Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for WestJet Confirms Pas ...

 Firewall Daily

Earlier this year, WestJet revealed that some of its passengers were affected by a cyberattack that resulted in the theft of personal information. The WestJet data breach, which took place in June 2025, has now been confirmed to be targeting passenger data.   While the airline has confirmed that no credit card   show more ...  

numbers, debit card details, or user passwords were compromised, the breach involved sensitive information such as passports and other travel-related data.  The WestJet Data Breach  The WestJet data breach was discovered on June 13, 2025, when the airline detected suspicious activity within its systems. A subsequent investigation confirmed that an unauthorized third party had gained access to parts of the airline's infrastructure.  The stolen data varies for each affected individual, but it includes personal details such as names, dates of birth, email addresses, phone numbers, and mailing addresses. Additionally, recent travel booking information, including booking numbers, was also compromised.   More concerning, however, is the exposure of travel documents, such as passports or other government-issued identification information, which are highly sensitive and valuable to criminals.  WestJet clarified that no credit card or debit card numbers were obtained during the cyberattack. Similarly, user passwords associated with accounts were not part of the breach. Despite these reassurances, the stolen personal data, including travel history and passport information, could still be used for identity theft or fraud.  Response to the WestJet Cyberattack  Upon discovering the WestJet data breach, the airline immediately took steps to contain the incident. The airline worked with both internal and external cybersecurity experts to investigate the nature and scope of the breach. Although the airline confirmed that no flight operations were disrupted, it acknowledged that certain personal data had been stolen.  WestJet also offered affected passengers complimentary identity theft protection and monitoring services for 24 months, to help mitigate the potential risks stemming from the breach.  Regulatory Oversight and Ongoing Investigation  Following the WestJet data breach, the airline notified the relevant authorities, including Canada’s Privacy Commissioner, Transport Canada, and other provincial and international bodies.   The breach is under investigation by the Office of the Privacy Commissioner of Canada, which will assess whether the airline met its legal obligations regarding data protection. In addition, WestJet has worked closely with law enforcement agencies and the Canadian Centre for Cyber Security to identify the perpetrators behind the attack.  While WestJet has contained the breach, the investigation is still ongoing. The airline has implemented additional security measures to strengthen its systems and prevent similar incidents in the future. The company has also made further updates to its cybersecurity protocols as part of its ongoing response to the attack.  Conclusion  The Cyber Express has reached out to the airline to learn more about this cyberattack. However, at the time of writing this, no official information or statement has been received. This is an ongoing story, and The Cyber Express will be closely monitoring the situation.  

image for Fortinet Issues Emer ...

 Vulnerabilities

Fortinet has urgently notified users of a critical OS command injection vulnerability in its FortiSIEM platform, identified as CVE-2025-25256, which is now being actively exploited in the wild. According to Fortinet’s security advisory, the flaw received a CVSS score of 9.8, indicating its extreme severity. What’s   show more ...  

at Risk and Which Versions Are Affected? This vulnerability stems from improper sanitization of special elements used within operating system commands (classified under CWE-78). As a result, unauthenticated threat actors can remotely execute arbitrary code or commands through crafted CLI requests—without any user interaction. The affected FortiSIEM versions include: 6.1 through 6.6 6.7.0 to 6.7.9 (upgrade to 6.7.10+) 7.0.0 to 7.0.3 (upgrade to 7.0.4+) 7.1.0 to 7.1.7 (upgrade to 7.1.8+) 7.2.0 to 7.2.5 (upgrade to 7.2.6+) 7.3.0 to 7.3.1 (upgrade to 7.3.2+) 7.4 is not affected What Fortinet Recommends for FortiSIEM Bug Fortinet urges immediate action — either patch to a fixed version or restrict access to the phMonitor port (TCP 7900), which is commonly used for internal discovery and synchronization. Limiting access to this port to trusted internal hosts or IPs may mitigate risk temporarily. Fortinet also confirmed that working exploit code is circulating in the wild. Unfortunately, these exploits do not generate distinctive indicators of compromise (IoCs), making detection challenging. Brute-Force Attacks on Fortinet SSL VPNs This advisory comes on the heels of GreyNoise’s discovery of a sudden surge in brute-force attempts targeting Fortinet SSL VPN devices. On August 3, 2025, more than 780 unique IP addresses—from countries including the US, Canada, Russia, and the Netherlands—attempted unauthorized access to VPN endpoints on numerous continents. GreyNoise further observed that this brute-force tooling shifted focus around August 5, transitioning from FortiOS-targeted attacks to hitting FortiManager (FGFM) systems instead—suggesting attackers may be adapting their strategy mid-operation. This pattern is consistent with GreyNoise's broader research showing that spikes in brute-force activity often precede new CVE disclosures targeting the same vendor, typically within a six-week period. CVE-2025-25256 Vulnerability Summary Issue Details Vulnerability CVE-2025-25256 – critical OS command injection in FortiSIEM (CVSS 9.8) Exploit Status Actively exploited; lacks clear IoCs Affected Versions FortiSIEM 6.1–7.3.1 (except 7.4) Recommended Action Patch to latest fixed version; restrict access to phMonitor port (7900) Related Attack Trends Large-scale brute-force attacks on SSL VPN and shifts toward FortiManager Strategic Insight Brute-force spikes are often a precursor to new vulnerability disclosures Organizations running FortiSIEM must prioritize immediate patching. If updates cannot be applied right away, tightening access to critical internal ports like 7900 (phMonitor) can serve as a temporary buffer. Meanwhile, the recent wave of brute-force attacks against Fortinet devices—especially the shift toward FortiManager—signals a broader, coordinated effort that intensifies the urgency. Also read: Fortinet FortiSIEM Vulnerabilities Expose Systems to Remote Code Execution

