Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Ukrainian Extradited ...

 Firewall Daily

Artem Stryzhak, a Ukrainian national, has been extradited from Spain to the United States to face charges related to a global ransomware operation that used the notorious Nefilim ransomware strain. The 2025 extradition is an important step in a years-long investigation into a cyber-extortion campaign that targeted   show more ...  

multinational corporations and caused millions of dollars in losses.  On April 30, Stryzhak was brought to the U.S. after his arrest in Spain in June 2024. Federal prosecutors in Brooklyn unsealed a superseding indictment earlier today, charging him with conspiracy to commit fraud and related computer crimes, including extortion. His arraignment is scheduled before U.S. Magistrate Judge Robert Levy in the Eastern District of New York.  International Operation Targets Cybercrime Using Nefilim Ransomware Strain  According to U.S. Attorney John Durham, “As alleged, the defendant was part of an international ransomware scheme in which he conspired to target high-revenue companies in the United States, steal data, and hold data hostage in exchange for payment. If victims did not pay, the criminals then leaked the data online.” Durham emphasized the importance of the extradition, stating it demonstrated that cybercriminals operating from overseas are not beyond the reach of American law.  The FBI also stressed the importance of international cooperation in bringing cybercriminals to justice. “The successful extradition of the defendant is a significant achievement in that ongoing collaboration, and it sends a clear message: those who attempt to hide behind international borders to target American citizens will face justice,” said Christopher J.S. Johnson, Special Agent in Charge of the FBI's Springfield, Illinois Field Office.  The Nefilim ransomware strain, at the center of this case, was used to compromise and encrypt the computer networks of businesses across the globe. According to court documents, these ransomware attacks resulted in substantial financial damage, stemming not only from ransom payments but also from extensive disruptions to the victims’ IT systems.  Customized Attacks on High-Revenue Companies  Stryzhak allegedly joined the Nefilim ransomware operation in June 2021, after receiving access to the ransomware's core code in exchange for 20% of his ransom earnings. Operating under a personal account on the Nefilim platform—referred to as the “panel”—Stryzhak even questioned whether he should use a different alias to avoid detection by the FBI if the panel were ever compromised.  The Nefilim ransomware group primarily focused on companies based in the U.S., Canada, and Australia, typically those with over $100 million in annual revenue. In one 2021 exchange, a Nefilim administrator encouraged Stryzhak to focus on firms with revenues exceeding $200 million. Before launching an attack, the conspirators conducted detailed reconnaissance, using online tools to assess potential targets' financial standing and infrastructure. Once inside a victim’s network, Stryzhak and his co-conspirators exfiltrated sensitive data. Victims were then presented with ransom notes that threatened to leak their data publicly on “Corporate Leaks” websites—online platforms managed by the Nefilim administrators—if the ransom was not paid.  The investigation and prosecution of Artem Stryzhak’s involvement in the Nefilim ransomware scheme is being led by the National Security and Cybercrime Section of the U.S. Attorney’s Office. While the charges remain allegations and Stryzhak is presumed innocent until proven guilty, he faces up to five years in federal prison if convicted.

image for Apache Parquet Java ...

 Firewall Daily

A vulnerability has been identified in Apache Parquet Java, which could leave systems exposed to remote code execution (RCE) attacks. Apache Parquet contributor Gang Wu discovered, this flaw, tracked as CVE-2025-46762, in the parquet-avro module and publicly disclosed it on May 2. This security issue impacts all   show more ...  

