Tag: cybersecurity
-
CISA Adds Four Critical Vulnerabilities to KEV Catalog Due to Active Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.The list of flaws is as follows -CVE-2014-3931 (CVSS score: 9.8) – A buffer overflow vulnerability in Multi-Router Looking Glass (MRLG) that could allow remote attackers to…
-
Why SEC, SolarWinds Agreed to Settle Cyberfraud Lawsuit
Proposed Deal Could End Precedent-Setting SEC Case Over Cybersecurity Misstatements The SEC and SolarWinds told a federal judge they’ve reached a tentative agreement to resolve a first-of-its-kind fraud case over cybersecurity disclosures. Federal regulators alleged that SolarWinds misled investors about its cybersecurity, and the settlement hinges on SEC commissioner approval. First seen on govinfosecurity.com Jump…
-
Parrot Security OS 6.4 Released What’s New!
The Parrot Security team has released Parrot Security OS 6.4, a robust update featuring community-driven enhancements and contributions. As the probable final chapter of the 6.x series, this release refines the security-focused OS and sets the stage for the upcoming Parrot 7. Parrot Security OS is an Ethical Hacking and Cybersecurity Professional dedicated Distribution, explicitly…
-
SEO Poisoning Campaign Targets 8,500+ SMB Users with Malware Disguised as AI Tools
Cybersecurity researchers have disclosed a malicious campaign that leverages search engine optimization (SEO) poisoning techniques to deliver a known malware loader called Oyster (aka Broomstick or CleanUpLoader).The malvertising activity, per Arctic Wolf, promotes fake websites hosting trojanized versions of legitimate tools like PuTTY and WinSCP, aiming to trick software professionals First seen on thehackernews.com Jump…
-
Survey Surfaces Myriad Small Business Security Challenges
A survey of 1,000 executives of organizations that generate less than $100 million in revenue finds 59% believe the right amount of budget is being allocated to cybersecurity, with 64% noting they also believe their organization is too small to be an attractive target. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/survey-surfaces-myriad-small-business-security-challenges/
-
Will AI Gut the Cybersecurity Talent Pipeline?
Automation Saves Time But Risks Hollowing Out Critical Early-Career Roles. Time travel can seem like an unofficial requirement for cybersecurity job seekers, with would-be employers demanding mid-tier chops for entry-level positions. Come back in a few years, they say, after you’ve gained experience. But organizations can’t assume the pipeline will fix itself. First seen on…
-
NSB Warns of Cybersecurity Risks Linked to Popular Chinese Apps Like Rednote, Weibo, TikTok, WeChat, and Baidu Cloud
Taiwan’s National Security Bureau (NSB) has issued a stark warning about cybersecurity risks associated with several widely used China-developed mobile applications, including Rednote, Weibo, TikTok, WeChat, and Baidu Cloud. Following an in-depth investigation conducted in collaboration with the Ministry of Justice Investigation Bureau (MJIB) and the Criminal Investigation Bureau (CIB) under the National Police Agency,…
-
AiLock Ransomware Emerges with Hybrid Encryption Tactics: ChaCha20 Meets NTRUEncrypt
The AiLock ransomware organization, which Zscaler first discovered in March 2025, has become a powerful force in the ransomware-as-a-service (RaaS) market, which is a frightening trend for cybersecurity professionals. This malicious entity operates with a sophisticated structure, leveraging both a negotiation site to extract ransoms from victims and a Data Leak Site (DLS) to threaten…
-
VenusTech and Salt Typhoon Breach Sheds Light on China’s Covert Cyber Mercenary Networks
The dark web forum DarkForums, which has been a site for data breaches and leaks since BreachForums was shut down in mid-April, was the scene of two major leaks in late May involving Chinese cybersecurity organizations: VenusTech, a well-known IT security vendor, and Salt Typhoon, a state-sponsored advanced persistent threat (APT) organization affiliated with the…
-
NightEagle APT Unleashes Custom Malware and Zero-Days to Infiltrate Industrial Systems
The advanced attack campaigns of a top Advanced Persistent Threat (APT) group known as >>NightEagle,
-
GOP domestic policy bill includes hundreds of millions for military cyber
Democrats have critiqued the bill for not protecting funds for the Cybersecurity and Infrastructure Security Agency. First seen on cyberscoop.com Jump to article: cyberscoop.com/gop-domestic-policy-bill-includes-hundreds-of-millions-for-military-cyber/
-
Hackers Target Employee Credentials Amid Spike in ID Attacks
Cybersecurity researchers have observed a 156% increase in credential theft incidents between 2024 and Q1 2025 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/hackers-target-employee-credentials/
-
Has CISO become the least desirable role in business?
