Tag: update
-
Cisco Wireless LAN Controllers under threat again after critical exploit details go public
A call for urgent patching: Cisco had patched the max severity flaw, CVSS 10 out of 10, in mid-May rollouts for customers with service contracts and through Cisco TAC for customers without service contracts.Researchers recommended promptly upgrading to the latest version of the affected software, as no other workaround is available. “For security teams, the…
-
Zscaler Unveils AI And Security Updates: Five Things To Know
Zscaler announced new capabilities for protecting the use of AI, as well as around AI-powered application management and network intelligence, in connection with its 2025 Zenith Live conference. First seen on crn.com Jump to article: www.crn.com/news/security/2025/zscaler-unveils-ai-and-security-updates-five-things-to-know
-
Microsoft patches the patch that put Windows 11 in a coma
Out-of-band is becoming the norm rather than the exception First seen on theregister.com Jump to article: www.theregister.com/2025/06/03/windows_11_oob_fix/
-
Multiple High-Risk Vulnerabilities in Microsoft Products
According to the latest advisory by Cert-In, 78 vulnerabilities have been discovered across a broad range of Microsoft products, including Windows, Azure, MS Office, Developer Tools, Microsoft Apps, System Center, Dynamics, and even legacy products receiving Extended Security Updates (ESU). These flaws pose serious security threats, as they can be exploited by attackers to gain……
-
Google fixed the second actively exploited Chrome zero-day since the start of the year
Google addressed three vulnerabilities in its Chrome browser, including one that it actively exploited in attacks in the wild. Google released out-of-band updates to address three vulnerabilities in its Chrome browser, including one, tracked as CVE-2025-5419, that is actively exploited in the wild. The vulnerability is an out-of-bounds read and write in the V8 JavaScript…
-
Google Chrome to Distrust Two Certificate Authorities Over Compliance and Conduct Issues
Google has revealed that it will no longer trust digital certificates issued by Chunghwa Telecom and Netlock citing “patterns of concerning behavior observed over the past year.”The changes are expected to be introduced in Chrome 139, which is scheduled for public release in early August 2025. The current major version is 137. The update will…
-
SolarWinds Dameware Vulnerability Could Let Attackers Gain Elevated Privileges
June 3, 2025 SolarWinds Worldwide, LLC has announced the release of Dameware 12.3.2, a critical service update focused on bug fixes, security enhancements, and library upgrades. The release, dated June 2, 2025, addresses several technical issues reported by users and security researchers, further strengthening the reliability and safety of Dameware remote support solutions. Security […]…
-
Patch verfügbar – Forscher veröffentlichten PoC für kritische Fortinet-Sicherheitslücke
First seen on security-insider.de Jump to article: www.security-insider.de/kritische-sicherheitsluecke-cve-2025-32756-in-fortinet-produkte-a-4e72f4f36713b503cf4e0799e70e4380/
-
What You Don’t Know About SaaS Can Violate HIPAA Compliance
Explore how SaaS identity risks impact HIPAA compliance and what the 2025 updates mean for MFA, app inventory, and third-party software controls. Read now. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/06/what-you-dont-know-about-saas-can-violate-hipaa-compliance/
-
New Chrome Zero-Day Actively Exploited; Google Issues Emergency Out-of-Band Patch
Google on Monday released out-of-band fixes to address three security issues in its Chrome browser, including one that it said has come under active exploitation in the wild.The high-severity flaw is being tracked as CVE-2025-5419, and has been flagged as an out-of-bounds read and write vulnerability in the V8 JavaScript and WebAssembly engine.”Out of bounds…
-
Frequently Asked Questions About BadSuccessor
Frequently asked questions about “BadSuccessor,” a zero-day privilege escalation vulnerability in Active Directory domains with at least one Windows Server 2025 domain controller. Background Tenable’s Research Special Operations (RSO) and the Identity Content team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding a newly disclosed zero-day in Active Directory called BadSuccessor. FAQ…
-
Qualcomm fixed three zero-days exploited in limited, targeted attacks
Qualcomm addressed three zero-day vulnerabilities that, according to the company, have been exploited in limited, targeted attacks in the wild. Qualcomm has shipped security updates to address three zero-day vulnerabilities that it said have been exploited in limited, targeted attacks in the wild. Google Android Security team reported the three issues, tracked as CVE-2025-21479, CVE-2025-21480,…
-
Qualcomm Fixes 3 Zero-Days Used in Targeted Android Attacks via Adreno GPU
Qualcomm has shipped security updates to address three zero-day vulnerabilities that it said have been exploited in limited, targeted attacks in the wild.The flaws in question, which were responsibly disclosed to the company by the Google Android Security team, are listed below -CVE-2025-21479 and CVE-2025-21480 (CVSS score: 8.6) – Two incorrect authorization vulnerabilities in the…
-
New Tools and Initiatives in Data Breach Monitoring and Healthcare AI
Latest updates on cyber security, AI health initiatives, and pandemic preparedness. Stay informed and take action today! First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/06/new-tools-and-initiatives-in-data-breach-monitoring-and-healthcare-ai/
-
May Recap: New AWS Services and Privileged Permissions
