Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Microsoft Patch Tues ...

 Cyber News

Patch Tuesday for July 2025 was the busiest day for Microsoft fixes since January, with 130 Microsoft CVEs patched – including 17 ones at high risk for exploitation. July’s total also included 10 non-Microsoft CVEs. In all, Microsoft Patch Tuesday July 2025 was twice the size of June’s patch total, and the   show more ...  

biggest month for Microsoft CVEs since January’s 159. High-Risk Flaws in Microsoft Patch Tuesday July 2025 The highest-rated vulnerability for July is a 9.8-severity remote code execution (RCE) flaw affecting Windows 10, version 1607 and above. CVE-2025-47981 affects SPNEGO Extended Negotiation (NEGOEX) Security Mechanism, and is a heap-based buffer overflow vulnerability caused by a Group Policy Object (GPO) enabled by default on these operating systems: "Network security: Allow PKU2U authentication requests to this computer to use online identities." An attacker could exploit the vulnerability by sending a malicious message to the server, potentially leading to remote code execution, Microsoft said. Microsoft Office and SharePoint each had two high-risk RCE vulnerabilities. CVE-2025-49695 is a Use After Free vulnerability in Microsoft Office, while CVE-2025-49696 is an Out-of-bounds Read/Heap-based Buffer Overflow in Office. Both vulnerabilities are rated 8.4 and could allow an attacker to achieve remote code execution without user interaction. Security updates for Microsoft Office LTSC for Mac 2021 and 2024 are not yet available and will be released as soon as possible. CVE-2025-49701 is an 8.8-severity Improper Authorization vulnerability in SharePoint, and CVE-2025-49704 is a Code Injection vulnerability in SharePoint that’s also rated 8.8. Other vulnerabilities deemed more likely to be exploited include: CVE-2025-49724, an 8.8-rated Windows Connected Devices Platform Service Remote Code Execution vulnerability CVE-2025-49735, an 8.1-severity Windows KDC Proxy Service (KPSSVC) Remote Code Execution vulnerability CVE-2025-47978, a 6.5-severity Windows Kerberos Denial of Service vulnerability CVE-2025-47987, a 7.8-rated Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege vulnerability CVE-2025-48799, a 7.8-rated Windows Update Service Elevation of Privilege vulnerability CVE-2025-48800, CVE-2025-48001, CVE-2025-48804 and CVE-2025-48818, all 6.8-severity BitLocker Security Feature Bypass vulnerabilities CVE-2025-49718, a 7.5-rated Microsoft SQL Server Information Disclosure vulnerability CVE-2025-49727, a 7.0-severity Win32k Elevation of Privilege vulnerability CVE-2025-49744, a 7.0-rated Windows Graphics Component Elevation of Privilege vulnerability Other IT Vendors Issuing Patch Tuesday Updates Microsoft isn’t the only IT vendor issuing updates on the second Tuesday of the month. Other vendors releasing updates and patches in the last day have included: AMD Fortinet Google Android Ivanti SAP  

image for Shrinking your digit ...

 Privacy

In todays world, having an online presence is practically unavoidable. More and more of our daily lives happen online, and unless youre a sailor out at sea or a forest ranger, living completely offline is a rare luxury. Its estimated that each of us generates roughly two to three gigabytes of data every hour through   show more ...  

