Tag: cybersecurity
-
Hackers Expose 184 Million User Passwords via Open Directory
A major cybersecurity incident has come to light after researcher Jeremiah Fowler discovered a publicly accessible database containing 184,162,718 unique logins and passwords”, totaling 47.42 GB of raw credential data. The exposed records included sensitive information such as emails, usernames, passwords, and direct URLs to login pages for a wide variety of services. These ranged…
-
Critical infrastructure under attack: Flaws becoming weapon of choice
Tags: access, attack, authentication, breach, china, citrix, communications, control, cve, cyber, cybersecurity, dark-web, data-breach, defense, exploit, flaw, fortinet, government, group, hacker, healthcare, ibm, identity, incident, infrastructure, intelligence, iran, kev, login, mfa, monitoring, moveIT, network, ransomware, risk, service, software, strategy, supply-chain, threat, update, vpn, vulnerability, zero-dayTrade in exploit code: IBM’s X-Force found four of the 10 most mentioned common vulnerabilities and exposures (CVEs) on the dark web were linked to sophisticated threat actor groups, including nation-state intelligence agencies.”Exploit codes for these CVEs were openly traded on numerous forums, fueling a growing market for attacks against power grids, health networks, and…
-
Optimistic Security: A New Era for Cyber Defense
Why Optimistic Cybersecurity? Ever wondered how evolving technology could help fortify your entity against cyber threats? Well, this might be the perfect time to introduce the concept of Optimistic Cybersecurity, an innovative approach that’s transforming the perspective of many industries, especially those that operate. Implementing high security standards is no longer an afterthought but a……
-
CISA Alerts on Threat Actors Targeting Commvault Azure App to Steal Secrets
Tags: advisory, backup, cisa, cloud, cyber, cybersecurity, data, exploit, infrastructure, microsoft, service, software, threat, vulnerability, zero-dayOn May 22, 2025, Commvault, a leading enterprise data backup provider, issued an urgent advisory regarding active cyber threat activity targeting its Metallic software-as-a-service (SaaS) application, which is hosted in the Microsoft Azure cloud environment. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that threat actors exploited a zero-day vulnerability (CVE-2025-3928) in Commvault’s web…
-
Outsourcing cybersecurity: How SMBs can make smart moves
Tags: cybersecurityOutsourcing cybersecurity can be a practical and affordable option. It allows small businesses to get the protection they need without straining their budgets, freeing up time … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/23/smbs-outsourcing-cybersecurity/
-
CISA Warns of Suspected Broader SaaS Attacks Exploiting App Secrets and Cloud Misconfigs
Tags: attack, backup, cisa, cloud, cyber, cybersecurity, exploit, infrastructure, microsoft, monitoring, saas, service, software, threatThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday revealed that Commvault is monitoring cyber threat activity targeting applications hosted in their Microsoft Azure cloud environment.”Threat actors may have accessed client secrets for Commvault’s (Metallic) Microsoft 365 (M365) backup software-as-a-service (SaaS) solution, hosted in Azure,” the agency said.”This First seen on thehackernews.com Jump to…
-
GitLab Duo Vulnerability Enabled Attackers to Hijack AI Responses with Hidden Prompts
Cybersecurity researchers have discovered an indirect prompt injection flaw in GitLab’s artificial intelligence (AI) assistant Duo that could have allowed attackers to steal source code and inject untrusted HTML into its responses, which could then be used to direct victims to malicious websites.GitLab Duo is an artificial intelligence (AI)-powered coding assistant that enables users to…
-
Critical Versa Concerto Flaws Let Attackers Escape Docker and Compromise Hosts
Cybersecurity researchers have uncovered multiple critical security vulnerabilities impacting the Versa Concerto network security and SD-WAN orchestration platform that could be exploited to take control of susceptible instances.It’s worth noting that the identified shortcomings remain unpatched despite responsible disclosure on February 13, 2025, prompting a public release of the issues First seen on thehackernews.com Jump…
-
Russian APT28 compromised Western logistics and IT firms to track aid to Ukraine
Tags: access, advisory, api, authentication, cctv, cloud, computer, container, credentials, cve, cybersecurity, data, detection, email, exploit, flaw, government, hacker, identity, infrastructure, Internet, login, malicious, malware, mfa, military, network, ntlm, office, open-source, password, phishing, powershell, russia, service, software, threat, tool, ukraine, vulnerabilityCredential guessing and spearphishing: The attackers used brute-force credential guessing techniques, also known as password spraying, to gain initial access to accounts. This was complemented with targeted phishing emails that directed recipients to fake login pages for government entities or Western cloud email providers. These phishing pages were stored on free web hosting services or…
