Tag: cybersecurity
-
Critical 10-Year-Old Roundcube Webmail Bug Allows Authenticated Users Run Malicious Code
Tags: cve, cvss, cybersecurity, exploit, flaw, malicious, remote-code-execution, software, vulnerabilityCybersecurity researchers have disclosed details of a critical security flaw in the Roundcube webmail software that has gone unnoticed for a decade and could be exploited to take over susceptible systems and execute arbitrary code.The vulnerability, tracked as CVE-2025-49113, carries a CVSS score of 9.9 out of 10.0. It has been described as a case…
-
#Infosec2025: Good Cybersecurity Enabled Ukraine’s Surprise Attack on Russia, Says NCSC
Effective cybersecurity played a key role Ukraine drone attack on Russian strategic bombers, a leading government security expert has claimed First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/infosec2025-ukraine-drone-attack/
-
One hacker, many names: Industry collaboration aims to fix cyber threat label chaos
Tags: advisory, attack, blizzard, china, corporate, country, crowdstrike, cyber, cybersecurity, group, guide, hacker, india, intelligence, international, microsoft, risk, russia, threatBuilding a translation guide, not a standard: The collaboration is analyst-driven, focusing on harmonizing known adversary profiles through direct cooperation between the companies’ threat research teams. Already, the effort has led to alignment on more than 80 threat actors, confirming connections that had previously been uncertain.The companies describe their effort as creating a “Rosetta Stone”…
-
New Report: Governments Struggle to Regain Backdoor Access to Secure Communications
Tags: access, backdoor, communications, cyber, cybersecurity, encryption, government, monitoring, network, privacy, vpnA crucial point has been reached in the conflict between personal privacy and governmental monitoring in a time when digital communication is essential. Governments worldwide are grappling with the proliferation of strong encryption in messaging apps, social media platforms, and virtual private networks (VPNs). As a cybersecurity researcher with nearly three decades of insight into…
-
Future-ready cybersecurity: Lessons from the MITRE CVE crisis
The domino effect of CVE disruption is something all cybersecurity practitioners must be aware of, a Morphisec executive argues. First seen on cyberscoop.com Jump to article: cyberscoop.com/mitre-cve-vulnerability-database-morphisec-op-ed/
-
New Research Uncovers Strengths and Vulnerabilities in Cloud-Based LLM Guardrails
Cybersecurity researchers have shed light on the intricate balance of strengths and vulnerabilities inherent in cloud-based Large Language Model (LLM) guardrails. These safety mechanisms, designed to mitigate risks such as data leakage, biased outputs, and malicious exploitation, are critical to the secure deployment of AI models in enterprise environments. Exposing the Dual Nature of AI…
-
Photos: Infosecurity Europe 2025
Tags: cybersecurityInfosecurity Europe 2025 is a cybersecurity event taking place from June 3 to 5 in London. Help Net Security is on-site and here’s a closer look at the conference. The … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/03/infosecurity-europe-2025-photos/
-
Scattered Spider: Understanding Help Desk Scams and How to Defend Your Organization
In the wake of high-profile attacks on UK retailers Marks & Spencer and Co-op, Scattered Spider has been all over the media, with coverage spilling over into the mainstream news due to the severity of the disruption caused, currently looking like hundreds of millions in lost profits for M&S alone. This coverage is extremely valuable…
-
Malicious NPM Packages Exploit Ethereum Wallets with Obfuscated JavaScript
A recent wave of malicious NPM packages has emerged as a significant threat to cryptocurrency users, specifically targeting Ethereum wallet holders. Cybersecurity researchers have uncovered a sophisticated campaign where attackers leverage the widely-used Node Package Manager (NPM) ecosystem to distribute harmful code disguised as legitimate libraries. This attack vector exploits the trust developers place in…
-
Lyrix Ransomware Targets Windows Users with Advanced Evasion Techniques
A formidable new strain of ransomware, dubbed Lyrix, has recently surfaced, posing a significant threat to Windows users worldwide. Cybersecurity researchers have identified Lyrix as a highly advanced malicious software designed to encrypt critical files and demand substantial ransoms for decryption keys. New Threat Emerges with Sophisticated Tactics Unlike typical ransomware, Lyrix incorporates cutting-edge evasion…
-
How Secure is Your Data Against NHIs Attacks?
