Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Apple Backports Zero ...

 Firewall Daily

Apple has released a series of critical security updates to address vulnerabilities that were actively exploited as zero-day threats. These updates include backported patches for older versions of iOS, iPadOS, macOS, and watchOS, aiming to secure devices that may still be running outdated software.   A key focus of   show more ...  

these updates is the backporting of zero-day patches to older devices, reflecting the ongoing efforts to mitigate risks across a broad range of hardware. Notable vulnerabilities include CVE-2025-24200 and CVE-2025-24201, both of which were actively exploited before patches were issued.  Backporting Zero-Day Fixes  The vulnerability CVE-2025-24200 allowed mobile forensic tools to bypass the USB Restricted Mode on locked devices, a feature designed to prevent unauthorized data access via USB ports. This flaw was addressed with the release of iOS 18.3.1, iPadOS 18.3.1, and macOS 17.7.5 on February 10, 2025, with backports provided for older versions such as iOS 16.7.11 and iPadOS 16.7.11.  Similarly, CVE-2025-24201, which affected the WebKit engine, enabled attackers to break out of the Web Content sandbox through specially crafted web content. This vulnerability was exploited in several attacks, prompting company to release fixes in iOS 18.3.2, iPadOS 18.3.2, and macOS Sequoia 15.3.2 on March 11, 2025. Older devices received updates through versions like iOS 16.7.11 and corresponding macOS releases.  Apple Addresses Other Vulnerabilities and Fixes  In addition to the zero-day flaws, Apple addressed CVE-2025-24085, a privilege escalation issue within the Core Media framework. This vulnerability was patched in the January 2025 updates for iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, and tvOS 18.3, with backports available in iPadOS 17.7.6 and macOS Sonoma 14.7.5.  The updates also cover a range of other security flaws across various system components, including Safari, CoreAudio, Maps, Calendar, and more. These patches aim to enhance the overall security posture of company’s ecosystem, addressing risks that could lead to data breaches, system crashes, or unauthorized access.  Security Content of Latest Updates  The latest update, watchOS 11.4, released on April 1, 2025, targets vulnerabilities affecting the Apple Watch Series 6 and later. Key fixes include CVE-2025-24097, which addresses a permissions issue with AirDrop, and CVE-2025-24244, a flaw in font processing that could lead to memory disclosure.  Authentication services have also been fortified, with patches for issues like CVE-2025-30430, which could allow attackers to bypass password autofill restrictions, and CVE-2025-24180, which affected WebAuthn credentials across websites with similar suffixes. Other security enhancements cover audio-related vulnerabilities, such as CVE-2025-24243, which addressed a flaw in processing malicious font files capable of triggering arbitrary code execution.  Conclusion  The release of these security updates highlights the critical role of timely patching in addressing vulnerabilities, particularly zero-day threats like CVE-2025-24200 and CVE-2025-24201. By backporting fixes to older devices, company aims to provide broader protection, though the effectiveness of such measures relies heavily on user promptness in applying updates.  

image for Thailand Enhances Cy ...

 Cyber News

In an effort to enhance Thailand’s cybersecurity infrastructure, the National Cyber Security Agency (NCSA) and Google Cloud have announced a strategic collaboration to improve cyber resilience. The initiative, launched during Safer Songkran, aligns with ongoing efforts to protect citizens and government entities   show more ...  