versions of Apache Parquet Java up to and including version 1.15.1, allowing malicious actors to execute arbitrary code on vulnerable systems.  Technical Breakdown of CVE-2025-46762  At the core of this vulnerability is the insecure schema parsing process within the parquet-avro module. The flaw enables attackers to inject malicious code into the metadata of a Parquet file, specifically within the Avro schema. When a vulnerable system reads the file, this malicious code is automatically executed, paving the way for Remote Code Execution (RCE).  For systems utilizing the "specific" or "reflect" data models (rather than the safer "generic" model), the risk is especially pronounced. While the "generic" model remains unaffected by this vulnerability, the default configuration of trusted packages still leaves certain code execution paths open, potentially allowing the exploit to be triggered by pre-approved Java packages, such as java.util.  Affected Systems and Scope of the Issue  The impact of CVE-2025-46762 extends to all Apache Parquet Java versions up to 1.15.1. A wide range of applications, especially those leveraging the parquet-avro module in big data frameworks like Apache Spark, Hadoop, and Flink, are vulnerable to this threat. These platforms rely on the module for deserialization and schema parsing, which opens a potential attack surface if the system is reading Parquet files with malicious Avro schema data.  [caption id="attachment_102422" align="alignnone" width="1218"] Apache Parquet Java 1.15.2 Release Notes (GitHub)[/caption] For organizations managing data pipelines, especially those processing Parquet files in big data ecosystems, the threat is considerable. If unpatched, an attacker could inject malicious Parquet files into the data stream, enabling exploitation through backend vulnerabilities.  Mitigation Strategies  The Apache Software Foundation has urged all users to address this issue urgently. There are two primary mitigation strategies available:  Upgrade to Apache Parquet Java 1.15.2: This release fully resolves the issue by tightening the boundaries on trusted packages, ensuring that malicious code cannot execute through the existing configuration.  Patch for Users on Version 1.15.1: For those unable to immediately upgrade, it is recommended to set the JVM system property -Dorg.apache.parquet.avro.SERIALIZABLE_PACKAGES="" to empty. This will mitigate the risk by blocking the execution of code from potentially malicious packages.  Moreover, organizations are advised to audit their data pipelines to prioritize the use of the generic Avro model, which remains impervious to vulnerability. Implementing this model wherever feasible can reduce the risk of RCE attacks via CVE-2025-46762.  Unpatched systems vulnerable to CVE-2025-46762 face not only direct attacks but also the risk of supply chain exploits, where compromised Parquet files could trigger backend execution of malicious code, leading to widespread system failures.   Security experts have highlighted the severe threat of Remote Code Execution (RCE), which can result in data breaches, unauthorized access, and other malicious activities. Given the nature of this vulnerability and its impact on large-scale data environments, quick action is essential.   Users of Apache Parquet Java versions up to 1.15.1 are strongly advised to upgrade to version 1.15.2 or apply the necessary patches to mitigate these risks, ensuring the protection of their systems against exploitation. 

image for Apple beefs up paren ...

 Privacy

Earlier this year, Apple announced a string of new initiatives aimed at creating a safer environment for young kids and teens using the companys devices. Besides making it easier to set up kids accounts, the company plans to give parents the option of sharing their childrens age with app developers so as to be able to   show more ...  

