Tag: cyber
-
Linux Boot Vulnerability Lets Attackers Bypass Secure Boot Protections
A newly highlighted vulnerability in the Linux boot process exposes a critical weakness in the security posture of many modern distributions. Despite widespread adoption of Secure Boot, full-disk encryption, and bootloader passwords, attackers can still bypass these defenses by exploiting the Initial RAM Filesystem (initramfs) debug shell”, a loophole often overlooked in hardening guides, as…
-
Skills gaps send CISOs in search of managed security providers
Tags: access, awareness, business, ciso, compliance, control, cyber, cybersecurity, detection, governance, group, infrastructure, intelligence, jobs, monitoring, msp, mssp, network, penetration-testing, risk, risk-assessment, service, skills, strategy, threat, tool, training, update, vulnerabilitySecurity operations centers (SOCs)Cloud platform managementSIEM and log monitoringFramework-based cybersecurity management functionsThreat intelligence feeds and analysisVulnerability scanning and patch managementEndpoint detection and response (EDR)Firewall and network security managementCompliance tracking and audit support”MSPs already have the infrastructure and staff in place to deliver these services efficiently, and at scale,” Richard Tubb, who runs the MSP community…
-
Digital warfare is blurring civilian front lines
Singapore’s defence cyber chief warns that the traditional lines between military conflict and civilian life are blurring, with adversaries now targeting civilian systems and using AI to put the threat landscape on steroids First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366627027/Digital-warfare-is-blurring-civilian-front-lines
-
ScriptCase Vulnerabilities Allow Remote Code Execution and Full Server Compromise
Two critical vulnerabilities have been discovered in ScriptCase, a popular low-code PHP web application generator, which puts thousands of servers at risk of remote code execution and complete compromise. The flaws, tracked as CVE-2025-47227 and CVE-2025-47228, affect the Production Environment module (also known as the >>prod console
-
PoC Released for Linux Privilege Escalation Flaw in udisksd and libblockdev
Security researchers disclosed a critical local privilege escalation (LPE) vulnerability affecting Fedora, SUSE, and other major Linux distributions. The flaw, tracked asCVE-2025-6019, resides in the interaction between theudisksddaemon and its backend library,libblockdev. A proof-of-concept (PoC) exploit has been released, demonstrating how a user in the allow_active group can escalate privileges to root with minimal effort in certain…
-
Cyber-Zwischenfall bei einer Luxusmarke in Südkorea
개인정보에 관한 루이비통코리아의 중요 공지 First seen on louisvuitton.com Jump to article: www.louisvuitton.com/documents/privacy-information/kr/information-notice
-
CitrixBleed 2 Vulnerability PoC Published Experts Warn of Mass Exploitation Risk
A newly published proof-of-concept (PoC) for the critical CitrixBleed 2 vulnerability (CVE-2025-5777) has sent shockwaves through the cybersecurity community, with experts warning of imminent mass exploitation risks for organizations using Citrix NetScaler ADC and Gateway devices. The Vulnerability: CitrixBleed 2 (CVE-2025-5777) Dubbed “CitrixBleed 2” for its eerie resemblance to the notorious CitrixBleed flaw of 2023,…
-
Qantas attack reveals one phone call is all it takes to crack cybersecurity’s weakest link: humans
Tags: access, attack, breach, cyber, cybercrime, cybersecurity, data, data-breach, email, finance, healthcare, phone, riskOther sectors also at risk from attacks, including healthcare, finance and telecommunications, expert warns<ul><li>Get our <a href=”https://www.theguardian.com/email-newsletters?CMP=cvau_sfl”>breaking news email, <a href=”https://app.adjust.com/w4u7jx3″>free app or <a href=”https://www.theguardian.com/australia-news/series/full-story?CMP=cvau_sfl”>daily news podcast</li></ul>All it can take is a phone call. That’s what <a href=”https://www.theguardian.com/business/2025/jul/02/qantas-confirms-cyber-attack-exposes-records-of-up-to-6-million-customers”>Qantas learned this week when the personal information of up to 6 million customers was stolen by cybercriminals…
-
Technical difficulties or cyber attack? Ingram Micro’s website goes down just in time for the holiday weekend
