Tag: service
-
Oxford City Council Cyberattack Disrupts Services and Exposes Historic Election Data
The Oxford City Council is investigating a recent cybersecurity breach that disrupted various council services and potentially exposed the personal data of past election workers. The Oxford City Council cyberattack, which occurred over the weekend of June 78, was identified by the council’s automated defense systems. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/oxford-city-council-cyberattack/
-
Can users reset their own passwords without sacrificing security?
Self-service password resets (SSPR) reduce helpdesk strain”, but without strong security, they can open the door to attackers. Learn why phishing-resistant MFA, context-aware verification, and risk-based detection are critical to secure SSPR implementation. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/can-users-reset-their-own-passwords-without-sacrificing-security/
-
Massive DDoS Attack Hits 7.3 Tbps Delivering 37.4 Terabytes in 45 Seconds
The internet witnessed a new record in cyberattacks last month as Cloudflare, blocked the largest distributed denial-of-service (DDoS) attack ever recorded. The attack peaked at an astonishing 7.3 terabits per second (Tbps), overwhelming its target with 37.4 terabytes of data in just 45 seconds. The attack, detected in mid-May 2025, targeted an unnamed hosting provider…
-
AntiDot 31 Android Botnet Malware Grants Attackers Full Control Over Victim Devices
A new Android botnet malware named AntiDot has emerged as a formidable threat, granting cybercriminals unprecedented control over infected devices. Operated and sold by LARVA-398 as a Malware-as-a-Service (MaaS) on underground forums like XSS, AntiDot is marketed as a >>3-in-1
-
CVE-2025-49763: Apache Traffic Server Vulnerability Enables Memory Exhaustion Attacks
A security flaw in Apache Traffic Server (ATS) is targeting cloud service providers worldwide. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/apache-traffic-server-cve-2025-49763/
-
Attack on Oxford City Council exposes 21 years of election worker data
Services coming back online after legacy systems compromised First seen on theregister.com Jump to article: www.theregister.com/2025/06/20/oxford_city_council_breach/
-
Massive 7.3 Tbps DDoS Attack Delivers 37.4 TB in 45 Seconds, Targeting Hosting Provider
Cloudflare on Thursday said it autonomously blocked the largest ever distributed denial-of-service (DDoS) attack ever recorded, which hit a peak of 7.3 terabits per second (Tbps).The attack, which was detected in mid-May 2025, targeted an unnamed hosting provider.”Hosting providers and critical Internet infrastructure have increasingly become targets of DDoS attacks,” Cloudflare’s Omer First seen on…
-
16 Billion Passwords Stolen From 320 Million+ Computers Leaked Online
Tags: apple, breach, computer, credentials, cyber, cybersecurity, data, data-breach, github, google, government, identity, Internet, leak, login, password, risk, serviceA staggering 16 billion login credentials, usernames, and passwords have been exposed in what cybersecurity experts are calling the largest data breach in internet history. The leak, which impacts major platforms including Apple, Facebook, Google, Instagram, Telegram, GitHub, and even government services, has put billions of online accounts at unprecedented risk of account takeover, identity…
-
How to conduct an effective post-incident review
Tags: breach, business, ciso, compliance, credentials, cyber, cybersecurity, detection, email, finance, governance, group, incident, incident response, lessons-learned, phishing, risk, service, software, tool, training, update, vulnerabilityPerform a root-cause analysis: Your post-incident review must include a root-cause analysis, Taylor says. “Identifying the underlying issues that caused the incident is essential for avoiding future cyber incidents,” he says.The post-incident review team should examine the root causes of the incident, whether they are technical, procedural, or human-related, and implement corrective actions and preventive…
-
Cybersicherheit für Unternehmen jeder Größe SOC-as-a-Service
Cyberangreifer machen vor keiner Unternehmensgröße halt und auch kleine und mittelständische Unternehmen (KMU) werden zur Zielscheibe. Während die Angriffstaktiken von Cyberkriminellen immer raffinierter werden, können KMU die zum Schutz nötigen modernen Sicherheitsstrategien kaum umsetzen. First seen on ap-verlag.de Jump to article: ap-verlag.de/cybersicherheit-fuer-unternehmen-jeder-groesse-soc-as-a-service/96646/
-
Malicious Support Tickets Let Hackers Exploit Atlassian’s Model Context Protocol
A new class of cyberattack is targeting organizations leveraging Atlassian’s Model Context Protocol (MCP), exposing a critical weakness in the boundary between external and internal users. Researchers have demonstrated that malicious support tickets can be weaponized to exploit AI-powered workflows in Atlassian’s Jira Service Management (JSM), enabling attackers to gain privileged access and exfiltrate sensitive…
-
A New Identity Playbook for AI Agents: Securing the Agentic User Flow
Artificial intelligence has reached an inflection point. AI agents are no longer just service accounts or background processes. They’re decision-makers, workflow executors, and digital delegates”, acting autonomously across APIs, clouds, and systems. Unlike traditional non-human identities (NHI), like service accounts or static API keys, agentic identities are dynamic, ephemeral, and often self-directed. Gartner highlights that…
-
How Financial Institutions Can Meet DORA Compliance with Crypto-Agility
Today’s financial systems are highly digital and deeply interconnected. That’s great until something breaks. Whether it’s ransomware paralyzing critical services or cryptographic vulnerabilities quietly eroding trust, disruptions are no longer rare”, they’re systemic. The Modern Heist Bank Report 2025 shows just how serious it’s become: 64% of surveyed financial institutions reported cyber incidents in the…
-
