Tag: zero-day
-
Beyond the Inbox: ThreatLabz 2025 Phishing Report Reveals How Phishing Is Evolving in the Age of GenAI
Tags: access, ai, attack, authentication, best-practice, captcha, cloud, control, credentials, crypto, cyber, cybercrime, data, defense, detection, dmarc, email, exploit, finance, google, identity, jobs, login, malicious, malware, mfa, phishing, radius, risk, scam, spam, strategy, tactics, technology, theft, threat, tool, vulnerability, zero-day, zero-trustGone are the days of mass phishing campaigns. Today’s attackers are leveraging generative AI (GenAI) to deliver hyper-targeted scams, transforming every email, text, or call into a calculated act of manipulation. With flawless lures and tactics designed to outsmart AI defenses, cybercriminals are zeroing in on HR, payroll, and finance teams”, exploiting human vulnerabilities with…
-
Hackers Exploit Ivanti Connect Secure 0-Day to Deploy DslogdRAT and Web Shell
Threat actors exploited a zero-day vulnerability in Ivanti Connect Secure, identified as CVE-2025-0282, to deploy malicious tools including a web shell and a sophisticated remote access trojan (RAT) named DslogdRAT. According to a detailed analysis by JPCERT/CC, these attacks underscore the persistent and evolving risks surrounding Ivanti products, which have become a frequent target for…
-
Lazarus Hits 6 South Korean Firms via Cross EX, Innorix Zero-Day and ThreatNeedle Malware
At least six organizations in South Korea have been targeted by the prolific North Korea-linked Lazarus Group as part of a campaign dubbed Operation SyncHole.The activity targeted South Korea’s software, IT, financial, semiconductor manufacturing, and telecommunications industries, according to a report from Kaspersky published today. The earliest evidence of compromise was first detected in First…
-
Google Warns: Threat Actors Growing More Sophisticated, Exploiting Zero-Day Vulnerabilities
Google’s Mandiant team has released its M-Trends 2025 report, highlighting the increasing sophistication of threat actors, particularly China-nexus groups. These adversaries are deploying custom malware ecosystems, exploiting zero-day vulnerabilities in security appliances, and utilizing proxy networks resembling botnets to evade detection. Their tactics also include targeting edge devices lacking endpoint detection and response (EDR) capabilities…
-
Apple Zero-Days Under ‘Sophisticated Attack,’ but Details Lacking
The technology giant said two zero-day vulnerabilities were used in attacks on iOS devices against specific targeted individuals, which suggests spyware or nation-state threat activity. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/apple-zero-days-sophisticated-attacks
-
Bubble.io 0-Day Flaw Lets Attackers Run Arbitrary Queries on Elasticsearch
A vulnerability in Bubble.io, a leading no-code development platform, has exposed thousands of applications to data breaches. The flaw allows attackers to bypass security controls and execute arbitrary queries on Elasticsearch databases, potentially compromising sensitive user information. Security researchers reverse-engineered Bubble.io’s JavaScript code and HTTP headers to uncover flaws in how the platform encrypts and…
-
CISA Issues Alert on Actively Exploited Apple 0-Day Vulnerabilities
Tags: apple, cisa, cyber, cybersecurity, exploit, flaw, infrastructure, macOS, ransomware, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority warning regarding two critical zero-day vulnerabilities impacting a wide range of Apple devices. The flaws, which impact the latest versions of iOS, iPadOS, macOS, and other Apple products, are believed to be actively exploited in the wild, though connections to ransomware campaigns remain unconfirmed.…
-
Actively exploited Apple zero-days patched
First seen on scworld.com Jump to article: www.scworld.com/brief/actively-exploited-apple-zero-days-patched
-
Your Network Is Showing Time to Go Stealth
