Tag: cybersecurity
-
Trump seeks unprecedented $1.23 billion cut to federal cyber budget
Tags: attack, cisa, cyber, cybersecurity, data, government, infrastructure, jobs, network, nist, office, risk, risk-management, service, strategy, technology, threatCynthia Brumfield / CSO(The chart is based on White House data provided for 2017, 2018, 2019, 2020, 2021, 2022, and 2023. Numbers for 2024, 2025, and 2026 reflect adjustments that Trump’s OMB made for 2024 and 2025.)The administration’s cybersecurity budget cuts are not evenly distributed among federal agencies. In fact, according to crosscut tables released…
-
Trend Micro flags BERT: A rapidly growing ransomware threat
Low-code, high impact: BERT is not an isolated development, it is part of a growing wave of emerging ransomware groups that are proving both capable and elusive. In just the last three to four months, cybersecurity researchers have identified multiple new ransomware families that signal a shift toward leaner, low-code, and faster malware operations.For instance,…
-
Hackers Manipulate Search Results to Target IT Pros with Trojanized PuTTY and WinSCP
Arctic Wolf has uncovered a cunning cybersecurity threat that exploits search engine optimization (SEO) poisoning and malvertising tactics to distribute Trojanized versions of widely used IT tools such as PuTTY and WinSCP. This campaign cunningly targets IT professionals and system administrators, individuals who frequently rely on these tools for secure file transfers and remote system…
-
Anatsa Android Banking Trojan Hits 90,000 Users with Fake PDF App on Google Play
Cybersecurity researchers have discovered an Android banking malware campaign that has leveraged a trojan named Anatsa to target users in North America using malicious apps published on Google’s official app marketplace.The malware, disguised as a “PDF Update” to a document viewer app, has been caught serving a deceptive overlay when users attempt to access their…
-
Cybersecurity Operations and AI Carry Hidden Climate Costs
Crypto Defense, Data Centers, Monitoring Systems Strain Global Energy Use As security monitoring, crypto mining protection and data centers fuel cybersecurity’s energy demands, new regulations, such as Australia’s National Greenhouse and Energy Reporting Act 2007, signal a global shift toward holding the industry accountable for its environmental impact. First seen on govinfosecurity.com Jump to article:…
-
Security coalition urges Congress to renew 2015 CISA law
A group of top cybersecurity and technology firms said the law provided critical protections for sharing essential vulnerability information. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cyber-information-sharing-law-congress-reauthorize-security-coalition-letter/752454/
-
Malicious Pull Request Targets 6,000+ Developers via Vulnerable Ethcode VS Code Extension
Cybersecurity researchers have flagged a supply chain attack targeting a Microsoft Visual Studio Code (VS Code) extension called Ethcode that has been installed a little over 6,000 times.The compromise, per ReversingLabs, occurred via a GitHub pull request that was opened by a user named Airez299 on June 17, 2025.First released by 7finney in 2022, Ethcode…
-
New spyware strain steals data from Russian industrial companies
Moscow-based cybersecurity firm Kaspersky said the campaign has already affected over 100 victims across several dozen Russian organizations, but did not disclose the specific targets. First seen on therecord.media Jump to article: therecord.media/spyware-strain-steals-data-russian-industrial-sector
-
U.S. CISA adds MRLG, PHPMailer, Rails Ruby on Rails, and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Multi-Router Looking Glass (MRLG), PHPMailer, Rails Ruby on Rails, and Synacor Zimbra Collaboration Suite (ZCS) flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Multi-Router Looking Glass (MRLG), PHPMailer, Rails Ruby on Rails, and Synacor Zimbra Collaboration Suite (ZCS) flaws to…
-
CISA Alerts on Active Exploit of Ruby on Rails Path Traversal Flaw
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding the active exploitation of a critical path traversal vulnerability in Ruby on Rails, designated as CVE-2019-5418. The agency added this five-year-old security flaw to its Known Exploited Vulnerabilities (KEV) catalog on July 7, 2025, signaling that threat actors are actively leveraging this…
-
Aviatrix to Build Security Fabric to Secure Cloud Computing Environments
