Tag: cyber
-
UXSS Vulnerability in DuckDuckGo Browser’s AutoConsent JS Bridge Allows Cross-Origin Attacks
A critical vulnerability was recently discovered in the DuckDuckGo browser for Android, exposing users to Universal Cross-Site Scripting (UXSS) attacks. This flaw, found in the browser’s AutoConsent JS bridge, allows malicious code from an untrusted source to run on a trusted webpage. Security researcher Dhiraj Mishra reported the vulnerability via HackerOne. It has since been…
-
OneUptime Command Injection Vulnerability Poses Major Risk of Full System Takeover
A critical command injection vulnerability, identified as CVE-2026-27728, has been discovered in OneUptime, a platform for monitoring and managing online services. This flaw allows authenticated users to execute arbitrary operating system commands on the Probe server, posing a significant risk of a full system takeover. Organizations using versions prior to 10.0.7 are urged to patch…
-
GTFire Phishing Campaign Exploits Google Services to Bypass Detection and Harvest Credentials
GTFire is a large-scale phishing scheme that abuses multiple Google services to hide malicious infrastructure, evade security tools, and steal credentials from organizations worldwide. GTFire is a credential-harvesting operation that chains Google Firebase Hosting and Google Translate to deliver phishing pages that look like legitimate brand logins. Attackers host fake login portals on Firebase .web.…
-
Pakistan’s Top News Channels Hacked and Hijacked With Anti-Military Messages
Major Pakistani TV channels, including Geo News and ARY News, were hit by a coordinated cyberattack on 1 March 2026. Hackers took control of live satellite feeds to display unauthorised messages. Read more about the breach, the regional impact, and the reported counter-cyber response. First seen on hackread.com Jump to article: hackread.com/pakistan-news-channels-hacked-anti-military-messages/
-
UK reduces cyberattack fix times from two months to eight days
The UK government has launched a new vulnerability monitoring service (VMS) that promises to reduce the time needed to fix critical cyber weaknesses across the public sector. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/02/uk-vulnerability-monitoring-service-and-cyber-profession/
-
Link11 Releases European Cyber Report 2026: DDoS Attacks Become a Constant Threat
Frankfurt am Main, Germany, 2nd March 2026, CyberNewswire First seen on hackread.com Jump to article: hackread.com/link11-releases-european-cyber-report-2026-ddos-attacks-become-a-constant-threat/
-
Project Compass Operation Cracks Down on “The Com” Cybercrime Collective 30 Arrested, 179 Suspects Identified
An international law enforcement operation named Project Compass has launched a major offensive against >>The Com,<< a dangerous transnational virtual network (TVN). The operation, which began in January 2025, has successfully led to the arrest of 30 suspects and the identification of 179 potential perpetrators connected to the sprawling cybercrime collective. Led by the European…
-
Link11 Releases European Cyber Report 2026: DDoS Attacks Become a Constant Threat
Frankfurt am Main, Germany, 2nd March 2026, CyberNewswire First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/link11-releases-european-cyber-report-2026-ddos-attacks-become-a-constant-threat/
-
GUEST ESSAY: Real cyber risks arise when small flaws combine and alerts are viewed in isolation
Security teams are drowning in signals. Alerts fire. Logs accumulate. Dashboards light up. Yet breaches still unfold quietly, often through a series of low-level actions that never trigger a single catastrophic alarm. Related: How ‘observability’ drives security Attackers do not… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/guest-essay-real-cyber-risks-arise-when-small-flaws-combine-and-alerts-are-viewed-in-isolation/
-
A scorecard for cyber and risk culture
Tags: access, automation, awareness, breach, business, compliance, control, credentials, cyber, finance, governance, identity, jobs, metric, mitigation, phishing, risk, service, strategy, tool, trainingWhen someone asks for an exception.When a change goes in late.When an alert fires at 2 a.m.When a junior analyst spots something odd and wonders if it’s worth escalating.When an executive wants speed, and the team wants safety. Ownership means people act like the risk is partly theirs. They don’t outsource judgment to “security.” They…
-
Hackers Launch Massive SonicWall Firewall Attack Using 4,000+ IP Addresses
Hackers are actively mapping SonicWall firewalls worldwide, launching more than 84,000 SonicOS scanning sessions from over 4,000 unique IP addresses in just four days to identify SSL VPN targets for future credential and vulnerability attacks. Three operationally distinct infrastructure clusters coordinated large-scale VPN enumeration, with 92% of all sessions hitting a single SonicOS REST API…
-
OCRFix Botnet Uses ClickFix Phishing and EtherHiding to Mask Blockchain C2 Infrastructure
OCRFix is a multi-stage botnet Trojan campaign that abuses a fake Tesseract OCR download site, ClickFix-style PowerShell execution, and EtherHiding on BNB Smart Chain to conceal a rotating blockchain-backed command infrastructure. The fake site gates content behind a bogus CAPTCHA and then instructs users to open PowerShell and paste a pre-copied command, a hallmark of…
-
How CISOs can build a resilient workforce
