Tag: update
-
Critical RCE Flaws in Cisco ISE and ISE-PIC Allow Unauthenticated Attackers to Gain Root Access
Cisco has released updates to address two maximum-severity security flaws in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that could permit an unauthenticated attacker to execute arbitrary commands as the root user.The vulnerabilities, assigned the CVE identifiers CVE-2025-20281 and CVE-2025-20282, carry a CVSS score of 10.0 each. A description of the defects…
-
Beyond Traditional Threats: The Rise of AI-Driven API Vulnerabilities
AI has had dramatic impacts on almost every facet of every industry. API security is no exception. Up until recently, defending APIs meant guarding against well-understood threats. But as AI proliferates, automated adversaries, AI-crafted exploits, and business logic abuse have complicated matters. It’s no longer enough to merely patch known flaws; security teams must now…
-
SAP-Schwachstellen gefährden Windows-Nutzerdaten
Tags: access, compliance, cve, cvss, cyberattack, encryption, fortinet, GDPR, PCI, phishing, risk, sap, spear-phishing, update, vulnerability, windowsSchwachstellen in SAP GUI geben sensible Daten durch schwache oder fehlende Verschlüsselung preis.Die Forscher Jonathan Stross von Pathlock, und Julian Petersohn von Fortinet warnen vor zwei neuen Sicherheitslücken in einer Funktion von SAP GUI, die für die Speicherung der Benutzereingaben in den Windows- (CVE-2025-0055) und Java-Versionen (CVE-2025-0056) zuständig ist .Dadurch werden sensible Informationen wie Benutzernamen,…
-
Microsoft Teams Adds Feature for Admins to Control 365 Certified Apps with Custom Rules
Microsoft is rolling out a major update to Microsoft Teams, empowering administrators with enhanced control over third-party app availability through new rule-based settings in the Teams admin center. This change”, detailed in Microsoft’s recent Message Center update (MC1085133)”, is set to begin global rollout in mid-August 2025, with completion expected by early September 2025. The…
-
Proaktive Resilienz in dynamischen Bedrohungsszenarien – Patch-Management in kritischen Produktionsumgebungen
First seen on security-insider.de Jump to article: www.security-insider.de/risikobasiertes-patch-management-fuer-produktionsnetze-a-037fa7d85039df0640f98f57b2b06368/
-
The top red teamer in the US is an AI bot
Tags: ai, attack, breach, cybersecurity, data, email, exploit, infrastructure, monitoring, ransomware, risk, software, threat, tool, training, updateDefenders need to rethink their approach: While Xbow is now besting human red-teamers, and at a rapid clip, defenders still have a long way to go to keep up with the onslaught of AI-perpetrated attacks, experts say.”Hackers are quickly adopting new tools that allow them to move faster, hit harder, and target more precisely than…
-
Citrix bleeds again: This time a zero-day exploited – patch now
Two emergency patches issued in two weeks First seen on theregister.com Jump to article: www.theregister.com/2025/06/25/citrix_netscaler_critical_bug_exploited/
-
Citrix Releases Emergency Patches for Actively Exploited CVE-2025-6543 in NetScaler ADC
Citrix has released security updates to address a critical flaw affecting NetScaler ADC that it said has been exploited in the wild.The vulnerability, tracked as CVE-2025-6543, carries a CVSS score of 9.2 out of a maximum of 10.0.It has been described as a case of memory overflow that could result in unintended control flow and…
-
Citrix Bleed 2 Flaw Enables Token Theft; SAP GUI Flaws Risk Sensitive Data Exposure
Cybersecurity researchers have detailed two now-patched security flaws in SAP Graphical User Interface (GUI) for Windows and Java that, if successfully exploited, could have enabled attackers to access sensitive information under certain conditions.The vulnerabilities, tracked as CVE-2025-0055 and CVE-2025-0056 (CVSS scores: 6.0), were patched by SAP as part of its monthly updates for January First…
-
Weiteres Update-Debakel: Android TV 14 für Chromecast mit Google TV erneut fehlerhaft
