Curate Feeds | Make Collections | Customize Email Briefs

A critical vulnerability has been discovered in the file transfer solution from Soliton Systems K.K., potentially allowing attackers to execute arbitrary system commands on affected installations. The issue, tracked as CVE-2026-25108, has been assessed with a CVSS v3.0 base score of 8.8, indicating a severe command injection flaw. The flaw stems from an  OS command injection vulnerability (CWE-78) within FileZen’s processing mechanism whenever the Antivirus Check Option is enabled. Attackers with authenticated access could exploit this weakness by sending specially crafted HTTP requests to the affected FileZen instance, thereby gaining execution privileges on the underlying operating system. The developer, Soliton Systems K.K., confirmed that exploitation attempts targeting this vulnerability have already been observed in the wild, indicating active use of this flaw before it was patched. FileZen File Transfer App Vulnerability FileZen is a secure file transfer and sharing system widely used by enterprises for data exchange across organizations and internal networks. The company clarified that FileZen S (a separate variant) is not affected. CVE ID CVSS Description Affected Versions CVE-2026-25108 8.8 (High) OS command injection enabling arbitrary execution. V5.0.0–V5.0.10, V4.2.1–V4.2.8 The issue allows an authenticated attacker, once logged in, to send a maliciously crafted HTTP request that could run arbitrary OS-level commands with elevated privileges. Successful exploitation may enable attackers to fully compromise the affected appliance, manipulate files, or establish persistent access for further exploitation within the network. According to the advisory published through Japan’s JPCERT/CC (JVN#84622767), this vulnerability affects a file transfer system often exposed to enterprise networks, and the risk extends to data confidentiality and system integrity. Soliton Systems has released a firmware update addressing this issue. Users are urged to upgrade to FileZen firmware version V5.0.11 or later, as it includes security fixes that neutralize the OS command injection vector. Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories. The post FileZen File Transfer App Vulnerability Enables Arbitrary Command Execution appeared first on Cyber Security News .

In recent months, the Egyptian authorities renewed their campaign of arbitrarily detaining and unlawfully deporting refugees and asylum seekers solely on the basis of their irregular immigration status in blatant violation of the principle of non-refoulement and Egypt’s own asylum law, Amnesty International said today. Refugees or asylum seekers registered with the UN High Commissioner for Refugees (UNHCR) are among those unlawfully deported or arbitrarily detained pending deportation. Since late December 2025, police officers in plain clothes have been arbitrarily rounding up nationals of Syria, Sudan, South Sudan and other Sub-Saharan countries from the streets or their workplaces in cities across the country following identity checks. Those found without valid residency permits were driven away in unmarked vans, even when they were able to produce UNHCR cards. The Egyptian authorities must immediately release all refugees and asylum seekers arbitrarily detained solely on immigration grounds and halt deportations of anyone entitled to protection under international law. Mahmoud Shalaby, Egypt and Libya Researcher at Amnesty International. “Refugees who have fled war, persecution or humanitarian crises should not be forced to live in daily fear of being arbitrarily arrested and deported back to a place where they are at risk of grave human rights violations. By forcibly expelling refugees and asylum seekers, Egyptian authorities are not only flagrantly flouting international human rights and refugee law, but they are also breaching the protections afforded in the country’s own recently passed asylum law prohibiting refoulment of recognized refugees,” said Mahmoud Shalaby, Egypt and Libya Researcher at Amnesty International. “Fearing arrest and deportation, families have been forced into hiding at home, living in limbo and unable to access work or education. Many are struggling to survive after the primary breadwinner of the family had been detained or deported. The Egyptian authorities must immediately release all refugees and asylum seekers arbitrarily detained solely on immigration grounds and halt deportations of anyone entitled to protection under international law.” Amnesty International documented security forces’ arbitrary arrest of 22 refugees and asylum seekers, including one child and two women, from their homes, the streets or at security checkpoints between late December 2025 and 5 February 2026 in Cairo, Giza, Al-Qalyubia and Alexandria governorates. Those arrested and detained are refugees and asylum seekers from Sudan, Syria and South Sudan, 15 of whom are registered with UNHCR.  Of this group, security forces have deported one Syrian asylum seeker registered with UNHCR. The 21 others remain at risk of deportation as the authorities had already begun their deportation procedures even though prosecutors had ordered the release of 19 of them, while three had scheduled residency renewal appointments with the immigration department. There are no available statistics on deportations of Syrians, but Egyptian NGOs sounded the alarm about the rise in unlawful deportations of Syrian nationals in mid-January. On 17 January, the Syrian embassy in Cairo stated that it had received information from the Egyptian authorities that they were conducting “periodic verification campaigns on residency permits.” The embassy advised Syrians to always carry a valid residency permit. On 31 January, the Sudanese Ambassador to Cairo said in a press conference that 207 Sudanese nationals were returned from Egypt in December 2025 and another 371 in January 2026, without clarifying whether these were deportations carried out by security forces or whether individuals were compelled to return home through programmes coordinated by the Sudanese embassy and Egyptian authorities, in order to avoid indefinite detention or risk of arrest. He added that around 400 Sudanese nationals were currently detained in Egypt, without clarifying the grounds. Since the outbreak of armed conflict in Sudan in 2023, Egyptian authorities have periodically carried out intensified identity checks targeting foreign nationals, detaining those who lack documentation and subsequently deporting them. The Egyptian government does not publish official figures on deportations.  