Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Google’s AI ‘Big ...

 Firewall Daily

An experimental AI tool developed by Google has identified its first set of real-world security vulnerabilities in widely used open-source projects. The tool, internally codenamed Big Sleep, has uncovered 20 bugs, according to statements from Google’s security division.  The AI bug hunter, which is the result of a   show more ...  

collaboration between DeepMind and Google’s internal security team Project Zero, is part of an ongoing initiative to explore how artificial intelligence can assist in identifying software vulnerabilities. Heather Adkins, Google’s Vice President of Security, confirmed that the AI tool flagged bugs across several open-source libraries, including FFmpeg, a multimedia framework, and ImageMagick, a graphics processing library.  The vulnerabilities discovered by Big Sleep have not yet been publicly detailed, as is standard practice in security research to prevent potential exploitation before fixes are available. According to Google, each issue was autonomously found and reproduced by the AI agent, though a human analyst was still involved to verify the findings before they were reported.  Transparency Trial to Address the Patch Gap  Alongside the Big Sleep findings, Google has also introduced a new disclosure policy aimed at addressing what it calls the “upstream patch gap.” This term refers to the time delay between a vulnerability being fixed by an upstream vendor and that fix being implemented in downstream products used by end users.  In a recent blog post, the company outlined a Reporting Transparency trial policy. While keeping its existing “90+30” model (90 days for vendors to fix the issue, with an optional 30-day extension for patch rollout), the new approach will now include an early disclosure step.  Approximately one week after a vulnerability is reported to a vendor, Google will publicly disclose:  The name of the affected vendor or project The impacted product The date the report was filed The 90-day deadline for resolution This change is intended to give downstream maintainers earlier visibility into security issues that may eventually affect their users. According to Google, this step will not include technical details or code that could aid malicious actors.  “There may be increased public attention on unfixed bugs,” the blog post acknowledged, “but we want to be clear: no technical details, proof-of-concept code, or information that we believe would materially assist discovery will be released until the deadline.”  The policy is also being applied to Big Sleep’s findings, meaning any vulnerabilities reported by the AI tool will follow the same transparency timeline.   Broader Context for Big Sleep  This shift in approach reflects a broader industry trend toward making vulnerability disclosure more accountable and time sensitive. Google argues that while security research has improved, long gaps between patch development and actual adoption still leave systems exposed.  The company notes that this delay often happens before a patch reaches end users, not after it's published, but during the stage when downstream vendors are integrating the upstream fix. The result is that even known, fixed vulnerabilities may remain exploitable for weeks or months.  Google says the ultimate goal is to reduce the lifespan of vulnerabilities by closing these upstream delays. Still, the new policy is being introduced as a trial, and its effectiveness will be evaluated over time. 

image for CVE-2025-21479 and 2 ...

 Firewall Daily

Google has released its latest Android Security Bulletin for August 2025, addressing multiple vulnerabilities across the Android ecosystem. Among the most notable vulnerabilities, CVE-2025-21479 and CVE-2025-27038 were reportedly exploited in the wild before this month's security release. These are joined by   show more ...  