our smartphones, IoT devices, and online services. So, its no wonder that, for example, around 70% of Americans are concerned about the government collecting their data, and a staggering ~80% worry about corporations doing the same. Today, we explore where and how our everyday actions leave digital trails, and what we can do about it. Your morning routine: how your smartphone and browser track you You wake up, check the weather, maybe scroll through some reels, like a few posts, and check your commute to see the possible traffic jams. When it comes to social media privacy settings, its pretty straightforward: you tweak them so your parents and colleagues dont get a heart attack from your edgy humor. Our Privacy Checker website can help with that. But it gets trickier with geolocation data, which seemingly everyone wants to collect. Weve already dived deep into how smartphones build detailed profiles on you, and explained what geolocation data brokers are and what happens when their data leaks. Just imagine: about half of popular Android apps ask for your geolocation even though they dont need it. And by default, Chrome and Safari allow cross-domain cookie tracking. This lets advertising networks build detailed user profiles for personalized ads. Pretty much all of your smartphones telemetry is used to create a thorough consumer portrait — no need for customer interviews or focus groups. The best marketer is in your pocket, but its not working for you. What should you do? Normal measures Head to Settings -> Privacy -> Permission Manager. From there, disable background access to the devices location for messaging apps, weather widgets, and any other apps that neednt be tracking your movements in the background. Go to Settings -> Privacy & Security -> Tracking and turn off Allow Apps to Request to Track. Also, in newer iOS versions, under Settings -> Privacy & Security, youll find a Safety Check section. This is a great place to review and adjust app and user access to your data, and even reset all access types in an emergency. You can minimize tracking by following the instructions in our post What Google Ad Topics is, and how to disable it. Enable Prevent cross-site tracking in Safaris privacy and security settings on both your mobile devices and computers. Then, in the advanced settings, turn on Use advanced tracking and fingerprinting protection for all browsing. Paranoid measures Consider getting a Google Pixel and flashing it with GrapheneOS modified firmware that has Google Play Services disabled. Alternatively, research if AOSP firmware is available for your current Android phone. AOSP gives you a bare-bones Android experience where you choose exactly which services to install. Enable Lockdown Mode (found under Settings -> Privacy & Security). While it significantly limits functionality, it drastically reduces your chances of being tracked or having your iPhone compromised. Weve covered this mode in detail in our article Protection through restriction: Apples new Lockdown Mode. Set up a local DNS filter: for example, Pi-hole can block more than 280,000 trackers. Alternatively, you can install browser extensions like Privacy Badger for Firefox, Opera, Edge, and Chrome. Many modern routers also allow you to configure DNS filters that can block most ad network traffic on websites. For more on this, check out our post Why you should set up secure DNS — and how. Hitting the road: the dangers of connected cars Youre ready for your commute, hop into your car, hit the ignition… The system automatically plays your favorite playlist and has your loved ones on speed dial. Convenient, right? Absolutely, but theres a caveat. Modern vehicles can transmit a staggering 25 GB of (your!) data per hour! This creates two categories of problems. First, connected cars are often easier to hack because automotive manufacturers generally have a less-than-stellar approach to cybersecurity. While compromising a cars onboard systems doesnt always lead to theft, many vulnerabilities allow attackers to track you, or even remotely control your vehicle. For instance, in November 2024, a vulnerability was discovered in the Mazda Connect onboard system that allowed attackers to execute arbitrary code with root privileges. Before that, significant vulnerabilities were found in vehicles from Kia, Tesla, Jeep, and dozens of other carmakers. Second, car makers themselves often enthusiastically monitor owners of the vehicles they sell and resell that collected data to data brokers and insurance companies. What to do? Normal measures Dive into your cars smart features menu and disable any that you dont actively use or need. Install an immobilizer that breaks the data bus connection. Some vehicles come with one built-in, but if yours doesnt, consider a third-party immobilizer. Regularly update your ECU firmware through official service centers. This helps patch known vulnerabilities, though its worth noting that new, undiscovered vulnerabilities could emerge with updates. Paranoid measures If youre serious about minimizing data collection, consider buying a used car with minimal data-gathering and transmission capabilities. The absence of its own cellular module (GSM/3G/4G) in the car is a reliable sign that youre on the right track. Embrace public transport or cycling! Lunch time: the hidden dangers of delivery apps That much-anticipated lunch break is the perfect time to unwind… and leave a few more digital footprints. Whether youre ordering coffee through an app or checking in to your favorite bakery on social media, youre constantly adding to your online profile. This includes your location, payment details, and even your order history from delivery apps. Food delivery apps, in particular, are incredibly data hungry. On average, they collect 21 categories of personal data, and a staggering 95% of this information is directly linked to your identity. Much of this data doesnt stay with the delivery service; it gets sent elsewhere. Uber Eats, for instance, shares 12 out of 21 collected data points with partner companies, including your phone number, address, and search and order histories. Whats more, food delivery services can experience data breaches. When that happens, your personal information — everything from your name, phone number and address to your shopping list and order costs — can end up exposed. So, its clear: we