control what content they show. Apple says these updates will be made available to parents and developers later this year. In this post, we break down the pros and cons of the new measures. We also touch on what Instagram, Facebook (and the rest of Meta) have to do with it, and discuss how the tech giants are trying to pass the buck on young users mental health. Before the updates: how Apple protects kids right now Before we talk about Apples future innovations, lets quickly review the parental control status quo on Apple devices. The company introduced its first parental controls way back in June 2009 with the release of the iPhone 3.0, and has been developing them bit by bit ever since. As things stand, users under 13 must have a special Child Account. These accounts allow parents to access the parental control features built into Apples operating systems. Teenagers can continue using a Child Account until the age of 18, as their parents see fit. What Apples Child Account management center currently looks like. Source Now for the new stuff… The company has announced a series of changes to its Child Account system related to how parental status is verified. Additionally, itll soon be possible to edit a childs age if it was entered incorrectly. Previously, for accounts of users under 13, it wasnt even an option: Apple suggested waiting for the account to naturally age up. In borderline cases (accounts of kids just under 13), you could try a workaround involving changing the birth date — but such tricks wont be needed for much longer. But perhaps the most significant innovation relates to simplifying the creation of these Child Accounts. Henceforth, if parents dont set up a device before their under-13-year-old starts using it, the child can do it themselves. In this case, Apple will automatically apply age-appropriate web content filters and only allow pre-installed apps, such as Notes, Pages, and Keynote. Upon visiting the App Store for the first time to download an app, the child will be prompted to ask a parent to complete the setup. On the other hand, until parental consent is given, neither app developers nor Apple itself can collect data on the child. At this point, even the least tech-savvy parent might ask the logical question: what if my child enters the wrong age during setup? Say, not 10, but 18. Wont the deepest, darkest corners of the internet be opened up to them? How Apple intends to solve the age verification issue The single most substantial of Apples new initiatives announced in early 2025 attempts to address the problem of online age verification. The company proposes the following solution: parents will be able to select an age category and authorize sharing this information with app developers during installation or registration. This way, instead of relying on young users to enter their date-of-birth honestly, developers will be able to use the new Declared Age Range API. In theory, app creators will also be able to use age information to steer their recommendation algorithms away from inappropriate content. Through the API, developers will only know a childs age category — not their exact date of birth. Apple has also stated that parents will be able to revoke permission to share age information at any time. In practice, access to the age category will become yet another permission that young users will be able to give (or, more likely, not give) to apps — just like permissions to access the camera and microphone, or to track user actions across apps. This is where the main flaw of the proposed solution lies. At present, Apple has given no guarantee that if a user denies permission for age-category access, they wont be able to use a downloaded app. This decision rests with app developers, as there are no legal consequences for allowing children access to inappropriate content. Moreover, many companies are actively seeking to grow their young audience, since young kids and teens spend a lot of their time online (more on this below). Finally, lets mention Apples latest innovation: its updating its age-rating system. It will now consist of five categories: 4+, 9+, 13+, 16+, and 18+. In the companys own words, This will allow users a more granular understanding of an apps appropriateness, and developers a more precise way to rate their apps. Apple is updating its age rating system — it will comprise five categories. Source Apple and Meta disagree over whos responsible for childrens safety online The problem of verifying a young persons age online has long been a hot topic. The idea of showing ID every time you want to use an app is, naturally, hardly a crowd-pleaser. At the same time, taking all users at their word is asking for trouble. After all, even an 11-year-old can figure out how to edit their age in order to register on TikTok, Instagram, or Facebook. App developers and app stores are all too eager to lay the responsibility for verifying a childs age at anyone elses doorstep but their own. Among app developers, Meta is particularly vocal in advocating that age verification is the duty of app stores. And app stores (especially Apples) insist that the buck stops with app developers. Many view Apples new initiatives on this matter as a compromise. Meta itself has this to say: Parents tell us they want to have the final say over the apps their teens use, and thats why we support legislation that requires app stores to verify a childs age and get a parents approval before their child downloads an app. All very well on paper — but can it be trusted? Child safety isnt the priority: why you shouldnt trust tech giants Entrusting kids online safety to companies that directly profit from the addictive nature of their products doesnt seem like the best approach. Leaks from Meta, whose statements on Apples solution we cited above, have repeatedly shown that the company targets young users deliberately. For example, in her book Careless People, Sarah Wynne-Williams, former global public policy director at Facebook (now Meta), recounts how in 2017 she learned that the company was inviting advertisers to target teens aged 13 to 17 across all its platforms, including Instagram. At the time, Facebook was selling the chance to show ads to youngsters at their most psychologically vulnerable — when they felt worthless, insecure, stressed, defeated, anxious, stupid, useless, and/or like a failure. In practice, this meant, for example, that the company would track when teenage girls deleted selfies to then show them ads for beauty products. Another leak revealed that Facebook was actively hiring new employees to develop products aimed at kids as young as six, with the goal of expanding its consumer base. Its all a bit reminiscent of tobacco companies best practices back in the 1960s. Apple has never particularly prioritized kids online safety, either. For a long time its parental controls were quite limited, and kids themselves were quick to exploit holes in them. It wasnt until 2024 that Apple finally closed a vulnerability allowing kids to bypass controls just by entering a specific nonsensical phrase in the Safari address bar. That was all it took to disable Screen Time controls for Safari — giving kids access to any website. The vulnerability was first reported back in 2021, yet it took three years for the company to react. Content control: what really helps parents Child psychology experts agree that unlimited consumption of digital content is bad for childrens psychological and physical health. In his 2024 book The Anxious Generation, US psychologist Jonathan Haidt describes how smartphone and social media use among teenage girls can lead to depression, anxiety, and even self-harm. As for boys, Haidt points to the dangers of overexposure to video games and pornography during their formative years. Apple may have taken a step in the right direction, but itll be for nothing if third-party app developers decide not to play ball. And as the example of Meta illustrates, relying on their honesty and integrity seems premature. Therefore, despite Apples innovations, if you need a helping hand, youll find one… at the end of your own arm. If you want to maintain control over what and how much your child consumes online with minimal interference in their life, look no further than our parental control solution. Kaspersky Safe Kids lets you view reports detailing your childs activity in apps and online in general. You can use these to customize restrictions and prevent digital addiction by filtering out inappropriate content in search results and, if necessary, blocking specific sites and apps. What other online threats do kids face, and how to neutralize them? Essential reading: Choosing wisely: a guide to your kids first gadget Back to School Security Tips Back-to-school threats: gadgets Back-to-school threats: social networking Back-to-school threats: virtual classrooms and videoconferencing Keeping kids safe: a new variation on an old theme