CVE-2025-21480, another serious Qualcomm flaw disclosed in June 2025.  The two primary vulnerabilities, CVE-2025-21479 and CVE-2025-27038, have received CVSS scores of 8.6 and 7.5, respectively, indicating high to critical severity. A third, CVE-2025-21480, also scored 8.6 and is being closely monitored. All three were first publicly disclosed by Qualcomm in June, and while precise methods of exploitation have not been publicly revealed, there is credible intelligence suggesting they have been actively used in targeted attacks.  According to Qualcomm’s disclosure, CVE-2025-21479 involves an incorrect authorization issue in the Graphics component, which can allow unauthorized command execution within GPU microcode, leading to potential memory corruption. CVE-2025-27038 is categorized as a use-after-free vulnerability, also within the Graphics component, and could result in memory corruption when rendering graphics through Adreno GPU drivers, particularly in Chrome environments.  The Google Threat Analysis Group has indicated that these vulnerabilities, CVE-2025-21479, CVE-2025-21480, and CVE-2025-27038, are subject to "limited, targeted exploitation." However, no further technical details about the attack vectors or threat actors involved have been disclosed.  Android Security Bulletin: Security Patch Level and Coverage  Devices patched to the 2025-08-05 level will be protected against all vulnerabilities listed in this month's Android Security Bulletin, including the Qualcomm-related ones. Users can verify their device’s patch level through the Settings menu. Google emphasizes that Android partners were alerted to these vulnerabilities at least a month in advance, in line with their coordinated disclosure process. The bulletin also states that all relevant patches will be pushed to the Android Open-Source Project (AOSP) within 48 hours of the bulletin’s release. As of August 4, 2025, this process is already underway.  Critical System Vulnerability Also Addressed  Aside from the Qualcomm vulnerabilities, the bulletin highlights another critical flaw in the Android System component: CVE-2025-48530, a remote code execution (RCE) vulnerability. This issue could allow attackers to execute arbitrary code remotely without requiring user interaction or elevated privileges. Devices running Android 16 are particularly at risk, though mitigations are in place for earlier versions. Google has assessed this vulnerability as critical due to the potential damage an exploit could cause, particularly if existing security measures are bypassed. Additional Vulnerabilities in Framework and System Components  The August 2025 bulletin also lists multiple other vulnerabilities, grouped according to their affected components. In the Framework component, CVE-2025-22441 and CVE-2025-48533 were marked as high-severity elevation of privilege (EoP) vulnerabilities. These flaws affect devices running Android versions 13 through 16.  The System component was also home to vulnerabilities like CVE-2025-48530, which, as mentioned, could enable remote code execution. Each of these issues has been patched accordingly in the respective Android version lines.  Conclusion  To mitigate the risk associated with these vulnerabilities, including CVE-2025-21479 and CVE-2025-21480, Google continues to rely on a layered security approach. Central to this is Google Play Protect, which comes pre-enabled on devices with Google Mobile Services and scans for potentially harmful apps, particularly vital for users who install apps outside the Play Store.   Additionally, newer Android versions incorporate better defenses such as improved memory protections, sandboxing, and runtime checks to make exploitation more challenging. Notably, the August 2025 Android Security Bulletin confirms there are no new fixes delivered through Project Mainline this month, with all updates consolidated in the August 1 and August 5 security patch levels. Devices must be updated to one of these patch levels to be fully protected, with 2025-08-05 covering all known vulnerabilities to date. The bulletin also clarifies common vulnerability classifications, including Remote Code Execution (RCE), Elevation of Privilege (EoP), and Denial of Service (DoS), providing transparency for both users and developers.

image for LunaSpy hides as a s ...

 Threats

In the pursuit of security, many folks are ready to install any app that promises reliable protection from malware and scammers. Its this fear thats skillfully used by the creators of new mobile spyware distributed through messengers under the guise of an antivirus. After installation, the fake antivirus imitates the   show more ...  

work of a genuine one — scanning the device, and even giving a frightening number of threats found. Of course no real threats are detected, while what it really does is simply spy on the owner of the infected smartphone. How the new malware works and how to protect yourself from it is what well be telling you about today. How the spyware gets into your phone Weve discovered a new malware campaign targeting Android users. Its been active since at least the end of February 2025. The spy gets into smartphones through messengers, not only under the guise of an antivirus, but also banking protection tools. It can look like this, for example: Hi, install this program here. A potential victim can receive a message suggesting installing software from either a stranger, or a hacked account of a person in their contacts (which is how, for example, Telegram accounts are hijacked. Download the app in our channel. New channels appear in Telegram every second, so its quite possible that some of them may distribute malware under the guise of legitimate software. After installation, the fake security app shows the number of detected threats on the device in order to force the user to provide all possible permissions supposedly to save the smartphone. In this way, the victim gives the app access to all personal data without realizing the real motives of the fake AV. What LunaSpy can do The capabilities of the spyware are constantly increasing. For example, the latest version we found has the ability to steal passwords from both browsers and messengers. This, by the way, is another reason to start using password managers if you havent already done so. What else can LunaSpy do? Record audio and video from the microphone and camera. Read texts, the call log, and contact list. Run arbitrary shell commands. Track geolocation. Record the screen. We also discovered malicious code responsible for stealing photos from the gallery, but its not being used yet. All the information collected by the malware is sent to the attackers via command-and-control servers. Whats surprising is that there are around 150 different domains and IP addresses associated with this spyware — all of them command-and-control servers. How to protect your devices We assume that this spyware is used by attackers as an auxiliary tool, so for now it doesnt compete with big players like SparkCat. Nevertheless, you should protect yourself from LunaSpy as best you can as you do with other threats. Dont download apps from third-party sources. We usually talk about the possible presence of malware in official stores and catalogs; however, this is a special case, so well supplement the standard recommendation with: never download APK files from messengers — even if they were sent to you by close friends. Better yet, disable the ability to install unknown applications. Check which apps you give permission to. Be wary if an antivirus or any other security solution requires too many permissions with no clear reason why it needs them. Use Kaspersky for Android to detect spyware and other malware in a timely manner. Trust trusted developers. If someone offers you to download a new super-accurate and secure antivirus that the internet seems to know nothing about, be very wary and opt for a proven solution. A bit more on spyware: FinSpy: the ultimate spying tool Spyware messengers on Google Play Staying safe from Pegasus, Chrysaor and other APT mobile malware LianSpy: new mobile spyware for Android How to keep spies off your phone — in real life, not the movies

image for Who Got Arrested in ...