Aviatrix today committed to building a security fabric that because it will run natively in cloud computing environments will enable cybersecurity teams to streamline workflows in a way that also promises to reduce total costs. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/aviatrix-to-build-security-fabric-to-secure-cloud-computing-environments/
-
Aviatrix to Build Security Fabric to Secure Cloud Computing Environments
Aviatrix today committed to building a security fabric that because it will run natively in cloud computing environments will enable cybersecurity teams to streamline workflows in a way that also promises to reduce total costs. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/aviatrix-to-build-security-fabric-to-secure-cloud-computing-environments/
-
RondoDox Botnet Exploits Flaws in TBK DVRs and Four-Faith Routers to Launch DDoS Attacks
Cybersecurity researchers are calling attention to a malware campaign that’s targeting security flaws in TBK digital video recorders (DVRs) and Four-Faith routers to rope the devices into a new botnet called RondoDox.The vulnerabilities in question include CVE-2024-3721, a medium-severity command injection vulnerability affecting TBK DVR-4104 and DVR-4216 DVRs, and CVE-2024-12856, an operating First seen on…
-
BaitTrap: Over 17,000 Fake News Websites Caught Fueling Investment Fraud Globally
A newly released report by cybersecurity firm CTM360 reveals a large-scale scam operation utilizing fake news websites—known as Baiting News Sites (BNS)—to deceive users into online investment fraud across 50 countries.These BNS pages are made to look like real news outlets: CNN, BBC, CNBC, or regional media. They publish fake stories that feature public figures,…
-
RondoDox Botnet Exploits Flaws in TBK DVRs and Four-Faith Routers to Launch DDoS Attacks
Cybersecurity researchers are calling attention to a malware campaign that’s targeting security flaws in TBK digital video recorders (DVRs) and Four-Faith routers to rope the devices into a new botnet called RondoDox.The vulnerabilities in question include CVE-2024-3721, a medium-severity command injection vulnerability affecting TBK DVR-4104 and DVR-4216 DVRs, and CVE-2024-12856, an operating First seen on…
-
Claroty erhält C5-Testat für Cloud-Sicherheit
Claroty hat mit dem C5 (Cloud-Computing-Compliance-Criteria-Catalogue)-Testat eine der höchsten Auszeichnungen für Cloud-Sicherheitsstandards in Deutschland erhalten. Der Spezialist für die Sicherheit cyberphysischer Systeme (CPS) hat dabei die strengen, vom Bundesamt für Sicherheit in der Informationstechnik (BSI) definierten Anforderungen erfüllt und unterstreicht damit seine Zielsetzung, Cybersecurity und Compliance durch eine sichere und regelkonforme Cloud bereitzustellen. Der Kriterienkatalog…
-
Atomic macOS Info-Stealer Updated with New Backdoor for Persistent Access
The Atomic macOS Stealer (AMOS), a notorious piece of info-stealing malware targeting Apple users, has undergone a significant update, introducing an embedded backdoor for the first time. This development, reported by Moonlock a cybersecurity division of MacPaw marks a critical escalation in the malware’s capabilities, allowing attackers to maintain persistent access to compromised macOS systems.…
-
Researchers Uncover Batavia Windows Spyware Stealing Documents from Russian Firms
Russian organizations have been targeted as part of an ongoing campaign that delivers a previously undocumented Windows spyware called Batavia.The activity, per cybersecurity vendor Kaspersky, has been active since July 2024.”The targeted attack begins with bait emails containing malicious links, sent under the pretext of signing a contract,” the Russian company said. “The main goal…
-
Forescouts Industrial Cybersecurity Benchmark 2025 zeigt Diskrepanzen in der OT-Security
Takepoint Research führte eine globale Umfrage unter 236 Fachleuten durch, die für die Sicherheit von OT-Umgebungen in den Bereichen Fertigung, Energie & Versorgung, Transport, Regierung sowie Öl & Gas verantwortlich sind. Die Erhebung wurde zwischen Januar und März 2025 durchgeführt. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/forescouts-industrial-cybersecurity-benchmark-2025-zeigt-diskrepanzen-in-der-ot-security/a41323/
-
ParrotOS 6.4 lands with key tool updates and kernel upgrade
ParrotOS, known for its emphasis on security, privacy, and development, is widely used by cybersecurity professionals and enthusiasts alike. Version 6.4 delivers a host of … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/07/08/parrotos-6-4-released/