need to do something about this too. Normal measures Check your apps location settings. Instead of granting always-on access, switch it to only while using the app. If youre extra cautious, you can turn off location services entirely and manually enter your address. Unless the apps core features genuinely require it, dont let delivery services access your contacts, gallery or messages. Paranoid measures Set up a burner email address and use a different name for all your food orders. Even more radically, consider a second smartphone exclusively for delivery apps and other potentially risky applications. Avoid providing your exact apartment number. Meet the courier at the entrance to the building instead. This can prevent your precise living location from being linked to your spending habits in case of a data breach. Opting for cash payments ensures your purchase details arent stored in a payment system profile. For a drastically reduced digital footprint, skip electronic lunch ordering altogether. Grab some cash, leave your phone at the office, and head to a local eatery. No phone means no GPS tracking, and cash transactions leave no digital trace whatsoever. While this wont make you completely invisible (security cameras are still a thing!), it significantly shrinks your digital footprint. Home sweet home: what your smart devices know about you Theres nothing quite like relaxing at home after a long day. You ask your voice assistant to turn on the lights or recommend a movie. Smart speakers, TVs, robot vacuums, and other gadgets certainly make life easier. However, they also create a host of vulnerabilities for your home network, and often have questionable privacy practices. For instance, in 2023, Amazon faced a $25 million fine for retaining childrens voice recordings and other privacy violations related to Alexa. And its not just corporations misusing voice assistant capabilities. Surveillance cameras, smart plugs, and even smart kettles are frequently hacked — often being roped into botnets for DDoS attacks. There have even been unsettling cases where malicious actors gained access to home cameras, using them for surveillance or pranks like speaking through a compromised baby monitor. Normal measures Dive into your smart home management app (Google Home, Apple Home, the Alexa app, and so on) and look for sections titled Privacy or similar. Turn off options that send your voice recordings for analysis. For Alexa, this is typically Use of Voice Recordings. For Google Assistant, opt out of the quality improvement program. Enable automatic deletion of your voice history. You can also manually clear your query history. With Alexa, just say, Alexa, delete everything I said today. For Google Assistant, manage and delete recordings through your Google account. This significantly reduces the amount of data stored. Every smart speaker has a microphone mute button. If you dont need the assistant, especially during private conversations, hit that mute button. Laptops and some smart cameras come with built-in privacy shutters or covers. Use them! Its a simple way to prevent unwanted peeping. Many smart TVs allow you to disable the collection of viewing statistics (often called ACR). Its a good idea to turn this off to stop your TV from sending reports about every channel you flip through. Modern routers often let you set up a secondary or guest Wi-Fi network. Connect all your IoT devices to that network. This prevents the gadgets from seeing your main computers and phones on your home network. Even if one of your smart devices gets hacked, the attacker wont be able to access your personal data. Plus, it makes it easier to cut off internet access to IoT devices when theyre not in use. Use a strong, unique password for every device. When you first set up a smart device, always change the default login and password. A reliable password manager like Kaspersky Password Manager can help you generate and store secure passwords. Paranoid measures The most drastic option is to completely abandon voice assistants and cloud-based smart home services. Flip those light switches manually, and use mechanical timers for your appliances. The fewer microphones and cameras in your home, the more peace of mind youll have. If you absolutely must have an assistant, consider offline alternatives. There are open-source projects like Mycroft AI that can be configured to process commands locally — without sending data to the cloud. If youre concerned about covert listening, consider purchasing a bug detector – if its allowed in your country. These devices help locate hidden cameras and microphones when, for example, you suspect that a smart light bulb is actually a spy cam. You can also check the four ways to find spy cameras, which we described earlier. During confidential meetings, either unplug suspicious gadgets or remove them from the room entirely. Look for IoT devices that can function autonomously. Examples include cameras with local storage that dont stream to the cloud, or smart home systems built on a local server like openHAB where all your data stays right in your home. Takeaways In todays digital world, your data is a valuable commodity. While its impossible to completely erase your digital footprint, that doesnt mean you should give up doing what you can. By staying aware and implementing smart security measures, you can control a significant portion of your data exposure. The extra protection services found in Kaspersky Premium can further enhance your privacy and payment protection. And our Privacy Checker website offers a wealth of comprehensive guides: these cover privacy settings for smartphones, computers, social networks, apps, and even entire operating systems. Whether youre looking for simple adjustments or more thorough security measures — weve got you covered. While achieving absolute anonymity often requires an extreme, almost paranoid level of effort, while most people dont need anonymity, adopting even the normal measures from our recommendations will significantly limit the ability of both cybercriminals and corporations to track you. What other steps should you take to stay safe? Below are some examples: Should you disable Microsoft Recall in 2025? Watching porn safely: a guide for grown-ups Messengers 101: safety and privacy advice How to safely convert files Creating an unforgettable password