Google verteilt eine fehlerkorrigierte Version von Android TV 14 für Chromecast mit Google TV. Das Update hat diesmal andere Fehler. First seen on golem.de Jump to article: www.golem.de/news/weiteres-update-debakel-android-tv-14-fuer-chromecast-mit-google-tv-erneut-fehlerhaft-2506-197457.html
-
SAP GUI flaws expose sensitive data via weak or no encryption
Tags: attack, breach, cve, data, encryption, exploit, flaw, phishing, sap, spear-phishing, threat, update, vulnerability, windowsThe impact could be much greater: Dani noted that a breach through these vulnerabilities can facilitate further targeted attacks. “Not undermining the fact that this extracted data provides attackers with enough gunpowder for reconnaissance activities, a threat actor could comprehend organizational structure, usage patterns, and system configurations from the exploitation of these vulnerabilities and weaponize…
-
Firefox 140 Launches with Critical Code Execution Bug Fix Update Now
Mozilla has officially released Firefox 140, marking a significant update that addresses multiple security vulnerabilities, including a critical code execution flaw. Users are strongly urged to update their browsers immediately to protect against potential exploits targeting these newly patched weaknesses. Critical Security Fixes in Firefox 140 The highlight of Firefox 140 is the resolution of…
-
Windows 11 Configuration Bug Freezes Update Scanning Process
A recently discovered bug in Windows 11 has caused significant frustration among users, as the operating system’s update scanning process can freeze unexpectedly, leaving systems unable to check for or install critical updates. Microsoft has officially acknowledged the issue and is rolling out fixes to affected devices worldwide. The problem, which primarily impacts users running…
-
Windows 10: How to get security updates for free until 2026
Users who want to stick with Windows 10 beyond its planned end-of-support date but still receive security updates, can enroll into the Windows 10 Extended Security Updates … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/25/windows-10-how-to-get-security-updates-for-free-until-2026/
-
Chrome Releases Security Patch for 11 Code Execution Vulnerabilities
The Chrome team has announced the rollout of a critical security update for its popular web browser, Chrome, addressing 11 code execution vulnerabilities that could potentially put millions of users at risk. The update, Chrome 138.0.7204.49 for Linux and 138.0.7204.49/50 for Windows and Mac, is now being distributed through the stable channel and will reach…
-
New TeamViewer Vulnerability Puts Windows Systems at Risk of Privilege Escalation
TeamViewer has shared a new security update for a flaw in TeamViewer Remote Management for Windows. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cve-2025-36537-teamviewer-remote-management/
-
Schutz vor Cybercrime: Verbraucher werden nachlässiger
Tags: authentication, bsi, cyber, cyberattack, cybercrime, cyersecurity, fraud, Internet, mail, mfa, password, phishing, updateLaut einer Umfrage des BSI verzichten immer mehr Bürger auf Cyberschutzmaßnahmen.Ein angeblicher Lottogewinn, für den noch Daten fehlen, ein allzu billiges Produkt im Online-Handel, das nie ankommt oder gar ein Virus. Cybercrime hat viele Facetten. Wie schützen sich die Bürger? Bei einer Umfrage des Bundesamt für Sicherheit in der Informationstechnik (BSI) gaben nur noch 44…
-
NVIDIA Megatron LM Flaw Allows Attackers to Inject Malicious Code
NVIDIA has issued an urgent security update for its open-source Megatron-LM framework, following the discovery of two critical vulnerabilities that could allow attackers to inject and execute malicious code on affected systems. The flaws, tracked as CVE-2025-23264 and CVE-2025-23265, impact all platforms running Megatron-LM versions prior to 0.12.0 and have prompted a swift response from…
-
Mit Einschränkungen: Microsoft bietet kostenlose Updates für Windows 10 bis 2026
Für Privatnutzer sollte das ESU-Programm für Windows 10 ohnehin günstiger sein als für Geschäftskunden. Jetzt geht es sogar ganz ohne Geld. First seen on golem.de Jump to article: www.golem.de/news/mit-einschraenkungen-microsoft-bietet-kostenlose-updates-fuer-windows-10-bis-2026-2506-197431.html
