Tag: cyber
-
CISOs flag gaps in third-party risk management
Third-party cyber risk continues to concern security leaders as vendor ecosystems grow, supply chains stretch, and AI plays a larger role in business operations. A recent … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/15/panorays-cisos-ai-vendor-risk/
-
Incorporating Geopolitical Risk Into Your IT Strategy
Scenario Planning Must Model Disruption, Strengthen Cyber Basics, Build Redundancy. IT organizations know how to plan for outages, but even the most rigorously designed strategy is vulnerable to the shifting winds of geopolitics. CIOs and technology leaders need to know how their organizations will respond to geopolitical disruptions, and scenario planning needs to be a…
-
CVE-2025-64155: Exploit Code Released for Critical Fortinet FortiSIEM Command Injection Vulnerability
Tags: access, advisory, attack, authentication, cisa, cve, cyber, cybersecurity, exploit, flaw, fortinet, infrastructure, injection, kev, mitigation, threat, update, vpn, vulnerability, zero-dayExploit code has been published for CVE-2025-64155, a critical command injection vulnerability affecting Fortinet FortiSIEM devices. Key takeaways: CVE-2025-64155 is a critical operating system (OS) command injection vulnerability affecting Fortinet FortiSIEM. Fortinet vulnerabilities have historically been common targets for cyber attackers, with 23 Fortinet CVEs currently on the CISA KEV list. Public exploit code has…
-
Iran’s partial internet shutdown may be a windfall for cybersecurity intel
only available launchpads. A connection from the Ministry of Agriculture might not be a farmer. It’s likely a tunnel for a state actor who needs an exit node.”Ranjbar said the removal of the traffic from millions of routine Iranian business and residential users allows a powerful visibility into Iranian government traffic patterns, thereby allowing SOCs…
-
France fines Free Mobile Euro42 million over 2024 data breach incident
The French data protection authority (CNIL) has imposed cumulative fines of Euro42 million on Free Mobile and its parent company, Free, for inadequate protection of customer data against cyber threats. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/france-fines-free-mobile-42-million-over-2024-data-breach-incident/
-
North Korean Hackers Exploit Code Repositories in “Contagious Interview” Campaign
A newly documented campaign dubbed “Contagious Interview” shows North Korean threat actors weaponising developer tooling and code-repository workflows to steal credentials, cryptocurrency wallets and establish remote access even when victims never “run” the code they are sent. In a recent case analysed by SEAL, a malicious Bitbucket repository (hxxps://bitbucket[.]org/0xmvptechlab/ctrading) was delivered as a take”‘home technical…
-
Android Users Hit by Volume Button Bug Linked to Select to Speak
Google has confirmed a critical bug affecting Android devices where volume buttons malfunction when the Select to Speak accessibility feature is enabled. The issue causes volume keys to adjust accessibility volume rather than media volume. It prevents the camera from capturing photos when the volume buttons are pressed during photography. Users with Select to Speak…
-
US cybersecurity weakened by congressional delays despite Plankey renomination
Tags: business, cisa, cyber, cybersecurity, government, infrastructure, law, network, risk, strategy, threatCISA 2015 reauthorization: Likely, but late and suboptimal: A major cybersecurity bill called the Cybersecurity Information Sharing Act of 2015 (CISA 2015), which expired on Sept. 30, was temporarily revived on Nov. 13 and given a two-month lease on life through Jan. 30, 2026. The law provides critical legal liability protections that enable cyber threat…
-
Multiple Elastic Vulnerabilities Could Lead to File Theft and DoS
Elastic has released urgent security patches addressing four significant vulnerabilities in Kibana that could enable attackers to steal sensitive files, trigger service outages, and exhaust system resources. The advisories, published on January 14, 2026, affect multiple Kibana versions spanning from 7.x through 9.2.3. Critical File Disclosure and SSRF Vulnerability The most severe flaw, CVE-2026-0532, has…
-
AuraInspector: Open-Source Misconfiguration Detection for Salesforce Aura
Mandiant has released AuraInspector, an open-source command-line tool designed to help security teams identify and audit access control misconfigurations within the Salesforce Aura framework that could expose sensitive data, including credit card numbers, identity documents, and health information. The tool addresses a critical gap in Salesforce Experience Cloud security, where complex sharing rules and multi-level…
-
January 2026 Microsoft Patch Tuesday: Actively exploited zero day needs attention
More priorities: Executives should also prioritize rapid patching and risk reduction efforts this month around the Windows Local Security Authority Subsystem Service Remote Code Execution, Windows Graphics Component Elevation of Privilege, and Windows Virtualization Based Security Enclave Elevation of Privilege flaws, Bicer said, as these vulnerabilities directly enable full system or trust boundary compromise.Strategic focus…
-
Taiwan Endures Greater Cyber Pressure From China
Chinese cyberattacks on Taiwan’s critical infrastructure, including energy utilities and hospitals, rose 6% in 2025, averaging 2.63 million attacks a day. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/taiwan-sees-greater-cyber-pressure-from-china
-
Western cyber agencies warn about threats to industrial operational technology
