Tag: data
-
Backdoors in Python and NPM Packages Target Windows and Linux
Checkmarx uncovers cross-ecosystem attack: fake Python and NPM packages plant backdoor on Windows and Linux, enabling data theft plus remote control. First seen on hackread.com Jump to article: hackread.com/backdoors-python-npm-packages-windows-linux/
-
New Linux Security Bugs Could Expose Password Hashes Across Millions of Devices
The Qualys Threat Research Unit (TRU) has disclosed two significant local information disclosure vulnerabilities”, CVE-2025-5054 and CVE-2025-4598″, impacting the core-dump handlers Apport and systemd-coredump on millions of Linux systems. These race-condition vulnerabilities could enable local attackers to extract highly sensitive data, including password hashes, by manipulating the crash reporting mechanisms embedded in popular distributions such…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 47
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape 60 Malicious npm Packages Leak Network and Host Data in Active Malware Campaign Russia-Aligned TAG-110 Targets Tajikistan with Macro-Enabled Word Documents Inside a VenomRAT Malware Campaign Fake Google Meet Page Tricks Users into Running PowerShell Malware…
-
Security Affairs newsletter Round 526 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Two Linux flaws can lead to the disclosure of sensitive data Meta stopped covert operations from…
-
How Secrets Scanning is Evolving for Better Security
Why is Secrets Scanning Important in Cybersecurity? Secrets scanning is paramount in cybersecurity. It involves identifying and mitigating risks associated with sensitive data like passwords, tokens, or keys, collectively known as “secrets”. These secrets are nothing less than the passports of Non-Human Identities (NHIs), granting them access to the desired server destination. But how can……
-
Cybersecurity Alert: Major Breaches at TikTok and Ticketmaster
A major TikTok breach claims 428M user records are for sale, raising security alarms. Stay informed & secure your data today! First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/cybersecurity-alert-major-breaches-at-tiktok-and-ticketmaster/
-
Two Linux flaws can lead to the disclosure of sensitive data
Qualys warns of two information disclosure flaws in apport and systemd-coredump, the core dump handlers in Ubuntu, Red Hat Enterprise Linux, and Fedora distros. Researchers discovered a vulnerability in Apport (Ubuntu’s core dump handler) and another bug in systemd-coredump, which is used in the default configuration of Red Hat Enterprise Linux 9 and the Fedora distribution. systemd-coredump automatically captures >>core…
-
Can We Rely on Current Secrets Management Solutions?
Can Secrets Management Really Secure our Digital Assets? How effective are current secrets management solutions? Are they adequate to safeguard our data in the highly volatile environment of the internet? With data management experts and cybersecurity specialists, we delve deep into Non-Human Identities (NHIs) and Secrets Security Management, two crucial pillars of cloud security. Exploring……
-
UK banks urged to beef up anti-fraud systems for international payments
Data reveals ‘notable increase’ in scammers tricking people into sending money abroadUK banks and payment firms have been urged to strengthen their anti-fraud systems for international payments after a rise in scammers tricking people into sending money abroad.After years of horror stories about people losing huge sums through bank transfer scams, rules came into force…
-
The Sequential Kill Chain for AI FireTail Blog
May 30, 2025 – Timo Rüppell – The Sequential Kill Chain for AI-Powered Attacks Excerpt: We’ve talked before about Mean Time To Attack, or MTTA, which has grown alarmingly short for new vulnerabilities across the cyber landscape. In this blog, we’ll dive into the “how” and “why” of this”¦ Summary: In our current cyber landscape,…
-
‘Earth Lamia’ Exploits Known SQL, RCE Bugs Across Asia
A highly active Chinese threat group is taking proverbial candy from babies, exploiting known bugs in exposed servers to steal data from organizations in sensitive sectors. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/earth-lamia-exploits-sql-rce-bugs-asia
-
Hospitals in Maine, New Hampshire limit services after cyberattack on Catholic health org
Three hospitals run by Catholic healthcare organization Covenant Health are dealing with a cyberattack that forced the facilities to shut off all access to data systems. First seen on therecord.media Jump to article: therecord.media/maine-new-hampshire-cyberattacks-hospital
-
Genetic Data: Emerging Cyberthreats and Privacy Concerns
It’s only a matter of time before cybercriminals begin to use artificial intelligence-enabled tools, open-source software and other technologies to launch attacks to exploit sensitive genetic data, said Nicholas Morris, a practice manager at security firm Optiv. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/interviews/genetic-data-emerging-cyberthreats-privacy-concerns-i-5478
-
US medical org pays $50M+ to settle case after crims raided data and threatened to swat cancer patients