Tags: access, ai, attack, authentication, backdoor, breach, china, cisco, cloud, computer, control, credentials, cyberattack, cybersecurity, data, data-breach, defense, detection, encryption, endpoint, exploit, firewall, firmware, fortinet, group, Hardware, infrastructure, mfa, network, software, theft, threat, tool, update, vpn, vulnerability, zero-day -
Apple Patches Two Zero-Days Used in ‘Extremely Sophisticated’ Attacks
Find out the specifics of these iOS and macOS vulnerabilities, as well as which Apple devices were impacted. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-apple-patches-zero-days-ios-macos/
-
Hackers target Apple users in an ‘extremely sophisticated attack’
Flaws patched across the board: According to the NVD description, Apple issued a fix for all impacted operating systems. Patched Apple OS rollouts include tvOS 18.4.1, visionOS 2.4.1, iOS 18.4.1, iPadOS 18.4.1, and macOS Sequoia 15.4.1.Specific iPhones and iPads that shall be receiving the patch include iPhone XS and later, iPad Pro 13-inch, iPad Pro…
-
Apple plugs zero-day holes used in targeted iPhone attacks (CVE-2025-31200, CVE-2025-31201)
Apple has released emergency security updates for iOS/iPadOS, macOS, tvOS and visionOS that fix two zero-day vulnerabilities (CVE-2025-31200, CVE-2025-31201) that have been … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/04/17/apple-plugs-zero-days-holes-used-in-targeted-iphone-attacks-cve-2025-31200-cve-2025-31201/
-
Apple plugs zero-days holes used in targeted iPhone attacks (CVE-2025-31200, CVE-2025-31201)
Apple has released emergency security updates for iOS/iPadOS, macOS, tvOS and visionOS that fix two zero-day vulnerabilities (CVE-2025-31200, CVE-2025-31201) that have been … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/04/17/apple-plugs-zero-days-holes-used-in-targeted-iphone-attacks-cve-2025-31200-cve-2025-31201/
-
CVE-2025-31200: Apple Patches Two Actively Exploited Zero-Days
Apple has rolled out critical security updates across its ecosystem, including iOS, iPadOS, macOS Sequoia, tvOS, and visionOS, to address two newly discovered zero-day vulnerabilities that are currently being exploited in real-world attacks. Two Actively Exploited Zero-Day Flaws Patched The… First seen on sensorstechforum.com Jump to article: sensorstechforum.com/cve-2025-31200-zero-days-apple/
-
Multiple orgs subjected to attacks involving Gladinet zero-day
First seen on scworld.com Jump to article: www.scworld.com/brief/multiple-orgs-subjected-to-attacks-involving-gladinet-zero-day
-
Zero-Day in CentreStack Raises Concerns for MSPs and Enterprises
First seen on scworld.com Jump to article: www.scworld.com/brief/zero-day-in-centrestack-raises-concerns-for-msps-and-enterprises
-
Apple says zero-day bugs exploited against ‘specific targeted individuals’ using iOS
One of the bugs was discovered by Google’s security researchers who investigate government-backed cyberattacks. First seen on techcrunch.com Jump to article: techcrunch.com/2025/04/16/apple-says-zero-day-bugs-exploited-against-specific-targeted-individuals-using-ios/
-
Apple fixes two zero-days exploited in targeted iPhone attacks
Apple released emergency security updates to patch two zero-day vulnerabilities that were used in an “extremely sophisticated attack” against specific targets’ iPhones. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/apple-fixes-two-zero-days-exploited-in-targeted-iphone-attacks/
-
Hertz Data Breach Exposes Customer Information in Cleo Zero-Day Attack
Hertz has confirmed a data breach exposing customer data after a zero-day attack targeting file transfer software from Cleo Communications First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/hertz-data-breach-exposes-customer/
-
Ein Appell an die Sicherheits-Community Umgang mit der CrushFTP-Sicherheitslücke