 Cybercrime

The Justice Department confirmed the arrest in a statement, unsealing a nine-count indictment on Tuesday accusing Xu and co-defendant Zhang Yu of being involved in “computer intrusions between February 2020 and June 2021, including the indiscriminate HAFNIUM computer intrusion campaign that compromised thousands of computers worldwide, including in the United States.”

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The list of flaws is as follows - CVE-2014-3931 (CVSS score: 9.8) - A buffer overflow vulnerability in Multi-Router Looking Glass (MRLG) that could allow remote attackers to cause an

 Feed

Russian organizations have been targeted as part of an ongoing campaign that delivers a previously undocumented Windows spyware called Batavia. The activity, per cybersecurity vendor Kaspersky, has been active since July 2024. "The targeted attack begins with bait emails containing malicious links, sent under the pretext of signing a contract," the Russian company said. "The main goal of the

 Feed

From overprivileged admin roles to long-forgotten vendor tokens, these attackers are slipping through the cracks of trust and access. Here’s how five retail breaches unfolded, and what they reveal about... In recent months, major retailers like Adidas, The North Face, Dior, Victoria's Secret, Cartier, Marks & Spencer, and Co‑op have all been breached. These attacks weren’t sophisticated

 Feed

Cybersecurity researchers are calling attention to a malware campaign that's targeting security flaws in TBK digital video recorders (DVRs) and Four-Faith routers to rope the devices into a new botnet called RondoDox. The vulnerabilities in question include CVE-2024-3721, a medium-severity command injection vulnerability affecting TBK DVR-4104 and DVR-4216 DVRs, and CVE-2024-12856, an operating

 Feed

A newly released report by cybersecurity firm CTM360 reveals a large-scale scam operation utilizing fake news websites—known as Baiting News Sites (BNS)—to deceive users into online investment fraud across 50 countries. These BNS pages are made to look like real news outlets: CNN, BBC, CNBC, or regional media. They publish fake stories that feature public figures, central banks, or financial

 Feed

In yet another instance of threat actors repurposing legitimate tools for malicious purposes, it has been discovered that hackers are exploiting a popular red teaming tool called Shellter to distribute stealer malware. The company behind the software said a company that had recently purchased Shellter Elite licenses leaked their copy, prompting malicious actors to weaponize the tool for

 Feed

Cybersecurity researchers have discovered an Android banking malware campaign that has leveraged a trojan named Anatsa to target users in North America using malicious apps published on Google's official app marketplace. The malware, disguised as a "PDF Update" to a document viewer app, has been caught serving a deceptive overlay when users attempt to access their banking application, claiming

 Feed

Cybersecurity researchers have flagged a supply chain attack targeting a Microsoft Visual Studio Code (VS Code) extension called Ethcode that has been installed a little over 6,000 times. The compromise, per ReversingLabs, occurred via a GitHub pull request that was opened by a user named Airez299 on June 17, 2025. First released by 7finney in 2022, Ethcode is a VS Code extension that's used to

 AI

In episode 58 of "The AI Fix" podcast, our hosts discover a pair of AI headphones that don't electrocute you, Microsoft invents "medical superintelligence", Chucky opens a hotel, some robot footballers fall over, Jony Ive invents a $6 billion pen, and Malcolm Gladwell fears a dystopian future full   show more ...  

of children playing joyfully in the street. Graham discovers that the number 27 holds a special place in the heart of every AI, and Mark investigates Anthropic’s terrible AI shopkeeper. All this and much more is discussed in the latest edition of "The AI Fix" podcast by Graham Cluley and Mark Stockley.