image for Microsoft Teams CVE- ...

 Firewall Daily

Microsoft has disclosed a serious vulnerability in its collaboration platform, Microsoft Teams, that could open the door to Remote Code Execution (RCE) attacks. The flaw, tracked as CVE-2025-53783, carries a CVSS score of 7.5 and is categorized as “Important.”  The issue arises from a heap-based buffer overflow,   show more ...  

a well-known software weakness classified under CWE-122. In this type of vulnerability, an application writes more data to a buffer located in the heap than it was allocated to hold. This can result in adjacent memory corruption, giving attackers a pathway to inject and execute arbitrary code.  In the context of Microsoft Teams, this means a successful exploit could allow malicious actors to read private communications, alter message content, or delete messages altogether.  Although the flaw does not require administrative privileges, it does depend on user interaction. For instance, the victim might need to click on a specially crafted link or open a malicious file within the Teams environment. This requirement slightly mitigates the threat, but does not eliminate it, particularly in corporate settings where social engineering remains an effective tactic.  Exploitability and Risk Assessment for CVE-2025-53783 Vulnerability  Microsoft has assessed CVE-2025-53783 as "Exploitation Less Likely" under its exploitability index. The complexity of crafting a working exploit and the specific conditions needed for it to succeed reduce the likelihood of immediate widespread attacks.   That said, the vulnerability still uses a network-based attack vector, meaning attackers can launch attacks remotely without needing physical access to devices.  No known in-the-wild exploits or public exploit code have surfaced as of the disclosure date.   Patch Available, Immediate Action Recommended  Microsoft has released a patch addressing CVE-2025-53783, and all organizations using Microsoft Teams are urged to apply it without delay. The patch is part of Microsoft's August 2025 Patch Tuesday release, which covers a total of 110 vulnerabilities, including several with higher severity ratings. Administrators should also reinforce best practices such as user education on phishing, regular software updates, and network activity monitoring. Given the widespread use of Teams in enterprise environments, the consequences of a successful attack could include exposure of sensitive business data and disruption of internal communications. Additionally, IT teams should evaluate their incident response plans and ensure that they have better data backup and recovery procedures in place, especially if data integrity is compromised in the wake of an exploit. Other Vulnerabilities in the August 2025 Update  While CVE-2025-53783 is notable for its potential to enable Remote Code Execution in a widely used platform, it is not the only issue addressed this month. Microsoft’s August update includes fixes for several high-risk vulnerabilities, including:  CVE-2025-53767: A 10.0-severity Azure OpenAI Elevation of Privilege vulnerability, now mitigated.  CVE-2025-53792: A 9.1-severity Azure Portal Elevation of Privilege issue.  CVE-2025-50171, CVE-2025-50165, and CVE-2025-53766: All rated 9.0 or higher; these flaws span components such as Remote Desktop and Windows Graphics.  The update also addressed 13 vulnerabilities rated 8.8, affecting components like SQL Server, SharePoint, and Windows Media. One NTLM flaw, rated 8.8, was specifically highlighted as high-risk.  Among the ten vulnerabilities considered most likely to be exploited:  CVE-2025-53786: An 8.0-severity vulnerability affecting Exchange Server Hybrid Deployments. Shadowserver reported that 28,000 Exchange instances remain unpatched.  Other notable flaws include CVE-2025-53778 (Windows NTLM), CVE-2025-50177 (MSMQ), and CVE-2025-53132 (Win32k). 

image for Adobe Patch Tuesday ...

 Firewall Daily

Adobe has issued a new set of security patches addressing more than 60 vulnerabilities across 13 of its widely used software products. This update, part of the company’s routine Adobe Patch Tuesday cycle, includes critical fixes for applications ranging from Adobe Commerce and Illustrator to its Substance 3D suite.   show more ...  