As May 2025 comes to a close, we’re back with the latest roundup of AWS privileged permission updates and service-level developments reshaping cloud security. Tracking these changes is essential, as newly introduced permissions often grant deep access to critical services, opening doors to risks like lateral movement, data exposure, and evasion of security controls…. First…
-
Microsoft ships emergency patch to fix Windows 11 startup failures
Microsoft has released an out-of-band update to address a known issue causing some Windows 11 systems to enter recovery and fail to start after installing the KB5058405 May 2025 security update. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-ships-emergency-patch-to-fix-windows-11-installation-issues/
-
Microsoft ships emergency patch to fix Windows 11 startup failures
Microsoft has released an out-of-band update to address a known issue causing some Windows 11 systems to enter recovery and fail to start after installing the KB5058405 May 2025 security update. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-ships-emergency-patch-to-fix-windows-11-installation-issues/
-
Experts published a detailed analysis of Cisco IOS XE WLC flaw CVE-2025-20188
Technical details about a critical Cisco IOS XE WLC flaw (CVE-2025-20188) are now public, raising the risk of a working exploit emerging soon. Details of a critical vulnerability, tracked as CVE-2025-20188, impacting Cisco IOS XE WLC are now public, raising the risk of exploitation. In early May, Cisco released software updates to address the vulnerability CVE-2025-20188…
-
Critical Roundcube Flaw Allows Remote Code Execution by Attackers
Roundcube Webmail, one of the most widely used browser-based IMAP clients, has released urgent security updates for its 1.6 and 1.5 LTS versions. The newly published versions, 1.6.11 and 1.5.10, address a critical post-authentication remote code execution (RCE) vulnerability stemming from PHP object deserialization. This flaw, reported by security researcher firs0v, could allow attackers with…
-
KI-gesteuerte Scams definieren die Cyberkriminalität neu
Der Verlust persönlicher Daten, Phishing-Berichte, gefälschte Browser-Updates und Scam-Yourself-Angriffe nehmen stetig zu. Gen, ein Unternehmen, das sich mit einer Familie von Marken wie Norton, Avast, MoneyLion und anderen für digitale Freiheit einsetzt, veröffentlichte seinen Q1/2025 Gen Threat Report [1]. Dieser beleuchtet die wichtigsten Veränderungen in der globalen Cybersicherheitslandschaft zwischen Januar und März 2025. Zu… First…
-
Keeper Security Introduces Bidirectional One-Time Sharing Feature to Its Password Manager Platform
Keeper Security has unveiled an update to its password management platform: Keeper’s upgraded One-Time Share. The new feature enables bidirectional, single-use encrypted sharing between Keeper users and non-users, providing customers with a secure way of exchanging confidential information with their customers, vendors and partners. The new bidirectional sharing feature builds upon the functionality of Keeper’s…
-
The Sequential Kill Chain for AI FireTail Blog
May 30, 2025 – Timo Rüppell – The Sequential Kill Chain for AI-Powered Attacks Excerpt: We’ve talked before about Mean Time To Attack, or MTTA, which has grown alarmingly short for new vulnerabilities across the cyber landscape. In this blog, we’ll dive into the “how” and “why” of this”¦ Summary: In our current cyber landscape,…
-
Software supply chain security tools take on toil for users
Recent updates from software supply chain security vendors simply take over vulnerability management on behalf of IT orgs, rather than provide facilitating tools. First seen on techtarget.com Jump to article: www.techtarget.com/searchitoperations/news/366625212/Software-supply-chain-security-tools-take-on-toil-for-users
-
ISMG Editors: Are We Less Secure Despite the AI Buzz?
Also: Deepfake Dangers with Veo 3; Claude Opus 4’s Manipulative Edge. In this week’s update, Information Security Media Group editors questioned whether we’re less secure today despite agentic AI and platformization, examined Veo 3’s alarming leap in deepfake realism, and dug into Anthropic’s powerful yet problematic Claude Opus 4. First seen on govinfosecurity.com Jump to…
-
Windows 11 Security Update for 22H2 23H2 May Cause Recovery Errors
A recent Windows 11 security update, KB5058405, released on May 13, 2025, has caused significant boot failures for some users running Windows 11 versions 22H2 and 23H2″, especially in enterprise and virtual environments. Affected systems display a recovery error with code 0xc0000098, specifically referencing the ACPI.sys file, a crucial kernel-mode driver responsible for power management…
-
Cybersecurity Firm SentinelOne Suffers Major Outage
After Hours-Long Disruption, XDR Vendor Promises Full Root Cause Analysis of Outage. Cybersecurity vendor SentinelOne suffered a major, global outage for about six hours on Thursday that disrupted its monitoring of managed response service customers’ endpoints and networks, interrupted software updates and kept administrators from accessing consoles for troubleshooting purposes. First seen on govinfosecurity.com Jump…
-
Critical Icinga 2 Vulnerability Allows Attackers to Obtain Valid Certificates
A critical vulnerability (CVE-2025-48057) has been discovered in Icinga 2, the widely used open-source monitoring platform. The flaw, affecting installations built with OpenSSL versions older than 1.1.0, could allow attackers to obtain valid certificates from the Icinga Certificate Authority (CA), potentially impersonating trusted nodes and compromising monitoring environments. Security updates have been released in versions…
-
CISA Urged to Enrich KEV Catalog with More Contextual Data
Security teams should use vulnerability context alongside KEV lists to prioritize patching, OX argued First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-urged-enrich-kev-catalog/