Posts tagged ‘Threat Intelligence’
CVE-2026-41940: Inside the cPanel/WHM Authentication Bypass
Introduction Hosting control panels operate with near-total authority over a server: websites, databases, DNS, email, and the account lifecycle are all driven from one place. That privilege makes them a high-value target—when a control-plane bug appears, compromise can extend far beyond a single site. CVE-2026-41940 is a pre-authentication bypass affecting WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared). In practical terms, it lets a remote, unauthenticated attacker reach administrator-level control without supplying valid credentials. Background: What Is cPanel/WHM? cPanel is a widely deployed, Linux-based hosting panel. WHM is the higher-privileged layer used by resellers and server administrators to…
The Ghost in the Leased Line: Unmasking MuddyWater, Surgical Cyber Arm
In the high-stakes theater of global geopolitics, the most effective weapons aren’t always missiles; sometimes, they are just few lines of code.
Identity Is the New Perimeter. Stryker Just Taught Us That the Hard Way.
A story on how an Iran-linked group wiped tens of thousands of Stryker’s devices A nation-state attack that changes every assumption we had For years, we have treated nation-state threats as a “Tier 1” problem — something reserved for defense contractors and the energy grid. The March 2026 attack on Stryker Corporation by Iran-linked group Handala officially kills that assumption. On March 11, 2026, Stryker’s corporate Microsoft environment was hit. Employees arrived to find their managed devices wiped out overnight through entirely legitimate Intune commands. Handala claimed 200,000+ systems affected; independent reporting confirms that tens of thousands were impacted. Stryker’s…
What is Workspace Security?
“What Is Workspace Security? Learn how Workspace Security, operating within the broader Secure Access Service Edge (SASE) framework, unites advanced security and networking technologies to safeguard users, devices, applications, and data. From enabling Zero Trust principles to incorporating tools like SWG, CASB, ZTNA, DLP, and DEM, explore how Workspace Security helps organizations protect distributed workforces while enabling productivity and collaboration. Discover why Versa is a leader in SASE innovation for modern enterprises.
Securing the Modern Browser: How Versa Remote Browser Isolation Protects an AI-Driven Workforce
Remote Browser Isolation (RBI) is a critical defense against zero-day threats, data loss, and unmanaged device risk. Learn how Versa RBI integrates natively with Unified SASE to secure the browser across your enterprise.
AI-Generated Malware Like VoidLink: Why Architecture, Not Hype, Is the Real Defense — and How Versa SASE Delivers It
Recent reporting on VoidLink, a Linux malware framework reportedly developed almost entirely with the assistance of generative AI, marks a structural shift in the threat landscape. According to coverage in CSO Online, VoidLink’s development cycle, code organization, and modular design strongly suggest AI-assisted creation — compressing what historically required months of coordinated engineering into days of automated iteration. This is where Versa SASE, combined with GenAI usage controls, provides a grounded and enforceable defensive posture.
BrickStorm Malware: Anatomy of a Stealth Linux Backdoor Targeting Modern Infrastructure
BrickStorm is a highly stealthy Linux backdoor designed for long-term, targeted cyber-espionage. Brickstorm is closely associated with Cyber Espionage group UNC5221, which is known for exploiting zero-days vulnerability in network edge appliances like Ivanti, F5 and MiTRE breach. Unlike commodity malware, BrickStorm is deployed post-compromise, operates largely in memory, and uses a modular architecture with custom encrypted command-and-control (C2). Its focus on Linux servers, network appliances, and embedded systems reflects a broader trend: attackers increasingly target infrastructure layers where visibility and detection are weakest.
React2Shell Vulnerability
React2Shell Remote Code Execution in React Server Components Vulnerability The bug dubbed as React2Shell, comprising two CVE’s, mainly CVE-2025-55182 and CVE-2025-66478, allows remote unauthenticated users to gain code execution on servers running vulnerable versions of React RSC or Next.JS App Router via single HTTP request. MITRE Tactic ID Technique Name Initial Access T1109 Exploit Public-Facing Application Execution T1059 Command and Scripting Interpreter Persistence T1505.003 Server Software Component: Web Shell Privilege Escalation T1068 Exploitation for Privilege Escalation Defense Evasion T1070.004 Indicator Removal on Host: File Deletion Next.js now powers a massive share of the modern web — millions of production sites,…
Achieve Zero Blind Spots with Versa’s Complete Branch Security that Protects Guest Wi-Fi and Beyond
Branches are surging back in prominence as hubs for users, applications, and a rapidly expanding IoT ecosystem. In this new branch paradigm, Guest Wi-Fi is no longer a convenience. It’s a non-negotiable requirement across retail, healthcare, hospitality, financial services, and much more. Unfortunately, this shift introduces a new mix of unpredictable user behavior, diverse applications, and thousands of devices to the branch infrastructure. This dramatically increases bandwidth demands and expands the attack surface where guest devices can bring malicious files, launch DNS-based threats, enable data exfiltration, or open compliance and privacy gaps. Industry research shows 70% of performance degradation and…
Versa Threat Research Labs Spotlight – DeskRAT: TransparentTribe’s Latest Weapon for Targeted Espionage
TransparentTribe (also known as APT36), a state sponsored threat actor known for long running cyber espionage against defense and government sectors, has launched a new campaign leveraging a custom Remote Access Trojan (RAT) dubbed DeskRAT. This malware is distributed through phishing emails containing malicious attachments or links that deliver the payload to targeted systems.
