FlagThis

Security researchers discovered a critical zero-click vulnerability within Synology’s Photos app, impacting millions of users. This vulnerability allows attackers to compromise the system without any user interaction. The flaw resides in a part of the app that doesn’t require authentication, enabling direct exploitation over the internet. Attackers can gain root access and install malicious code, potentially turning the infected device into a botnet for further nefarious activities. Synology has addressed the bug, but users need to manually update their devices. This incident highlights the importance of regularly updating software to mitigate security risks and the growing threat of zero-click vulnerabilities.

References:

• www.synology.com - Synology's security advisory detailing the vulnerability in the Photos app. - 19d
• Engadget is a web magazine with obsessive daily coverage of everything new in gadgets and consumer e - Security researchers found a serious zero-click bug in Synology's Photos app that allows hackers to compromise a system without a user needing to click something first. - 19d
• Wired - A new zero-click vulnerability in the Synology Photos app poses a serious threat to users of the popular NAS devices. - 19d
• Malware Analysis, News and Indicators - Satori Threat Intelligence and Research team published findings about a group of cybercriminals that infect legitimate web shops to create and promote fake product listings. - 19d
• @jos1264 - 1,000+ web shops infected by “Phish ‘n Ships” criminals who create fake product listings for in-demand products - 19d
• Company News - Satori Threat Intelligence and Research team published findings about a group of cybercriminals that infect legitimate web shops to create and promote fake product listings. - 19d
• Malwarebytes - Researchers at the Satori Threat Intelligence and Research team have published their findings about a group of cybercriminals that infect legitimate web shops to create and promote fake product listin - 19d
• googleprojectzero.blogspot.com - Google's security team used a system based around Gemini 1.5 Pro to find a previously unreported security vulnerability in SQLite (a stack buffer underflow), in time for it to be fixed prior to making - 19d
• infosec.exchange - AI agent finds 0day in widely used software - and Google's Naptime wasn't first - 19d
• @LukaszOlejnik - New era in cybersecurity. The first public example of an AI agent finding a previously unknown exploitable memory-safety vulnerability (0day) in widely used real-world software. It even beat 's AFL fu - 19d
• @PrivacyDigest - Another Mastodon post by the same user summarizes the vulnerability in one sentence. - 18d

Classification:

• HashTags: cybersecurity synology zeroclick
• Company: Synology
• Target: Synology Users
• Product: Photos App
• Feature: Zero-Click Vulnerability
• Type: Vulnerability
• Severity: Major