Tag: cisa
-
Hacker greifen über Microsoft-Lücke an
Über eine Sicherheitslücke in SharePoint haben Hacker zahlreiche Behörden und Unternehmen angegriffen. IT-Sicherheitsexperten schlagen Alarm, weil Behörden und Unternehmen über eine neu entdeckte Schwachstelle in Software von Microsoft angegriffen werden. Betroffen sind demnach lokale Server für das Programm SharePoint zum Teilen von Dateien. Über die Schwachstelle seien Angreifer bereits in Systeme “Dutzender” Organisationen eingedrungen, sowohl in…
-
CISA Issues Alert on Microsoft SharePoint 0-Day RCE Exploited in Attacks
Tags: attack, cisa, cve, cyber, cybersecurity, data, exploit, flaw, infrastructure, microsoft, rce, remote-code-execution, threat, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent security alert regarding a critical zero-day vulnerability in Microsoft SharePoint Server that is being actively exploited in cyberattacks. The vulnerability, tracked as CVE-2025-53770, represents a significant threat to organizations running on-premises SharePoint installations. The flaw stems from a deserialization of untrusted data vulnerability within…
-
U.S. CISA adds Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Fortinet FortiWeb flaw, tracked as CVE-2025-25257, to its Known Exploited Vulnerabilities (KEV) catalog. Hackers began exploiting the critical Fortinet FortiWeb flaw CVE-2025-25257 (CVSS score of 9.6) on the same day a proof-of-concept (PoC) exploit…
-
ISMG Editors: Seychelles Bank Breach Echoes ‘Panama Papers’
Also: Train Hack Risks Outed by CISA Alert; AI Comprehension Issues Won’t Go Away. In this week’s update, four ISMG editors discussed the potential global implications of the Seychelles Commercial Bank data breach; the real-world threat of train hacks following an alert about a critical railway vulnerability; and growing concerns around AI’s comprehension problem. First…
-
CISA Issues Advisories on Critical ICS Vulnerabilities Across Multiple Sectors
The US CISA has issued advisories for Industrial Control Systems vulnerabilities affecting multiple vendors including Johnson Controls, ABB, Hitachi Energy, and Schneider Electric First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-issues-advisories-ics-vulns/
-
Signal App Clone Telemessage App Vulnerability Actively Exploited for Password Theft
A critical vulnerability in TeleMessageTM SGNL, an enterprise messaging platform modeled after Signal, is being actively exploited by threat actors to steal passwords and sensitive data from government agencies and enterprises. The flaw, tracked as CVE-2025-48927, was added to CISA’s Known Exploited Vulnerabilities catalog on July 14th, indicating widespread exploitation in the wild. Vulnerability Details…
-
CISA Publishes 13 ICS Security Advisories on Critical Flaws
Tags: advisory, cisa, control, cyber, cybersecurity, flaw, infrastructure, network, technology, threat, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) released thirteen Industrial Control Systems (ICS) security advisories on July 17, 2025, highlighting critical vulnerabilities that could compromise essential infrastructure operations. This coordinated disclosure represents one of the most significant advisory releases of the year, underscoring escalating threats to operational technology networks across multiple sectors. Three Priority Vulnerabilities…
-
Signal App Clone Vulnerability Actively Exploited for Password Theft
A critical vulnerability in TeleMessageTM SGNL, an enterprise messaging platform modeled after Signal, is being actively exploited by threat actors to steal passwords and sensitive data from government agencies and enterprises. The flaw, tracked as CVE-2025-48927, was added to CISA’s Known Exploited Vulnerabilities catalog on July 14th, indicating widespread exploitation in the wild. Vulnerability Details…
-
CISA warnt vor Emerson ValveLink – Sicherheitslücken in Lösung für industrielle Steuerungssysteme
Tags: cisaFirst seen on security-insider.de Jump to article: www.security-insider.de/cisa-warnung-sicherheitsluecken-emersons-valvelink-software-a-3ddc33466f3109fbb83c0638a95b1e25/
-
New TeleMessage SGNL Flaw Is Actively Being Exploited by Attackers
Hackers are exploiting a new TeleMessage SGNL flaw that exposes sensitive data. CISA warns agencies to patch or stop using it by July 22. First seen on hackread.com Jump to article: hackread.com/telemessage-sgnl-flaw-actively-exploited-by-attackers/
-
Breach Roundup: Fashion House Louis Vuitton Confirms Breach
Also: CISA Warns of Unpatched Train Brake Vulnerability. This week: Louis Vuitton and Co-op confirm breaches, unpatched train brake flaw, Barclays fined £42M pounds for financial crime failures, secret U.K. program relocated thousands of Afghans, ex-soldier pleads guilty to hacking, Ukrainian hackers claim hit on Russian drone supplier. First seen on govinfosecurity.com Jump to article:…
-
‘FRED’ Security FAIL, Ignored by US Rail for 20 YEARS
BCH vs. SDR, AAR vs. CISA: Railroad industry first warned about this nasty vulnerability in 2005. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/train-fred-vuln-20-years-richixbw/
-
U.S. CISA adds Wing FTP Server flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Wing FTP Server flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Wing FTP Server flaw, tracked as CVE-2025-47812, to its Known Exploited Vulnerabilities (KEV) catalog. Wing FTP Server is a secure and flexible file transfer solution that supports multiple protocols, including FTP,…
-
CISA Flags Remote Linking Protocol Flaws Allowing Attackers to Hijack Train Brake Systems
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority security alert warning of serious vulnerabilities in railway brake control systems that could allow attackers to commandeer train operations and potentially cause catastrophic accidents. The alert, published on July 10, 2025, identifies critical flaws in the End-of-Train and Head-of-Train remote linking protocol used across…
-
