Close Menu
    DevStackTipsDevStackTips
    • Home
    • News & Updates
      1. Tech & Work
      2. View All

      This week in AI updates: Mistral’s new Le Chat features, ChatGPT updates, and more (September 5, 2025)

      September 6, 2025

      Designing For TV: Principles, Patterns And Practical Guidance (Part 2)

      September 5, 2025

      Neo4j introduces new graph architecture that allows operational and analytics workloads to be run together

      September 5, 2025

      Beyond the benchmarks: Understanding the coding personalities of different LLMs

      September 5, 2025

      Hitachi Energy Pledges $1B to Strengthen US Grid, Build Largest Transformer Plant in Virginia

      September 5, 2025

      How to debug a web app with Playwright MCP and GitHub Copilot

      September 5, 2025

      Between Strategy and Story: Thierry Chopain’s Creative Path

      September 5, 2025

      What You Need to Know About CSS Color Interpolation

      September 5, 2025
    • Development
      1. Algorithms & Data Structures
      2. Artificial Intelligence
      3. Back-End Development
      4. Databases
      5. Front-End Development
      6. Libraries & Frameworks
      7. Machine Learning
      8. Security
      9. Software Engineering
      10. Tools & IDEs
      11. Web Design
      12. Web Development
      13. Web Security
      14. Programming Languages
        • PHP
        • JavaScript
      Featured

      Why browsers throttle JavaScript timers (and what to do about it)

      September 6, 2025
      Recent

      Why browsers throttle JavaScript timers (and what to do about it)

      September 6, 2025

      How to create Google Gemini AI component in Total.js Flow

      September 6, 2025

      Drupal 11’s AI Features: What They Actually Mean for Your Team

      September 5, 2025
    • Operating Systems
      1. Windows
      2. Linux
      3. macOS
      Featured

      Harnessing GitOps on Linux for Seamless, Git-First Infrastructure Management

      September 6, 2025
      Recent

      Harnessing GitOps on Linux for Seamless, Git-First Infrastructure Management

      September 6, 2025

      How DevOps Teams Are Redefining Reliability with NixOS and OSTree-Powered Linux

      September 5, 2025

      Distribution Release: Linux Mint 22.2

      September 4, 2025
    • Learning Resources
      • Books
      • Cheatsheets
      • Tutorials & Guides
    Home»Development»Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE

    Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE

    September 3, 2025

    The North Korea-linked threat actor known as the Lazarus Group has been attributed to a social engineering campaign that distributes three different pieces of cross-platform malware called PondRAT, ThemeForestRAT, and RemotePE.
    The attack, observed by NCC Group’s Fox-IT in 2024, targeted an organization in the decentralized finance (DeFi) sector, ultimately leading to the compromise of an

    Source: Read More

    Facebook Twitter Reddit Email Copy Link
    Previous ArticlePalo Alto Networks, Zscaler Among Salesloft Breach Victims
    Next Article Researchers Warn of MystRodX Backdoor Using DNS and ICMP Triggers for Stealthy Control

    Related Posts

    Development

    How to focus on building your skills when everything’s so distracting with Ania Kubów [Podcast #187]

    September 6, 2025
    Development

    Introducing freeCodeCamp Daily Python and JavaScript Challenges – Solve a New Programming Puzzle Every Day

    September 6, 2025
    Leave A Reply Cancel Reply

    For security, use of Google's reCAPTCHA service is required which is subject to the Google Privacy Policy and Terms of Use.

    Continue Reading

    ViciousTrap Uses Cisco Flaw to Build Global Honeypot from 5,300 Compromised Devices

    Development

    Windows Security in 2025: Battling Sophisticated Threats with Advanced Defenses

    Security

    CVE-2025-52725 – CouponXxL PEBAS Object Injection Vulnerability

    Common Vulnerabilities and Exposures (CVEs)

    CVE-2025-6227 – Mattermost Auth Token Interception Vulnerability

    Common Vulnerabilities and Exposures (CVEs)

    Highlights

    CVE-2025-38232 – Linux NFSd Race Condition Vulnerability

    July 4, 2025

    CVE ID : CVE-2025-38232

    Published : July 4, 2025, 2:15 p.m. | 4 hours, 57 minutes ago

    Description : In the Linux kernel, the following vulnerability has been resolved:

    NFSD: fix race between nfsd registration and exports_proc

    As of now nfsd calls create_proc_exports_entry() at start of init_nfsd
    and cleanup by remove_proc_entry() at last of exit_nfsd.