 Breadcrumbs

On July 22, 2025, the European police agency Europol said a long-running investigation led by the French Police resulted in the arrest of a 38-year-old administrator of XSS, a Russian-language cybercrime forum with more than 50,000 members. The action has triggered an ongoing frenzy of speculation and panic among XSS   show more ...  

denizens about the identity of the unnamed suspect, but the consensus is that he is a pivotal figure in the crime forum scene who goes by the hacker handle “Toha.” Here’s a deep dive on what’s knowable about Toha, and a short stab at who got nabbed. An unnamed 38-year-old man was arrested in Kiev last month on suspicion of administering the cybercrime forum XSS. Image: ssu.gov.ua. Europol did not name the accused, but published partially obscured photos of him from the raid on his residence in Kiev. The police agency said the suspect acted as a trusted third party — arbitrating disputes between criminals — and guaranteeing the security of transactions on XSS. A statement from Ukraine’s SBU security service said XSS counted among its members many cybercriminals from various ransomware groups, including REvil, LockBit, Conti, and Qiliin. Since the Europol announcement, the XSS forum resurfaced at a new address on the deep web (reachable only via the anonymity network Tor). But from reviewing the recent posts, there appears to be little consensus among longtime members about the identity of the now-detained XSS administrator. The most frequent comment regarding the arrest was a message of solidarity and support for Toha, the handle chosen by the longtime administrator of XSS and several other major Russian forums. Toha’s accounts on other forums have been silent since the raid. Europol said the suspect has enjoyed a nearly 20-year career in cybercrime, which roughly lines up with Toha’s history. In 2005, Toha was a founding member of the Russian-speaking forum Hack-All. That is, until it got massively hacked a few months after its debut. In 2006, Toha rebranded the forum to exploit[.]in, which would go on to draw tens of thousands of members, including an eventual Who’s-Who of wanted cybercriminals. Toha announced in 2018 that he was selling the Exploit forum, prompting rampant speculation on the forums that the buyer was secretly a Russian or Ukrainian government entity or front person. However, those suspicions were unsupported by evidence, and Toha vehemently denied the forum had been given over to authorities. One of the oldest Russian-language cybercrime forums was DaMaGeLaB, which operated from 2004 to 2017, when its administrator “Ar3s” was arrested. In 2018, a partial backup of the DaMaGeLaB forum was reincarnated as xss[.]is, with Toha as its stated administrator. CROSS-SITE GRIFTING Clues about Toha’s early presence on the Internet — from ~2004 to 2010 — are available in the archives of Intel 471, a cyber intelligence firm that tracks forum activity. Intel 471 shows Toha used the same email address across multiple forum accounts, including at Exploit, Antichat, Carder[.]su and inattack[.]ru. DomainTools.com finds Toha’s email address — toschka2003@yandex.ru — was used to register at least a dozen domain names — most of them from the mid- to late 2000s. Apart from exploit[.]in and a domain called ixyq[.]com, the other domains registered to that email address end in .ua, the top-level domain for Ukraine (e.g. deleted.org[.]ua, lj.com[.]ua, and blogspot.org[.]ua). A 2008 snapshot of a domain registered to toschka2003@yandex.ru and to Anton Medvedovsky in Kiev. Note the message at the bottom left, “Protected by Exploit,in.” Image: archive.org. Nearly all of the domains registered to toschka2003@yandex.ru contain the name Anton Medvedovskiy in the registration records, except for the aforementioned ixyq[.]com, which is registered to the name Yuriy Avdeev in Moscow. This Avdeev surname came up in a lengthy conversation with Lockbitsupp, the leader of the rapacious and destructive ransomware affiliate group Lockbit. The conversation took place in February 2024, when Lockbitsupp asked for help identifying Toha’s real-life identity. In early 2024, the leader of the Lockbit ransomware group — Lockbitsupp — asked for help investigating the identity of the XSS administrator Toha, which he claimed was a Russian man named Anton Avdeev. Lockbitsupp didn’t share why he wanted Toha’s details, but he maintained that Toha’s real name was Anton Avdeev. I declined to help Lockbitsupp in whatever revenge he was planning on Toha, but his question made me curious to look deeper. It appears Lockbitsupp’s query was based on a now-deleted Twitter post from 2022, when a user by the name “3xp0rt” asserted that Toha was a Russian man named Anton Viktorovich Avdeev, born October 27, 1983. Searching the web for Toha’s email address toschka2003@yandex.ru reveals a 2010 sales thread on the forum bmwclub.ru where a user named Honeypo was selling a 2007 BMW X5. The ad listed the contact person as Anton Avdeev and gave the contact phone number 9588693. A search on the phone number 9588693 in the breach tracking service Constella Intelligence finds plenty of official Russian government records with this number, date of birth and the name Anton Viktorovich Avdeev. For example, hacked Russian government records show this person has a Russian tax ID and SIN (Social Security number), and that they were flagged for traffic violations on several occasions by Moscow police; in 2004, 2006, 2009, and 2014. Astute readers may have noticed by now that the ages of Mr. Avdeev (41) and the XSS admin arrested this month (38) are a bit off. This would seem to suggest that the person arrested is someone other than Mr. Avdeev, who did not respond to requests for comment. A FLY ON THE WALL For further insight on this question, KrebsOnSecurity sought comments from Sergeii Vovnenko, a former cybercriminal from Ukraine who now works at the security startup paranoidlab.com. I reached out to Vovnenko because for several years beginning around 2010 he was the owner and operator of thesecure[.]biz, an encrypted “Jabber” instant messaging server that Europol said was operated by the suspect arrested in Kiev. Thesecure[.]biz grew quite popular among many of the top Russian-speaking cybercriminals because it scrupulously kept few records of its users’ activity, and its administrator was always a trusted member of the community. The reason I know this historic tidbit is that in 2013, Vovnenko — using the hacker nicknames “Fly,” and “Flycracker” — hatched a plan to have a gram of heroin purchased off of the Silk Road darknet market and shipped to our home in Northern Virginia. The scheme was to spoof a call from one of our neighbors to the local police, saying this guy Krebs down the street was a druggie who was having narcotics delivered to his home. I happened to be lurking on Flycracker’s private cybercrime forum when his heroin-framing plan was carried out, and called the police myself before the smack eventually arrived in the U.S. Mail. Vovnenko was later arrested for unrelated cybercrime activities, extradited to the United States, convicted, and deported after a 16-month stay in the U.S. prison system [on several occasions, he has expressed heartfelt apologies for the incident, and we have since buried the hatchet]. Vovnenko said he purchased a device for cloning credit cards from Toha in 2009, and that Toha shipped the item from Russia. Vovnenko explained that he (Flycracker) was the owner and operator of thesecure[.]biz from 2010 until his arrest in 2014. Vovnenko believes thesecure[.]biz was stolen while he was in jail, either by Toha and/or an XSS administrator who went by the nicknames N0klos and Sonic. “When I was in jail, [the] admin of xss.is stole that domain, or probably N0klos bought XSS from Toha or vice versa,” Vovnenko said of the Jabber domain. “Nobody from [the forums] spoke with me after my jailtime, so I can only guess what really happened.” N0klos was the owner and administrator of an early Russian-language cybercrime forum known as Darklife[.]ws. However, N0kl0s also appears to be a lifelong Russian resident, and in any case seems to have vanished from Russian cybercrime forums several years ago. Asked whether he believes Toha was the XSS administrator who was arrested this month in Ukraine, Vovnenko maintained that Toha is Russian, and that “the French cops took the wrong guy.” WHO IS TOHA? So who did the Ukrainian police arrest in response to the investigation by the French authorities? It seems plausible that the BMW ad invoking Toha’s email address and the name and phone number of a Russian citizen was simply misdirection on Toha’s part — intended to confuse and throw off investigators. Perhaps this even explains the Avdeev surname surfacing in the registration records from one of Toha’s domains. But sometimes the simplest answer is the correct one. “Toha” is a common Slavic nickname for someone with the first name “Anton,” and that matches the name in the registration records for more than a dozen domains tied to Toha’s toschka2003@yandex.ru email address: Anton Medvedovskiy. Constella Intelligence finds there is an Anton Gannadievich Medvedovskiy living in Kiev who will be 38 years old in December. This individual owns the email address itsmail@i.ua, as well an an Airbnb account featuring a profile photo of a man with roughly the same hairline as the suspect in the blurred photos released by the Ukrainian police. Mr. Medvedovskiy did not respond to a request for comment. My take on the takedown is that the Ukrainian authorities likely arrested Medvedovskiy. Toha shared on DaMaGeLab in 2005 that he had recently finished the 11th grade and was studying at a university — a time when Mevedovskiy would have been around 18 years old. On Dec. 11, 2006, fellow Exploit members wished Toha a happy birthday. Records exposed in a 2022 hack at the Ukrainian public services portal diia.gov.ua show that Mr. Medvedovskiy’s birthday is Dec. 11, 1987. The law enforcement action and resulting confusion about the identity of the detained has thrown the Russian cybercrime forum scene into disarray in recent weeks, with lengthy and heated arguments about XSS’s future spooling out across the forums. XSS relaunched on a new Tor address shortly after the authorities plastered their seizure notice on the forum’s  homepage, but all of the trusted moderators from the old forum were dismissed without explanation. Existing members saw their forum account balances drop to zero, and were asked to plunk down a deposit to register at the new forum. The new XSS “admin” said they were in contact with the previous owners and that the changes were to help rebuild security and trust within the community. However, the new admin’s assurances appear to have done little to assuage the worst fears of the forum’s erstwhile members, most of whom seem to be keeping their distance from the relaunched site for now. Indeed, if there is one common understanding amid all of these discussions about the seizure of XSS, it is that Ukrainian and French authorities now have several years worth of private messages between XSS forum users, as well as contact rosters and other user data linked to the seized Jabber server. “The myth of the ‘trusted person’ is shattered,” the user “GordonBellford” cautioned on Aug. 3 in an Exploit forum thread about the XSS admin arrest. “The forum is run by strangers. They got everything. Two years of Jabber server logs. Full backup and forum database.” GordonBellford continued: And the scariest thing is: this data array is not just an archive. It is material for analysis that has ALREADY BEEN DONE . With the help of modern tools, they see everything: Graphs of your contacts and activity. Relationships between nicknames, emails, password hashes and Jabber ID. Timestamps, IP addresses and digital fingerprints. Your unique writing style, phraseology, punctuation, consistency of grammatical errors, and even typical typos that will link your accounts on different platforms. They are not looking for a needle in a haystack. They simply sifted the haystack through the AI sieve and got ready-made dossiers.