Are Your Secrets Safe from NHIs Attacks? With cybersecurity strategies continue to evolve, one area of particular focus is non-human identities (NHIs) and secrets security. NHIs, or machine identities, comprise a “Secret” (an encrypted password, token, or key), effectively serving as passports, while permissions granted by a destination server act as the visas. NHIs management……
-
Bankers Association’s attack on cybersecurity transparency
A coalition of banking industry associations, including SIFA, the American Bankers Association (ABA), Bank Policy Institute (BPI), and several other lobbying groups have made … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/03/bankers-association-attack-on-cybersecurity-transparency/
-
Trump Homeland Security Budget Guts CISA Staff, Key Programs
DHS Budget Proposal Reduces CISA’s Operational Core Amid Growing Global Threats. The Trump administration’s 2026 Homeland Security Department budget would cut $500 million from the Cybersecurity and Infrastructure Security Agency, eliminating over a third of its staff and gutting key programs central to federal cybersecurity and private sector engagement efforts. First seen on govinfosecurity.com Jump…
-
5 ways to make cybersecurity a top priority
Tags: cybersecurityFirst seen on scworld.com Jump to article: www.scworld.com/perspective/5-ways-to-make-cybersecurity-a-top-priority
-
Survey: Changing Threat Landscape Drives Cybersecurity Spending Shifts
A survey of 840 cybersecurity leaders conducted by The Futurum Group finds that cybersecurity budgets will increase on average to 11% of the IT budget in 2025, with just under half (49%) planning either a major (10%), moderate (21%) or minor consolidation (18%) to streamline operations. In contrast, just under a quarter (24%) are planning..…
-
SentinelOne: Last week’s 7-hour outage caused by software flaw
American cybersecurity company SentinelOne revealed over the weekend that a software flaw triggered a seven-hour-long outage on Thursday. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/technology/sentinelone-last-weeks-7-hour-outage-caused-by-software-flaw/
-
Survey Surfaces Rise on Cyberattacks Fueled by AI
An annual survey of 1,021 cybersecurity and IT professionals finds the number of breaches increased 17% in the past year, with well over half (58%) now seeing a surge in ransomware attacks that appear to have been created using artificial intelligence (AI). Conducted by the market research firm Vitreous World on behalf of Gigamon, a..…
-
Breaking the Lifecycle of Stolen Credentials Before It Breaks You
From Breach to Exploit: How Stolen Credentials Fuel the Underground Economy In cybersecurity, breaches often make headlines. But what happens next after usernames and passwords, or active session cookies, are stolen is just as dangerous. The lifecycle of stolen credentials reveals a dark ecosystem of harvesting, trading, and exploitation. This post explores how… First seen…
-
Cryptojacking Campaign Exploits DevOps APIs Using OffShelf Tools from GitHub
Cybersecurity researchers have discovered a new cryptojacking campaign that’s targeting publicly accessible DevOps web servers such as those associated with Docker, Gitea, and HashiCorp Consul and Nomad to illicitly mine cryptocurrencies.Cloud security firm Wiz, which is tracking the activity under the name JINX-0132, said the attackers are exploiting a wide range of known misconfigurations and…
-
Pro-Ukraine hacker group Black Owl poses ‘major threat’ to Russia, Kaspersky says
BO Team, also known as Black Owl, has been active since early 2024 and appears to operate independently, with its own arsenal of tools and tactics, researchers at Russian cybersecurity firm Kaspersky said. First seen on therecord.media Jump to article: therecord.media/pro-ukraine-hacker-group-black-owl-major-threat-russia
-
CISO Roles Take on Strategic Security Leadership Roles Beyond Cybersecurity as Organizations
A comprehensive analysis of over 800 Chief Information Security Officers reveals a fundamental transformation in the cybersecurity leadership landscape, with CISOs increasingly assuming strategic business responsibilities that extend far beyond traditional information security functions. The fifth annual CISO Compensation and Budget Survey conducted by IANS and Artico Search demonstrates that the modern CISO role is…
-
Severe Vulnerabilities in Consilium CS5000 Fire Panels Allow Remote System Takeover
Two severe cybersecurity vulnerabilities have been disclosed in the Consilium Safety CS5000 Fire Panel, a widely deployed industrial control system integral to fire safety across sectors like commercial facilities, healthcare, transportation, and government services. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued alert ICSA-25-148-03 on May 29, 2025, warning that these flaws could enable…
-
Fake Recruiter Emails Target CFOs Using Legit NetBird Tool Across 6 Global Regions
Cybersecurity researchers have warned of a new spear-phishing campaign that uses a legitimate remote access tool called Netbird to target Chief Financial Officers (CFOs) and financial executives at banks, energy companies, insurers, and investment firms across Europe, Africa, Canada, the Middle East, and South Asia. “In what appears to be a multi-stage phishing operation, the…
-
CISO 3.0: Leading AI governance and security in the boardroom
In this Help Net Security interview, Aaron McCray, Field CISO at CDW, discusses how AI is transforming the CISO role from a tactical cybersecurity guardian into a strategic … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/02/aaron-mccray-cdw-cisos-ai-security/
-
DoD Cyber Clause Flowdown: What Suppliers Must Do
The Department of Defense DFARS Cybersecurity Clause, more commonly known as the DoD Cyber Clause (or just DFARS 7012), is the long-standing set of rules the DoD has put in place for all members of the DoD supply chain and defense industrial base. It has also spread beyond those boundaries through the use of DFARS……
-
How Secrets Scanning is Evolving for Better Security
Why is Secrets Scanning Important in Cybersecurity? Secrets scanning is paramount in cybersecurity. It involves identifying and mitigating risks associated with sensitive data like passwords, tokens, or keys, collectively known as “secrets”. These secrets are nothing less than the passports of Non-Human Identities (NHIs), granting them access to the desired server destination. But how can……