Nothing says “Holiday Weekend” like a mysterious IT outage. First seen on grahamcluley.com Jump to article: grahamcluley.com/technical-difficulties-or-cyber-attack-ingram-micros-website-goes-down-just-in-time-for-the-holiday-weekend/
-
Malicious SEO Plugins on WordPress Can Lead to Site Takeover
A new wave of cyberattacks is targeting WordPress websites through malicious SEO plugins that can lead to complete site takeover. Security analysts have uncovered sophisticated malware campaigns where attackers disguise their plugins to blend seamlessly with legitimate site components, making detection extremely challenging for administrators. One particularly insidious tactic involves naming the malicious plugin after…
-
Instagram Now Rotating TLS Certificates Daily with 1-Week Validity
Instagram has begun rotating its TLS certificates on a daily basis, with each certificate valid for just over a week. This approach, which goes far beyond current industry standards, was discovered during routine network debugging and has since been confirmed through systematic monitoring and analysis. Setup and Discovery The anomaly was first noticed when a…
-
SquareX Reveals That Employees Are No Longer The Weakest Link, Browser AI Agents Are
Every security practitioner knows that employees are the weakest link in an organization, butthis is no longer the case. SquareX’s research reveals that Browser AI Agents are more likely tofall prey to cyberattacks than employees, making them the new weakest link that enterprisesecurity teams need to look out for. Browser AI Agents are software applications…
-
Scattered Spider Enhances Tactics to Exploit Legitimate Tools for Evasion and Persistence
Scattered Spider, also tracked under aliases such as UNC3944, Scatter Swine, and Muddled Libra, has emerged as a formidable financially motivated cybercriminal group since at least May 2022. Initially known for targeting telecommunications and tech firms with phishing and SIM-swapping campaigns, the group has significantly evolved, orchestrating full-spectrum, multi-stage intrusions across both cloud and on-premises…
-
Hunters International Is Not Shutting Down, It’s Rebranding
Some admins of Hunters International are now part of the encryption-less cyber extortion group World Leaks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ransomware-hunters-international/
-
Next.js Vulnerability Allows Attackers to Trigger DoS via Cache Poisoning
A critical vulnerability, tracked asCVE-2025-49826, has been discovered and addressed in the popular React-based web framework, Next.js. The flaw, present in versions >=15.1.0 and <15.1.8, allowed attackers to exploit a cache poisoning bug, potentially leading to a Denial of Service (DoS) condition for affected applications, as per a report by Vercel. CVE ID Affected Versions Severity…
-
Hackers Abuse Legitimate Inno Setup Installer to Deliver Malware
Cybercriminals are increasingly weaponizing legitimate software installer frameworks like Inno Setup to distribute malware, turning user-friendly tools into covert vehicles for malicious payloads. Originally designed to simplify software deployment on Windows, Inno Setup has become a favored tool among threat actors due to its trusted appearance and powerful Pascal scripting capabilities. This sophisticated abuse allows…
-
Writable File in Lenovo Path Lets Attackers Evade AppLocker Restrictions
A security researcher has uncovered a significant vulnerability affecting Lenovo computers: a writable file within the Windows directory that can be exploited to bypass AppLocker restrictions. The file in question, C:\Windows\MFGSTAT.zip, is present on many Lenovo machines that ship with the manufacturer’s default Windows image. This issue, initially thought to affect only a handful of…
-
Researchers Discover New Method to Identify Azure Arc in Enterprise Environments and Maintain Persistence
Security researchers have discovered novel ways to identify and take advantage of Microsoft Azure Arc in business settings, which is a major advancement in cybersecurity and may reveal weaknesses in this hybrid management system. Introduced in 2019, Azure Arc extends Azure’s native management capabilities to non-Azure resources, including on-premises servers and Kubernetes clusters, through the…
-
Critical HIKVISION applyCT Flaw Allows Remote Code Execution