from escalating cyber threats. This alliance builds on the Thai government’s existing collaboration with Google to enhance online security. As part of this partnership, NCSA and Google Cloud will engage in threat intelligence sharing and develop incident response capabilities to counter evolving cyber threats. This collaboration is particularly crucial as digital transformation in Thailand accelerates, making strong cybersecurity measures a necessity. One key achievement highlighted was Google Play Protect’s anti-scam feature, launched in partnership with the Ministry of Digital Economy and Society (MDES) in 2024, which has successfully blocked over 6.6 million high-risk app installations. To further enhance mobile security, new protections have been introduced to mitigate social engineering attacks that target Thai users. Thailand Government's Commitment to Cyber Resilience Thailand’s Deputy Prime Minister and Minister of Digital Economy and Society, Prasert Jantararuangtong, emphasized the urgency of strengthening cybersecurity to stop online scams. He acknowledged Google’s commitment to this cause, stating: “Strengthening cybersecurity and combating online scams are paramount and urgent priorities for the government, especially as organizations and individuals increasingly embrace digital innovation. We commend Google for its proactive and continuous efforts in collaborating with us to safeguard citizens online through its cyber literacy programs and implementation of enhanced anti-scam features in Google Play Protect on Android devices.” Secretary General of NCSA, Amorn Chomchoey, reiterated the importance of combining skilled talent with advanced technology. He highlighted how Google Cloud Cybershield and Mandiant’s expertise will serve as critical tools in strengthening Thailand’s cyber defenses. A Coordinated National Cyber Defense Strategy NCSA will deploy Google Cloud Cybershield, an AI-powered security platform that integrates automation, analytics, and threat intelligence. This initiative will enhance centralized monitoring of security threats across public sector entities. Through ThaiCERT, Thailand’s national cyber defense center, a more streamlined and coordinated response to cyber threats targeting government agencies and critical infrastructure will be established. Key components of the collaboration include: Threat Intelligence Sharing: Google Cloud will provide NCSA access to Google Threat Intelligence, Mandiant’s threat insights, and VirusTotal’s database. This will help the government understand and counter cybercriminal tactics and state-sponsored attacks. Incident Response Training: Mandiant consultants will train information security professionals in incident response, digital forensics, and malware analysis. These initiatives will expand Thailand’s pool of cybersecurity experts within the public sector. Protecting Thai Citizens from Cyber Threats Beyond national security, the partnership also aims to enhance individual user protection. NCSA and Google Cloud will integrate Google Cloud Web Risk into government cybersecurity frameworks to defend against online scams and phishing attempts. Web Risk APIs will provide real-time intelligence on malicious websites, allowing NCSA to proactively block access to dangerous URLs. This capability mirrors the functionality of Google Safe Browsing, which analyzes over 10 billion URLs daily and protects more than five billion devices worldwide. Google Cloud’s Thailand Country Director, Annop Siritikul, highlighted the economic importance of cybersecurity: “Thailand’s digital economy is set to grow from US$46 billion in 2024 to at least US$100 billion by 2030. At Google Cloud, we believe we can contribute meaningfully toward the collective cyber defense that’s required to safeguard this future growth.” Enhanced Mobile Security Against Scams Thailand was among the first countries to implement Google Play Protect’s anti-scam feature in 2024. The feature has since prevented over 6.6 million high-risk app installations on more than 1.4 million Android devices in the country. In 2025, Google introduced additional security measures to counter cybercriminals who use social engineering tactics over phone calls. Now, the toggle switch to disable Play Protect’s app scanning feature is locked during phone calls, preventing scammers from deceiving users into disabling security protections. Digital Future for Thailand The Safer Songkran initiative, launched under the Safer with Google program, continues to empower Thai citizens with essential cybersecurity tools and knowledge. The collaboration between NCSA and Google Cloud is a significant step toward building a more secure digital ecosystem for Thailand, ensuring that individuals and organizations can safely benefit from digital transformation. By adopting AI-driven security technologies, advanced threat intelligence, and public-private collaboration, Thailand is strengthening its position as a leader in cybersecurity in the Asia-Pacific region.

image for DragonForce Claims t ...