 Feed

When Technology Resets the Playing Field In 2015 I founded a cybersecurity testing software company with the belief that automated penetration testing was not only possible, but necessary. At the time, the idea was often met with skepticism, but today, with 1200+ of enterprise customers and thousands of users, that vision has proven itself. But I also know that what we’ve built so far is only

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added three old security flaws impacting D-Link routers to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation in the wild. The high-severity vulnerabilities, which are from 2020 and 2022, are listed below - CVE-2020-25078 (CVSS score: 7.5) - An unspecified vulnerability in D-Link

 Feed

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of cyber attacks carried out by a threat actor called UAC-0099 targeting government agencies, the defense forces, and enterprises of the defense-industrial complex in the country. The attacks, which leverage phishing emails as an initial compromise vector, are used to deliver malware families like MATCHBOIL, MATCHWOK, and

 Feed

As the volume and sophistication of cyber threats and risks grow, cybersecurity has become mission-critical for businesses of all sizes. To address this shift, SMBs have been urgently turning to vCISO services to keep up with escalating threats and compliance demands. A recent report by Cynomi has found that a full 79% of MSPs and MSSPs see high demand for vCISO services among SMBs. How are

 Feed

Microsoft on Tuesday announced an autonomous artificial intelligence (AI) agent that can analyze and classify software without assistance in an effort to advance malware detection efforts. The large language model (LLM)-powered autonomous malware classification system, currently a prototype, has been codenamed Project Ire by the tech giant. The system "automates what is considered the gold

 Feed

Trend Micro has released mitigations to address critical security flaws in on-premise versions of Apex One Management Console that it said have been exploited in the wild. The vulnerabilities (CVE-2025-54948 and CVE-2025-54987), both rated 9.4 on the CVSS scoring system, have been described as management console command injection and remote code execution flaws. "A vulnerability in Trend Micro

 Feed

Cybersecurity researchers have demonstrated an "end-to-end privilege escalation chain" in Amazon Elastic Container Service (ECS) that could be exploited by an attacker to conduct lateral movement, access sensitive data, and seize control of the cloud environment. The attack technique has been codenamed ECScape by Sweet Security researcher Naor Haziz, who presented the findings today at the

 Feed

The malicious ad tech purveyor known as VexTrio Viper has been observed developing several malicious apps that have been published on Apple and Google's official app storefronts under the guise of seemingly useful applications. These apps masquerade as VPNs, device "monitoring" apps, RAM cleaners, dating services, and spam blockers, DNS threat intelligence firm Infoblox said in an exhaustive