CISA Issues Alert on Actively Exploited Wing FTP Server Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Wing FTP Server vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, warning that threat actors are actively exploiting the security flaw in the wild. Critical Security Flaw Enables System Takeover The vulnerability, tracked as CVE-2025-47812, affects Wing FTP Server and involves improper neutralization of null…
-
An attacker using a $500 radio setup could potentially trigger train brake failures or derailments from a distance
A 20-year-old flaw in End-of-Train and Head-of-Train systems could let hackers trigger emergency braking, finally getting proper attention. US CISA has warned about a critical flaw, tracked as CVE-2025-1727, in the radio-based linking protocol between End-of-Train (EoT) and Head-of-Train (HoT) systems. An End-of-Train (EoT) device, also known as a Flashing Rear End Device (FRED), is…
-
Exploited Wing file transfer bug risks ‘total server compromise,’ CISA warns
A critical vulnerability in products from the file transfer company Wing FTP Server is being actively exploited, the Cybersecurity and Infrastructure Security Agency said. First seen on therecord.media Jump to article: therecord.media/exploited-file-transfer-bug-cisa
-
A software-defined radio can derail a US train by slamming the brakes on remotely
Neil Smith has been trying to get the railroad industry to listen since 2012, but it took a CISA warning to get there First seen on theregister.com Jump to article: www.theregister.com/2025/07/14/train_brakes_flaw/
-
‘Critical’ Citrix NetScaler Vulnerability Now Seeing Exploitation: CISA
CISA ordered Federal Civilian Executive Branch agencies to implement fixes for a critical-severity vulnerability affecting two Citrix NetScaler products by end of day Friday. First seen on crn.com Jump to article: www.crn.com/news/security/2025/critical-citrix-netscaler-vulnerability-now-seeing-exploitation-cisa
-
CISA warns hackers are actively exploiting critical ‘Citrix Bleed 2’ security flaw
The U.S. cybersecurity agency gave federal agencies just one day to patch a security bug in Citrix Netscaler, which can be exploited to break into corporate and government networks. First seen on techcrunch.com Jump to article: techcrunch.com/2025/07/11/cisa-confirms-hackers-are-actively-exploiting-critical-citrix-bleed-2-bug/
-
CISA confirms hackers are actively exploiting critical ‘Citrix Bleed 2’ bug
The U.S. cybersecurity agency gave federal agencies just one day to patch a security bug in Citrix Netscaler, which can be exploited to break into corporate and government networks. First seen on techcrunch.com Jump to article: techcrunch.com/2025/07/11/cisa-confirms-hackers-are-actively-exploiting-critical-citrix-bleed-2-bug/
-
Researchers, CISA confirm active exploitation of critical Citrix Netscaler flaw
Critics have faulted Citrix for not updating its guidance in recent days, even as concerns grow about a resumption of the 2023 CitrixBleed crisis. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/researchers-cisa-exploitation-citrix-netscaler/752819/
-
CISA orders agencies to immediately patch Citrix Bleed 2, saying bug poses ‘unacceptable risk’
The one-day deadline issued by CISA on Thursday appears to be the shortest one ever issued. Federal civilian agencies are typically given three weeks to patch bugs added to the known exploited vulnerability catalog. First seen on therecord.media Jump to article: therecord.media/cisa-orders-agencies-patch-citrix-bleed-2
-
CISA tags Citrix Bleed 2 as exploited, gives agencies a day to patch
The U.S. Cybersecurity & Infrastructure Security Agency has confirmed active exploitation of the CitrixBleed 2 vulnerability (CVE-2025-5777) in Citrix NetScaler ADC and Gateway and is giving federal agencies one day to apply fixes. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch/
-
ISACA Addresses Experience Gap with CISA Associate Designation
Tags: cisaThe new CISA Associate designation recognizes ISACA members who have passed the CISA exam, but do not yet have the required experience First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/isaca-cisa-associate-designation/
-
CISA Alerts on Active Exploits Targeting Citrix NetScaler ADC and Gateway Flaw
Tags: cisa, citrix, cve, cyber, cybersecurity, exploit, flaw, infrastructure, network, risk, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding active exploitation of a newly discovered vulnerability in Citrix NetScaler ADC and Gateway systems, with organizations facing an immediate deadline to implement protective measures. The vulnerability, designated CVE-2025-5777, poses significant security risks to enterprise networks worldwide and has been added to CISA’s…
-
CISA Issues 13 New Advisories on Industrial Control System Vulnerabilities and Exploits
Tags: cisa, control, cyber, cybersecurity, exploit, infrastructure, mitigation, threat, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) released thirteen new Industrial Control Systems (ICS) advisories, spotlighting a range of security vulnerabilities and potential exploits affecting critical infrastructure components. These advisories are a vital resource for organizations relying on ICS technologies, offering detailed technical insights into current threats and actionable mitigations to safeguard operations. With industries…
-
U.S. CISA adds Citrix NetScaler ADC and Gateway flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds U.S. CISA adds Citrix NetScaler ADC and Gateway flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Citrix NetScaler ADC and Gateway, tracked as CVE-2025-5777, to its Known Exploited Vulnerabilities (KEV) catalog. The CVE-2025-5777 flaw, dubbed ‘CitrixBleed 2’ (CVSS v4.0 Base Score…
-
CISA Adds Citrix NetScaler CVE-2025-5777 to KEV Catalog as Active Exploits Target Enterprises
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting Citrix NetScaler ADC and Gateway to its Known Exploited Vulnerabilities (KEV) catalog, officially confirming the vulnerability has been weaponized in the wild.The shortcoming in question is CVE-2025-5777 (CVSS score: 9.3), an instance of insufficient input validation that First seen…