 Cyber News

The DragonForce ransomware group claims to be taking over the infrastructure of RansomHub, the largest ransomware group in the last year, Cyble threat intelligence researchers reported in an advisory to clients today. Cyble said the moniker behind the operators of DragonForce announced a new “project” on the RAMP   show more ...  

forum and subsequently posted the same information on their onion-based data leak site (DLS). DragonForce said the group is launching fresh infrastructure – with two new onion links secured by CAPTCHA, similar to DragonForce's native tor site approach – but displaying the logo of the RansomHub ransomware group. While it’s unclear if DragonForce acquired RansomHub or simply compromised it, the official RansomHub onion site has been offline since March 31, fueling speculation of a possible takeover, Cyble said. DragonForce and RansomHub: New Relationship Unclear DragonForce’s post on RAMP read: “Hi. Don’t worry RansomHub will be up soon, they just decided to move to our infrastructure! We are Reliable partners. “A good example of how “projects” work, a new option from the DragonForce Ransomware Cartel!” A postscript read (image below): “RansomHub hope you are doing well, consider our offer! We are waiting for everyone in our ranks” DragonForce made a similar claim on the group’s Tor-based Data Leak Site (DLS) - and previewed a new onion site bearing the RansomHub logo (image below). [caption id="attachment_101814" align="aligncenter" width="927"] Preview of new onion site posted by DragonForce on RAMP forum and bearing the RansomHub Logo[/caption] DragonForce Ransomware Emerges As a Significant Player While it is unclear what the nature of the new arrangement is between the two groups, the announcement follows a March 18 announcement by DragonForce of a major expansion of its ransomware-as-a-service (RaaS) operation, Cyble said. The group introduced a franchise-like model allowing affiliates to launch their own ransomware brands under the DragonForce Ransomware Cartel. Affiliates receive full backend support, including admin/client panels, data hosting, and 24/7 infrastructure with anti-DDoS protection, providing autonomy while maintaining centralized control. DragonForce also rolled out technical upgrades across its ransomware lockers for ESXi, NAS, BSD, and Windows systems. Enhancements include encryption status tracking, detached execution, persistent UI messaging, and improved recovery mechanisms. The encryption engine was further hardened with two-pass header protection and BearSSL AES-CTR implementation using external entropy sources, “signaling DragonForce's ambition to scale its operations with a more professionalized and affiliate-friendly infrastructure,” Cyble said. RansomHub Future Uncertain While it’s not clear what happened between the two ransomware groups, RansomHub put together an impressive run, besting all competitors since February 2024 (image below). [caption id="attachment_101810" align="aligncenter" width="1200"] Most victims claimed by ransomware groups Feb. 2024-March 2025[/caption] RansomHub’s staying power at the top has been driven by multiple factors, in Cyble’s analysis, including perceptions of greater transparency than predecessor groups, predictable payouts, and well-packaged attack playbooks for affiliates. It remains to be seen what form RansomHub and DragonForce will take on next. We will continue to follow this breaking story and update it as new information becomes available.

image for Polyglot technique f ...

 Business

Not long ago, our Securelist blog published a post (Russian language only) about an attack on industrial enterprises using the PhantomPyramid backdoor, which our experts with a high degree of confidence attribute to the Head Mare group. The attack was fairly standard — an email claiming to contain confidential   show more ...  

information, with an attached password-protected archive containing malware, and a password for unpacking located right in the emails body. But the method by which the attackers hid their malicious code — in a seemingly harmless file — is quite interesting: to do it they used the polyglot technique. What is the polyglot technique? In the Mitre ATT&CK matrix, polyglot files are described as files that correspond to several file types of at once, and that operate differently depending on the application in which theyre launched. Theyre used to disguise malware: for the user, as well as for some basic protection mechanisms, they look like something completely harmless, for example a picture or a document, but in fact theres malicious code inside. Moreover, the code can be written in several programming languages at once. Attackers use a variety of format combinations. Unit42 once investigated an attack using a help file in the Microsoft Compiled HTML Help format (.chm extension), which also was an HTML application (.hta file). Researchers also describe the use of a .jpeg image inside which, in fact, was a .phar PHP archive. In the case of the attack investigated by our experts, executable code was hidden inside a .zip archive file. Polyglot file in the PhantomPyramid case The file sent by attackers (presumably the Head Mare group) had a .zip extension and could be opened with a standard archiver application. But in fact it was a binary executable file, to the end of which a small ZIP archive was added. Inside the archive was a shortcut file with a double extension .pdf.lnk. If the victim, confident that they were dealing with a regular PDF file, clicked on it, the shortcut executed a powershell script, which allowed the malicious .zip file to be launched as an executable file, and also created a decoy PDF file in the temporary directory to show it to the user. How to stay safe To prevent the launch of malicious code, we recommend equipping all computers having internet access with reliable security solutions. In addition, since most cyberattacks are started with malicious or social engineering emails, its not a bad idea to install a security solution at the corporate mail gateway level. And in order to have the most up-to-date data on the techniques, tactics, and procedures of attackers, we suggest using the threat data provided by our Threat Intelligence services.

