The Week - Ending 18 July 2025

Round-Up

CVE-2025-5777 update: Citrix has admitted to public exploitation - Citrix updated their blog after industry and CISA pressure, adding the exploit to the Known Exploited Vulnerabilities catalogue last week. Citrix has also provided further detail on how to threat hunt against CitrixBleed2 (Netscaler Blog).

Something to bring your attention to here by Security Researcher Kevin Beaumont - the patching notes are still missing a key point “if it’s a HA pair you need to additionally reset other session types or you’re still vulnerable to session hijack after patching” Mastodon . His updated scan data shows over 3,000 devices still unpatched (here).

UPDATE - Dutch Department of Justice internal services down- speculation is that this is related to Citrix Netscalers. They took down their internet services this morning (Friday 25/07/25) after the Dutch NCSC detected some in the ministry’s environment. As reported by the NRC: “The NCSC [National Cyber Security Center] received a signal that there is a potential vulnerability,” the spokesperson said. “A thorough analysis of the Public Prosecution Service’s environments has given reason to believe that this potential vulnerability has indeed been exploited.”

Its been reported that while the department did patch, due to incomplete patching instructions that more orgs may well be hit with similar problems even though they may believe they are patched. The Dutch NCSC are recommended that all orgs threat hunt against threat actors if they have Citrix Netscalers.

Techzine | NRC.NL | Dutch News | NCSC
Max Severity Cisco Identity Services Engine bug CVE-2025-20337 - A critical 10.0 CVSS vulnerability allowing pre-auth attacks via a specially crafted API request. This relates to previously fixed bugs CVE-2025-20281 and CVE-2025-20282, both also rated 10.0, so unfortunately its time to patch again. Patch 7 has only recently become available. Cisco Response | Bleeping Computer

Threat Actor targets SonicalWall devices with Malware and Rootkits - SonicWall EOL devices are being targeted by UNC6148 says Googles Threat Intelligence Group (GTIG). The deployed malware named OVERSTEP, acts as a backdoor with some novel anti-forensic features capable of deleting evidence of intrusion. As is often the case, these targeted devices are EOL and should be replaced. Recommendation here is to examine logs, isolating impacted devices, and working with SonicWall to confirm the extent of malicious activity. Due to the anti-forensic nature of the malware, incident response may need to be invoked to investigate.

Bleeping Computer | Google GTIG EOL
The Co-op Group have confirmed personal data of 6.5 million members has been stolen -Shirine Khoury-Haq, the CEO, confirmed to the BBC that members’ data was stolen. BBC News They confirmed that not all systems are up and running yet, but on the face of it I thought there general response has been pretty decent. (Apart from their initial silence around member data being stolen)

They have announced a partnership with The Hacking Games to pilot a programme designed to redirect young cyber talent away from crime. The Co-op’s 38 academies will participate in the pilot. Further details are available in their press release.
WING FTP Server under active exploitation - CVE-2025-47812 with a CVSS score of 10.0 could lead to unauthenticated remote code execution with all versions prior to 7.4.4 effected. This has been added to CISAs KEV catalog. CVE-2025-47812
Cloudflare restricting access to Internet Piracy Websites in the UK - A notable change is that Content Delivery providers have started facilitating copyright infringement notices. Cloudflare now displays “Error 451 – Unavailable for Legal Reasons.” While ISPs have long been forced to block access to these sites, it’s a first that Cloudflare is now also following suit. Cloudflare operates a public resolver (1.1.1.1), provides ZTNA services, and, of course, operates a large public CDN. They appear to be using geo-blocking to restrict access to these sites in the UK only.

Currently, the targeted sites are limited in number and don’t seem to include the much larger list that UK ISPs block. It’s worth noting that the blocks also appear to affect any sites that use Cloudflare for website caching.

Torrent Freak ISP Review

OpenAI Release new Agentic AI Agents

OpenAI yesterday (17/07/25) released its ChatGPT Agent as part of its agentic strategy. It brings together ChatGPT’s Deep Research, an Operator that can interact with websites, and the general GPT model into a unified system allowing it to carry out tasks on its own virtual computer.

They’ve given the agent with a visual browser allowing it to interact with websites, a text-based browser, terminal, and direct API access. The agent can also use ChatGPT Connectors to connect to apps such as Gmail and GitHub.

In comparison to what Microsoft has managed so far with Copilot, this is very interesting—but whether it will actually bring real-world value is something I guess we’ll see. Some guardrails have already been put in place to restrict the agent’s ability to interact with financial-related tasks.

Availability

Directly from OpenAI:

"ChatGPT agent starts rolling out today to Pro, Plus, and Team; Pro will get access by the end of day, while Plus and Team users will get access over the next few days. Enterprise and Education users will get access in the coming weeks. Pro users have 400 messages per month, while other paid users get 40 messages monthly, with additional usage available via flexible credit-based options.

We are still working on enabling access for the European Economic Area and Switzerland."

ChatGPT Announcement

Cloudflare Outage 14/07/2025

Cloudflare have admitted to a borked configuration change that caused an outage to the 1.1.1.1 resolver which effected the majority of the 1.1.1.1 users globally., being a DNS resolver meant this caused a fair amount of issues for users accessing services on the web.

Initially, it appeared to be a BGP hack, but it looks like the configuration error withdrew the 1.1.1.0/24 route completely. Cloudflare (AS13335) withdrew 1.1.1.0/24 and 1.0.0.0/24. I assume Tata (AS4755) had always been announcing 1.1.1.0/24, and when Cloudflare withdrew the route, Tata’s announcement became active.

Cloudflare Blog Post Cloudflare Radar

Normally I would bring out my favorite DNS meme, but as always its always DNS until it isn’t and its actually BGP.