  The Adobe security update rollout includes advisories APSB25-71 through APSB25-84 (excluding APSB25-82), reflecting Adobe's ongoing efforts to resolve a growing array of security threats, many of which could lead to arbitrary code execution, denial-of-service (DoS), memory leaks, and unauthorized privilege escalation.  Decoding the Latest Adobe Security Update  The most pressing fixes in this Adobe security update come under APSB25-71, which addresses multiple critical vulnerabilities in Adobe Commerce, Magento Open Source, and Commerce B2B. Six distinct CVEs were highlighted in this category, affecting versions 2.4.8‑p1 and earlier. These include:  CVE‑2025‑49554: Improper input validation (DoS)  CVE‑2025‑49555: CSRF vulnerability (privilege escalation)  CVE‑2025‑49556: Authentication bypass (arbitrary file system read)  CVE‑2025‑49557: Stored XSS (privilege escalation)  CVE‑2025‑49558 & CVE‑2025‑49559: TOCTOU and path traversal vulnerabilities (security feature bypass)  Adobe assigned these issues a priority rating of 2, urging users to update immediately to mitigate the risk of exploitation. The patched versions now extend to 2.4.8‑p2 and 2.4.7‑p7 for Commerce, and up to 1.5.2‑p2 for Commerce B2B.  Substance 3D Products Hit Hard  A notable chunk of the Adobe vulnerabilities was discovered in the Substance 3D product line, including Viewer, Modeler, Painter, Sampler, and Stager, across bulletins APSB25-72, 76, 77, 78, and 81. These include critical code execution bugs caused by heap-based buffer overflows and out-of-bounds writes.  Key CVEs in this category:  CVE‑2025‑49560 and CVE‑2025‑49569 (Substance 3D Viewer)  CVE‑2025‑49571 to CVE‑2025‑49573 and CVE‑2025‑54186 to 54235 (Substance 3D Modeler)  CVE‑2025‑54187 to CVE‑2025‑54195 (Substance 3D Painter)  CVE‑2025‑54205 (Substance 3D Sampler)  CVE‑2025‑54222 and CVE‑2025‑54237 (Substance 3D Stager)  These vulnerabilities are largely related to unsafe memory operations, posing risks of crashes, data corruption, and remote code execution. The priority rating across these products is marked as 3, indicating that important but less urgent action is required; however, updates are still strongly advised. Popular Creative Tools Also Affected  Adobe Illustrator (APSB25‑74)  Multiple high-impact bugs were found in Illustrator 2024 and 2025, including:  CVE‑2025‑49563: Out-of-bounds write  CVE‑2025‑49564: Stack-based buffer overflow  CVE‑2025‑49567: NULL pointer dereference (DoS)  CVE‑2025‑49568: Use-after-free (code execution)  Users are urged to upgrade to Illustrator 2025 version 29.7 or later and Illustrator 2024 version 28.7.9 or later.  Adobe Photoshop (APSB25‑75)  A critical out-of-bounds write bug (CVE‑2025‑49570) in Photoshop 2025 and 2024 could allow arbitrary code execution. Updated versions are available as 26.9 and 25.12.4, respectively.  Adobe Animate (APSB25‑73)  Two vulnerabilities, including a use-after-free flaw (CVE‑2025‑49561) and a memory leak (CVE‑2025‑49562), were patched in Animate versions 23.0.13 and 24.0.10.  Adobe InDesign, InCopy, and FrameMaker Also Patched  Adobe InDesign (APSB25‑79) and InCopy (APSB25‑80) received several critical patches covering heap overflows, use-after-free errors, and out-of-bounds writes.  InCopy Fixes:  CVE-2025-54215 to CVE-2025-54223: All critical vulnerabilities allow arbitrary code execution  Affected versions: InCopy 20.4 and 19.5.4, and earlier  Updated versions: 20.5 and 19.5.5  InDesign Fixes:  CVE-2025-54206 to CVE-2025-54228: Critical memory-related issues  Updates are available through Creative Cloud or manual update channels  FrameMaker (APSB25‑83) was also updated to fix critical use-after-free bugs (CVE‑2025‑54229 to 54232) and a memory leak (CVE‑2025‑54233). The updates apply to the 2020 and 2022 releases.  Adobe Dimension Receives Low-Key But Necessary Fix  APSB25‑84 addresses a single, important memory leak vulnerability in Adobe Dimension (CVE‑2025‑54238). Though no exploits are known to exist in the wild, the vulnerability still warrants action. Users should move to version 4.1.4 across both Windows and macOS.  No Known Exploits But Risks Remain  The organization emphasized that it is not aware of any active exploits for the vulnerabilities disclosed in this Adobe security update. Nonetheless, the company strongly recommends updating to patched versions immediately.   Exploitable vulnerabilities such as buffer overflows, improper input validation, and use-after-free issues remain a serious concern even if not yet weaponized in the wild.  Research Contributions  Multiple independent researchers and security professionals contributed to the discovery and responsible disclosure of these Adobe vulnerabilities. Contributors included:  Francis Provencher (prl)  Jony (jony_juice)  yjdfy  voidexploit  kaiksi, blaklis, akashhamal0x01, wohlie, and others  Their efforts were acknowledged in Adobe’s official bulletins.  Conclusion  With over 60 vulnerabilities addressed, the August Adobe security update is among the more extensive security update cycles in recent months. While none of the flaws have been publicly exploited as of this writing, the nature of many, especially those that enable code execution, means organizations and individuals should not delay applying the necessary patches.  Administrators managing enterprise deployments are advised to use the Adobe Admin Console or Creative Cloud Packager to implement updates across systems. For individual users, the Creative Cloud Desktop App provides access to the latest secure versions. 

image for Telegram scams in 20 ...