 ClickFix

Source: thehackernews.com – Author: . A combination of propagation methods, narrative sophistication, and evasion techniques enabled the social engineering tactic known as ClickFix to take off the way it did over the past year, according to new findings from Guardio Labs. “Like a real-world virus variant,   show more ...  

this new ‘ClickFix’ strain quickly outpaced and ultimately wiped […] La entrada ClickFix Malware Campaign Exploits CAPTCHAs to Spread Cross-Platform Infections – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Google has released security updates to address multiple security flaws in Android, including fixes for two Qualcomm bugs that were flagged as actively exploited in the wild. The vulnerabilities include CVE-2025-21479 (CVSS score: 8.6) and CVE-2025-27038 (CVSS score: 7.5),   show more ...  

both of which were disclosed alongside CVE-2025-21480 (CVSS score: 8.6), by […] La entrada Google’s August Patch Fixes Two Qualcomm Vulnerabilities Exploited in the Wild – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cursor

Source: thehackernews.com – Author: . Cybersecurity researchers have disclosed a high-severity security flaw in the artificial intelligence (AI)-powered code editor Cursor that could result in remote code execution. The vulnerability, tracked as CVE-2025-54136 (CVSS score: 7.2), has been codenamed MCPoison by   show more ...  

Check Point Research, owing to the fact that it exploits a quirk in the […] La entrada Cursor AI Code Editor Vulnerability Enables RCE via Malicious MCP File Swaps Post Approval – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . In SaaS security conversations, “misconfiguration” and “vulnerability” are often used interchangeably. But they’re not the same thing. And misunderstanding that distinction can quietly create real exposure. This confusion isn’t just semantics. It reflects a   show more ...  

deeper misunderstanding of the shared responsibility model, particularly in SaaS environments where the line between vendor […] La entrada Misconfigurations Are Not Vulnerabilities: The Costly Confusion Behind Security Risks – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackercombat.com – Author: Hacker Combat. In 2024, the cybersecurity landscape was shaken by an unexpected and widespread incident—the Snowflake data breach. Despite being a leading provider of cloud-based data warehousing solutions, Snowflake found itself at the center of a massive breach that   show more ...  

affected approximately 165 major companies worldwide. This event serves as a cautionary […] La entrada Snowflake Data Breach: What Happened and How to Prevent It – Source:www.hackercombat.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team Preface RSA Conference just wrapped up, and while phrases like “We are an Agentic AI solution for XYZ,” “AI in Cybersecurity,” and “Risks of AI Adoption” echoed across the expo halls, panels, and keynotes, you probably caught a few sessions on   show more ...  

quantum threats and Post-Quantum Cryptography (PQC) too. Beyond […] La entrada Post Quantum Threats – The Encryption Apocalypse That Isn’t – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team When was the last time you revisited your organization’s email security practices? Is your current software up to the task of defending your data against newer and more sophisticated cyber attacks? And is your team armed with the information and   show more ...  

education needed to respond if it isn’t? These are […] La entrada There Are Plenty of Phish in The Sea: Here’s How to Avoid Them – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Model Context Protocol (MCP) wird immer beliebter, um KI-Systeme mit Datenquellen und Services zu verbinden. Umso wichtiger ist es, diese Schwachstellen auf dem Schirm zu haben. Sicherheitsentscheider sollten tunlichst vermeiden, dass MCP-Stricke reißen. Victor Moussa |   show more ...  

shutterstock.com Der quelloffene Standard Model Context Protocol (MCP) lässt KI-Systeme ohne Integrationsaufwand mit einer Vielzahl […] La entrada Wie Model Context Protocol gehackt wird – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: News 5. Aug. 20254 Minuten Ermittlungen und ForensikSchadsoftwareOpen Source Die US-Cybersicherheitsbehörde CISA bringt mit Thorium eine quelloffene Plattform an den Start, die dabei unterstützen soll, Schadsoftware zu analysieren. Mit Thorium steht Unternehmen nun auch   show more ...  

eine Open-Source-Plattform offen, um Malware zu analysieren. Gorodenkoff – shutterstock.com Thorium wurde in Zusammenarbeit mit den Sandia […] La entrada CISA bringt Open-Source-Plattform für digitale Forensik – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Artificial Intelligence

Source: www.csoonline.com – Author: A crafted inference request in Triton’s Python backend can trigger a cascading attack, giving remote attackers control over AI-serving environments, researchers say. A surprising attack chain in Nvidia’s Triton Inference Server, starting with a seemingly minor memory-name   show more ...  

leak, could allow full remote server takeover without user authentication. Security researchers from Wiz […] La entrada Nvidia patches critical Triton server bugs that threaten AI model security – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Die Staatsanwaltschaft in Taiwan ermittelt gegen frühere und aktuelle TSMC-Mitarbeiter. Sie sollen Schlüsseltechnologien unrechtmäßig erlangt haben. TSMC ist ein attraktives Ziel für Spionage. Vidpen | shutterstock.com Drei Mitarbeiter des weltgrößten   show more ...  