-
CISA Alerts on Active Exploitation of PHPMailer Command Injection Flaw
Tags: cisa, cyber, cybersecurity, email, exploit, flaw, infrastructure, injection, open-source, threat, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding the active exploitation of a long-standing vulnerability in PHPMailer, a widely used open-source email-sending library for PHP applications. The flaw, tracked as CVE-2016-10033, poses a significant threat to organizations relying on PHPMailer for email functionality within their web applications. Vulnerability Overview The PHPMailer…
-
How talent-strapped CISOs can tap former federal government cyber pros
Tags: cio, ciso, cyber, cybersecurity, government, jobs, risk, service, skills, software, switch, technology, threat, vulnerability, vulnerability-managementLuring federal talent to the private sector: In the past, the federal government represented a stable career path. Many highly skilled people spent their entire careers within the federal government. But the current shakeup makes some of that talent, trusted and honed by federal agencies, available to industry CISOs.Federal workers may look to state and…
-
How talent-strapped CISOs can tap former federal government cyber pros
Tags: cio, ciso, cyber, cybersecurity, government, jobs, risk, service, skills, software, switch, technology, threat, vulnerability, vulnerability-managementLuring federal talent to the private sector: In the past, the federal government represented a stable career path. Many highly skilled people spent their entire careers within the federal government. But the current shakeup makes some of that talent, trusted and honed by federal agencies, available to industry CISOs.Federal workers may look to state and…
-
Critical Vulnerabilities in KIA Infotainment Let Attackers Inject Code with PNG Files
A recent security analysis has uncoveredcritical vulnerabilitiesin the infotainment systems of KIA vehicles, raising alarm across the automotive cybersecurity community. These flaws allow attackers to inject and execute malicious code through specially crafted PNG image files, potentially compromising vehicle safety and user privacy. Security researchers, during an in-depth examination of KIA’s head unit and its…
-
CISA Issues Alert Over Actively Exploited Flaw in Zimbra Collaboration Suite
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding an actively exploited vulnerability in Synacor’s Zimbra Collaboration Suite (ZCS), urging organizations to take immediate action to mitigate the threat. The flaw, tracked as CVE-2019-9621, is a server-side request forgery (SSRF) vulnerability that resides in the ProxyServlet component of ZCS and has…
-
Critical Vulnerabilities in KIA Infotainment Let Attackers Inject Code with PNG Files
A recent security analysis has uncoveredcritical vulnerabilitiesin the infotainment systems of KIA vehicles, raising alarm across the automotive cybersecurity community. These flaws allow attackers to inject and execute malicious code through specially crafted PNG image files, potentially compromising vehicle safety and user privacy. Security researchers, during an in-depth examination of KIA’s head unit and its…
-
CISA Issues Alert Over Actively Exploited Flaw in Zimbra Collaboration Suite
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding an actively exploited vulnerability in Synacor’s Zimbra Collaboration Suite (ZCS), urging organizations to take immediate action to mitigate the threat. The flaw, tracked as CVE-2019-9621, is a server-side request forgery (SSRF) vulnerability that resides in the ProxyServlet component of ZCS and has…
-
Exposure management is the answer to: “Am I working on the right things?”
Tags: cybersecurityIn this Help Net Security interview, Dan DeCloss, Founder and CTO at PlexTrac, discusses the role of exposure management in cybersecurity and how it helps organizations gain … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/07/08/dan-decloss-plextrac-exposure-management-strategy/
-
How 1ST Airport Taxis Is Redefining Secure Smart Travel
In an era where the convergence of convenience and cybersecurity defines modern transport services, 1ST Airport Taxis LTD emerges not just as a leading UK-based private hire operator but as a technological innovator in secure and intelligent transport solutions. With deep historical roots in Luton and a footprint that spans across major airports including Heathrow,…