Ob Zero-Day-Exploits oder Fehlkonfigurationen Sicherheitslücken sind längst eine alltägliche Herausforderung. Entscheidend ist nicht nur, dass sie entdeckt werden, sondern wie mit den Erkenntnissen umgegangen wird. Zwischen koordinierter Offenlegung und der Gefahr von Angriffswellen auf ungeschützte Systeme ist eine Debatte entbrannt, die längst nicht mehr nur Fachkreise betrifft. Der jüngste Fall einer Schwachstelle in der… First…
-
Hertz Falls Victim to Cleo Zero-Day Attacks
Customer data such as birth dates, credit card numbers and driver’s license information were stolen when threat actors exploited zero-day vulnerabilities in Cleo-managed file transfer products. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/hertz-falls-victim-cleo-zero-day-attacks
-
Attackers exploit zero-day flaw in Gladinet CentreStack file-sharing platform
Critical vulnerability affects both CentreStack and Gladinet’s on-premises file-sharing server, Triofox. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/attackers-exploit-zero-day-gladinet-centrestack-file-sharing/745407/
-
Hertz data breach: Customers in US, EU, UK, Australia and Canada affected
American car rental company Hertz has suffered a data breach linked to last year’s exploitation of Cleo zero-day vulnerabilities by a ransomware gang. The breach … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/04/15/hertz-data-breach-customers-in-us-eu-uk-australia-and-canada-affected/
-
Schattenseiten unkoordinierter Veröffentlichung von Schwachstellen
Ob Zero-Day-Exploits oder Fehlkonfigurationen Sicherheitslücken sind längst eine alltägliche Herausforderung. Entscheidend ist nicht nur, dass sie entdeckt werden, sondern wie mit den Erkenntnissen umgegangen wird. Zwischen koordinierter Offenlegung und der Gefahr von Angriffswellen auf ungeschützte Systeme ist eine Debatte entbrannt, die längst nicht mehr nur Fachkreise betrifft. Der jüngste Fall einer Schwachstelle in der […]…
-
CentreStack 0-Day Exploit Enables Remote Code Execution on Web Servers
A critical 0-day vulnerability has been disclosed in CentreStack, a popular enterprise cloud storage and collaboration platform, which could allow attackers to execute arbitrary code remotely on affected web servers. The vulnerability, tracked as CVE-2025-30406, leverages a flaw in the application’s handling of cryptographic keys responsible for securing sensitive ViewState data. Flaw in MachineKey Management…
-
Hertz disclosed a data breach following 2024 Cleo zero-day attack
Hertz Corporation disclosed a data breach after customer data was stolen via Cleo zero-day exploits in late 2024, affecting Hertz, Thrifty, and Dollar brands. Car rental giant Hertz Corporation disclosed a data breach that impacted its Hertz, Thrifty, and Dollar brands. Threat actors gained access to customer data via Cleo zero-day exploits in late 2024.…
-
Wie ein IT Security Assessment den Mittelstand schützen kann
Kleinere und mittlere Unternehmen geraten zunehmend ins Visier von Cyberangriffen mit täglich bis zu 500.000 neuen Schadvarianten und 18 Zero-Day-Angriffen. Ein Cybersecurity Assessment deckt Schwachstellen auf und zeigt, wie Sie sich schützen können. Doch was muss ein gutes Assessment wirklich leisten? First seen on itsicherheit-online.com Jump to article: www.itsicherheit-online.com/news/cybersecurity/wie-ein-it-security-assessment-den-mittelstand-schuetzen-kann/
-
Hertz confirms customer info, drivers’ licenses stolen in data breach
Car rental giant Hertz Corporation warns it suffered a data breach after customer data for its Hertz, Thrifty, and Dollar brands was stolen in the Cleo zero-day data theft attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hertz-confirms-customer-info-drivers-licenses-stolen-in-data-breach/
-
Hertz confirms customer info and drivers’ licenses stolen in data breach
Car rental giant Hertz Corporation warns it suffered a data breach after customer data for its Hertz, Thrifty, and Dollar brands was stolen in the Cleo zero-day data theft attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hertz-confirms-customer-info-and-drivers-licenses-stolen-in-data-breach/