-
News alert: INE Security, Abadnet Institute partner to deliver cybersecurity training in Saudi Arabia
Cary, NC. May 22, 2025, CyberNewswire, INE Security, a global leader in Cybersecurity training and certifications, has announced a strategic partnership with Abadnet Institute for Training, a Riyadh-based leader in specialized Information Technology, Cybersecurity, and Networking training.”¦ (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/news-alert-ine-security-abadnet-institute-partner-to-deliver-cybersecurity-training-in-saudi-arabia/
-
U.S. CISA adds a Samsung MagicINFO 9 Server flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Samsung MagicINFO 9 Servervulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)added a Samsung MagicINFO 9 Servervulnerability, tracked as CVE-2025-4632 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is an improper limitation of a pathname…
-
German Cyber Agency Sounds Warning on Grid Vulnerabilities
BSI Cites New Technologies, Geopolitical Tensions as Key Risk Factors. Mounting decentralization and digitization put electricity grids at risk of hacking that could cause power outages, the German cybersecurity agency warned Wednesday. Technologies such as internet-connected solar power inverters and a tense geopolitical situation sparks increased concern. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/german-cyber-agency-sounds-warning-on-grid-vulnerabilities-a-28461
-
5 Things To Watch In Delta’s Lawsuit Against CrowdStrike
While a Georgia judge has declined to dismiss parts of Delta’s lawsuit against CrowdStrike, over the July 2024 outage caused by the cybersecurity vendor, CrowdStrike’s attorney said he continues to be ‘confident’ that any liabilities will ultimately be negligible. First seen on crn.com Jump to article: www.crn.com/news/security/2025/5-things-to-watch-in-delta-s-lawsuit-against-crowdstrike
-
Chinese-speaking hackers targeting US municipalities with Cityworks bug
Since January, cybersecurity experts have seen Chinese-speaking hackers exploiting a bug impacting a tool used by local governments to manage critical infrastructure assets and other services. First seen on therecord.media Jump to article: therecord.media/chinese-speaking-hackers-target-municipalities-cityworks
-
CefSharp Enumeration Tool Identifies Critical Security Issues in .NET Desktop Applications
Cybersecurity researchers and red teamers, a newly released tool named CefEnum is shedding light on critical security flaws in .NET-based desktop applications leveraging CefSharp, a lightweight wrapper around the Chromium Embedded Framework (CEF). CefSharp enables developers to embed Chromium browsers within .NET applications, facilitating the creation of web-based thick-clients for Windows environments. However, as detailed…
-
Database Leak Reveals 184 Million Infostealer-Harvested Emails and Passwords
Cybersecurity researcher Jeremiah Fowler discovered a misconfigured cloud server containing a massive 184 million login credentials, likely collected… First seen on hackread.com Jump to article: hackread.com/database-leak-184-million-infostealer-emails-passwords/
-
Researchers Warn of ‘Smiao Network’ Cyber Threat Against Taiwan’s Federal Staff
The Foundation for Defense of Democracies (FDD) and cybersecurity firm TeamT5 has exposed an intricate Chinese intelligence operation, dubbed the ‘Smiao Network,’ targeting federal workers in both the United States and Taiwan. This network, linked to the Chinese technology company Smiao Intelligence, employs deceptive online recruitment schemes to extract sensitive information from high-value professionals. Initially…
-
Senators revive bill to harmonize conflicting cybersecurity regulations
The legislation Sens. Gary Peters and James Lankford would create an executive branch panel to align federal cyber rules. First seen on cyberscoop.com Jump to article: cyberscoop.com/senators-revive-bill-to-harmonize-conflicting-cybersecurity-regulations/
-
Gujarat Teen Arrested for Orchestrating Over 50 Cyberattacks in ‘Operation Sindoor’
Gujarat Anti-Terrorism Squad (ATS) has apprehended two individuals, including a minor, for orchestrating a series of sophisticated cyber attacks against Indian websites and disseminating anti-national content online. The arrests came as part of >>Operation Sindoor,
-
Law Enforcement, Microsoft Disrupt Operations of Popular Lumma Stealer
International law enforcement agencies and cybersecurity vendors seized thousands of domains used to run the MaaS operations of the widely popular Lumma Stealer malware, which was used to facilitate ransomware, malvertising, and phishing attacks around the globa. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/law-enforcement-microsoft-disrupt-operations-of-popular-lumma-stealer/