 Threats

Remember the early days of the internet and 419 (aka Nigerian prince) scams promising mountains of gold just for you? That era is thankfully over, but today a new curse is all the rage: messenger phishing. Due to its vast user base, the openness of its API, and support for crypto payments, one particular messenger   show more ...  

— Telegram — has become a very popular choice for phishing cybercriminals. So what new tricks do Telegram scammers employ, and how can you spot them in time? Telegram bots in the service of cybercriminals Telegram is home to a huge array of bot-related scams. And sometimes attackers offer their bots to other bad guys to create new ones. If youre feeling a bit overwhelmed, dont worry: our Securelist blogpost takes a detailed look at this phenomenon — known as phishing-as-a-service. Attackers often use Telegram bots instead of websites. Its much easier to lure potential victims this way; its far harder to create and maintain a full-fledged phishing site and get victims to swallow the bait. With bots, everythings simpler since users dont need to leave Telegram, which many mistakenly think is a safe environment by default. So what does it look like in practice? One example is a new scam involving cryptocurrency investments: Were handing out a new token to everyone — just enter the bot and go through KYC verification. Of course, KYC verification for scammers doesnt mean a passport photo or a video call to confirm your identity, but depositing a sum of cryptocurrency. And, yes, this crypto goes straight into the attackers account, while you get zilch. Telegram bot offers fake KYC verification Sure, Telegram bots arent limited to extracting crypto. For instance, we uncovered a scam inviting victims to get paid for watching short videos. Where? In a Telegram bot, of course. Victims earn two euros per video view Telegram bots are highly intrusive — if you dont block them, theyll keep knocking on your door. Most phishing sites dont do this; user interaction with them plays out differently: visit the site, browse, leave. But chat with a Telegram bot just once, and itll bombard you with suspicious links or pester you for access to manage your channels and groups. If you grow tired of an intrusive bot, just block it: open a dialog with the bot, tap its name, then select Block. That done, the pesky bot will message you no more. In another nasty bot-related scam, attackers persuade victims to start bot chats, then share their data or send money. Once the victim is hooked, the scammers rename the bot Telegram Wallet or Support Bot (mimicking supposedly official channels), transfer ownership of the bot to the victims account without their knowledge, and report it to Telegram support. Thinking it was the victim who created the bot, Telegram support deletes not only the bot, but also the victims account. The scammers do this to cover their tracks and muddy the waters for a possible police investigation. Fake gifts and account theft Attackers employ a variety of tricks to gain access to victims accounts. One of the most common scams is a gift subscription to Telegram Premium. Check out our post Youve been sent a gift — a Telegram Premium subscription for details. In brief: scammers message victims from the hacked account of a friend, prompting them to go to a phishing site to finalize the subscription. Theres no subscription, of course. Instead, victims have their own accounts stolen. Another new vector of fraud involves Telegraph, Telegrams tool for posting longer texts. Anyone can publish content there, and no prior registration is required, which is what attackers exploit since its easy to redirect users to phishing pages. The result, as a rule, is one more hijacked account. The user is lured into following the link to view the full version of the document What else have scammers and phishers come up with? Threat actors are actively using AI to create deepfakes, steal biometric data, hide phishing attacks under temporary Blob URLs, and even spoof Google Translate subdomains. Read about these and other trends in our Securelist report. How to guard against Telegram scams and phishing The best tip is to apply critical thinking at all times. But even the smartest of us can sometimes act rashly, so try to read up on scams as much as possible so that your muscle memory automatically triggers the right response. Dont follow links sent by people you barely know. Dont follow such links even if they promise a juicy gift, and never enter personal data on sites they point to. Configure privacy and security in your Telegram account. See our in-depth how-to on two-factor authentication and secret chats. Dont share one-time codes or passwords with anyone. And dont enter them anywhere except in the official Telegram app. Scammers know how to trick users into revealing their OTPs. Use reliable protection that knows phishing when it sees it and warns you about it. Block intrusive bots. As we said, theyll keep on knocking, so if after one chat with a Telegram bot youre sure thats enough, feel free to block it. Set up automatic termination of all inactive Telegram sessions every week. In Telegram, go to Settings, then select Devices -> Automatically terminate sessions -> If inactive for -> 1 week. If your Telegram account is already hacked, read our post What to do if your Telegram account is hacked. Time is of the essence — its easier to restore access in the first 24 hours after an attack. And subscribe to our Telegram channel for the inside track on new cybersecurity trends. Other Telegram swindles: Youve been sent a gift — a Telegram Premium subscription How hijackers target Telegram accounts and crypto wallets What to do if your Telegram account is hacked Buy Toncoin and invite your friends: how scammers promise big earnings with cryptocurrency

image for Microsoft Patch Tues ...