Industry Insights
A Pragmatic View of Breaking and Inspecting SSL
By Mark Harman
Sr. Systems Engineer, Versa Networks
October 11, 2023
SSL Break and Inspect (B&I) has always been a point of contention in the security world. On the one hand, we have the network security teams saying, “We should inspect everything on our network and not allow anything that we cannot inspect.”
Industry Insights
Riding the Storm-0978: Mitigating Trojanized Microsoft Office Exploits
By Naganathan S J
Staff Security Engineer - Research
July 28, 2023
Cyber criminal organization based out of Russia known as RomCom have been very active lately targeting Ukraine and its military. The threat actors were targeting European government officials with phishing emails containing lure documents around the current political situation.
Company Updates
Versa Networks Enterprise Firewall Sets the Industry Standard for Security Effectiveness, Performance and Value
By Dan Maier
Chief Marketing Officer, Versa Networks
May 16, 2023
In a world where cybersecurity is of paramount importance, choosing the right enterprise firewall can make or break a company’s security posture. Versa Networks, the pioneer of single-vendor Unified Secure Access Service Edge (SASE) solutions, has recently emerged as a leading vendor in the highly competitive firewall market. In a groundbreaking independent test conducted by CyberRatings.org comparing eight leading firewall vendors, Versa Networks’ CSG5000 Next Generation Firewall garnered a remarkable 99.48% security effectiveness score and achieved top ‘AAA’ ratings in all categories. ‘AAA’ is the highest rating assigned by CyberRatings. In addition, Versa delivered the highest Rated Throughput and the lowest Price per…
Industry Insights
Healthcare Means Security
By Jon Taylor
Director and Principal of Security, Versa Networks
January 12, 2023
Cybersecurity is crucial in all industries, but it is especially important in the healthcare sector. Let Versa Networks take you through the reasons cyber security is of upmost importance in healthcare, some scenarios of what can and has happened, and what Versa Networks can do to improve security in healthcare while increasing the security posture, reducing TCO, and easing the stress of the engineering staff through simplified management and reporting.
Company Updates
Ransomware and What It Could Cost You
By Jon Taylor
Director and Principal of Security, Versa Networks
October 17, 2022
Read more to find out more about the actual cost of ransomware.
Industry Insights
The State of Cloud Security in 2022
By The Versa Team
Universal SASE leaders
October 17, 2022
What does a data breach say about your company? We surveyed 600 IT professionals to see how important cloud security is in 2022. Here’s what they said.
Research Lab
Blackcat/ALPHV Ransomware and What To Do
By Versa Threat Research Lab
Versa Networks
April 27, 2022
The FBI, chief investigating agency of the U.S., has triggered an alert concluding that more than 60 organizations worldwide have been a victim of the sophisticated ransomware attack by Blackcat also known as ALPHV/Noberus. The ransomware first came to light when the investigation revealed it to be the first ransomware using the memory-safe programming language RUST, known for its improved performance. Many of the developers of Blackcat are linked with more popular ransomware groups Darkside and Blackmatter who large groups with the experience to carry out operations with a well-established network to support logistics. The advantage of using the RUST…
Research Lab
How Often Do Americans Snoop Online?
By The Versa Team
Universal SASE leaders
April 26, 2022
Whether it’s scouring social media feeds of professionals, family, friends, or strangers, curiosity fills our minds with questions about others we’d prefer not to ask. But how often?
Research Lab
Surveying American Business Owners on Data Breaches
By The Versa Team
Universal SASE leaders
March 16, 2022
Data breaches are on the rise, but are companies properly prepared for this growing threat? We surveyed 1,200 business owners to find out.
Industry Insights
Defense Against Web Threats in the Modern Era
By Amelie Sutsakhan
Product Marketing Manager, Versa Networks
April 20, 2021
Cyberattacks have been ranked as the fastest growing crime in the US. Secure Web Gateway (SWG), one of the five components of Secure Access Service Edge (SASE) is key to protecting users from web-based threats while applying and enforcing security policies consistently.
Subscribe to the Versa Blog
Recent Posts