-
Agentic-AI und die Zukunft der Cybersecurity
Die technologische Entwicklung im Bereich der künstlichen Intelligenz (KI) hat in den letzten Jahren ein beispielloses Tempo erreicht. Diese Dynamik verändert nicht nur Geschäftsmodelle und Prozesse, sondern stellt auch die Cybersicherheit vor völlig neue Herausforderungen. Für CISOs, CIOs und andere Entscheidungsträger bedeutet dies: Strategien, Prozesse und Kontrollmechanismen müssen neu bewertet und konsequent weiterentwickelt werden, insbesondere…
-
New NIST Security Metric Aims to Pinpoint Exploited Vulnerabilities
Researchers from the National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA) have introduced a new security metric designed to improve vulnerability management. The proposed Likely Exploited Vulnerabilities (LEV) metric aims to enhance organizations’ ability to identify which vulnerabilities are most likely to be exploited, enabling more efficient remediation…
-
Feds and Microsoft crush Lumma Stealer that stole millions of passwords
Tags: access, breach, control, cyber, cybercrime, cybersecurity, infrastructure, malware, microsoft, password, russia, service, software, threat, tool2,300 domains neutralized, command infrastructure seized: As part of the legal action filed in the US District Court for the Northern District of Georgia, Microsoft secured authorization to seize and disrupt a core component of Lumma’s ecosystem: its domain infrastructure. These domains acted as communication nodes between infected devices and the malware’s operators.According to the…
-
Webinar: Learn How to Build a Reasonable and Legally Defensible Cybersecurity Program
It’s not enough to be secure. In today’s legal climate, you need to prove it.Whether you’re protecting a small company or managing compliance across a global enterprise, one thing is clear: cybersecurity can no longer be left to guesswork, vague frameworks, or best-effort intentions.Regulators and courts are now holding organizations accountable for how “reasonable” their…
-
Unpatched Versa Concerto Flaws Let Attackers Escape Docker and Compromise Host
Cybersecurity researchers have uncovered multiple critical security vulnerabilities impacting the Versa Concerto network security and SD-WAN orchestration platform that could be exploited to take control of susceptible instances.It’s worth noting that the identified shortcomings remain unpatched despite responsible disclosure on February 13, 2025, prompting a public release of the issues First seen on thehackernews.com Jump…
-
Cyberattack Hits Cellcom: Voice, Text Services Down; FBI Notified
Cellcom, a regional wireless provider based in Wisconsin, is continuing efforts to restore full service following a cybersecurity incident that has disrupted customers’ ability to make phone calls and send text messages. The company, which reported a Cellcom cyberattack last week, left many of its customers frustrated and without service. First seen on thecyberexpress.com Jump…
-
Top 12 US cities for cybersecurity job and salary growth
Tags: access, ai, apple, attack, blockchain, business, country, crowdstrike, cyber, cybersecurity, data, defense, finance, fintech, government, group, infrastructure, insurance, iot, jobs, metric, microsoft, nvidia, office, okta, privacy, software, startup, strategy, supply-chain, technology, training, warfareWhile major hubs like San Francisco naturally come to mind, and perform well based on the metrics we evaluated, there are many lesser-known cities that may be just as promising, if not more. These emerging destinations can offer easier access to job opportunities, more sustainable career paths, higher pay, and a lower cost of living.Here’s…
-
Agentic AI läutet die 3. KI-Revolution in der Cybersecurity ein
Revolutionen kommen öfter vor, als man denkt. In der Cybersecurity gab es beispielsweise bereits mehrere Revolutionen, in denen neue Technologien wie künstliche Intelligenz und Machine Learning alles bisher Dagewesene auf den Kopf stellten. (Ein)Blick in die Geschichte, die Gegenwart und die Zukunft der KI-Revolutionen im Cybersecurity-Bereich. KI verändert jeden Bereich unseres Lebens von… First seen…
-
#Infosec2025: NCC Group Expert Warns UK Firms to Prepare for Cyber Security and Resilience Bill
UK businesses should start to plan for required changes to their cybersecurity programs ahead of the Cyber Security and Resilience Bill First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/infosec2025-ncc-uk-cybersecurity/
-
INE Security Partners with Abadnet Institute for Cybersecurity Training Programs in Saudi Arabia
Cary, North Carolina, 22nd May 2025, CyberNewsWire First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/ine-security-partners-with-abadnet-institute-for-cybersecurity-training-programs-in-saudi-arabia/