Auftragsfertigers für High-End-Chips TSMC sind in Taiwan wegen mutmaßlicher Betriebsspionage festgenommen worden. Das Unternehmen gilt als Schlüsselakteur der globalen Halbleiterindustrie und […] La entrada TSMC-Mitarbeiter unter Spionageverdacht festgenommen – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 authentication

Source: www.csoonline.com – Author: Opinion Aug 5, 20257 mins AuthenticationEncryptionMultifactor Authentication Infostealers are silently targeting financial data; institutions must adopt proactive, modern cybersecurity to safeguard client trust and digital assets. In the sophisticated world of financial   show more ...  

services, trust is more than a buzzword — it’s the foundation of everything we do. Our clients don’t merely […] La entrada The age of infostealers is here. Is your financial service secure? – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Chinese

Source: www.infosecurity-magazine.com – Author: Chinese smishing syndicates may have compromised up to 115 million payment cards in the US between July 2023 and October 2024. Researchers from SecAlliance estimated that these compromises have resulted in billions of dollars in financial losses. The SecAlliance   show more ...  

report highlighted the sophisticated nature of these campaigns, which involved the strategic […] La entrada Chinese Smishing Campaigns Compromise up to 115 Million US Payment Cards – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BHUSA

Source: www.infosecurity-magazine.com – Author: Experts have called for greater transparency in AI supply chains as generative AI (GenAI) adoption continues to grow, bringing with it more security and data privacy compliance challenges for enterprises. One proposed solution gaining traction is the AI Bill of   show more ...  

Materials (AIBOM), a framework designed to document the components, data sources […] La entrada #BHUSA: Experts Urge Greater AI Supply Chain Transparency as GenAI Adoption Surges – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Critical

Source: www.infosecurity-magazine.com – Author: A chain of critical vulnerabilities in NVIDIA’s Triton Inference Server has been discovered by researchers, just two weeks after a Container Toolkit vulnerability was identified. The Triton Inference Server is an open-source platform for running AI models on   show more ...  

a scale.  The flaws discovered by Wiz can potentially allow a remote, unauthenticated […] La entrada Critical Vulnerabilities Found in NVIDIA’s Triton Inference Server – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Cybersecurity teams have suffered their lowest rate of budget growth in five years, which has had a cascading effect on hiring new staff, according to new research by IANS and Artico. Average annual security budget growth was 4% in 2025, significantly less than   show more ...  

the 8% increase recorded in 2024. Just 47% […] La entrada Cybersecurity Teams Hit by Lowest Budget Growth in Five Years – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A new report has laid bare the sudden surge in cyber-threat activity from pro-Iran hacking groups which accompanied the 12-day war against Israel earlier this summer. SecurityScorecard said it analyzed 250,000 Telegram messages to uncover various activity   show more ...  

including intelligence gathering, propaganda and direct attacks on critical infrastructure and public entities. This came […] La entrada Pro-Iran Hackers Aligned Cyber with Kinetic War Aims – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . As the volume and sophistication of cyber threats and risks grow, cybersecurity has become mission-critical for businesses of all sizes. To address this shift, SMBs have been urgently turning to vCISO services to keep up with escalating threats and compliance demands. A   show more ...  

recent report by Cynomi has found that a […] La entrada AI Slashes Workloads for vCISOs by 68% as SMBs Demand More – New Report Reveals – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Microsoft on Tuesday announced an autonomous artificial intelligence (AI) agent that can analyze and classify software without assistance in an effort to advance malware detection efforts. The large language model (LLM)-powered autonomous malware classification system,   show more ...  

currently a prototype, has been codenamed Project Ire by the tech giant. The system “automates […] La entrada Microsoft Launches Project Ire to Autonomously Classify Malware Using AI Tools – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Trend Micro has released mitigations to address critical security flaws in on-premise versions of Apex One Management Console that it said have been exploited in the wild. The vulnerabilities (CVE-2025-54948 and CVE-2025-54987), both rated 9.4 on the CVSS scoring system,   show more ...  

have been described as management console command injection and remote […] La entrada Trend Micro Confirms Active Exploitation of Critical Apex One Flaws in On-Premise Systems – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CERT-UA

