Tag: software
-
Lyrix Ransomware Targets Windows Users with Advanced Evasion Techniques
A formidable new strain of ransomware, dubbed Lyrix, has recently surfaced, posing a significant threat to Windows users worldwide. Cybersecurity researchers have identified Lyrix as a highly advanced malicious software designed to encrypt critical files and demand substantial ransoms for decryption keys. New Threat Emerges with Sophisticated Tactics Unlike typical ransomware, Lyrix incorporates cutting-edge evasion…
-
Critical HPE StoreOnce Flaws Allow Remote Code Execution by Attackers
Hewlett-Packard Enterprise (HPE) has issued a critical security bulletin (HPESBST04847 rev. 1) warning users of multiple high-impact vulnerabilities in its StoreOnce Software, specifically affecting versions before 4.3.11. The vulnerabilities, if exploited, could allow attackers to bypass authentication, execute arbitrary code remotely, perform server-side request forgery (SSRF), delete files, and access sensitive information via directory traversal.…
-
Vet: Open-source software supply chain security tool
Vet is an open source tool designed to help developers and security engineers spot risks in their software supply chains. It goes beyond traditional software composition … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/03/vet-open-source-software-supply-chain-security-tool/
-
What You Don’t Know About SaaS Can Violate HIPAA Compliance
Explore how SaaS identity risks impact HIPAA compliance and what the 2025 updates mean for MFA, app inventory, and third-party software controls. Read now. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/06/what-you-dont-know-about-saas-can-violate-hipaa-compliance/
-
Frage: Wie steht es um die Sicherheit unserer Medizin(geräte)-Technik?
Tags: softwareHeute mal eine Frage an die Blog-Leserschaft, die im Bereich Gesundheitswesen, Kliniken, Arzt-Praxen oder auch in der Entwicklung von Medizin-Software unterwegs ist. Wie aktuell und sicher ist unsere Software in der Medizintechnik bzw. im Gesundheitswesen? Ist da alles paletti, oder … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/06/03/frage-wie-steht-es-um-die-sicherheit-unserer-medizingeraete-technik/
-
SentinelOne: Last week’s 7-hour outage caused by software flaw
American cybersecurity company SentinelOne revealed over the weekend that a software flaw triggered a seven-hour-long outage on Thursday. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/technology/sentinelone-last-weeks-7-hour-outage-caused-by-software-flaw/
-
SentinelOne analysis links service disruption to software flaw
The outage had major impacts on enterprise customers’ ability to manage security operations, although federal customers were not affected. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/sentinelone-service-disruption-software-flaw/749548/
-
Infosecurity 2025: NCA cyber intelligence head spells out trends
Will Lyne, head of cyber intelligence at the National Crime Agency, sketches out cyber criminal trends as ransomware and other attack varieties become democratised beyond Russophone, skilled software developers First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366625059/Infosecurity-2025-NCA-cyber-intelligence-head-spells-out-trends
-
Critical Denodo Scheduler Flaw Allows Remote Code Execution by Attackers
Denodo, a provider of logical data management software, recently faced a critical security vulnerability in its Denodo Scheduler product. This vulnerability, tracked as CVE-2025-26147, allows authenticated users to perform remote code execution (RCE) on affected systems, posing significant risks to organizations relying on this scheduling tool for data extraction and integration jobs. Introduction to Denodo…
-
Active Exploits Detected Targeting Critical vBulletin Vulnerability
Two critical vulnerabilities”, CVE-2025-48827 and CVE-2025-48828″, have been assigned to vBulletin, the widely used PHP/MySQL forum software, following public disclosure and observed exploitation in the wild. The flaws, affecting vBulletin versions 5.0.0 through 6.0.3, enable unauthenticated attackers to achieve Remote Code Execution (RCE), putting thousands of online communities at risk. Reflection API Abuse and Template…
-
Experts published a detailed analysis of Cisco IOS XE WLC flaw CVE-2025-20188
Technical details about a critical Cisco IOS XE WLC flaw (CVE-2025-20188) are now public, raising the risk of a working exploit emerging soon. Details of a critical vulnerability, tracked as CVE-2025-20188, impacting Cisco IOS XE WLC are now public, raising the risk of exploitation. In early May, Cisco released software updates to address the vulnerability CVE-2025-20188…
-
New Study Reveals Vulnerable Code Pattern Putting GitHub Projects at Risk of Path Traversal Attacks
A comprehensive research study has identified a widespread path traversal vulnerability (CWE-22) affecting 1,756 open-source GitHub projects, some of which are highly influential in the software ecosystem. The vulnerability, present in a commonly used Node.js code pattern for creating static HTTP file servers, enables attackers to access files outside of restricted locations, potentially compromising confidentiality…
-
48% of security pros are falling behind compliance requirements
32% of security professionals think they can deliver zero-vulnerability software despite rising threats and compliance regulations, according to Lineaje. Meanwhile, 68% are … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/02/software-compliance-regulations-requirements/
-
Two flaws in vBulletin forum software are under attack
Experts found two vulnerabilities in the vBulletin forum software, one of which is already being exploited in real-world attacks. Two critical vBulletin flaws, tracked as CVE-2025-48827 and CVE-2025-48828, enable API abuse and remote code execution. The experts warn that one of these flaws is actively exploited in the wild. An unauthenticated user could exploit CVE-2025-48827…