Tags: ai, automation, ciso, communications, cyber, cybersecurity, data, infrastructure, jobs, monitoring, network, risk, service, skills, soc, software, strategy, technology, threat, tool, trainingBurnout leads to job dissatisfaction: Burnout is an ongoing concern for many CISOs and their teams, especially when unpredictable events can trigger workload spikes, burnout can escalate fast. “It’s something that can overwhelm pretty quickly,” Ford says.Industry surveys continue to flash red on persistent burnout that leads to job dissatisfaction. The ISC2 study found almost…
-
Middle East AWS Outage Sends Shockwaves Through Cloud Infrastructure Service
A severe infrastructure incident in the Middle East has triggered a massive Amazon Web Services (AWS) outage, disrupting critical cloud operations across the region. The event, which aggressively impacted the ME-CENTRAL-1 (United Arab Emirates) and ME-SOUTH-1 (Bahrain) regions, left countless organizations unable to access essential compute, networking, and storage resources. Physical Damage Sparks Data Center…
-
CISA Alerts on RESURGE Malware Exploiting Ivanti Connect Secure Zero-Days
The Cybersecurity and Infrastructure Security Agency (CISA) has released a Malware Analysis Report (MAR) detailing a new malware family dubbed RESURGE, which is actively exploiting a zero-day vulnerability in Ivanti Connect Secure devices. According to CISA, RESURGE builds upon the functionality of the earlier SPAWNCHIMERA malware strain, introducing new commands designed to enhance persistence and…
-
When cyber threats start thinking for themselves
In this Help Net Security video, Jason Rivera, Field CISO Head of Solution Engineering at SimSpace, discusses how autonomous AI agents are changing cyber threats. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/02/autonomous-cyber-threats-video/
-
Prayer App Used by Millions Hacked to Broadcast Defection Messages Amid U.S.-Israel Strikes on Iran
A popular Iranian prayer timing application, BadeSaba Calendar, was hacked to deliver anti-government push notifications to millions of users. This cyber incident occurred early Saturday morning, coinciding with joint U.S. and Israeli military strikes on Iran. While the kinetic strikes targeted physical locations, this coordinated cyber operation sought to broadcast messages of defection directly to…
-
Pixel Perfect Browser Extension Exploited for Stealth Script Injection and Security Header Stripping
A popular Chrome add-on, “QuickLens Search Screen with Google Lens,” has quietly morphed from a legitimate productivity tool into a full”‘fledged remote code-execution platform that abuses browser trust, security headers, and silent auto”‘updates. What began as a simple Google Lens wrapper ended in a covert C2″‘driven campaign capable of injecting arbitrary scripts into any […]…
-
How vCISO Services Reduce Cyber Risk Without Increasing Costs?
Smaller organizations are increasingly under attack, with ransomware emerging as the dominant threat. According to the Verizon 2025 Data Breach Investigations Report, ransomware was involved in 88% of breaches affecting small and medium-sized enterprises (SMEs), compared to 39% among large enterprises. Such incidents can disrupt operations, expose sensitive information, and drive up recovery costs. Despite……
-
Area Man Accidentally Hacks 6,700 Camera-Enabled Robot Vacuums
Plus: The top US cyber agency falls into shambles, AI models develop an upsetting penchant for nuclear weapons, and more. First seen on wired.com Jump to article: www.wired.com/story/security-news-this-week-area-man-accidentally-hacks-6700-camera-enabled-robot-vacuums/
-
Hackers Exploit Windows File Explorer and WebDAV to Distribute Malware
Cybersecurity researchers at Cofense Intelligence have uncovered an ongoing campaign where threat actors abuse Windows File Explorer to distribute malware. By exploiting the legacy WebDAV protocol, attackers are tricking victims into downloading Remote Access Trojans (RATs) while bypassing traditional web browser security controls and some Endpoint Detection and Response (EDR) systems.”‹ WebDAV Exploit WebDAV (Web-based…
-
Trump Bans Anthropic AI in Federal Agencies Amid Growing Security Concerns
The United States government has taken a massive step by banning federal agencies from using Anthropic, a domestic AI company known for its model, Claude. For the first time, a U.S. firm has been classified as a supply chain risk to national security, a label usually given to foreign companies like Huawei. President Donald Trump…
-
Senate Health Cyber Bill Clears Committee Hurdle
Bipartisan Bill Would Mandate Multifactor Authentication, Pen Testing. Proposed legislation that’s been kicking around Congress for the last few years that aims to help bolster cybersecurity of the healthcare sector cleared a critical hurdle on Thursday. But will the bill gain enough momentum to pass the full Senate, the House and be signed into law?…
-
Cities Hosting Major Events Need More Focus on Wireless, Drone Defense
Major events like the FIFA World Cup need to look beyond traditional physical and cyber security to active and passive wireless threats, say experts. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/cities-major-events-wireless-drone-defense
-
CISA Leadership Shakeup Amid DHS Shutdown
US Cyber Defense Agency Switches Acting Director Amid Shutdown Turmoil. The U.S. cyber defense agency is going through a major leadership shakeup – again – following months of staffing turnover, budget cuts and shutdowns. Acting Director Madhu Gottumukkala is moving into a senior strategy role at the Department of Homeland Security, of which CISA is…