Source: thehackernews.com – Author: . The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of cyber attacks carried out by a threat actor called UAC-0099 targeting government agencies, the defense forces, and enterprises of the defense-industrial complex in the country. The attacks, which   show more ...  

leverage phishing emails as an initial compromise vector, are used to […] La entrada CERT-UA Warns of HTA-Delivered C# Malware Attacks Using Court Summons Lures – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . When Technology Resets the Playing Field In 2015 I founded a cybersecurity testing software company with the belief that automated penetration testing was not only possible, but necessary. At the time, the idea was often met with skepticism, but today, with 1200+ of   show more ...  

enterprise customers and thousands of users, that […] La entrada AI Is Transforming Cybersecurity Adversarial Testing – Pentera Founder’s Vision – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added three old security flaws impacting D-Link Wi-Fi cameras and video recorders to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation in the wild. The   show more ...  

high-severity vulnerabilities, which are from 2020 and 2022, are listed below […] La entrada CISA Adds 3 D-Link Vulnerabilities to KEV Catalog Amid Active Exploitation Evidence – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: levelblue.com – Author: hello@alienvault.com. Cyberattacks don’t just hit networks. They hit trust. And once that’s gone, the road to recovery can be long and full of questions: Who got in? What did they take? Are they still lurking somewhere inside? That’s where digital forensics comes in. Think   show more ...  

of it as the detective work behind […] La entrada Key Concepts in Digital Forensics and Its Role in Cybersecurity – Source:levelblue.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: sec.cloudapps.cisco.com – Author: . Cisco Webex Meeting Client Join Certificate Validation Vulnerability Medium CVE-2025-20215 CWE-295 Download CSAF Email Summary A vulnerability in the meeting-join functionality of Cisco Webex Meetings could have allowed an unauthenticated, network-proximate attacker   show more ...  

to complete a meeting-join process in place of an intended targeted user, provided the requisite conditions were satisfied. […] La entrada Cisco Webex Meeting Client Join Certificate Validation Vulnerability – Source:sec.cloudapps.cisco.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Associated Press WhatsApp has taken down 6.8 million accounts that were “linked to criminal scam centers” targeting people online around that world, its parent company Meta said this week. The account deletions, which Meta said took place over the first six months of   show more ...  

the year, arrive as part of wider company […] La entrada WhatsApp Takes Down 6.8 Million Accounts Linked to Criminal Scam Centers, Meta Says – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Eduard Kovacs Google revealed on Tuesday that one of its corporate Salesforce instances was targeted by threat actors. The attack appears to be part of a campaign that has hit several major companies. The tech giant said its Salesforce instance was targeted in June and   show more ...  

attributed the activity to a threat […] La entrada Google Discloses Data Breach via Salesforce Hack  – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.bitdefender.com – Author: Graham Cluley Ukraine’s Defence Intelligence agency (HUR) claims that its hackers have successfully stolen secret files and classified data on a state-of-the-art Russian nuclear submarine, the “Knyaz Pozharsky.” The “Knyaz Pozharsky” is nuclear-powered   show more ...  

ballistic missile submarine, that was commissioned into the Russian Navy’s Northern Fleet at a shipyard in Severodvinsk during […] La entrada Ukraine claims to have hacked secrets from Russia’s newest nuclear submarine – Source: www.bitdefender.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 bug bounty program

Source: www.securityweek.com – Author: Ionut Arghire Microsoft on Tuesday announced that 344 security researchers in 59 countries received $17 million in rewards through its bug bounty programs over the past year. This is the highest total bounty the Redmond-based tech giant has distributed in a single year   show more ...  

since launching its bug bounty programs in 2018, […] La entrada Microsoft Paid Out $17 Million in Bug Bounties in Past Year – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: Kevin Townsend Ox Security has introduced a new AI-powered extension that goes beyond identifying vulnerabilities — it automatically generates organization-specific code to fix them. The platform integrates with customers’ existing security tools. This integration   show more ...  

floats vulnerabilities in code that should be fixed by the developers. But developers are already overwhelmed by […] La entrada Ox Security Launches AI Agent That Auto-Generates Code to Fix Vulnerabilities – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: grahamcluley.com – Author: Graham Cluley Skip to content I’m a big fan of recycling. But what about recycling our private data? Like medical records? Well, according to local media reports, a hospital in Thailand has been fined after patient’s printed records were recycled as snack bags to hold   show more ...  

crispy crepes! An investigation by Thailand’s […] La entrada Hospital fined after patient data found in street food wrappers – Source: grahamcluley.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-08
Aggregator history
Wednesday, August 06
FRI
SAT
SUN
MON
TUE
WED
THU
AugustSeptember