 advanced persistent threats

Source: www.csoonline.com – Author: News Jul 7, 20253 mins Advanced Persistent ThreatsCyberattacksSecurity Cybersecurity firm QiAnXin links a North America-based APT group to long-term espionage targeting China’s AI, semiconductor, and military industries through a zero-day Exchange exploit. A previously   show more ...  

undocumented Advanced Persistent Threat (APT) group, “NightEagle,” has been found targeting the Chinese government and critical sectors […] La entrada NightEagle hackers exploit Microsoft Exchange flaw to spy on China’s strategic sectors – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: The multi-day outage has disrupted order processing, delayed shipments, and highlighted weak links across the global tech distribution ecosystem. Ingram Micro is facing a major cybersecurity crisis as a ransomware attack has triggered a multi-day IT outage, disrupting   show more ...  

services for customers and partners across the globe. The outage, which reportedly began […] La entrada Ingram Micro confirms ransomware attack after days of downtime – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Ingram Micro kämpft seit Tagen mit einem weltweiten Systemausfall. Der Distributor hat nun einen Ransomware-Angriff als Ursache bestätigt. Die Webseiten von Ingram Micro sind aufgrund einer Cyberattacke aktuell nicht erreichbar. Screenshot by Foundry / Julia Mutzbauer Die   show more ...  

Internetseiten des globalen IT-Distributors Ingram Micro sind laut Aussagen von Kunden seit vergangenen Donnerstag […] La entrada Ransomware-Attacke auf Ingram Micro – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Business IT Alignment

Source: www.csoonline.com – Author: Problematic reporting structures, outsized responsibility for enterprise risk, and personal accountability without authority are just a few reasons CISO roles are experiencing high churn. After nine years as CSO and senior vice president of IT at Sumo Logic, George Gerchow   show more ...  

had had enough. The job was stressful and he was burnt […] La entrada Has CISO become the least desirable role in business? – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 budget

Source: www.csoonline.com – Author: Feature Jul 7, 20257 mins BudgetManaged Service ProvidersSecurity Operations Center Use of MSSPs is on the rise as CISOs contend with increased workloads, rising threats, and budget constraints, in addition to talent and training gaps. A shortage of skilled cybersecurity   show more ...  

professionals, combined with budget cuts, is fueling growth in the managed […] La entrada Skills gaps send CISOs in search of managed security providers – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Cybersecurity researchers have disclosed a malicious campaign that leverages search engine optimization (SEO) poisoning techniques to deliver a known malware loader called Oyster (aka Broomstick or CleanUpLoader). The malvertising activity, per Arctic Wolf, promotes fake   show more ...  

websites hosting trojanized versions of legitimate tools like PuTTY and WinSCP, aiming to trick software […] La entrada SEO Poisoning Campaign Targets 8,500+ SMB Users with Malware Disguised as AI Tools – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Everything feels secure—until one small thing slips through. Even strong systems can break if a simple check is missed or a trusted tool is misused. Most threats don’t start with alarms—they sneak in through the little things we overlook. A tiny bug, a reused   show more ...  

password, a quiet connection—that’s all it […] La entrada ⚡ Weekly Recap: Chrome 0-Day, Ivanti Exploits, MacOS Stealers, Crypto Heists and More – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . If you didn’t hear about Iranian hackers breaching US water facilities, it’s because they only managed to control a single pressure station serving 7,000 people. What made this attack noteworthy wasn’t its scale, but how easily the hackers gained access   show more ...  

— by simply using the manufacturer’s default password “1111.” This narrow […] La entrada Manufacturing Security: Why Default Passwords Must Go – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: sec.cloudapps.cisco.com – Author: . Cisco IOS XE Software Bootstrap Arbitrary File Write Vulnerability Medium CVE-2025-20155 CWE-1287 Download CSAF Email Summary A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an   show more ...  

affected system. This vulnerability is due to insufficient input validation of […] La entrada Cisco IOS XE Software Bootstrap Arbitrary File Write Vulnerability – Source:sec.cloudapps.cisco.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: sec.cloudapps.cisco.com – Author: . Cisco IOS XE Software DHCP Snooping Denial of Service Vulnerability High CVE-2025-20162 CWE-400 Download CSAF Email Summary A vulnerability in the DHCP snooping security feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a full   show more ...  

interface queue wedge, which could result in a denial of […] La entrada Cisco IOS XE Software DHCP Snooping Denial of Service Vulnerability – Source:sec.cloudapps.cisco.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Batavia spyware

Source: securityaffairs.com – Author: Pierluigi Paganini Since March 2025, fake contract emails have been spreading Batavia spyware in targeted attacks on Russian organizations. Since March 2025, a targeted phishing campaign against Russian organizations has used fake contract-themed emails to spread the   show more ...  