-
Week in review: NIST proposes new vulnerabilities metric, flaws in NASA’s open source software
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Vulnerabilities found in NASA’s open source software Vulnerabilities in open … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/01/week-in-review-nist-proposes-new-vulnerabilities-metric-flaws-in-nasas-open-source-software/
-
New Relic Enhances Software Reliability with GitHub Copilot Integration
New Relic’s integration with GitHub Copilot to boost productivity and enhance software reliability. Discover more now! First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/new-relic-enhances-software-reliability-with-github-copilot-integration/
-
U.S. DoJ Seizes 4 Domains Supporting Cybercrime Crypting Services in Global Operation
A multinational law enforcement operation has resulted in the takedown of an online cybercrime syndicate that offered services to threat actors to ensure that their malicious software stayed undetected from security software.To that effect, the U.S. Department of Justice (DoJ) said it seized four domains and their associated server facilitated the crypting service on May…
-
The Sequential Kill Chain for AI FireTail Blog
May 30, 2025 – Timo Rüppell – The Sequential Kill Chain for AI-Powered Attacks Excerpt: We’ve talked before about Mean Time To Attack, or MTTA, which has grown alarmingly short for new vulnerabilities across the cyber landscape. In this blog, we’ll dive into the “how” and “why” of this”¦ Summary: In our current cyber landscape,…
-
Software supply chain security tools take on toil for users
Recent updates from software supply chain security vendors simply take over vulnerability management on behalf of IT orgs, rather than provide facilitating tools. First seen on techtarget.com Jump to article: www.techtarget.com/searchitoperations/news/366625212/Software-supply-chain-security-tools-take-on-toil-for-users
-
Hackers are exploiting critical flaw in vBulletin forum software
Two critical vulnerabilities affecting the open-source forum software vBulletin have been discovered, with one confirmed to be actively exploited in the wild. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-are-exploiting-critical-flaw-in-vbulletin-forum-software/
-
Genetic Data: Emerging Cyberthreats and Privacy Concerns
It’s only a matter of time before cybercriminals begin to use artificial intelligence-enabled tools, open-source software and other technologies to launch attacks to exploit sensitive genetic data, said Nicholas Morris, a practice manager at security firm Optiv. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/interviews/genetic-data-emerging-cyberthreats-privacy-concerns-i-5478
-
Police takes down AVCheck site used by cybercriminals to scan malware
An international law enforcement operation has taken down AVCheck, a service used by cybercriminals to test whether their malware is detected by commercial antivirus software before deploying it in the wild. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/police-takes-down-avcheck-antivirus-site-used-by-cybercriminals/
-
ConnectWise Breached, ScreenConnect Customers Targeted
The software company, which specializes in remote IT management, said a sophisticated nation state actor was behind the attack but provided few details. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/connectwise-breached-screenconnect-customers-targeted
-
Cybersecurity Firm SentinelOne Suffers Major Outage
After Hours-Long Disruption, XDR Vendor Promises Full Root Cause Analysis of Outage. Cybersecurity vendor SentinelOne suffered a major, global outage for about six hours on Thursday that disrupted its monitoring of managed response service customers’ endpoints and networks, interrupted software updates and kept administrators from accessing consoles for troubleshooting purposes. First seen on govinfosecurity.com Jump…
-
Hackers Use Gh0st RAT to Hijack Internet Café Systems for Crypto Mining
Hackers have been targeting Internet cafés in South Korea since the second half of 2024, exploiting specialized management software to install malicious tools for cryptocurrency mining. According to a detailed report from AhnLab SEcurity intelligence Center (ASEC), the attackers, active since 2022, are using the notorious Gh0st RAT (Remote Access Trojan) to seize control of…
-
Hackers Use AI-Generated Videos on TikTok to Spread Info-Stealing Malware
TrendMicro has uncovered a sophisticated campaign where threat actors are exploiting TikTok to distribute information-stealing malware. By leveraging AI-generated videos posing as tutorials for unlocking pirated software, cybercriminals trick unsuspecting viewers into executing malicious PowerShell commands. These commands download dangerous malware strains such as Vidar and StealC, designed to harvest sensitive data from infected systems.…
-
Novel Malware Evades Detection by Skipping PE Header in Windows
Researchers have identified a sophisticated new strain of malware that bypasses traditional detection mechanisms by entirely omitting the Portable Executable (PE) header in Windows environments. This innovative evasion tactic represents a significant shift in how malicious software can infiltrate systems, posing a critical challenge to conventional antivirus and endpoint detection solutions. Breakthrough in Malware Evasion…
-
North Korean IT Workers Exploit Legitimate Software and Network Tactics to Evade EDR
A North Korean IT worker, operating under a false identity, was uncovered infiltrating a Western organization with a sophisticated remote-control system. This incident, exposed during a U.S. federal raid on a suspected laptop farm, showcases a chilling trend where adversaries leverage legitimate software and low-level network protocols to evade traditional Endpoint Detection and Response (EDR)…