 Latest Warnings

Microsoft today released updates to fix more than 100 security flaws in its Windows operating systems and other software. At least 13 of the bugs received Microsoft’s most-dire “critical” rating, meaning they could be abused by malware or malcontents to gain remote access to a Windows system with   show more ...  

little or no help from users. August’s patch batch from Redmond includes an update for CVE-2025-53786, a vulnerability that allows an attacker to pivot from a compromised Microsoft Exchange Server directly into an organization’s cloud environment, potentially gaining control over Exchange Online and other connected Microsoft Office 365 services. Microsoft first warned about this bug on Aug. 6, saying it affects Exchange Server 2016 and Exchange Server 2019, as well as its flagship Exchange Server Subscription Edition. Ben McCarthy, lead cyber security engineer at Immersive, said a rough search reveals approximately 29,000 Exchange servers publicly facing on the internet that are vulnerable to this issue, with many of them likely to have even older vulnerabilities. McCarthy said the fix for CVE-2025-53786 requires more than just installing a patch, such as following Microsoft’s manual instructions for creating a dedicated service to oversee and lock down the hybrid connection. “In effect, this vulnerability turns a significant on-premise Exchange breach into a full-blown, difficult-to-detect cloud compromise with effectively living off the land techniques which are always harder to detect for defensive teams,” McCarthy said. CVE-2025-53779 is a weakness in the Windows Kerberos authentication system that allows an unauthenticated attacker to gain domain administrator privileges. Microsoft credits the discovery of the flaw to Akamai researcher Yuval Gordon, who dubbed it “BadSuccessor” in a May 2025 blog post. The attack exploits a weakness in “delegated Managed Service Account” or dMSA — a feature that was introduced in Windows Server 2025. Some of the critical flaws addressed this month with the highest severity (between 9.0 and 9.9 CVSS scores) include a remote code execution bug in the Windows GDI+ component that handles graphics rendering (CVE-2025-53766) and CVE-2025-50165, another graphics rendering weakness. Another critical patch involves CVE-2025-53733, a vulnerability in Microsoft Word that can be exploited without user interaction and triggered through the Preview Pane. One final critical bug tackled this month deserves attention: CVE-2025-53778, a bug in Windows NTLM, a core function of how Windows systems handle network authentication. According to Microsoft, the flaw could allow an attacker with low-level network access and basic user privileges to exploit NTLM and elevate to SYSTEM-level access — the highest level of privilege in Windows. Microsoft rates the exploitation of this bug as “more likely,” although there is no evidence the vulnerability is being exploited at the moment. Feel free to holler in the comments if you experience problems installing any of these updates. As ever, the SANS Internet Storm Center has its useful breakdown of the Microsoft patches indexed by severity and CVSS score, and AskWoody.com is keeping an eye out for Windows patches that may cause problems for enterprises and end users. GOOD MIGRATIONS Windows 10 users out there likely have noticed by now that Microsoft really wants you to upgrade to Windows 11. The reason is that after the Patch Tuesday on October 14, 2025, Microsoft will stop shipping free security updates for Windows 10 computers. The trouble is, many PCs running Windows 10 do not meet the hardware specifications required to install Windows 11 (or they do, but just barely). If the experience with Windows XP is any indicator, many of these older computers will wind up in landfills or else will be left running in an unpatched state. But if your Windows 10 PC doesn’t have the hardware chops to run Windows 11 and you’d still like to get some use out of it safely, consider installing a newbie-friendly version of Linux, like Linux Mint. Like most modern Linux versions, Mint will run on anything with a 64-bit CPU that has at least 2GB of memory, although 4GB is recommended. In other words, it will run on almost any computer produced in the last decade. There are many versions of Linux available, but Linux Mint is likely to be the most intuitive interface for regular Windows users, and it is largely configurable without any fuss at the text-only command-line prompt. Mint and other flavors of Linux come with LibreOffice, which is an open source suite of tools that includes applications similar to Microsoft Office, and it can open, edit and save documents as Microsoft Office files. If you’d prefer to give Linux a test drive before installing it on a Windows PC, you can always just download it to a removable USB drive. From there, reboot the computer (with the removable drive plugged in) and select the option at startup to run the operating system from the external USB drive. If you don’t see an option for that after restarting, try restarting again and hitting the F8 button, which should open a list of bootable drives. Here’s a fairly thorough tutorial that walks through exactly how to do all this. And if this is your first time trying out Linux, relax and have fun: The nice thing about a “live” version of Linux (as it’s called when the operating system is run from a removable drive such as a CD or a USB stick) is that none of your changes persist after a reboot. Even if you somehow manage to break something, a restart will return the system back to its original state.

