i dream in Ivanti vulnerabilities now
Hackers are exploiting a new Ivanti VPN security bug to hack into company networks
Hackers are exploiting a new Ivanti VPN security bug to hack into company networks
Mandiant says a Chinese cyberespionage group has been exploiting the critical-rated vulnerability since at least mid-December.
© 2024 TechCrunch. All rights reserved. For personal use only.
tcrn.ch
January 9, 2025 at 12:58 PM
i dream in Ivanti vulnerabilities now
My fave thing about this is they used the vuln to break into.. Ivanti.
NEW: There have been a seemingly endless series of critical flaws and cybersecurity incidents related to Ivanti's VPN appliances in the last few years.
Turns out there was a major one in 2021 that wasn't reported until now, according to Bloomberg.
techcrunch.com/2026/02/23/v...
Turns out there was a major one in 2021 that wasn't reported until now, according to Bloomberg.
techcrunch.com/2026/02/23/v...
VPN flaws allowed Chinese hackers to compromise dozens of Ivanti customers, says report | TechCrunch
Chinese hackers allegedly broke into the network of an Ivanti subsidiary in 2021. The hackers exploited a backdoor in its VPN product, which allowed the hackers to gain access to 119 other unnamed org...
techcrunch.com
February 23, 2026 at 4:31 PM
My fave thing about this is they used the vuln to break into.. Ivanti.
Anybody else have Ivanti 0-day fatigue?
January 10, 2025 at 1:05 PM
Anybody else have Ivanti 0-day fatigue?
🔥 new blog detailing 0day exploitation of Ivanti appliances as well as some newly observed malware families tracked as PHASEJAM and DRYHOOK. We also detail activity related to the previously observed SPAWN* malware ecosystem tied to China-nexus cluster UNC5337.
cloud.google.com/blog/topics/...
cloud.google.com/blog/topics/...
Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation | Google Cloud Blog
Zero-day exploitation of Ivanti Connect Secure VPN vulnerabilities since as far back as December 2024.
cloud.google.com
January 9, 2025 at 12:42 AM
🔥 new blog detailing 0day exploitation of Ivanti appliances as well as some newly observed malware families tracked as PHASEJAM and DRYHOOK. We also detail activity related to the previously observed SPAWN* malware ecosystem tied to China-nexus cluster UNC5337.
cloud.google.com/blog/topics/...
cloud.google.com/blog/topics/...
UK domain giant Nominet confirms cybersecurity incident linked to Ivanti VPN hacks
UK domain giant Nominet confirms cybersecurity incident linked to Ivanti VPN hacks
Nominet, the U.K. domain registry that maintains .co.uk domains, has experienced a cybersecurity incident that it confirmed is linked to the recent exploitation of a new Ivanti VPN vulnerability. In an email to customers, seen by TechCrunch, Nominet…
tcrn.ch
January 13, 2025 at 12:20 PM
UK domain giant Nominet confirms cybersecurity incident linked to Ivanti VPN hacks
If you're using Ivanti at the perimeter, I have to presume at this point that you enjoy incident repsonse. There's no other rational explanation...
April 8, 2025 at 10:59 AM
If you're using Ivanti at the perimeter, I have to presume at this point that you enjoy incident repsonse. There's no other rational explanation...
Ivanti zero-day write-up:
"This is why they initially deemed the vulnerability 'unexploitable' - the vulnerable buffer can be overflowed only with digits and a full stop (or a 'period', for our friends over the pond)."
Big fat LOL!
labs.watchtowr.com/is-the-sofis...
"This is why they initially deemed the vulnerability 'unexploitable' - the vulnerable buffer can be overflowed only with digits and a full stop (or a 'period', for our friends over the pond)."
Big fat LOL!
labs.watchtowr.com/is-the-sofis...
Is The Sofistication In The Room With Us? - X-Forwarded-For and Ivanti Connect Secure (CVE-2025-22457)
What's that Skippy? Another Ivanti Connect Secure vulnerability?