-
Microsoft Extends Windows 10 Security Updates for One Year with New Enrollment Options
Microsoft on Tuesday announced that it’s extending Windows 10 Extended Security Updates (ESU) for an extra year by letting users either pay a small fee of $30 or by sync their PC settings to the cloud.The development comes ahead of the tech giant’s upcoming October 14, 2025, deadline, when it plans to officially end support…
-
Das freut die Cyberkriminellen: Potenzielle Opfer werden immer fahrlässiger
Ob starke Passwörter, Zwei-Faktor-Authentisierung oder regelmäßige Updates: Trotz anhaltend hoher Bedrohungslage verwenden Menschen weniger Maßnahmen als noch in den Vorjahren zum Schutz vor Gefahren im Internet, so der Cybersicherheitsmonitor 2025 [1]. Die repräsentative Dunkelfeldstudie von BSI und Polizei betrachtet das Schutzverhalten der Bevölkerung sowie ihre Betroffenheit von Cyberkriminalität. Eine Mehrheit der Verbraucherinnen und Verbraucher schützt……
-
Key Cyber Law’s Lapse Could Mute Threat Sharing Nationwide
Congress Faces Pressure to Modernize Cyber Definitions, Safeguards Before Deadline. With the Cybersecurity Information Sharing Act of 2015 set to expire this fall, lawmakers face mounting pressure to update its liability protections and outdated definitions, as experts warn that failure to modernize could undermine public-private threat sharing and weaken national cyber defenses. First seen on…
-
Don’t panic, but it’s only a matter of time before critical ‘CitrixBleed 2’ is under attack
Why are you even reading this story? Patch now! First seen on theregister.com Jump to article: www.theregister.com/2025/06/24/critical_citrix_bug_citrixbleed/
-
UK Data Bill Signals Evolution in AI and Privacy Rules
Attorney Edward Machin on How the New Law Affects Data Use and Risk. The U.K.’s new data bill updates rules on AI, cookies and automated decisions while keeping EU data-sharing intact. Edward Machin of Ropes & Gray calls it evolution, not revolution and says the lighter-touch approach still carries serious long-term consequences. First seen on…
-
Black Hat SEO Poisoning Search Engine Results For AI to Distribute Malware
IntroductionZscaler ThreatLabz researchers recently uncovered AI-themed websites designed to spread malware. The threat actors behind these attacks are exploiting the popularity of AI tools like ChatGPT and Luma AI. These websites are utilizing platforms such as WordPress and are designed to poison search engine rankings and increase the probability of unsuspecting users landing on these…
-
Windows 10 KB5061087 update released with 13 changes and fixes
Microsoft has released the June 2025 non-security preview update for Windows 10, version 22H2, with fixes for bugs preventing the Start Menu from launching and breaking scanning features on USB multi-function printers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-10-kb5061087-update-released-with-13-changes-and-fixes/
-
Microsoft fixes known issue that breaks Windows 11 updates
Microsoft is rolling out a configuration update designed to address a known issue causing Windows Update to fail on some Windows 11 systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-fixes-known-issue-that-breaks-windows-11-updates/
-
Windows 10 users can get extended security updates using Microsoft points
Microsoft says Windows 10 home users who want to delay switching to Windows 11 can enroll in the Extended Security Updates (ESU) program using Microsoft Rewards points. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-windows-10-extended-security-updates-available-using-reward-points/
-
New DRAT V2 Update Enhances C2 Protocol with Shell Command Execution Capabilities
A new variant of the DRAT remote access trojan (RAT), dubbed DRAT V2, has been uncovered as part of a TAG-140 campaign targeting Indian government entities. This threat actor, believed to overlap with SideCopy and linked to Transparent Tribe (aka APT36), demonstrates a consistent pattern of refining its malware arsenal. TAG-140 Evolves Malware Arsenal The…