p><br>For many organizations that use Cloudflare’s API to manage services such as DNS records, firewall configurations, DDoS protection, caching, and SSL settings, this change is critical. Although a small percentage (about 2.4%) of internet traffic passing through Cloudflare is still done over HTTP, when accounting for automated traffic, that number jumps to nearly 17%. These numbers underscore the importance of transitioning to secure connections.</p><p>Developers can monitor their HTTP vs. HTTPS traffic through the Cloudflare dashboard under Analytics &amp; Logs &gt; Traffic Served Over SSL, which will help them estimate the impact on their environment and plan the necessary updates.</p><figure id="figure-kctnhmc32sm8ns0sb6"><img id="kctnhmc32sm8ns0sb6" src="https://media.gettyimages.com/id/1168740317/photo/secure-data-transfer-with-https-internet-connection-protocol-encryption-communication-website.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=nPyMF9d6jSWt6GqpCp2h2Qw3WhuAgjAMjBYXM9ccVHA=" alt="Secure data transfer with https internet connection protocol, encryption communication, website security concept. 3d illustration web browser with internet link and click hand cursor." title="Secure data transfer with https internet connection protocol, encryption communication, website security concept. 3d illustration web browser with internet link and click hand cursor." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1168740317/photo/secure-data-transfer-with-https-internet-connection-protocol-encryption-communication-website.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=nPyMF9d6jSWt6GqpCp2h2Qw3WhuAgjAMjBYXM9ccVHA=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Next Steps and Best Practices</h3><p><br>To adapt to this change, consider the following steps:</p><ul><li>Update Your Scripts and Tools: Ensure that all your automated tools, bots, and API clients are configured to use HTTPS instead of HTTP.</li><li>Audit Legacy Systems: Verify that any legacy systems or IoT devices that might still be using HTTP are updated or configured to default to HTTPS.</li><li>Review Cloudflare Analytics: Monitor your traffic to understand the shift and adjust your security protocols accordingly.</li><li>Stay Informed: Keep an eye on Cloudflare’s announcements for any additional measures or free options they might release to help with the transition.</li></ul><p>By enforcing HTTPS at the API level, Cloudflare not only enhances the security of its services but also sets a higher standard for protecting sensitive data across the internet.</p><p>&nbsp;<br>At TechHorizon Consulting, we understand that staying ahead of evolving cyber threats is essential. We have the knowlage to ensure that your network and digital assets are secure by implementing robust authentication protocols and continuous monitoring. If your organization depends on API services and cloud-based infrastructure, now is the time to verify your configurations and enforce secure communications.</p><p>Contact TechHorizon Consulting today to assess your security posture and implement advanced protection strategies against emerging threats.</p>

Articles

FortiNet Addresses Critical FortiSwitch Vulnerability

E-ZPass Toll Payment Texts Return in Massive Phishing Wave

The Impending Quantum Threat to Modern Encryption

Securing Ubuntu: How to Mitigate New User Namespace Bypasses

Critical Next.js Web Vulnerability Allows Attackers to By...

Cloudflare Enforces HTTPS: No More Unencrypted API Traffic

Articles

​FortiNet Addresses Critical FortiSwitch Vulnerability

E-ZPass Toll Payment Texts Return in Massive Phishing Wave

The Impending Quantum Threat to Modern Encryption

Securing Ubuntu: How to Mitigate New User Namespace Bypasses

Critical Next.js Web Vulnerability Allows Attackers to By...

Cloudflare Enforces HTTPS: No More Unencrypted API Traffic

FortiNet Addresses Critical FortiSwitch Vulnerability