    Which causes kernel OOPs if there is race between below 2 operations:
    (i) exportfs -r
    (ii) mount -t nfsd none /proc/fs/nfsd

    for 5.4 kernel ARM64:

    CPU 1:
    el1_irq+0xbc/0x180
    arch_counter_get_cntvct+0x14/0x18
    running_clock+0xc/0x18
    preempt_count_add+0x88/0x110
    prep_new_page+0xb0/0x220
    get_page_from_freelist+0x2d8/0x1778
    __alloc_pages_nodemask+0x15c/0xef0
    __vmalloc_node_range+0x28c/0x478
    __vmalloc_node_flags_caller+0x8c/0xb0
    kvmalloc_node+0x88/0xe0
    nfsd_init_net+0x6c/0x108 [nfsd]
    ops_init+0x44/0x170
    register_pernet_operations+0x114/0x270
    register_pernet_subsys+0x34/0x50
    init_nfsd+0xa8/0x718 [nfsd]
    do_one_initcall+0x54/0x2e0

    CPU 2 :
    Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010

    PC is at : exports_net_open+0x50/0x68 [nfsd]

    Call trace:
    exports_net_open+0x50/0x68 [nfsd]
    exports_proc_open+0x2c/0x38 [nfsd]
    proc_reg_open+0xb8/0x198
    do_dentry_open+0x1c4/0x418
    vfs_open+0x38/0x48
    path_openat+0x28c/0xf18
    do_filp_open+0x70/0xe8
    do_sys_open+0x154/0x248

    Sometimes it crashes at exports_net_open() and sometimes cache_seq_next_rcu().

    and same is happening on latest 6.14 kernel as well:

    [ 0.000000] Linux version 6.14.0-rc5-next-20250304-dirty
    …
    [ 285.455918] Unable to handle kernel paging request at virtual address 00001f4800001f48
    …
    [ 285.464902] pc : cache_seq_next_rcu+0x78/0xa4
    …
    [ 285.469695] Call trace:
    [ 285.470083] cache_seq_next_rcu+0x78/0xa4 (P)
    [ 285.470488] seq_read+0xe0/0x11c
    [ 285.470675] proc_reg_read+0x9c/0xf0
    [ 285.470874] vfs_read+0xc4/0x2fc
    [ 285.471057] ksys_read+0x6c/0xf4
    [ 285.471231] __arm64_sys_read+0x1c/0x28
    [ 285.471428] invoke_syscall+0x44/0x100
    [ 285.471633] el0_svc_common.constprop.0+0x40/0xe0
    [ 285.471870] do_el0_svc_compat+0x1c/0x34
    [ 285.472073] el0_svc_compat+0x2c/0x80
    [ 285.472265] el0t_32_sync_handler+0x90/0x140
    [ 285.472473] el0t_32_sync+0x19c/0x1a0
    [ 285.472887] Code: f9400885 93407c23 937d7c27 11000421 (f86378a3)
    [ 285.473422] —[ end trace 0000000000000000 ]—

    It reproduced simply with below script:
    while [ 1 ]
    do
    /exportfs -r
    done &

    while [ 1 ]
    do
    insmod /nfsd.ko
    mount -t nfsd none /proc/fs/nfsd
    umount /proc/fs/nfsd
    rmmod nfsd
    done &

    So exporting interfaces to user space shall be done at last and
    cleanup at first place.

    With change there is no Kernel OOPs.

    Severity: 0.0 | NA

    Visit the link for more details, such as CVSS details, affected products, timeline, and more…

    Distribution Release: Red Hat Enterprise Linux 10.0

    May 20, 2025

    CVE-2025-48474 – FreeScout Privilege Escalation Vulnerability

    May 29, 2025

    This fancy automatic espresso machine made me drop my Dunkin’ habit – and it’s on sale

    July 3, 2025
    © DevStackTips 2025. All rights reserved.
    • Contact
    • Privacy Policy

    Type above and press Enter to search. Press Esc to cancel.