Tags: advisory, ai, business, cio, ciso, control, corporate, cybersecurity, data, dora, finance, governance, international, jobs, network, office, regulation, resilience, risk, sap, skills, startup, threatGeorge Gerchow, CSO, Bedrock Security George Gerchow / Bedrock Security”I’ll never report to a CTO or CFO again. I have to have seat at the table,” he says emphatically. Otherwise, he says, you become frustrated “because you’re not in control of your own destiny. You’re parsing everything to this other person who’s a leader in…
-
U.S. CISA adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog
Tags: browser, chrome, cisa, cve, cybersecurity, exploit, flaw, google, infrastructure, kev, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Chromium V8 vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Chromium V8 vulnerability, tracked as CVE-2025-6554, to its Known Exploited Vulnerabilities (KEV) catalog. Last week, Google released security patches to address the Chrome vulnerability CVE-2025-6554 for which an exploit is…
-
Skills gaps send CISOs in search of managed security providers
Tags: access, awareness, business, ciso, compliance, control, cyber, cybersecurity, detection, governance, group, infrastructure, intelligence, jobs, monitoring, msp, mssp, network, penetration-testing, risk, risk-assessment, service, skills, strategy, threat, tool, training, update, vulnerabilitySecurity operations centers (SOCs)Cloud platform managementSIEM and log monitoringFramework-based cybersecurity management functionsThreat intelligence feeds and analysisVulnerability scanning and patch managementEndpoint detection and response (EDR)Firewall and network security managementCompliance tracking and audit support”MSPs already have the infrastructure and staff in place to deliver these services efficiently, and at scale,” Richard Tubb, who runs the MSP community…
-
Cyberangriff auf einen IT-Distributor aus den USA
Ingram Micro Issues Statement Regarding Cybersecurity Incident First seen on businesswire.com Jump to article: www.businesswire.com/news/home/20250705035732/en/Ingram-Micro-Issues-Statement-Regarding-Cybersecurity-Incident
-
CitrixBleed 2 Vulnerability PoC Published Experts Warn of Mass Exploitation Risk
A newly published proof-of-concept (PoC) for the critical CitrixBleed 2 vulnerability (CVE-2025-5777) has sent shockwaves through the cybersecurity community, with experts warning of imminent mass exploitation risks for organizations using Citrix NetScaler ADC and Gateway devices. The Vulnerability: CitrixBleed 2 (CVE-2025-5777) Dubbed “CitrixBleed 2” for its eerie resemblance to the notorious CitrixBleed flaw of 2023,…
-
Qantas attack reveals one phone call is all it takes to crack cybersecurity’s weakest link: humans
Tags: access, attack, breach, cyber, cybercrime, cybersecurity, data, data-breach, email, finance, healthcare, phone, riskOther sectors also at risk from attacks, including healthcare, finance and telecommunications, expert warns<ul><li>Get our <a href=”https://www.theguardian.com/email-newsletters?CMP=cvau_sfl”>breaking news email, <a href=”https://app.adjust.com/w4u7jx3″>free app or <a href=”https://www.theguardian.com/australia-news/series/full-story?CMP=cvau_sfl”>daily news podcast</li></ul>All it can take is a phone call. That’s what <a href=”https://www.theguardian.com/business/2025/jul/02/qantas-confirms-cyber-attack-exposes-records-of-up-to-6-million-customers”>Qantas learned this week when the personal information of up to 6 million customers was stolen by cybercriminals…
-
How Digital Executive Protection Shields Top Leaders from Modern Threats
Cybersecurity threats have emerged so quickly that most companies struggle to keep up and executives are often the… First seen on hackread.com Jump to article: hackread.com/how-digital-executive-protection-leaders-threats/
-
Künstliche Intelligenz in der Cybersecurity: Ein Balanceakt zwischen Schutz und Risiko
Künstliche Intelligenz ist ein mächtiges Werkzeug im Kampf gegen Cyberbedrohungen. Sie befähigt Unternehmen, Bedrohungen schneller zu erkennen, Sicherheitsprozesse zu automatisieren und proaktiv zu handeln. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/kuenstliche-intelligenz-in-der-cybersecurity-ein-balanceakt-zwischen-schutz-und-risiko/a41308/
-