 Feed

Cybersecurity researchers have discovered an updated version of a malware loader called Hijack Loader that implements new features to evade detection and establish persistence on compromised systems. "Hijack Loader released a new module that implements call stack spoofing to hide the origin of function calls (e.g., API and system calls)," Zscaler ThreatLabz researcher Muhammed Irfan V A said in

 Feed

The financially motivated threat actor known as FIN7 has been linked to a Python-based backdoor called Anubis (not to be confused with an Android banking trojan of the same name) that can grant them remote access to compromised Windows systems. "This malware allows attackers to execute remote shell commands and other system operations, giving them full control over an infected machine," Swiss

 Feed

Introduction As the cybersecurity landscape evolves, service providers play an increasingly vital role in safeguarding sensitive data and maintaining compliance with industry regulations. The National Institute of Standards and Technology (NIST) offers a comprehensive set of frameworks that provide a clear path to achieving robust cybersecurity practices. For service providers, adhering to NIST

 Feed

Cybersecurity researchers have shed light on an "auto-propagating" cryptocurrency mining botnet called Outlaw (aka Dota) that's known for targeting SSH servers with weak credentials. "Outlaw is a Linux malware that relies on SSH brute-force attacks, cryptocurrency mining, and worm-like propagation to infect and maintain control over systems," Elastic Security Labs said in a new analysis

 Feed

When assessing an organization’s external attack surface, encryption-related issues (especially SSL misconfigurations) receive special attention. Why? Their widespread use, configuration complexity, and visibility to attackers as well as users make them more likely to be exploited.  This highlights how important your SSL configurations are in maintaining your web application security and

 Feed

Cybersecurity researchers have disclosed details of a now-patched privilege escalation vulnerability in Google Cloud Platform (GCP) Cloud Run that could have allowed a malicious actor to access container images and even inject malicious code. "The vulnerability could have allowed such an identity to abuse its Google Cloud Run revision edit permissions in order to pull private Google Artifact

 1 - Cyber Security News Post

Source: hackread.com – Author: Owais Sultan. Data protection is of the highest importance in 2025. With growing numbers of organizations handling sensitive customer data and stricter data protection regulations emerging around the world, organizations need strong tools for information protection. That’s where   show more ...  

data anonymization enters the picture; it covers up or replaces personal data, and […] La entrada Best Data Anonymization Tools in 2025 – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Waqas. The state of Texas is now at the center of a legal firestorm after a class action lawsuit was filed against Oracle Corporation over a massive cloud data breach. The complaint, lodged on March 31, 2025, in the U.S. District Court for the Western District of Texas, accuses   show more ...  

Oracle of […] La entrada Oracle Hit with Lawsuit Over Alleged Cloud Breach Affecting Millions – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Waqas. Ontinue’s Cyber Defense Centre (CDC) recently investigated an incident that shows how a simple vishing call can turn into a full environment compromise. The attack combined social engineering with legitimate tools like Quick Assist, signed binaries, and malicious scripts   show more ...  

to gain access, maintain persistence, and avoid detection. A Teams Message […] La entrada Microsoft Teams Vishing Used to Deploy Malware via TeamViewer – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Owais Sultan. The cryptocurrency world feels like a wild ride full of risks, twists, and big dreams of building wealth. In its early days, it was only a far-out idea that some tech enthusiasts shared, but for a while, it has been in the spotlight, shaking how people perceive   show more ...  