Batavia spyware, a new malware designed to steal internal documents. The attack, ongoing since […] La entrada New Batavia spyware targets Russian industrial enterprises – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Baidu

Source: securityaffairs.com – Author: Pierluigi Paganini Taiwan warns Chinese apps like TikTok and WeChat pose security risks due to excessive data collection and data transfers to China. Taiwan National Security Bureau (NSB) warns that Chinese apps like TikTok, WeChat, Weibo, and Baidu Cloud pose security   show more ...  

risks due to excessive data collection and data transfer to […] La entrada Taiwan flags security risks in popular Chinese apps after official probe – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 AI

Source: securityboulevard.com – Author: Elad Schulman Generative AI (GenAI) is already deeply embedded in enterprises, whether managers realize it or not. Sales teams use it to craft emails, engineers run agents that generate and test code, and marketers rely on it for copywriting and campaign ideation. And   show more ...  

much of this is happening without formal approval, […] La entrada Shadow AI Is Exploding, Governance Needs to Catch Up – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 budget

Source: securityboulevard.com – Author: Michael Vizard A survey of 1,000 executives of organizations that generate less than $100 million in revenue finds 59% believe the right amount of budget is being allocated to cybersecurity, with 64% noting they also believe their organization is too small to be an   show more ...  

attractive target. The post Survey Surfaces Myriad […] La entrada Survey Surfaces Myriad Small Business Security Challenges – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breach

Source: securityboulevard.com – Author: Teri Robinson If the analysis by researchers at CyberNews is on point, then a massive breach, involving 16 billion records previously slipped under the radar and represents the largest of its kind so far.  The post 16 Billion Exposed Records Offer Blueprint for Mass   show more ...  

Exploitation  appeared first on Security Boulevard. Original […] La entrada 16 Billion Exposed Records Offer Blueprint for Mass Exploitation  – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. The International Criminal Court (ICC) recently announced it was hit by a sophisticated cyberattack. The attack, detected late last week, has been contained, and the Court is now assessing its full impact. This incident, publicly confirmed on Monday, marks the second   show more ...  

such major cyber security challenge for the ICC […] La entrada ICC Contained Cyberattack Amid Espionage Threats and Pressure – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. Telecom giant AT&T has agreed to a $177 million settlement to resolve two major lawsuits stemming from widespread data breaches that impacted millions of its current and former customers in 2019 and 2024. A US District Judge, Ada Brown, granted preliminary   show more ...  

approval for the settlement terms on Friday, June […] La entrada AT&T Reaches $177M Deal Over 2019 and 2024 Data Breaches – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A long-running cyber-espionage campaign linked to an Iran-aligned threat group has been observed targeting government entities in Iraq and the Kurdistan Regional Government (KRG).  According to new research by ESET, the group, dubbed “BladedFeline,” has   show more ...  

significantly evolved its toolset since its initial activities began in 2017. What’s new is the use […] La entrada Iran-Aligned Hacking Group Targets Middle Eastern Governments – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Russian organizations have been targeted as part of an ongoing campaign that delivers a previously undocumented Windows spyware called Batavia. The activity, per cybersecurity vendor Kaspersky, has been active since July 2024. “The targeted attack begins with bait   show more ...  

emails containing malicious links, sent under the pretext of signing a contract,” […] La entrada Researchers Uncover Batavia Windows Spyware Stealing Documents from Russian Firms – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Critical

Source: thehackernews.com – Author: . The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The list of flaws is as follows – CVE-2014-3931 (CVSS score:   show more ...  