 Feed

The threat actors known as Golden Chickens have been attributed to two new malware families dubbed TerraStealerV2 and TerraLogger, suggesting continued development efforts to fine-tune and diversify their arsenal. "TerraStealerV2 is designed to collect browser credentials, cryptocurrency wallet data, and browser extension information," Recorded Future Insikt Group said. "TerraLogger, by contrast

 Feed

What if attackers aren't breaking in—they're already inside, watching, and adapting? This week showed a sharp rise in stealth tactics built for long-term access and silent control. AI is being used to shape opinions. Malware is hiding inside software we trust. And old threats are returning under new names. The real danger isn’t just the breach—it’s not knowing who’s still lurking in your

 Feed

Let’s be honest: if you're one of the first (or the first) security hires at a small or midsize business, chances are you're also the unofficial CISO, SOC, IT Help Desk, and whatever additional roles need filling. You’re not running a security department. You are THE security department. You're getting pinged about RFPs in one area, and reviewing phishing alerts in another, all while sifting

 Feed

Cybersecurity researchers have disclosed a series of now-patched security vulnerabilities in Apple's AirPlay protocol that, if successfully exploited, could enable an attacker to take over susceptible devices supporting the proprietary wireless technology. The shortcomings have been collectively codenamed AirBorne by Israeli cybersecurity company Oligo. "These vulnerabilities can be chained by

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a maximum-severity security flaw impacting Commvault Command Center to its Known Exploited Vulnerabilities (KEV) catalog, a little over a week after it was publicly disclosed. The vulnerability in question is CVE-2025-34028 (CVSS score: 10.0), a path traversal bug that affects 11.38 Innovation Release, from versions

 Threat Lab

Phishing attacks are a significant threat to consumers, with cybercriminals constantly evolving their tactics to deceive unsuspecting individuals. The integration of artificial intelligence (AI) into phishing schemes has made these attacks even more sophisticated and challenging to detect. AI-enabled phishing attacks   show more ...  

