The Exploit Post

Sign in Subscribe

Red Dog Security

GhostContainer Backdoor Attacks Microsoft Exchange Servers

GhostContainer Backdoor Attacks Microsoft Exchange Servers

Researchers at Kaspersky Lab have uncovered a sophisticated new malware strain named GhostContainer, which leverages open-source tools to target Microsoft Exchange servers. Believed to be part of an advanced cyber espionage campaign, the backdoor appears to focus on high-value organizations in Asia—particularly those in government and high-tech sectors. Discovery

Proxy Trickster Group Attacks Nearly 900 Servers Across 58 Countries

Proxy Trickster Group Attacks Nearly 900 Servers Across 58 Countries

Security experts at Solar 4RAYS, a division of the Solar Group, have identified a previously unknown hacker collective named Proxy Trickster. This group has been quietly compromising servers across the globe—targeting 874 systems in 58 countries over the span of a year, including several in Russia. Discovery and Attack

Other Risks and Attack Vectors in the MCP Ecosystem

Other Risks and Attack Vectors in the MCP Ecosystem

As powerful as the Model Context Protocol (MCP) is, it also opens up a long list of new ways for attackers to mess with your AI systems. Think of each tool your model can call — each plugin, each API, each server — as a potential door into your system. Some of

Scammers Find a Way to Bypass FIDO Multi-Factor Authentication

Scammers Find a Way to Bypass FIDO Multi-Factor Authentication

The operators behind the PoisonSeed phishing campaign have uncovered a way to bypass FIDO2 authentication—specifically, FIDO2 with WebAuthn—by abusing the cross-device authentication feature built into the protocol. Rather than exploiting a technical vulnerability, attackers trick victims into voluntarily approving malicious login attempts originating from spoofed corporate portals. What

HPE Aruba Instant On Access Points Contained Hardcoded Credentials

HPE Aruba Instant On Access Points Contained Hardcoded Credentials

Hewlett Packard Enterprise (HPE) has issued a critical security advisory after discovering hardcoded credentials in its Aruba Instant On access points. The flaw allows remote attackers to bypass standard authentication and gain full administrative access to the device’s web interface. Aruba Instant On access points are compact wireless networking

Critical Vulnerability in CrushFTP Allows Administrative Access

Critical Vulnerability in CrushFTP Allows Administrative Access

CrushFTP developers have issued an urgent warning about an actively exploited zero-day vulnerability—CVE-2025-54309—that allows remote attackers to gain administrative access via the web interface on unpatched servers. Discovery and Exploitation Timeline The first signs of exploitation were detected on July 18, 2025, although attackers likely began leveraging the

Chaos RAT Trojan Found in Arch User Repository

Chaos RAT Trojan Found in Arch User Repository

Arch Linux developers have identified three malicious packages in the Arch User Repository (AUR) that were used to install the Chaos Remote Access Trojan (RAT) on Linux systems. Malicious Packages Discovered The packages—librewolf-fix-bin, firefox-patch-bin, and zen-browser-patched-bin—were uploaded by a user named danikpapas on July 16, 2025. They were