 Feed

Cybersecurity researchers have discovered a new campaign that employs a previously undocumented ransomware family called Charon to target the Middle East's public sector and aviation industry. The threat actor behind the activity, according to Trend Micro, exhibited tactics mirroring those of advanced persistent threat (APT) groups, such as DLL side-loading, process injection, and the ability

 Feed

Microsoft on Tuesday rolled out fixes for a massive set of 111 security flaws across its software portfolio, including one flaw that has been disclosed as publicly known at the time of the release. Of the 111 vulnerabilities, 16 are rated Critical, 92 are rated Important, two are rated Moderate, and one is rated Low in severity. Forty-four of the vulnerabilities relate to privilege

 Feed

Fortinet is alerting customers of a critical security flaw in FortiSIEM for which it said there exists an exploit in the wild. The vulnerability, tracked as CVE-2025-25256, carries a CVSS score of 9.8 out of a maximum of 10.0. "An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSIEM may allow an unauthenticated attacker to

 Feed

Security operations have never been a 9-to-5 job. For SOC analysts, the day often starts and ends deep in a queue of alerts, chasing down what turns out to be false positives, or switching between half a dozen tools to piece together context. The work is repetitive, time-consuming, and high-stakes, leaving SOCs under constant pressure to keep up, yet often struggling to stay ahead of emerging

 Feed

The AI revolution isn’t coming. It’s already here. From copilots that write our emails to autonomous agents that can take action without us lifting a finger, AI is transforming how we work. But here’s the uncomfortable truth: Attackers are evolving just as fast. Every leap forward in AI gives bad actors new tools — deepfake scams so real they trick your CFO, bots that can bypass human review,

 Feed

Cybersecurity researchers have discovered a new malvertising campaign that's designed to infect victims with a multi-stage malware framework called PS1Bot. "PS1Bot features a modular design, with several modules delivered used to perform a variety of malicious activities on infected systems, including information theft, keylogging, reconnaissance, and the establishment of persistent system

 Feed

Zoom and Xerox have addressed critical security flaws in Zoom Clients for Windows and FreeFlow Core that could allow privilege escalation and remote code execution.  The vulnerability impacting Zoom Clients for Windows, tracked as CVE-2025-49457 (CVSS score: 9.6), relates to a case of an untrusted search path that could pave the way for privilege escalation. "Untrusted search path in

 Cyber Security News

Source: thehackernews.com – Author: . New research has uncovered Docker images on Docker Hub that contain the infamous XZ Utils backdoor, more than a year after the discovery of the incident. More troubling is the fact that other images have been built on top of these infected base images, effectively   show more ...  

propagating the infection further in […] La entrada Researchers Spot XZ Utils Backdoor in Dozens of Docker Hub Images, Fueling Supply Chain Risks – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Cybersecurity researchers are warning of a “significant spike” in brute-force traffic aimed at Fortinet SSL VPN devices. The coordinated activity, per threat intelligence firm GreyNoise, was observed on August 3, 2025, with over 780 unique IP addresses   show more ...  

participating in the effort. As many as 56 unique IP addresses have been […] La entrada Fortinet SSL VPNs Hit by Global Brute-Force Wave Before Attackers Shift to FortiManager – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . An ongoing data extortion campaign targeting Salesforce customers may soon turn its attention to financial services and technology service providers, as ShinyHunters and Scattered Spider appear to be working hand in hand, new findings show. “This latest wave of   show more ...  

ShinyHunters-attributed attacks reveals a dramatic shift in tactics, moving beyond the […] La entrada Cybercrime Groups ShinyHunters, Scattered Spider Join Forces in Extortion Attacks on Businesses – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: thehackernews.com – Author: . A previously undocumented threat actor dubbed Curly COMrades has been observed targeting entities in Georgia and Moldova as part of a cyber espionage campaign designed to facilitate long-term access to target networks. “They repeatedly tried to extract the NTDS   show more ...  

database from domain controllers — the primary repository for user password […] La entrada New ‘Curly COMrades’ APT Using NGEN COM Hijacking in Georgia, Moldova Attacks – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Most security tools can’t see what happens inside the browser, but that’s where the majority of work, and risk, now lives. Security leaders deciding how to close that gap often face a choice: deploy a dedicated Enterprise Browser or add an enterprise-grade control layer   show more ...  

to the browsers employees already use […] La entrada The Ultimate Battle: Enterprise Browsers vs. Secure Browser Extensions – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 AI

Source: grahamcluley.com – Author: Graham Cluley Skip to content In episode 63 of The AI Fix, Unitree Robotics looks to Black Mirror episode “Metalhead” for tips on marketing its new robot dog, ChatGPT is secretly running Sweden, OpenAI introduces its first open weight model since GPT-2, and your private   show more ...  

and personal ChatGPT conversations could be […] La entrada The AI Fix #63: GPT-5 is the best AI ever, and Jim Acosta interviews a murdered teenager’s avatar – Source: grahamcluley.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BlackSuit

Source: www.bitdefender.com – Author: Graham Cluley The United States Department of Justice has revealed that the recent takedown of the BlackSuit ransomware gang’s servers, domains, and dark web extortion site, also saw the seizure of US $1,091,453 worth of cryptocurrency. The DOJ’s press release   show more ...  

describes how law enforcement agencies around the world – including the […] La entrada US reveals it seized $1 million worth of Bitcoin from Russian BlackSuit ransomware gang – Source: www.bitdefender.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 AI