At this point, regular readers will know all about Ivanti (and a handful of other vendors of the same class of devices), from our regu...
labs.watchtowr.com
April 5, 2025 at 7:57 PM
Ivanti zero-day write-up:
"This is why they initially deemed the vulnerability 'unexploitable' - the vulnerable buffer can be overflowed only with digits and a full stop (or a 'period', for our friends over the pond)."
Big fat LOL!
labs.watchtowr.com/is-the-sofis...
"This is why they initially deemed the vulnerability 'unexploitable' - the vulnerable buffer can be overflowed only with digits and a full stop (or a 'period', for our friends over the pond)."
Big fat LOL!
labs.watchtowr.com/is-the-sofis...
TIL that the recent Ivanti ImportXML vulnerability is a second-order XXE, where the payload must be enclosed in the CDATA section of a SOAP request 🦾
CVE 2024-37397 - Ivanti Endpoint Manager XXE Vulnerability
This blog provides an in-depth analysis of the exploitation process for an unauthenticated XXE vulnerability in Ivanti Endpoint Manager, identified as CVE-2024-37397.
d4mianwayne.github.io
December 15, 2024 at 12:00 PM
TIL that the recent Ivanti ImportXML vulnerability is a second-order XXE, where the payload must be enclosed in the CDATA section of a SOAP request 🦾
GreyNoise observed a major spike in scanning against Ivanti products weeks before two zero-days were disclosed in Ivanti EPMM. Full update: www.greynoise.io/blog/surge-i...
#Ivanti #GreyNoise #Cybersecurity #ZeroDays
#Ivanti #GreyNoise #Cybersecurity #ZeroDays
May 20, 2025 at 7:54 PM
GreyNoise observed a major spike in scanning against Ivanti products weeks before two zero-days were disclosed in Ivanti EPMM. Full update: www.greynoise.io/blog/surge-i...
#Ivanti #GreyNoise #Cybersecurity #ZeroDays
#Ivanti #GreyNoise #Cybersecurity #ZeroDays
Fortinet reporting on Ivanti zero day exploitation?
October 11, 2024 at 7:11 PM
Fortinet reporting on Ivanti zero day exploitation?
New! From John “Ivanti” Wolfram & team
Hot off the press is a new blog detailing our observations from in the wild exploitation of CVE-2025-22457 by UNC5221 including two newly observed malware families tracked as BRUSHFIRE and TRAILBLAZE.
cloud.google.com/blog/topics/...
cloud.google.com/blog/topics/...
Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457) | Google Cloud Blog
cloud.google.com
April 3, 2025 at 6:17 PM
New! From John “Ivanti” Wolfram & team
Dutch data protection agency was hacked via the two recent Ivanti zero-days disclosed earlier this month
www.tweedekamer.nl/kamerstukken...
www.tweedekamer.nl/kamerstukken...
February 7, 2026 at 10:24 PM
Dutch data protection agency was hacked via the two recent Ivanti zero-days disclosed earlier this month
www.tweedekamer.nl/kamerstukken...
www.tweedekamer.nl/kamerstukken...
🚨 9X Surge in Scanning for Ivanti Connect Secure. No CVEs are tied to this yet, but patterns like this often precede exploitation. Full analysis + suspicious IPs ↓
#Ivanti #Cybersecurity #Scanning
#Ivanti #Cybersecurity #Scanning
9X Surge in Ivanti Connect Secure Scanning Activity
GreyNoise observed a 9X spike in suspicious scanning activity targeting Ivanti Connect Secure or Ivanti Pulse Secure VPN systems. More than 230 unique IPs probed ICS/IPS endpoints. This surge may indi...
www.greynoise.io
April 23, 2025 at 8:40 PM
🚨 9X Surge in Scanning for Ivanti Connect Secure. No CVEs are tied to this yet, but patterns like this often precede exploitation. Full analysis + suspicious IPs ↓
#Ivanti #Cybersecurity #Scanning
#Ivanti #Cybersecurity #Scanning
Kiteworks communication is "Ivanti level" I would say...
September 25, 2026 at 10:01 PM
Kiteworks communication is "Ivanti level" I would say...
Sorry Ivanti, which decade is it again?
February 12, 2024 at 2:13 PM
Sorry Ivanti, which decade is it again?
