Core defenses are under pressure. |
Endpoint platforms, backbone routers, operating system isolation, mobile health apps — even encrypted DNS channels — are all in play. From root-level access to quiet data leaks, today’s stories show how trusted infrastructure can quickly become the weak link. FYI: March includes a few additional sponsor communications in your inbox. Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
Trend Micro Patches Apex One RCE Flaws |
Two critical vulnerabilities in Trend Micro’s Apex One platform could have allowed remote code execution through the management console. CVE-2025-71210 and CVE-2025-71211 are directory traversal flaws that enable unauthenticated file uploads and remote code execution in Apex One’s management console. |
Trend Micro has released patches for the vulnerabilities.
Patch immediately, restrict console access behind VPN or ZTNA, enforce MFA and least privilege, monitor for abnormal activity, and test incident response plans to limit potential impact. |
Juniper PTX Vulnerability Grants Root-Level Router Control |
A flaw in Juniper’s Junos OS Evolved could let unauthenticated attackers seize root-level control of PTX Series routers.
The vulnerability exposes the internal On-Box Anomaly Detection service over an external port, potentially allowing attackers to manipulate routing, intercept traffic, or disrupt core service provider and cloud networks. Juniper has released a patch and has not seen exploitation in the wild at the time of publication.
Patch to the latest release, lock down management access, enforce MFA and least privilege, monitor routing changes, and test incident response plans.
|
Jail Escape Vulnerability Hits FreeBSD |
A vulnerability in FreeBSD allows jailed processes to escape confinement and access the host filesystem under specific configurations.
The flaw arises from improper handling of directory file descriptors between sibling jails sharing a nullfs mount over a Unix domain socket, effectively bypassing chroot protections. A patch has been released for the issue.
Apply the latest patch, tighten jail configurations and inter-jail communication, enforce least privilege and MAC controls, monitor for abnormal filesystem activity, and test incident response for potential jail escapes.
|
|
|
How exposed is your routing layer? |
|
|
Yesterday's Pulse Check Results |
Be honest — your network segmentation strategy is: |
|
|
Security Tools You Can Use |
|
|
Android Therapy Apps Expose Private Records |
More than 14 million Android users may have had sensitive therapy data exposed after researchers uncovered 1,575 vulnerabilities across 10 popular mental health apps.
First reported by BleepingComputer and identified by Oversecured, the flaws — ranging from insecure storage to exposed APIs — could enable credential theft and unauthorized access. |
For security teams, the findings expose third-party governance gaps around sensitive data, including therapy records that fetch high prices on underground markets.
Conduct a mobile application risk review of sanctioned wellness apps, require secure coding attestations from vendors, and monitor for apps storing sensitive data without encryption or root-detection safeguards. |
Cisco Flags Dohdoor Attacks on Education |
A campaign is targeting education and health care organizations by hiding command-and-control traffic inside encrypted DNS requests. Cisco Talos attributes the campaign to UAT-10027 and reports that the previously undocumented Dohdoor loader uses DNS-over-HTTPS and reflective in-memory execution to evade detection.
The campaign is still active in the wild.
Monitor for PowerShell and DLL sideloading abuse, restrict DoH traffic, enable behavioral EDR detections, enforce MFA and allowlisting, segment networks, and test incident response. |
|
|
Is Your Core Infrastructure Secure Enough? |
Routers, switches, and firewalls are targeted through firmware flaws, exposed management interfaces, and misconfigurations. Because these devices control core traffic flows, a compromise can disrupt operations or enable persistent, hard-to-detect access. |
How to secure your network hardware: |
-
Keep network devices updated by applying firmware patches promptly and disabling unused services or ports to reduce the attack surface.
-
Restrict and secure management access by using dedicated management networks or VPNs and MFA for administrative accounts.
-
Enable configuration change logging and maintain secure backups or golden configurations to detect unauthorized modifications and support rapid recovery.
|
Securing network hardware is a foundational risk management practice that, through strong access controls, change monitoring, and timely firmware updates, helps limit potential impact and improve overall network resilience. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
