GreyNoiseVEGAS, WE ARE SO BACK! 🤘
| Blog | https://www.skullsecurity.org |
| GitHub | https://github.com/iagox86 |
| https://twitter.com/iagox86 | |
| Bluesky | https://bsky.app/profile/iagox86.bsky.social |
Ron Bowes
@iagox86@infosec.exchange
- 1.6K Followers
- 376 Following
- 1.6K Posts
Lead Security Researcher @ GreyNoise
cR0w 
More on the Langflow vuln ( CVE-2025-3248 ). In case you haven't followed it, it's hilarious. Literally rawdogging input to exec(). LMAO. People are going to keep trusting this shit.
Go hack more AI shit.
CVE-2025-3248 – Unauthenticated Remote Code Execution in Langflow via Insecure Python exec Usage
CVE-2025-3248 is a critical RCE vulnerability in Langflow that allows unauthenticated attackers to execute arbitrary Python code via unsanitized input to exec(). Learn how it works and how to protect your system.
@Viss Y'know, we track so, so much abuse activity at GreyNoise. Funny that the attempts to fix it are so bad
Of all things for Akamai to flag, it's hilarious that they're mad about a .sys file associated with 20yr old malware
New GreyNoise Labs research: CVE-2025-4748
Our team demonstrates how path traversal via zip archives can be used to achieve file write and code execution against Erlang OTP environments, exploiting CVE-2025-4748. This technique leverages the zip:unzip function when untrusted zip files are extracted.
Read the full technical breakdown here: https://www.labs.greynoise.io/grimoire/2025-06-17-erlang-zip/
The CVE lists the CVSS assessment as a sev:MED here.
sev:MED 5.3 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker to retrieve the files of other ZendTo users, retrieve files on the host system, or cause a denial of service.
Retrieving the files of other users does not seem like VC:L. And a DoS does not seem like VA:L. But IDK, I'm just a random crow on the Internet.
GreyNoise has observed exploit attempts targeting CVE-2023-28771 — an RCE vuln affecting Zyxel devices. Full analysis + malicious IPs
🔗https://www.greynoise.io/blog/exploit-attempts-targeting-zyxel-cve-2023-28771
SuricataHave interesting insights on Suricata?
Share them at #SuriCon2025! Join industry, open-source, academia, and research professionals passionate about Suricata and network threat hunting, apply today to talk at #SuriCon2025.
📣 There's still time! Submit your fabulous proposal today!
