Top stories.
- Fortra confirms exploitation of maximum-severity GoAnywhere flaw.
- Harvard investigates claims of a breach.
- Banking Trojan targets Brazilian WhatsApp users.
Fortra confirms exploitation of maximum-severity GoAnywhere flaw.
Security firm Fortra has belatedly confirmed in-the-wild exploitation of a maximum-severity vulnerability in its GoAnywhere managed file transfer (MFT) software, which was patched three weeks ago, CyberScoop reports. The vulnerability (CVE-2025-10035) is a deserialization flaw that "allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection."
The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog two weeks ago, and Microsoft last week published a report on the active exploitation. CISA and Microsoft both say the vulnerability is being used in ransomware campaigns.
Researchers at watchTowr, who published a report on the vulnerability last month, note that some details of the exploitation are still unclear. watchTowr's CEO Ben Harris told CyberScoop that the exploitation implies that "the attacker has somehow circumvented, or satisfied, the cryptographic requirements needed to exploit this vulnerability."