9.8) – A buffer overflow vulnerability in Multi-Router Looking Glass […] La entrada CISA Adds Four Critical Vulnerabilities to KEV Catalog Due to Active Exploitation – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securelist.com – Author: Denis Stepanov, Alexander Korotin In our previous article we dissected penetration testing techniques for IBM z/OS mainframes protected by the Resource Access Control Facility (RACF) security package. In this second part of our research, we delve deeper into RACF by examining   show more ...  

its decision-making logic, database structure, and the interactions between the […] La entrada Approach to mainframe penetration testing on z/OS. Deep dive into RACF – Source: securelist.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: The scale and sophistication of attacks targeting developers, software teams and CI/CD pipelines continued to grow in Q2 2025, with Sonatype reporting a 188% annual increase in malicious open source packages. The security vendor monitors activity across ecosystems   show more ...  

such as npm, PyPI and Maven Central, in order to better understand open […] La entrada Malicious Open Source Packages Surge 188% Annually – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: The developers behind a popular AV/EDR evasion tool have confirmed it is being used by malicious actors in the wild, while slamming a security vendor for failing to responsibly disclose the threat. Shellter is used by professional red teams and pen testers to   show more ...  

evade security tools while probing their clients’ attack […] La entrada Red Team Tool Developer Shellter Admits ‘Misuse’ by Adversaries – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Chinese

Source: www.infosecurity-magazine.com – Author: Chinese CCTV provider Hikvision is firmly committed to maintaining its presence in Canada, defying the government’s ban with legal action. The video surveillance vendor had been the subject of a national security review under the Investment Canada Act, which   show more ...  

concluded that Hikvision posed a threat to Canadian national security. Therefore, on […] La entrada Chinese Video Surveillance Vendor Hikvision to Fight Canadian Ban – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: The recently emerged Bert ransomware group is actively targeting organizations in the US, Asia and Europe using multiple variants and rapidly evolving tactics to evade detection, research from Trend Micro has found. Bert has been observed targeting organizations   show more ...  

since April 2025, with confirmed victims in sectors including healthcare, technology and event […] La entrada New Bert Ransomware Group Strikes Globally with Multiple Variants – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.schneier.com – Author: Bruce Schneier Academic papers were found to contain hidden instructions to LLMs: It discovered such prompts in 17 articles, whose lead authors are affiliated with 14 institutions including Japan’s Waseda University, South Korea’s KAIST, China’s Peking University and the   show more ...  

National University of Singapore, as well as the University of Washington and […] La entrada Hiding Prompt Injections in Academic Papers – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: security.googleblog.com – Author: Google. Security Blog The latest news and insights from Google on security and safety on the Internet Original Post url: http://security.googleblog.com/2025/07/advancing-protection-in-chrome-on.html Category & Tags: – Views: 0 La entrada Advancing Protection   show more ...  

in Chrome on Android – Source:security.googleblog.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Bei einem ClickFix-Angriff werden Nutzer dazu verleitet, schädlichen Code auszuführen. Die Social-Engineering-Technik wird bei Angreifern immer beliebter. Cyberkriminelle greifen immer häufiger auf ClickFix-Angriffe zurück. NAJA x -shutterstock.com Weniger bekannt als   show more ...  

Phishing ist die Social-Engineering-Methode ClickFix. Ziel solcher Attacken ist es, die Opfer dazu zu bewegen, bösartige Befehle in Tools wie PowerShell […] La entrada ClickFix-Attacken bedrohen Unternehmenssicherheit – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Two flaws, one undetected for over a decade, allow unintended root access on Ubuntu and Debian systems, prompting urgent patching across enterprise environments. Two new vulnerabilities have been found in Sudo, a privileged command-line tool installed on Linux systems, that   show more ...  

can allow privilege escalation and unintended command execution on affected Ubuntu […] La entrada How a 12-year-old bug in Sudo is still haunting Linux users – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.csoonline.com – Author: Your cloud provider may be failing you. Blockchain’s verifiable transparency is the only way to truly secure your data. As a cybersecurity consultant guiding organizations across the globe through digital transformation, I’ve observed one recurring pattern: We place   show more ...  

immense trust in cloud services without fully questioning the fragility of their trust […] La entrada The trust crisis in the cloud…and why blockchain deserves a seat at the table – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-07
Aggregator history
Tuesday, July 08
TUE
WED
THU
FRI
SAT
SUN
MON
JulyAugustSeptember