New Android Malware Surge Hits Devices via Overlays, Virtualization Fraud and NFC Theft
Cybersecurity researchers have exposed the inner workings of an Android malware called AntiDot that has compromised over 3,775 devices as part of 273 unique campaigns.”Operated by the financially motivated threat actor LARVA-398, AntiDot is actively sold as a Malware-as-a-Service (MaaS) on underground forums and has been linked to a wide range of mobile campaigns,” PRODAFT…
-
Gamers Targeted! Fake Minecraft Mods Enable Attackers to Take Control of Your System
Minecraft, the wildly popular sandbox game with over 200 million monthly active players, has become the latest hunting ground for cybercriminals. Check Point Research recently uncovered a sinister campaign targeting Minecraft users through the Stargazers Ghost Network, a Distribution as a Service (DaaS) platform operating on GitHub. This network distributes malware disguised as legitimate Minecraft…
-
MSPs remain confident over security
Despite being inundated with attacks, the vast majority of managed service providers are upbeat about their abilities to fend off breaches First seen on computerweekly.com Jump to article: www.computerweekly.com/microscope/news/366626122/MSPs-remain-confident-over-security
-
DOJ moves to seize $225 million in crypto stolen by scammers
A civil forfeiture complaint was filed in U.S. District Court for the District of Columbia this week, where investigators from the FBI and U.S. Secret Service said they used blockchain analysis to trace the funds back to fraud schemes perpetrated by actors in the Philippines. First seen on therecord.media Jump to article: therecord.media/doj-moves-to-seize-225-million-in-stolen-crypto
-
UBS employee data leaked after cyber attack on supplier
UBS and fellow Swiss bank Pictet have been affected by a cyber attack on a procurement service provider First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366626166/UBS-employee-data-leaked-after-cyber-attack-on-supplier
-
US States with Notable Consumer Data Privacy Laws
Privacy issues have garnered significant attention from the state despite not typically being at the forefront of discussions regarding data regulation. The states included in the article are not in any specific sequence. Kentucky Steps Up Early Sectors like entertainment and online platforms in Kentucky take data protection seriously. For example, popular iGaming services that…
-
Over Two Thirds of MSPs Hit by Multiple Breaches in Past Year, Survey Reveals
Today, Cybersmart, a provider of cyber risk management for small businesses, has released the findings from its second annual CyberSmart MSP Survey, which focuses on the security of Managed Service Providers (MSPs) and their customers. The 2025 report revealed that 69% of MSP leaders globally admitted to being hit by multiple breaches over the past 12…
-
IT-Sicherheit im Service-Bereich Verband KVD appelliert an KMU
Tags: serviceFirst seen on security-insider.de Jump to article: www.security-insider.de/cyberrisiken-technischer-service-handlungsempfehlungen-kvd-a-542c8f90ce678d63a64000ed4c1ef5cd/
-
UBS Employee Data Reportedly Exposed in Third Party Attack
Banking giant UBS revealed it had suffered a data breach following a cyber-attack on procurement service provider Chain IQ First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ubs-employee-data-exposed-third/
-
Qilin Ransomware Rises as Major Threat, Demanding $50M in Ransom
The global cybersecurity landscape is facing a seismic shift as the Qilin ransomware group, also known as Agenda, has surged to the forefront of digital extortion, demanding ransoms as high as $50 million and disrupting critical services worldwide. Once an obscure player, Qilin has rapidly evolved into the most prevalent and technically sophisticated ransomware operation…
-
Malicious Minecraft mods distributed by the Stargazers DaaS target Minecraft gamers
Java-based malware targets Minecraft users via fake cheat tools, utilizing the Stargazers Ghost Network distribution-as-a-service (DaaS). Check Point researchers found a multi-stage malware on GitHub targeting Minecraft users via Stargazers DaaS, using Java/.NET stealers disguised as cheat tools. Minecraft, one of the world’s most popular games with over 200 million monthly players and 300 million…
-
How the New HIPAA Regulations 2025 Will Impact Healthcare Compliance
The U.S. Department of Health and Human Services (HHS) is rolling out new HIPAA regulations in 2025. It’s designed to strengthen patient privacy and security in the face of these changes. These HIPAA updates are a response to the rise of telemedicine, the growing use of electronic health records (EHR), and an alarming increase in……
-
Third-party risk management is broken, but not beyond repair
Getting to the root of the problem: The surge of TPRM tools has automated much of what was once a manual, resource-intensive process. These platforms were developed to simplify the creation, distribution, and completion of security questionnaires, addressing the operational burden organizations often face when conducting third-party risk audits. While they’ve brought much-needed efficiency, they’ve…
-
XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service (CVE-2025-30220)
Summary A high-severity vulnerability has been identified in GeoServer’s Web Feature Service (WFS) that allows XML External Entity (XXE) attacks, potentially leading toinformation disclosure and First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2025/06/19/xml-external-entity-xxe-processing-vulnerability-in-geoserver-wfs-service-cve-2025-30220/
-
Hackers Exploit Cloudflare Tunnels to Infect Windows Systems With Python Malware
A sophisticated malware campaign dubbed SERPENTINE#CLOUD has emerged, leveraging Cloudflare Tunnel infrastructure to deliver Python-based malware to Windows systems across Western nations, including the United States, United Kingdom, and Germany. This ongoing operation, characterized by its use of obfuscated scripts and memory-injected payloads, demonstrates an alarming evolution in threat actor tactics, exploiting trusted cloud services…