security, value, […] La entrada Cryptocurrency in 2025: Exploring Bitcoin Growth, AI, and the Next Wave of Tools – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Cybersecurity researchers have discovered an updated version of a malware loader called Hijack Loader that implements new features to evade detection and establish persistence on compromised systems. “Hijack Loader released a new module that implements call stack   show more ...  

spoofing to hide the origin of function calls (e.g., API and system calls),” […] La entrada New Malware Loaders Use Call Stack Spoofing, GitHub C2, and .NET Reactor for Stealth – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Artificial Intelligence

Source: www.securityweek.com – Author: Ryan Naraine Researchers in Microsoft’s threat intelligence team say they are using AI technologies to uncover security vulnerabilities in popular open-source bootloaders, including GRUB2, U-boot, and Barebox.  Using its Security Copilot tool, the Microsoft team   show more ...  

pinpointed at least 20 critical vulnerabilities in open-source bootloaders (including GRUB2, U-boot, and Barebox) in UEFI […] La entrada Microsoft Using AI to Uncover Critical Bootloader Vulnerabilities – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 backdoor

Source: www.securityweek.com – Author: Ryan Naraine Security researchers this week raised an alarm after finding hidden remote access tunnel service pre-installed on the Unitree Go1 robot dog, warning that the backdoor activates once the device detects internet connectivity. According to documentation published   show more ...  

by researchers Andreas Makris and Kevin Finisterre, the quadruped robot developed by the […] La entrada Hackers Could Unleash Chaos Through Backdoor in China-Made Robot Dogs – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Ionut Arghire Threat actors are probing the internet for vulnerable Palo Alto Networks GlobalProtect secure remote access instances, likely in preparation for targeted exploitation, threat intelligence firm GreyNoise warns. Over the past month, more than 24,000 unique IP   show more ...  

addresses have been observed attempting to access GlobalProtect portals, indicating a coordinated effort […] La entrada Hackers Looking for Vulnerable Palo Alto Networks GlobalProtect Portals – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Eduard Kovacs Security operations solutions provider ReliaQuest on Monday announced raising $500 million in a new growth funding round that brings the total raised by the company to more than $830 million. The latest investment was led by EQT, KKR and FTV Capital, with   show more ...  

participation from Ten Eleven Ventures and Finback […] La entrada Security Operations Firm ReliaQuest Raises $500M at $3.4B Valuation – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Ionut Arghire The InterLock ransomware group over the weekend claimed responsibility for a disruptive cyberattack on National Presto Industries that occurred on March 1. The home appliance and ammunition company disclosed the incident in early March, in a regulatory filing   show more ...  

with the SEC, saying that it was working on restoring systems, […] La entrada Ransomware Group Takes Credit for National Presto Industries Attack – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Canon

Source: www.securityweek.com – Author: Eduard Kovacs Microsoft’s offensive security team has warned Canon about a critical vulnerability affecting some printer drivers.  According to an advisory published last week by Canon, drivers associated with several production printers, office multifunction printers,   show more ...  

and laser printers are affected by an out-of-bounds vulnerability.  The security hole is tracked as CVE-2025-1268 […] La entrada Critical Vulnerability Found in Canon Printer Drivers – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CrushFTP

Source: www.securityweek.com – Author: Eduard Kovacs The Shadowserver Foundation on Monday said it started seeing exploitation attempts aimed at a recently patched CrushFTP vulnerability. The developers of the CrushFTP enterprise file transfer solution informed customers on March 21 that versions 10 and 11 are   show more ...  

affected by a vulnerability that can allow a remote, unauthenticated attacker […] La entrada CrushFTP Blames Security Firms for Fast Exploitation of Vulnerability – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Check Point

Source: www.securityweek.com – Author: Ionut Arghire Israeli cybersecurity firm Check Point has issued a response after a hacker claimed to have stolen valuable information from the company’s systems. Over the weekend, a threat actor using the name CoreInjection announced in a BreachForums post that they were   show more ...  