Ivanti warns of maximum severity CSA auth bypass vulnerability
www.bleepingcomputer.com/news/securit...
Remember my rule for patching Ivanti: you need to patch on days that start with a ”T” - Tuesday, Thursday, Today and Tomorrow.
www.bleepingcomputer.com/news/securit...
Remember my rule for patching Ivanti: you need to patch on days that start with a ”T” - Tuesday, Thursday, Today and Tomorrow.
Ivanti warns of maximum severity CSA auth bypass vulnerability
Ivanti warned customers on Tuesday about a new maximum-severity authentication bypass vulnerability in its Cloud Services Appliance (CSA) solution.
www.bleepingcomputer.com
December 11, 2024 at 3:15 PM
Ivanti warns of maximum severity CSA auth bypass vulnerability
www.bleepingcomputer.com/news/securit...
Remember my rule for patching Ivanti: you need to patch on days that start with a ”T” - Tuesday, Thursday, Today and Tomorrow.
www.bleepingcomputer.com/news/securit...
Remember my rule for patching Ivanti: you need to patch on days that start with a ”T” - Tuesday, Thursday, Today and Tomorrow.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published an analysis of the malware deployed in attacks exploiting vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM).
CISA exposes malware kits deployed in Ivanti EPMM attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published an analysis of the malware deployed in attacks exploiting vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM).
www.bleepingcomputer.com
September 19, 2025 at 3:47 PM
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published an analysis of the malware deployed in attacks exploiting vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM).
Hackers are exploiting a new Ivanti VPN security bug to hack into company networks
Hackers are exploiting a new Ivanti VPN security bug to hack into company networks
Mandiant says a Chinese cyberespionage group has been exploiting the critical-rated vulnerability since at least mid-December.
© 2024 TechCrunch. All rights reserved. For personal use only.
tcrn.ch
January 9, 2025 at 12:54 PM
Hackers are exploiting a new Ivanti VPN security bug to hack into company networks
🚨 New: Zero-day vulnerability #CVE-2025-0282 in Ivanti Connect Secure VPN is being actively exploited, including by suspected China-nexus cyber espionage groups. Our team at Mandiant in partnership with Ivanti just published our initial findings. 🧵
cloud.google.com/blog/topics/...
cloud.google.com/blog/topics/...
Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation | Google Cloud Blog
Zero-day exploitation of Ivanti Connect Secure VPN vulnerabilities since as far back as December 2024.
cloud.google.com
January 9, 2025 at 12:42 AM
🚨 New: Zero-day vulnerability #CVE-2025-0282 in Ivanti Connect Secure VPN is being actively exploited, including by suspected China-nexus cyber espionage groups. Our team at Mandiant in partnership with Ivanti just published our initial findings. 🧵
cloud.google.com/blog/topics/...
cloud.google.com/blog/topics/...
Google says the recent Ivanti zero-day is being exploited by Chinese APTs
cloud.google.com/blog/topics/...
cloud.google.com/blog/topics/...
New Ivanti zero-day just dropped: forums.ivanti.com/s/article/Se...
"We are not aware of any exploitation of CVE-2025-0283 at the time of disclosure."
"We are not aware of any exploitation of CVE-2025-0283 at the time of disclosure."
January 9, 2025 at 1:17 PM
Google says the recent Ivanti zero-day is being exploited by Chinese APTs
cloud.google.com/blog/topics/...
cloud.google.com/blog/topics/...
r7 depression so bad I started thinking of ivanti and tearing up while watching smile 2 in the cinema last night
October 28, 2024 at 12:46 AM
r7 depression so bad I started thinking of ivanti and tearing up while watching smile 2 in the cinema last night
Three more vulns spotted in Ivanti CSA, all critical, one 10/10
Three more vulns spotted in Ivanti CSA, all critical, one 10/10
Patch up, everyone – that admin portal is mighty attractive to your friendly cyberattacker
Ivanti just put out a security advisory warning of three critical vulnerabilities in its Cloud Services Application (CSA), including a perfect 10.…
dlvr.it
December 11, 2024 at 12:10 PM
Three more vulns spotted in Ivanti CSA, all critical, one 10/10