seriously threaten consumers and their data. The volume of these attacks is staggering with an estimated 3.4 billion spam emails sent daily. The financial impact of phishing attacks amount to over $52 million so far in 2025. The threat of AI phishing attacks is pervasive, so let’s get prepared. Find out how AI enhances phishing attacks on consumers and how you can learn to identify and protect yourself. How AI enhances phishing attacks 1. Personalized phishing  AI algorithms can analyze vast amounts of data from social media, public records, and other online sources to create highly personalized phishing messages. By understanding the target’s interests, behaviors, and communication patterns, AI can craft messages that appear more legitimate and relevant, increasing the likelihood of the target falling for the scam. For example, you receive a text message from your bank using your name and asking you to authorize a recent purchase that happens to be from Amazon or another retailer you frequent. To authorize the purchase, you need to click an obfuscated link that  will bring you to a fake website that mimics your bank’s website. When you enter your information, it will be stolen.   2. Automated phishing campaigns AI can automate the process of creating and sending phishing emails, allowing cybercriminals to launch large-scale campaigns with minimal effort. Machine learning models can generate convincing email templates, select appropriate recipients, and even schedule the timing of emails to maximize their impact. Automated phishing scams usually aren’t full of personalize data, but are targeted to an audience that will think the email was meant for them. 3. Deepfake technology Deepfake technology, powered by AI, can create realistic audio and video content that mimics the appearance and voice of trusted individuals. This technology can be used in phishing attacks to create fake video calls or voice messages from a CEO or other authority figures, convincing employees to transfer funds or share sensitive information. How to detect AI-enabled phishing attacks 1. Scrutinize email addresses and URLs Always check the sender’s email address and the URLs in the email. Phishing emails often use addresses that look similar to legitimate ones, but have slight variations. Hover over links to see the actual URL before clicking. For example: info1@wellsfargo.com 2. Look for generic greetings Phishing emails often use generic greetings like “Dear Customer” instead of your name. Legitimate companies usually personalize their communications. 3. Check for spelling and grammar errors Many phishing emails contain spelling and grammar mistakes. While AI-generated emails are becoming more sophisticated, errors can still be a red flag. 4. Be wary of urgent or threatening language Phishing emails often create a sense of urgency or fear to prompt immediate action. Be cautious of emails that threaten account suspension or demand immediate payment. 5. Verify unexpected attachments or links If you receive an unexpected attachment or link, verify its legitimacy before opening it. Contact the sender through a different communication channel to confirm. Also, ensure the sender is legitimate. 6. Use multi-factor authentication (MFA) Enable multi-factor authentication on your accounts. This adds an extra layer of security, making it more difficult for cybercriminals to gain access even if they obtain your login credentials. Protecting against AI-enabled phishing attacks Advanced email filtering Use advanced email filtering solutions that leverage AI and machine learning to detect and block phishing emails. Google blocks about 100 million phishing emails a day. 2. Regular software updates Keep your software and systems up to date. Regular updates often include security patches that protect against known vulnerabilities. 3. User education and awareness Stay informed about the latest phishing tactics and educate yourself on how to recognize phishing attempts. Awareness is a crucial defense against phishing attacks. 4. Identity protection and antivirus Invest in all-in-one protection for your identity that includes a password manager, VPN, antivirus and even dark web monitoring. Webroot’s Total Protection allows you to live your life digitally without worry.   Stay in the know AI-enabled phishing attacks represent a significant evolution in the tactics used by cybercriminals. As these attacks become more sophisticated, it is essential for consumers to adopt advanced security measures and stay vigilant. By leveraging AI for defense, investing in user education, we can better protect ourselves against the growing threat of AI-driven phishing attacks. To learn more about how to protect yourself and the solutions that help keep your digital life safe, visit Webroot. The post AI-enabled phishing attacks on consumers: How to detect and protect appeared first on Webroot Blog.

 Cyber Security News

Source: thehackernews.com – Author: . The threat actors known as Golden Chickens have been attributed to two new malware families dubbed TerraStealerV2 and TerraLogger, suggesting continued development efforts to fine-tune and diversify their arsenal. “TerraStealerV2 is designed to collect browser   show more ...  

credentials, cryptocurrency wallet data, and browser extension information,” Recorded Future Insikt Group said. “TerraLogger, by […] La entrada Golden Chickens Deploy TerraStealerV2 to Steal Browser Credentials and Crypto Wallet Data – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Alison Mack Why is there a Need for Flexibility in Choosing the Right NHI Solutions? The need for well-rounded security measures is paramount. Undeniably, one of the key elements in crafting an effective cyber strategy revolves around Non-Human Identities (NHIs). Yet,   show more ...  