selling data allegedly stolen from Check Point for 5 […] La entrada Check Point Responds to Hacking Claims – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Owais Sultan. In the competitive world where artificial intelligence (AI) has made it easy to use technology, companies are constantly looking for ways to connect with their audience without stretching resources. One proven method is outsourcing, which allows businesses to focus   show more ...  

on core operations while leveraging expert outreach strategies. However, as […] La entrada Enhancing Customer Engagement with Outsourced Telemarketing  – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Connor Jones Specialist class action lawyers have launched proceedings against Oracle in Texas over two alleged data breaches. Floridian Michael Toikach is named as the only plaintiff in law firm Shamis & Gentile’s class action against the cloud giant, although   show more ...  

the case is representing others who are similarly affected. Lawyers demanded […] La entrada Oracle faces Texas-sized lawsuit over alleged cloud snafu and radio silence – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Bletchley

Source: go.theregister.com – Author: Iain Thomson Obit Betty Webb MBE, one of the team who worked at the code-breaking Bletchley Park facility during the Second World War, has died at the age of 101. In a 2018 interview Webb said she was very proud of her work, but horrified when she saw far-right protesters   show more ...  

giving […] La entrada One of the last of Bletchley Park’s quiet heroes, Betty Webb, dies at 101 – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Apple

Source: go.theregister.com – Author: Iain Thomson Apple has delivered a big batch of OS updates, some of which belatedly patch older versions of its operating systems to address exploited-in-the-wild flaws the iGiant earlier fixed in more recent releases. The most significant fix addresses CVE-2025-24200, a   show more ...  

hole in USB Restricted Mode – the security feature introduced […] La entrada Apple belatedly patches actively exploited bugs in older OSes – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Simon Sharwood North Korea’s scamming, thieving, and AI-abusing fake IT workers are increasingly targeting European employers. The hermit kingdom (DPRK) runs a corps of operatives who apply for remote tech jobs and, if they get them, funnel their salaries to Kim Jong   show more ...  

Un’s coffers. Some also run malware on company computers, […] La entrada North Korea’s fake tech workers now targeting European employers – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Iain Thomson Senior members of the US National Security Council, including the White House national security adviser Michael Waltz, have been accused of using their personal Gmail accounts to exchange sensitive information. A senior aide to Waltz used a Gmail account to   show more ...  

consult with government officials and exchange details on “sensitive […] La entrada Forget Signal. National Security Adviser Waltz now accused of using Gmail for work – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Richard Speed Microsoft will officially hit the half-century mark on Friday as the Windows giant turns 50 years old. What do you consider the highs and lows of the company’s journey to dominance? In addition to its successes, the House of Bill has also encountered   show more ...  

numerous gaffes and missteps along the […] La entrada Microsoft to mark five decades of Ctrl-Alt-Deleting the competition – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini Hackers are scanning for vulnerabilities in Palo Alto Networks GlobalProtect portals, likely preparing for targeted attacks. Researchers at the threat intelligence firm GreyNoise warn of hackers that are scanning for vulnerabilities in Palo Alto Networks   show more ...  

GlobalProtect portals, likely preparing for targeted attacks, warns threat intelligence firm GreyNoise. GreyNoise reports […] La entrada Spike in Palo Alto Networks scanner activity suggests imminent cyber threats – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini Microsoft’s offensive security team discovered a critical code execution vulnerability impacting Canon printer drivers.  Researchers at Microsoft’s Offensive Research and Security Engineering (MORSE) team have discovered a critical code execution   show more ...  

vulnerability, tracked as CVE-2025-1268 (CVSS score of 9.4), impacting Canon printer drivers.  The vulnerability is an out-of-bounds issue that […] La entrada Microsoft warns of critical flaw in Canon printer drivers – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini Attackers exploit CrushFTP CVE-2025-2825 flaw, enabling unauthenticated access to unpatched devices using public proof-of-concept code. Threat actors are exploiting a critical authentication bypass vulnerability, tracked as CVE-2025-2825, in the CrushFTP   show more ...  

file transfer software. Attackers are using exploits based on publicly available proof-of-concept exploit code. The vulnerability impacts CrushFTP versions […] La entrada CrushFTP CVE-2025-2825 flaw actively exploited in the wild – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Mike McNerney Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution.   show more ...  