Source: securityboulevard.com – Author: Alan Shimel At Black Hat, Robert Johnston and Vikram Ramesh of N-able talk about the growing security pressures on small and mid-sized businesses. They note that ransomware and credential-based attacks are climbing sharply in the mid-market. Attackers who once focused on   show more ...  

large enterprises are increasingly targeting organizations with fewer resources, viewing […] La entrada AI, Ransomware and the Security Gap for SMBs – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Application Security

Source: securityboulevard.com – Author: Richi Jennings Zero day—zero clue: Old, bug-prone app relies on you to go look for update files. The post ANOTHER WinRAR 0-Day: Don’t Patch Now — Uninstall It! appeared first on Security Boulevard. Original Post URL: https://securityboulevard.   show more ...  

com/2025/08/winrar-romcom-tropical-scorpius-richixbw/?utm_source=rss&utm_medium=rss&utm_campaign=winrar-romcom-tropical-scorpius-richixbw Category & Tags: Application Security,Cybersecurity,Data Privacy,Data Security,DevOps,Endpoint,Featured,Governance, Risk & Compliance,Humor,Incident Response,Industry Spotlight,Malware,Most Read This […] La entrada ANOTHER WinRAR 0-Day: Don’t Patch Now — Uninstall It! – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 56001

Source: securityboulevard.com – Author: Erik Hjelmvik PureRAT is a Remote Access Trojan, which can be used by an attacker to remotely control someone else’s PC. PureRAT provides the following features to an attacker: See the victims user interfaceInteract with the victim PC using mouse and keyboardView   show more ...  

the webcamListen to the microphoneRecord keystroke[…] The post PureRAT […] La entrada PureRAT = ResolverRAT = PureHVNC – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0day

Source: hackread.com – Author: Waqas. Microsoft’s August Patch Tuesday fixes 107 vulnerabilities, including 13 critical RCE flaws, impacting Windows, Office, Azure, and more, urging fast updates. Microsoft delivered patches for 107 vulnerabilities as per of its Patch Tuesday security updates. Of the   show more ...  

identified vulnerabilities, 13 are classified as Critical, demanding immediate attention due to their […] La entrada Patch Tuesday: Microsoft Fixes 107 Vulnerabilities, Including 13 RCE Flaws – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. Connex Credit Union breach exposes data of 172000 members, legal probe launched, experts urge victims to monitor accounts for fraud and identity theft. A significant data breach at Connex Credit Union has affected the personal information of 172,000 members. The   show more ...  

credit union, one of Connecticut’s largest, discovered that an […] La entrada Connex Credit Union Data Breach Affects 172,000 Members – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Deeba Ahmed. A new report from Bitdefender reveals the Russian-linked hacking group Curly COMrades is targeting Eastern Europe with a new backdoor called MucorAgent. Learn how they’re using advanced tactics to steal data. A new hacking group with ties to Russia has been   show more ...  

identified by cybersecurity researchers at Bitdefender. The group, […] La entrada Russian-Linked Curly COMrades Deploy MucorAgent Malware in Europe – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: news.sophos.com – Author: Editor PRODUCTS & SERVICES Following multiple enhancements to Sophos Email – the only MDR-optimized email security solution – Sophos is introducing two new offerings to boost email security posture. Email remains one of the primary malware delivery methods. With over   show more ...  

90% of successful cyberattacks starting with phishing1 and business email compromise […] La entrada Enhancements and new offerings for Sophos’ email security portfolio – Source: news.sophos.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Akamai

Source: krebsonsecurity.com – Author: BrianKrebs Microsoft today released updates to fix more than 100 security flaws in its Windows operating systems and other software. At least 13 of the bugs received Microsoft’s most-dire “critical” rating, meaning they could be abused by malware or malcontents to   show more ...  

gain remote access to a Windows system with little or […] La entrada Microsoft Patch Tuesday, August 2025 Edition – Source: krebsonsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . The AI revolution isn’t coming. It’s already here. From copilots that write our emails to autonomous agents that can take action without us lifting a finger, AI is transforming how we work. But here’s the uncomfortable truth: Attackers are evolving just as fast. Every   show more ...  

leap forward in AI gives bad […] La entrada Webinar: What the Next Wave of AI Cyberattacks Will Look Like — And How to Survive – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Microsoft on Tuesday rolled out fixes for a massive set of 111 security flaws across its software portfolio, including one flaw that has been disclosed as publicly known at the time of the release. Of the 111 vulnerabilities, 16 are rated Critical, 92 are rated Important,   show more ...  

two are rated Moderate, […] La entrada Microsoft August 2025 Patch Tuesday Fixes Kerberos Zero-Day Among 111 Total New Flaws – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Charon

Source: thehackernews.com – Author: . Cybersecurity researchers have discovered a new campaign that employs a previously undocumented ransomware family called Charon to target the Middle East’s public sector and aviation industry. The threat actor behind the activity, according to Trend Micro, exhibited   show more ...  