Cash splashed on damages, infrastructure improvements, and fraud monitoring First seen on theregister.com Jump to article: www.theregister.com/2025/05/30/fred_hutch_cancer_center_commits/
-
Linux Crash Dump Flaws Expose Passwords, Encryption Keys
Race-Condition Bugs in Ubuntu and Red Hat Tools Could Leak Sensitive Memory Data. Hackers could exploit a tool that stores crashed system data in older Linux operating systems to obtain passwords and encryption keys, warn researchers. The flaw lies in the way certain Linux distributions, including Ubuntu, Red Hat, and Fedora, handle application crashes. First…
-
From Swipe to Scare: Data Privacy and Cyber Security Concerns in Dating Apps
Dating apps changed everything; didn’t they? They’ve truly revolutionised how we discover love and make connections. Consider this: over 323 million people worldwide use them”, millions swiping, matching, and meeting. But there’s a catch before you get hold of your prince charming or princess! Behind those flattering photos and witty bios? A shadowy digital world…
-
Cloud migration demands contractual safeguards and clear strategy
Cyber security experts urge organisations to define clear objectives, understand shared security models and implement strong data governance when migrating workloads to the cloud First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366625093/Cloud-migration-demands-contractual-safeguards-and-clear-strategy
-
New Study Uncovers Multiple Vulnerabilities in WeChat and IM Apps
Instant messaging (IM) applications like WeChat have become indispensable for billions, facilitating not only communication but also payments, business, and personal data exchange. However, their ubiquity and complexity make them prime targets for sophisticated cyberattacks. This article explores how a single WeChat message can be leveraged for persistent client-side attacks, examining the technical mechanisms, real-world…
-
NSA, CISA Urge Organizations to Secure Data Used in AI Models
New guidance includes a list of 10 best practices to protect sensitive data throughout the AI lifecycle as well as addressing supply chain and data poisoning risks. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/nsa-cisa-gudnceai-secure-data-ai-models
-
New Apache InLong Vulnerability (CVE-2025-27522) Exposes Systems to Remote Code Execution Risks
A newly disclosed vulnerability, tracked as CVE-2025-27522, has been discovered in Apache InLong, a widely used real-time data streaming platform. The Apache InLong vulnerability introduces the potential for remote code execution (RCE). First seen on thecyberexpress.com Jump to article: thecyberexpress.com/apache-inlong-cve-2025-27522/
-
Hackers Use AI-Generated Videos on TikTok to Spread Info-Stealing Malware
TrendMicro has uncovered a sophisticated campaign where threat actors are exploiting TikTok to distribute information-stealing malware. By leveraging AI-generated videos posing as tutorials for unlocking pirated software, cybercriminals trick unsuspecting viewers into executing malicious PowerShell commands. These commands download dangerous malware strains such as Vidar and StealC, designed to harvest sensitive data from infected systems.…
-
Data watchdog put cops on naughty step for lost CCTV footage
Greater Manchester Police reprimanded over hours of video that went AWOL First seen on theregister.com Jump to article: www.theregister.com/2025/05/30/uk_data_watchdog_found_police/
-
Next.js Dev Server Vulnerability Leads to Developer Data Exposure
A recently disclosed vulnerability, CVE-2025-48068, has raised concerns among developers using the popular Next.js framework. This flaw, affecting versions 13.0.0 through 15.2.1 when the App Router is enabled, allows attackers to exploit the development server via Cross-site WebSocket Hijacking (CSWSH), potentially exposing sensitive application source code. The issue has been addressed in version 15.2.2, but…
-
Safari Flaw Exploited by BitM Attack to Steal User Login Data
A new wave of phishing attacks, known as Fullscreen Browser-in-the-Middle (BitM) attacks, is exploiting browser features to steal user credentials with unprecedented stealth. Unlike traditional phishing, which relies on fake websites and visible clues, BitM attacks leverage remote browser sessions and the Fullscreen API to create convincing overlays that mask all browser interface elements, including…
-
CISA Urged to Enrich KEV Catalog with More Contextual Data
Security teams should use vulnerability context alongside KEV lists to prioritize patching, OX argued First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-urged-enrich-kev-catalog/
-
EU-US Data Privacy Framework – Warum Unternehmen sich beim Datenschutz nicht auf Washington verlassen dürfen
First seen on security-insider.de Jump to article: www.security-insider.de/eu-us-datenschutzrahmen-unternehmen-handeln-a-3170b845e9944ea528b26c67696b5a58/
-
ConnectWise Hit by Advanced Cyberattack: Internal Data at Risk
ConnectWise, a leading provider of IT management and remote access software, has confirmed a cyberattack attributed to a sophisticated nation-state actor. The breach, discovered in May 2025, impacted a limited number of customers using the company’s ScreenConnect cloud platform, a tool widely used for remote support and system maintenance. ConnectWise responded by engaging forensic experts…