As of January 2026, 1,099,024 refugees and asylum seekers were registered with UNHCR. Amnesty International interviewed a former detainee, four relatives of detained refugees and asylum seekers, a friend of a released asylum seeker, a lawyer representing detainees, four refugees and asylum seekers whose families are confined at home due to the crackdown, and two community activists. The organization also spoke with two staff members at the Egyptian Commission for Rights and Freedoms and the Egyptian Initiative for Personal Rights, who both documented cases of arbitrary arrests and unlawful deportations of refugees and asylum seekers. Arrest despite immigration appointments and UNHCR cards The Egyptian government requires all foreign nationals in the country “irregularly” to regularize their status through an Egyptian sponsor and the payment of US$1,000. Refugees and asylum seekers registered with UNHCR are not subject to these requirements when renewing their residence permits. Many of the refugees and asylum seekers arrested since late December 2025 had scheduled appointments at the Ministry of Interior’s General Department of Passports, Immigration and Nationality to renew their residency. Such appointments are routinely delayed due to government backlogs – refugees and asylum seekers reported waiting for up to three years for appointments. The arbitrary arrests took place even in cases where refugees and asylum seekers were able to produce UNHCR cards. The mother of a 10-year-old South Sudanese boy with a valid residence permit told Amnesty International she chose to keep him at home after hearing reports of police confiscating refugees’ valid documents. Her fears are well founded. Amnesty International documented the case of Eisa, a 20-year-old Eritrean refugee registered with UNHCR and with a valid Egyptian residence permit. His mother said that police officers confiscated his UNHCR card and residence permit and warned him: “Next time we will catch you without documents and you will be detained and deported.” On 23 January, police arrested Ahmed, a 40-year-old Syrian asylum seeker registered with UNHCR, from the street in 6th of October City, Giza, just six days before his scheduled appointment with the General Administration of Passports, Immigration and Nationality to renew his residence permit. The following day, prosecutors ordered his release pending investigations into charges related to irregular stay in Egypt and ordered his referral to the “relevant administrative authority,” namely the ministry of interior. Despite this, police refused to release him   and escorted him to the National Security Agency (NSA), the immigration authority and the Syrian embassy to verify his identity, as part of deportation procedures. Forced deportations and refoulement In early February, police informed Ahmed’s lawyer that unless his family purchased him a flight ticket to Syria, he would remain indefinitely detained. The family complied, and security officials deported Ahmed, who had lived in Egypt for 12 years after fleeing armed conflict in Syria, without an individualized assessment of the risks he might face upon return and despite the prosecutor order for his release. In 19 cases documented by Amnesty International involving refugees or asylum seekers who are currently at risk of deportation, prosecutors had ordered their release pending investigation into immigration-related charges. However, police continue to hold them in detention despite these release orders and with no further judicial review allowing them to challenge the legality of their detention. In the two other cases documented by Amnesty International, detainees’ families were unsure if they had ever been brought before prosecutors. In line with the pattern documented in Ahmed’s case, the ministry of interior has already begun to escort all detainees to various authorities and their countries’ diplomatic representatives as part of the deportation procedures. The principle of non-refoulement prohibits states from sending anyone to a place where they would be at real risk of serious human rights violations. Even Egypt’s flawed asylum law prohibits the extradition of “recognized refugees” to their country of origin or habitual residence, despite the fact that other provisions implicitly permit exceptions under the guise of overly vague “national security and public order” grounds without due process safeguards. Amnesty International opposes forced returns of Sudanese nationals to Sudan amid an ongoing armed conflict marked by serious violations of international human rights and humanitarian law, including mass civilian casualties. Similarly, the UNHCR has maintained its position against all forced returns of Syrian nationals due to the volatile security situation and the ongoing risks posed by armed groups exercising control over towns and cities. Devastating impact of livelihoods and right to education The crackdown has had devastating consequences for refugee families, particularly affecting their rights to education and work. Three families, all registered with UNHCR, told Amnesty International they had stopped sending their children to school or university for fear of arrest because they currently do not have valid residence permits. One family said they had been unable to secure any appointment to renew their expired residence permits because they could not reach the UNHCR — which books appointments on behalf of the Egyptian authorities — neither physically through its sole office in the country due to long queues nor through its hotline. Another family reported that their son’s appointment was scheduled for 2027. Some refugees and asylum seekers have stopped or limited their work to minimize risk of arrest. Ahmed, a 26-year-old Sudanese asylum seeker registered with UNHCR, previously worked as a teacher at three schools. He resigned from two and now works at one school close to his home, in an effort to minimize journeys outside his home as his residence permit had expired, and his renewal appointment was scheduled for 2028. Amina, a 49-year-old Sudanese single mother and refugee registered with UNHCR, told Amnesty International she resorted to begging on the streets to support her two daughters after losing the family’s breadwinner, her son Moaatz, who was detained in the recent crackdown. On 28 January, police arrested Moaatz, who is a UNHCR-registered asylum seeker, while street vending in Cairo for lacking a valid residence permit. His renewal appointment is scheduled for 2027. “As a close partner to Egypt on migration and major donor to UNHCR, the European Union should urge the Egyptian government to adopt concrete and verifiable measures to protect the rights of refugees and migrants as well as to ensure that UNHCR has unimpeded access to all places of detention where refugees, asylum seekers and migrants are held, and allow them to make their international protection claims and have these fairly assessed,” said Mahmoud Shalaby. “The EU and other states must also step up responsibility-sharing by expanding resettlement opportunities and creating safe and regular pathways for people in need of international protection, including humanitarian visas, labour and student mobility schemes, and community sponsorship initiatives.” The post Egypt: Refugees in hiding amid crackdown involving arbitrary arrests and unlawful deportations appeared first on Amnesty International.