Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Zero-day vulnerabilities are the new normal in cybersecurity. In 2023 alone, more than 100 high-profile zero-day incidents were reported. Despite the early warning signs, major corporations and government agencies, from giants like Google and Cisco to the U.S. Government, continue to be blindsided by zero-day threats into 2025. In December 2024, for example, the U.S.

The second annual Remediation Operations Report from Seemplicity paints a clear picture: while organizations are investing more in security, they’re not necessarily getting faster or more effective at fixing what matters. This year’s data highlights a growing gap between strategic intent and day-to-day execution. Security leaders want to move faster, collaborate better, and prioritize smarter. But process bottlenecks and legacy workflows keep getting in the way.

Update to attack framework announced to coincide with recognition as an industry standard The Open Worldwide Application Security Project (OWASP) announced today that the Business Logic Attack Definition Framework (BLADE Framework) has become The OWASP BLADE Framework Project. The name change reflects the acceptance of the attack framework as an OWASP project and recognition of the framework as an industry standard.

SAP has released an out-of-band patch for a critical unrestricted file-upload flaw, CVE-2025-31324, in the NetWeaver Visual Composer “Metadata Uploader.” A missing authorization check allows unauthenticated attackers to upload arbitrary files (e.g., JSP, WAR) and instantly execute code on the SAP Java stack. If left unpatched, the weakness can expose sensitive ERP data and disrupt core business workflows across finance, HR, and manufacturing systems. In this article.

Authentication is used by most web applications. Both for letting users have access to individual accounts, but also for protecting certain resources from the public. Basic authentication allows an individual to prove to the application that they are the user that is trying to access it. Unfortunately, authentication vulnerabilities are often found by pen testers too. While there are many forms of authentication, the most common implementations are that of the username and password.

On April 24, 2025, SAP released fixes for CVE-2025-31324, a maximum-severity zero-day unrestricted file upload vulnerability in the NetWeaver Visual Composer component. Visual Composer is a tool within NetWeaver for creating applications and user interfaces. The vulnerability was discovered by ReliaQuest, which initially observed its exploitation in the wild.

This blog explores exploitable vulnerabilities meaning by demystifying the concept and explaining what the phrase actually entails – both as a category and in the context of specific threats. Understanding which vulnerabilities can be actively exploited – and learning how to address them – is essential for any organization striving to stay secure.