Old but deadly: Grafana path traversal exploit resurfaces

Author

Taylor Hawes
October 06, 2025

🔎 Cyber Watch

Old but deadly: Grafana path traversal exploit resurfaces

Security researchers observed a sudden surge in exploitation attempts targeting CVE-2021-43798, a path traversal flaw in Grafana that allows arbitrary file reads on unpatched systems. Attackers probed over 110 unique IPs in a single day, trying to harvest configuration files and credentials.

Takeaway: Legacy vulnerabilities can come back with greater force. Even when a flaw is years old, if many deployments remain unpatched, it becomes a low-hanging fruit for attackers. Staying current on patches and reducing your attack surface (e.g. segmenting monitoring systems) is not optional — it’s essential.

🎙️ Tech Briefing On‑Air

Leadership Lessons from the Cybersecurity Mentors Podcast

In this episode of the Cybersecurity Mentors Podcast, the discussion centers on leadership within cybersecurity teams, drawing from Jocko Willink’s concept of Extreme Ownership. The hosts explain that true leadership is not just about technical mastery but about communication, collaboration, and humility. They emphasize that effective leaders take full responsibility for their teams, maintain clarity under pressure, and keep egos in check.

What It Means

This conversation explores why belief in the mission matters, how to communicate it effectively, and how to prioritize and execute during crises. It’s a reminder that strong cybersecurity leadership begins with accountability and ends with trust.

🤝 Partner Intel

ExaVault offers secure file transfer and storage solutions designed for businesses, with built-in automation, access control, and audit logging features. Its interface is user-friendly, making it suitable even for non-technical teams. For organizations assessing managed file storage or secure data transfer tools, ExaVault presents a reliable and practical option.

🤖 AI Runtime

When AI Shakes Up Biosecurity

This article highlights how AI is beginning to press against the boundaries of biosecurity. It argues that tools designed for fast biological innovation (e.g. synthetic DNA design) may also be turned toward malicious ends.

Highlights

  • There is no universal law forcing DNA synthesis companies to screen all orders.

  • As costs to engineer biology drop, incentives might push firms to cut corners on safety.

  • We must treat biosecurity more like cybersecurity: adaptive, anticipatory, and coordinated.

📊 By the Numbers

10.7 TB

This is the massive data leak from U.S. auto-insurance service ClaimPix, where a misconfigured database exposed 10.7 TB of sensitive data, including over 5 million documents with vehicle details, Power of Attorney forms, and license plate images.

🗳️ Your Monday Take

Cast your vote on our weekly poll.

Which emerging threat will keep CISOs awake at night in the next 5 years?

Login or Subscribe to participate in polls.

📩 We’ll share the results in the Friday issue.

🔗 Stay Connected

Until Wednesday’s edition - Let’s keep that zero-day count at zero!