There are several actions that could trigger this […] La entrada How an Interdiction Mindset Can Help Win War on Cyberattacks – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Elizabeth Montalbano, Contributing Writer Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed   show more ...  

triggered the security solution. There are several actions that could […] La entrada Gootloader Malware Resurfaces in Google Ads for Legal Docs – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: George V. Hulme, Contributing Writer Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered   show more ...  

the security solution. There are several actions that […] La entrada Visibility, Monitoring Key to Enterprise Endpoint Strategy – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Cybersecurity researchers have disclosed details of a now-patched privilege escalation vulnerability in Google Cloud Platform (GCP) Cloud Run that could have allowed a malicious actor to access container images and even inject malicious code. “The vulnerability could   show more ...  

have allowed such an identity to abuse its Google Cloud Run revision edit […] La entrada Google Fixed Cloud Run Vulnerability Allowing Unauthorized Image Access via IAM Misuse – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Introduction As the cybersecurity landscape evolves, service providers play an increasingly vital role in safeguarding sensitive data and maintaining compliance with industry regulations. The National Institute of Standards and Technology (NIST) offers a comprehensive set   show more ...  

of frameworks that provide a clear path to achieving robust cybersecurity practices. For service providers, […] La entrada Helping Your Clients Achieve NIST Compliance: A Step by Step Guide for Service Providers – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Cybersecurity researchers have shed light on an “auto-propagating” cryptocurrency mining botnet called Outlaw (aka Dota) that’s known for targeting SSH servers with weak credentials. “Outlaw is a Linux malware that relies on SSH brute-force attacks,   show more ...  

cryptocurrency mining, and worm-like propagation to infect and maintain control over systems,” Elastic Security Labs […] La entrada Outlaw Group Uses SSH Brute-Force to Deploy Cryptojacking Malware on Linux Servers – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . When assessing an organization’s external attack surface, encryption-related issues (especially SSL misconfigurations) receive special attention. Why? Their widespread use, configuration complexity, and visibility to attackers as well as users make them more likely to be   show more ...  

exploited.  This highlights how important your SSL configurations are in maintaining your web application security […] La entrada How SSL Misconfigurations Impact Your Attack Surface – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . The financially motivated threat actor known as FIN7 has been linked to a Python-based backdoor called Anubis (not to be confused with an Android banking trojan of the same name) that can grant them remote access to compromised Windows systems. “This malware allows   show more ...  

attackers to execute remote shell commands and […] La entrada FIN7 Deploys Anubis Backdoor to Hijack Windows Systems via Compromised SharePoint Sites – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: More than ever, cybercriminal networks are now operating like legitimate businesses. In response, organizations must adopt a threat-informed defense approach that shifts the focus from reactive responses to proactive, intelligence-driven security operations. As the threat   show more ...  

landscape continues to evolve, critical infrastructure sectors face a growing wave of sophisticated cyber threats. Traditional […] La entrada Threat-informed defense for operational technology: Moving from information to action – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Ein Cyberkrimineller bietet mehrere Tausend Datensätze im Darknet an, die von Samsung Deutschland stammen sollen. Samsung Deutschland ist von einem Datenleck betroffen. Samsung Deutschland Bei Samsung Deutschland hat es offenbar ein massives Datenleck gegeben. Etwa 270.000   show more ...  

Kundendatensätze von Samsung Electronics Deutschland werden derzeit in einem Darknet-Forum angeboten. Ein krimineller Hacker mit […] La entrada Hacker stiehlt Kundendaten von Samsung Deutschland – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-04
Aggregator history
Wednesday, April 02
TUE
WED
THU
FRI
SAT
SUN
MON
AprilMayJune