Critical Sudo bugs expose major Linux distros to local Root exploits
Critical Sudo flaws let local users gain root access on Linux systems, the vulnerabilities affect major Linux distributions. Cybersecurity researchers disclosed two vulnerabilities in the Sudo command-line utility for Linux and Unix-like operating systems. Local attackers can exploit the vulnerabilities to escalate privileges to root on affected systems. Sudo (short for >>superuser do
-
NightEagle APT Exploits Microsoft Exchange Flaw to Target China’s Military and Tech Sectors
Tags: apt, china, cybersecurity, defense, exploit, flaw, government, microsoft, military, network, technology, threat, zero-dayCybersecurity researchers have shed light on a previously undocumented threat actor called NightEagle (aka APT-Q-95) that has been observed targeting Microsoft Exchange servers as a part of a zero-day exploit chain designed to target government, defense, and technology sectors in China.According to QiAnXin’s RedDrip Team, the threat actor has been active since 2023 and has…
-
Critical Sudo Vulnerabilities Let Local Users Gain Root Access on Linux, Impacting Major Distros
Cybersecurity researchers have disclosed two security flaws in the Sudo command-line utility for Linux and Unix-like operating systems that could enable local attackers to escalate their privileges to root on susceptible machines.A brief description of the vulnerabilities is below -CVE-2025-32462 (CVSS score: 2.8) – Sudo before 1.9.17p1, when used with a sudoers file that specifies…
-
Researchers Discover New Method to Identify Azure Arc in Enterprise Environments and Maintain Persistence
Security researchers have discovered novel ways to identify and take advantage of Microsoft Azure Arc in business settings, which is a major advancement in cybersecurity and may reveal weaknesses in this hybrid management system. Introduced in 2019, Azure Arc extends Azure’s native management capabilities to non-Azure resources, including on-premises servers and Kubernetes clusters, through the…
-
Cybersecurity in the supply chain: strategies for managing fourth-party risks
Tags: access, breach, business, ciso, compliance, control, cyber, cybersecurity, data, exploit, framework, governance, intelligence, ISO-27001, law, mitigation, monitoring, nist, risk, risk-management, saas, service, soc, software, strategy, supply-chain, threat, tool, vulnerabilitySet clear data boundaries: The reality is that any organization consuming third-party software-as-a-service offerings and services has extremely limited control over the partners that their third parties are working with, says Curtis Simpson, CISO at Armis.”This is why it’s critically important to understand the sub-processors involved in the delivery of contracted SaaS offerings and services,…
-
New hires, new targets: Why attackers love your onboarding process
In this Help Net Security video, Ozan Ucar, CEO of Keepnet Labs, highlights a critical cybersecurity blind spot: the vulnerability of new hires during onboarding. He explains … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/07/04/attackers-onboarding-process-video/
-
Africa’s cybersecurity crisis and the push to mobilizing communities to safeguard a digital future
Tags: cybersecurityWhile Africa hosts some of the fastest-growing digital economies globally, it also faces persistent challenges in cybersecurity preparedness. Many organizations and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/07/04/africa-cybersecurity-crisis/
-
Psychological Contract Breach and the Power of Security Culture Research Insights
Employees are expected to behave securely, and the definition of “securely” is often written down in a myriad of security policies. Yet, people do not always comply with security policies or make use of available tools. Gartner documents in their research that 69% of all employees intentionally bypass cybersecurity guidance, and 93% behave consciously and…
-
Virginia county says April ransomware attack exposed employee SSNs
Carol Steele, the county’s administrator, said they hired cybersecurity experts to help with the recovery and notified the FBI’s Cyber Crimes Division as well as the Cyber Fusion Center of the Virginia State Police. First seen on therecord.media Jump to article: therecord.media/virginia-county-says-ransomware-attack-exposed-ssns