with a myriad of options at our fingertips, how can […] La entrada Flexibility in Choosing the Right NHIs Solutions – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: securityboulevard.com – Author: Alison Mack Just how secure are your Non-Human Identities? Have you ever questioned the security level of your Non-Human Identities (NHIs)? NHIs are often the unsung heroes, silently working behind-the-scenes to protect your digital fortress. But are you doing enough to   show more ...  

safeguard these critical components? Understanding the World of Non-Human Identities […] La entrada Relax with Robust NHI Security Measures – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: securityboulevard.com – Author: Alison Mack Can Your Non-Human Identities Keep You Calm When It Comes to Data Security? Maintaining a sense of calm security might seem like a tall order. However, the management of Non-Human Identities (NHIs) and Secrets can be a game-changer in achieving this. But what   show more ...  

exactly are NHIs, and how do […] La entrada Stay Calm: Your NHIs Are Protecting You – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BSides Las Vegas 2024

Source: securityboulevard.com – Author: Marc Handelman Home » Security Bloggers Network » BSidesLV24 – Proving Ground – Taking D-Bus To Explore The Bluetooth Landscape Author/Presenter: Paul Wortman Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security   show more ...  

BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and […] La entrada BSidesLV24 – Proving Ground – Taking D-Bus To Explore The Bluetooth Landscape – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Tony MartinVegue Source: AI-generated using ChatGPT There are two things that live rent-free in my head. The first is my winning strategy for Oregon Trail (for starters, always play as the farmer). The second is how completely and utterly broken the ransomware ecosystem   show more ...  

is. I’ll save Oregon Trail strategy for beers. […] La entrada Why Ransomware Isn’t Just a Technology Problem (It’s Worse) – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Alison Mack Are Your Non-Human Identities Prepared for Emerging Cybersecurity Threats? Understanding the readiness and response efficiency of your Non-Human Identities (NHIs) to new cybersecurity threats is crucial. This post seeks to shed light on the criticality of   show more ...  

managing NHIs robustly and how it aids businesses in minimizing data breaches and […] La entrada Are Your NHIs Capable of Handling New Threats? – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: securityboulevard.com – Author: Alison Mack Why is Satisfaction with NHIs Paramount in Security Expertise? When it comes to managing security, Non-Human Identities (NHIs) have become a critical focus for many CISOs and security professionals. This growing importance prompts the question: Why does   show more ...  

satisfaction with NHIs play a significant role in demonstrating security expertise? Why […] La entrada Why NHIs Leave Security Experts Satisfied – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: sec.cloudapps.cisco.com – Author: . Cisco Meeting Management REST API Privilege Escalation Vulnerability Critical CVE-2025-20156 CWE-274 Download CSAF Email Summary A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate   show more ...  

privileges to administrator on an affected device. This vulnerability exists because proper authorization is […] La entrada Cisco Meeting Management REST API Privilege Escalation Vulnerability – Source:sec.cloudapps.cisco.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Simon Sharwood US President Donald Trump has said TikTok will be “very strongly protected” as the made-in-China social network has “a warm spot in my heart”. Speaking on NBC’s flagship Sunday morning political program Meet The Press, Trump was asked if he would   show more ...  

extend the deadline for TikTok’s developer, ByteDance, to […] La entrada Trump promises protection for TikTok, for which he has a ‘warm spot in my heart’ – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Simon Sharwood PLUS: China spring cleans its AIs; South Korea fines Meta, probes Broadcom; and more! India’s ambition to become a global semiconductor manufacturing player went backwards last week after two big players changed their plans. One was enterprise software   show more ...  

vendor Zoho, which abandoned a plan to become a semiconductor manufacturer. […] La entrada India’s chipmaking ambitions hurt by Zoho’s no-go and Adani unease – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Brandon Vigliarolo Infosec In Brief Microsoft has decided to push its consumer customers to dump password in favor of passkeys. The software giant announced the move Thursday, May 1, traditionally known as “World Password Day,” with a declaration it had joined   show more ...  