A newly disclosed vulnerability, tracked as CVE-2025-34067, has been identified in HIKVISION’s widely deployed security management platform, applyCT (also known as HikCentral). This critical flaw allows unauthenticated remote code execution (RCE), putting countless surveillance and security infrastructures at risk across government, commercial, and industrial sectors. Its advanced analytics and scalable architecture make it a popular choice…
-
Hackers Exploit Java Debug Wire Protocol Servers to Deploy Cryptomining Payloads
A sophisticated cyberattack targeting unsecured Java Debug Wire Protocol (JDWP) interfaces on honeypot servers running TeamCity, a popular CI/CD application, has been discovered, according to a startling disclosure from the Wiz Research Team. The team observed that within mere hours of exposing a vulnerable machine, attackers exploited the JDWP interface to achieve remote code execution…
-
Estonia’s cyber ambassador on digitalization, punching upwards and outing GRU spies
Recorded Future News spoke to Estonia’s cyber ambassador-at-large on the sidelines of the Tallinn Cyber Diplomacy Summer School about the country’s efforts to secure its digital services. First seen on therecord.media Jump to article: therecord.media/estonia-cyber-ambassador-interview
-
Massive Android Ad Fraud ‘IconAds’ Uses Google Play to Target and Exploit Users
HUMAN’s Satori Threat Intelligence and Research Team has dismantled a sprawling ad fraud operation named IconAds, which infiltrated the Google Play Store with 352 malicious apps. At its peak, this scheme generated a staggering 1.2 billion bid requests daily, flooding users’ screens with out-of-context ads while employing cunning tactics to hide app icons and obscure…
-
Dobrindt will mehr in Cybersicherheit investieren
Bundesinnenminister Alexander Dobrindt will den Schutz vor Cyberangriffen verstärken.Bundesinnenminister Alexander Dobrindt (CSU) hat verstärkte Maßnahmen gegen Cyberangriffe angekündigt. “Uns geht es darum, dass wir einen Cyber Dome für Deutschland entwickeln”, sagte er bei einem Besuch des Bundesamtes für Sicherheit in der Informationstechnik (BSI) in Bonn. Das bedeute, “dass wir den militärischen Schutz und den Cyber-Schutz…
-
Cybersecurity in the supply chain: strategies for managing fourth-party risks
Tags: access, breach, business, ciso, compliance, control, cyber, cybersecurity, data, exploit, framework, governance, intelligence, ISO-27001, law, mitigation, monitoring, nist, risk, risk-management, saas, service, soc, software, strategy, supply-chain, threat, tool, vulnerabilitySet clear data boundaries: The reality is that any organization consuming third-party software-as-a-service offerings and services has extremely limited control over the partners that their third parties are working with, says Curtis Simpson, CISO at Armis.”This is why it’s critically important to understand the sub-processors involved in the delivery of contracted SaaS offerings and services,…
-
Multiple PHP Vulnerabilities Enables SQLi and DoS Attacks Update Now
Security researchers have disclosed two significant vulnerabilities in PHP, the popular server-side scripting language, that could allow attackers to launch SQL injection (SQLi) and Denial of Service (DoS) attacks. According to the report, Administrators and developers are urged to update their PHP installations immediately to mitigate these risks. CVE ID Component Severity Affected Versions Patched…
-
Catwatchful Android Spyware Leaks Credentials of 62,000+ Users
A major security lapse has exposed the credentials of over 62,000 users of Catwatchful, a full-featured Android spyware app that openly markets itself as a tool for covert surveillance. The breach, discovered by a security researcher, highlights the persistent risks posed by stalkerware and the dangers of storing sensitive user data without adequate safeguards. Catwatchful…
-
Researchers Defeat Content Security Policy Protections via HTML Injection
In a breakthrough that challenges the perceived safety of nonce-based Content Security Policy (CSP), security researchers have demonstrated a practical method to bypass these protections by combining HTML injection, CSS-based nonce leakage, and browser cache manipulation. The Setup: A Realistic XSS Challenge The research centers on a minimal web application featuring a login form and…
-
New >>123 – Stealer<< Malware Rented on Dark Web for $120/Month
A new credential-stealing malware, dubbed >>123 – Stealer,123 | Stealer