Rapid Response & Vulnerabilities
When a vulnerability starts getting exploited, the clock starts. Rapid Response & Vulnerabilities covers CVE disclosures, vulnerability advisories, the exploitation activity we see in the wild, patch guidance, and disclosure timelines. Timely, focused, and built around what to do next.
The Latest Rapid Response & Vulnerabilities Blog Posts
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
Rapid Response: Critical N-able N-central Vulnerability and Active Exploitation
PaperCut Actively Exploited: A Pre-Auth RCE Chain
Seven Steps to Ransomware: CitrixBleed 2 Weaponized by Initial Access Brokers
Cybercrime Breaches Klue: Salesforce Data Impacted for Many Victims, including Huntress
Nightmare-Eclipse Tooling Moves From Public PoC to Real-World Intrusion
Huntress observed in-the-wild use of Nightmare-Eclipse tooling, including BlueHammer, RedSun, and UnDefend, in a live intrusion involving FortiGate VPN compromise as the initial access, reconnaissance commands, and likely tunneling activity.
Supply Chain Compromise of axios npm Package
Active Exploitation of SolarWinds Web Help Desk
Huntress observed active exploitation of SolarWinds Web Help Desk across three customers — with attackers deploying Cloudflare tunnels and Velociraptor for persistence immediately after getting in.
The Great VM Escape: ESXi Exploitation in the Wild
An ESXi VM escape exploit appeared in the wild with simplified Chinese development paths and the characteristics of a zero-day. Huntress traced the intrusion from SonicWall VPN all the way through.
Active Exploitation of Gladinet CentreStack/Triofox Insecure Cryptography Vulnerability
Gladinet CentreStack is being actively exploited, with the cl0p ransomware group now reportedly targeting internet-facing servers. Huntress has been tracking this from the start and has the latest updates.
PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182
Exploitation of Windows Server Update Services Remote Code Execution Vulnerability (CVE-2025-59287)
Huntress observed threat actors exploiting a Microsoft WSUS remote code execution vulnerability across four customers within days of disclosure. Here's the timeline, the TTPs, and why you need to patch now.