forces with the Fast Identity Online (FIDO) Alliance to re-name […] La entrada Microsoft tries to knife passwords once and for all – at least for consumers – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 China

Source: go.theregister.com – Author: Jessica Lyons RSAC Another RSAC has come and gone, with almost 44,000 attendees this year spread across San Francisco’s Moscone Center and the surrounding facilities, according to conference organizers. Hopefully, all of us made it home safely, didn’t get   show more ...  

deported to a Venezuelan prison, and didn’t end up bringing home a […] La entrada RSAC wrap: AI and China on everything, everywhere, all at once – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

As tax season approaches the SWE Finance Committee wants your SWE section to be prepared. Source Views: 0 La entrada ID Me and You for SWE Section Taxes se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

This event is organized by the Technical Career Path Affinity Group Source Views: 0 La entrada Technical Career Path Panel se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

As a rising junior at Highlands Ranch High School in Colorado, in the summer of 2022, I had the chance to intern for the Pak Research Group Laboratory for Multiscale Modeling of Macromolecular Assembly & Control (LMAC), a computational lab located at the Colorado School of Mines (CSM) with the Society of Women   show more ...  

Engineer’s (SWE)… […] La entrada SWE-ET High School Summer Research Experience se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

In honor of Black History Month, we are recognizing African American women who don’t just work in some of the world’s most innovative STEM fields, they also excel in them! Source Views: 0 La entrada Black History Month: Stand Out Women in STEM se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Narrowing down which college you will go to can be a stressful decision. Use the tips below to help make picking your final choice easier! Source Views: 0 La entrada Considerations When Selecting a College se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Acquisition

Source: www.securityweek.com – Author: Eduard Kovacs More than thirty cybersecurity merger and acquisition (M&A) deals were announced in April 2025. An analysis conducted by SecurityWeek shows that 405 cybersecurity-related mergers and acquisitions were announced in 2024. Check out the detailed report.    show more ...  

Here is a list of the most important cybersecurity M&A deals announced in April […] La entrada Cybersecurity M&A Roundup: 31 Deals Announced in April 2025 – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Cybersecurity researchers have disclosed a series of now-patched security vulnerabilities in Apple’s AirPlay protocol that, if successfully exploited, could enable an attacker to take over susceptible devices supporting the proprietary wireless technology. The   show more ...  

shortcomings have been collectively codenamed AirBorne by Israeli cybersecurity company Oligo. “These vulnerabilities can be chained by […] La entrada Wormable AirPlay Flaws Enable Zero-Click RCE on Apple Devices via Public Wi-Fi – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Commvault

Source: thehackernews.com – Author: . The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a maximum-severity security flaw impacting Commvault Command Center to its Known Exploited Vulnerabilities (KEV) catalog, a little over a week after it was publicly disclosed. The vulnerability in   show more ...  

question is CVE-2025-34028 (CVSS score: 10.0), a path traversal bug that affects […] La entrada Commvault CVE-2025-34028 Added to CISA KEV After Active Exploitation Confirmed – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . What if attackers aren’t breaking in—they’re already inside, watching, and adapting? This week showed a sharp rise in stealth tactics built for long-term access and silent control. AI is being used to shape opinions. Malware is hiding inside software we trust.   show more ...  

And old threats are returning under new names. The […] La entrada ⚡ Weekly Recap: Nation-State Hacks, Spyware Alerts, Deepfake Malware, Supply Chain Backdoors – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Let’s be honest: if you’re one of the first (or the first) security hires at a small or midsize business, chances are you’re also the unofficial CISO, SOC, IT Help Desk, and whatever additional roles need filling. You’re not running a security department.   show more ...  

You are THE security department. You’re getting […] La entrada Perfection is a Myth. Leverage Isn’t: How Small Teams Can Secure Their Google Workspace – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-05
Aggregator history
Monday, May 05
THU
FRI
SAT
SUN
MON
TUE
WED
MayJuneJuly