New guidance issued by Britain’s National Cyber Secure Centre (NCSC), a part of signals and cyber intelligence agency GCHQ, sets out how organizations should securely connect equipment such as industrial control systems, sensors and other critical services. First seen on therecord.media Jump to article: therecord.media/cyber-agencies-warn-of-industrial-system-threats
-
Taiwan Endures Greater Cyber Pressure From China
Chinese cyberattacks on Taiwan’s critical infrastructure, including energy utilities and hospitals, rose 6% in 2025, averaging 2.63 million attacks a day. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/taiwan-sees-greater-cyber-pressure-from-china
-
Cyber-stricken Belgian hospitals refuse ambulances, transfer critical patients
Attack enters second day with major disruption to healthcare provision First seen on theregister.com Jump to article: www.theregister.com/2026/01/14/belgium_hospital_cyberattack/
-
Taiwan Endures Greater Cyber Pressure From China
Chinese cyberattacks on Taiwan’s critical infrastructure, including energy utilities and hospitals, rose 6% in 2025, averaging 2.63 million attacks a day. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/taiwan-sees-greater-cyber-pressure-from-china
-
Survey: Rapid AI Adoption Causes Major Cyber Risk Visibility Gaps
As software supply chains become longer and more interconnected, enterprises have become well aware of the need to… First seen on hackread.com Jump to article: hackread.com/survey-rapid-ai-adoption-cyber-risk-visibility-gaps/
-
PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces
The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of new cyber attacks targeting its defense forces with malware known as PLUGGYAPE between October and December 2025.The activity has been attributed with medium confidence to a Russian hacking group tracked as Void Blizzard (aka Laundry Bear or UAC-0190). The threat actor is believed…
-
Microsoft DCU uses UK courts to hunt down cyber criminals
Microsoft has taken down the RedDVS cyber crime-as-a-service network after obtaining a UK court order, marking its first civil legal action outside of the US First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366637353/Microsoft-DCU-uses-UK-courts-to-hunt-down-cyber-criminals
-
Criminal Subscription Service Behind AI-Powered Cyber-Attacks Taken Out By Microsoft
RedVDS cyber-crime-as-a-service platform powering phishing, BEC attacks and other fraud has cost victims millions First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/criminal-subscription-service/
-
Nozomi Networks opens APAC headquarters in Singapore
Industrial cyber security firm Nozomi Networks has opened its Singapore headquarters, doubling its regional headcount, and pledging to remain vendor agnostic while targeting the manufacturing and utility sectors First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366637259/Nozomi-Networks-opens-APAC-headquarters-in-Singapore
-
G7 Sets 2034 Deadline for Finance to Adopt Quantum-Safe Systems
The financial sector should finalize its post-quantum cryptography transition circa 2034, G7 cyber experts said First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/g7-2034-deadline-finance-pqc/
-
Keeper Security puts Atlassian Williams F1 Team in pole position on cybersecurity
In Formula 1, milliseconds matter… and so does security. Keeper Security has helped Atlassian Williams F1 Team tighten its cyber defences, revealing how the iconic racing team is using KeeperPAM to protect its data, systems and global operations without taking its foot off the accelerator. Announced on 13 January 2026, a new case study from…
-
Hohe Summen für Verrat von innen: Cyber-Kriminelle suchen gezielt Insider
In einschlägigen Darknet-Foren werden Mitarbeitende aktiv angesprochen teilweise melden sie sich auch selbst. Angeboten werden Zugänge, Anmeldedaten oder sensible Informationen, bezahlt mit anonymen Kryptowährungen. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/hohe-summen-fuer-verrat-von-innen-cyber-kriminelle-suchen-gezielt-insider/a43355/
-
2026 Study from Panorays: 85% of CISOs Can’t See Third-Party Threats Amid Increasing Supply Chain Attacks
New York, NY, January 14th, 2026, CyberNewsWire Panorays, a leading provider of third-party security risk management software, has released the 2026 edition of its annual CISO Survey for Third-Party Cyber Risk Management. The survey highlights third-party cyber risk as one of the most critical challenges facing security leaders today, driven largely by a lack of…
-
SpyCloud Launches Supply Chain Solution to Combat Rising Third-Party Identity Threats
Austin, TX / USA, January 14th, 2026, CyberNewsWire New monitoring capability delivers unprecedented visibility into vendor identity exposures, moving enterprises and government agencies from static risk scoring to protecting against actual identity threats. SpyCloud, the leader in identity threat protection, today announced the launch of its Supply Chain Threat Protection solution, an advanced layer of…
-
GitGuardian Closes 2025 with Strong Enterprise Momentum, Protecting Millions of Developers Worldwide
New York, NY, January 14th, 2026, CyberNewsWire Leading secrets security platform sees accelerated adoption across Fortune 500, with 60% of new customers choosing multi-year commitments. GitGuardian, the leading secrets and Non-Human Identity security platform, today announced record growth in ARR and customer expansion throughout 2025, reinforcing its position as the enterprise standard for protecting code,…
-
DragonForce Ransomware Breakdown and Decryptor for ESXi Windows
Security researchers have published an in”‘depth technical analysis of the DragonForce ransomware operation, along with details of working decryptors for both Windows and ESXi systems targeting specific victims. By the time its dedicated Data Leak Site (DLS) was identified later that month, 17 victim organizations had already been listed. DragonForce markets itself as a cartel…