tactics mirroring those of advanced persistent threat (APT) groups, such as DLL side-loading, […] La entrada Charon Ransomware Hits Middle East Sectors Using APT-Level Evasion Tactics – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.techrepublic.com – Author: Aminu Abdullahi Older WinRAR versions let malicious archives override the user-specified path via crafted archives, enabling stealthy system compromise. Cybersecurity researchers have identified an actively exploited flaw in WinRAR that attackers are using to plant   show more ...  

long-term backdoors on targeted machines. The vulnerability, tracked as CVE-2025-8088, affects all Windows versions of WinRAR […] La entrada WinRAR Zero-Day Exploited by Russian-Linked Hackers RomCom and Paper Werewolf – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.techrepublic.com – Author: Megan Crouse Published August 12, 2025 SonicWall identified under 40 security incidents and determined the access control problem was related to a vulnerability published last year. Image: Envato/iLixe48 Cybersecurity platform company SonicWall has identified the origins   show more ...  

of a wave of cyberattacks targeting its Gen 7 firewalls with SSLVPN enabled. As of […] La entrada SonicWall VPN Cyberattack Linked to Known Access Control Vulnerability – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.techrepublic.com – Author: TechRepublic Academy Published August 12, 2025 We may earn from vendors via affiliate links or sponsorships. This might affect product placement on our site, but not the content of our reviews. See our Terms of Use for details. Lightweight, fingerprint-secured SSD with   show more ...  

450 MB/s speeds and ProRes support for mobile and remote […] La entrada Portable, Encrypted Storage That Keeps Your Work Protected – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Jos Creese Debate Not for the first time, Microsoft is in the spotlight for the UK government’s money it voraciously consumes – apparently £1.9 billion a year in software licensing, and roughly £9 billion over five years. Not surprisingly, there are plenty of   show more ...  

voices challenging whether this is good use of […] La entrada Microsoft wares may be UK public sector’s only viable option – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Gareth Halfacree The maintainers of the federated secure chat protocol Matrix are warning users of a pair of “high severity protocol vulnerabilities,” addressed in the latest version, saying patching them requires a breaking change in servers and clients.   show more ...  

“Last month we issued ‘pre-disclosure: upcoming coordinated security fix for all Matrix server […] La entrada Secure chat darling Matrix admits pair of ‘high severity’ protocol flaws need painful fixes – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Carly Page The Interlock ransomware gang has flaunted a 43GB haul of files allegedly stolen from the city of Saint Paul, following a late-July cyberattack that forced the Minnesota capital to declare a state of national emergency. The listing on Interlock’s dark web leak   show more ...  

site, seen by The Register, was published […] La entrada Ransomware crew spills Saint Paul’s 43GB of secrets after city refuses to cough up cash – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Crypto-crasher

Source: go.theregister.com – Author: Simon Sharwood Terraform Labs founder Do Kwon has pled guilty to committing fraud when promoting the so-called “stablecoin” Terra USD and now faces time in jail. Kwon was a pioneer of “stablecoins” – cryptocurrencies tied to the value of a fiat currency. In   show more ...  

theory, one of Kwon’s “UST” tokens would always […] La entrada Crypto-crasher Do Kwon admits guilt over failed not-so-stablecoin that erased $41 billion – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: heimdalsecurity.com – Author: Danny Mitchell MSPs are being told they need dedicated attack surface management solutions when what they really need is better visibility from the tools they already have. The security industry keeps introducing new categories of tools that promise to solve visibility   show more ...  

problems. Attack Surface Management is the latest. But for most […] La entrada Attack Surface Management: Why MSPs Don’t Need Another Tool – Source: heimdalsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: heimdalsecurity.com – Author: Danny Mitchell What I learned from listening to an engineer who spent six years burning money before discovering the truth about MSP sales. “I was afraid of sales. I was afraid of rejection. I was afraid of someone saying no to me. But that slippery slope led to complete   show more ...  

failure.” Michael […] La entrada Should MSPs Stop Chasing Leads and Start Solving Problems? – Source: heimdalsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A severe remote code execution (RCE) vulnerability in Erlang’s Open Telecom Platform (OTP) Secure Shell daemon (sshd) is being actively exploited. According to a new analysis by Palo Alto’s Unit 42, CVE-2025-32433, rated 10.0 on the CVSS scale, allows   show more ...  

unauthenticated attackers to execute commands by sending specific SSH messages before authentication.  […] La entrada Erlang/OTP SSH Vulnerability Sees Spike in Exploitation Attempts – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A surge in fraudulent “AI-powered” trading platforms has been observed exploiting deepfake technology and fabricated online content to deceive investors. According to a new investigation by Group-IB, scammers are deploying convincing fake videos, phony reviews   show more ...  

and targeted online ads to lure victims into fraudulent investment schemes. At the heart of these […] La entrada Deepfake AI Trading Scams Target Global Investors – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-08
Aggregator history
Wednesday, August 13
FRI
SAT
SUN
MON
TUE
WED
THU
AugustSeptember