The Exploit Post

Sign in Subscribe

Red Dog Security

Google Did Not Ask 2.5 Billion Gmail Users to Change Their Passwords

Google Did Not Ask 2.5 Billion Gmail Users to Change Their Passwords

Last week, several media outlets reported that Google was allegedly mass-notifying all 2.5 billion Gmail users to urgently change their passwords and enable two-factor authentication. Google has since clarified that these claims are false and that Gmail has not suffered a security breach. The Origin of the Claims The

FreePBX Servers Under Attack Due to 0-Day Vulnerability

FreePBX Servers Under Attack Due to 0-Day Vulnerability

Developers at Sangoma Technologies Corporation have issued an urgent warning about an actively exploited zero-day vulnerability in FreePBX. The flaw affects systems with their administration panel exposed to the internet. What is FreePBX? FreePBX is an open-source PBX (Private Branch Exchange) platform built on top of Asterisk. It is widely

Researchers Discover Flaw in Visual Studio Code Marketplace Allowing Attackers to Reuse Names of Previously Deleted Extensions

Researchers Discover Flaw in Visual Studio Code Marketplace Allowing Attackers to Reuse Names of Previously Deleted Extensions

Researchers at ReversingLabs, a software supply chain security firm, have uncovered a flaw in the Visual Studio Code (VS Code) Marketplace that allows attackers to reuse the names of previously deleted extensions. The vulnerability came to light after the team detected a malicious extension called ahbanC.shiba, which closely resembled

OldGremlin Extortionists Resume Attacks on Russian Companies

OldGremlin Extortionists Resume Attacks on Russian Companies

Kaspersky Lab researchers have reported a new wave of attacks by the extortion group OldGremlin, targeting Russian companies in the first half of 2025. Eight large enterprises—mostly in the industrial sector—were affected, along with organizations in healthcare, retail, and IT. Background on OldGremlin The group first appeared five

Authentication Bypass Bug Found in Passwordstate Corporate Password Manager

Authentication Bypass Bug Found in Passwordstate Corporate Password Manager

Click Studios, developer of the corporate password manager Passwordstate, has urged customers to immediately install a patch addressing a critical authentication bypass vulnerability. What Passwordstate Does Passwordstate functions as a centralized, web-based password vault. It allows organizations to securely store and manage passwords, API keys, certificates, and other credentials. The

F6 Experts Discover New Phantom Stealer

F6 Experts Discover New Phantom Stealer

In June 2025, researchers identified a new wave of malicious activity they dubbed Phantom Papa. Threat actors were distributing emails in both Russian and English, with attachments that delivered a new stealer malware called Phantom. Technical Capabilities Phantom is built on the codebase of Stealerium, a known stealer, and is

Google Warns of Massive Data Theft Linked to Salesloft AI Agent

Google Warns of Massive Data Theft Linked to Salesloft AI Agent

Last week it was revealed that hackers compromised the Salesloft sales automation platform, stealing OAuth and refresh tokens from its AI agent Drift—an integration tool for Salesforce. Google has now confirmed that the breach was far more extensive, with attackers also accessing Google Workspace data. How the Breach Unfolded