Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for China-linked Silk Ty ...

 Cyber News

The China-linked advanced persistent threat (APT) group Silk Typhoon has shown a rare ability to compromise trusted relationships in the cloud. That’s one of the key takeaways from new research by CrowdStrike, which calls the Silk Typhoon group “Murky Panda.” Another is the APT group’s ability to rapidly   show more ...  

weaponize n-day and zero-day vulnerabilities, gaining initial access to systems through vulnerabilities such as CVE-2023-3519 in Citrix NetScaler ADC and NetScaler Gateway and CVE-2025-3928 in Commvault. CrowdStrike detailed some of the group’s tactics, techniques and procedures (TTPs) – in addition to two compromises of Software as a Service (SaaS) providers. Among Silk Typhoon’s tactics is using compromised SOHO devices as a final exit node, which is also used by other Chinese APT groups to mask their activity “as legitimate activity originating from the same country in which the victim is located.” The group has used RDP, web shells such as Neo-reGeorg, and occasionally malware such as CloudedHope to move laterally within compromised networks and establish persistence, pivoting to cloud environments from there. Silk Typhoon Supply Chain Attacks Silk Typhoon is one of only “a few tracked adversaries that conduct trusted-relationship compromises in the cloud,” CrowdStrike researchers said in their blog post. “Due to the activity’s rarity, this initial access vector to a victim's cloud environment remains relatively undermonitored compared to more prominent initial access vectors such as valid cloud accounts and exploiting public-facing applications.” Through that rarely used initial access vector, the group “likely intends for their access to downstream victims to remain undetected, enabling prolonged access.” CrowdStrike detailed two examples of the group’s software supply chain attacks. The group exploited zero-day vulnerabilities for initial access to the SaaS providers’ cloud environments, then “determined the compromised SaaS cloud environments' logic, enabling them to leverage their access to that software to move laterally to downstream customers.” At least one of the SaaS providers was using Entra ID to manage its application’s access to downstream customers’ data. The threat actors likely gained access to the SaaS provider’s application registration secret, which the group was able to use to authenticate as the service principals of the application and log into customer environments and then access customer emails. In the other incident, Silk Typhoon compromised a Microsoft cloud solution provider, using access to customer Entra tenants via delegated administrative privileges (DAP). The threat actors had compromised a user in the Admin Agent group “and thus had Global Administrator privileges in all downstream customers' tenants,” and escalated their privileges from there. Defending Against Silk Typhoon CrowdStrike offered several recommendations for detecting Silk Typhoon activity, such as auditing Entra ID service principals’ credentials, particularly newly added credentials. Another recommendation is to enable Microsoft Graph activity logs to monitor resources accessed via Microsoft Graph, including which service principal accessed them. Other recommendations include hunting for service principal activities that deviate from expected actions, and hunting for Entra ID service principal sign-ins from unexpected networks.

image for African Authorities ...

 Cyber News

An INTERPOL-coordinated operation, dubbed Operation Serengeti 2.0, delivered a telling blow to cybercrime across the African continent. The operation that ran between June and August, this year, saw 1,209 arrests made across 18 African nations and the UK, while 11,432 malicious online infrastructures, including   show more ...  

domains, IPs, and phishing or C&C servers, seized. Financially, investigators recovered US$97.4 million tied to ransomware, business email compromise and online scams. [caption id="attachment_104715" align="aligncenter" width="600"] Credit: INTERPOL[/caption] In Angola, authorities dismantled 25 illegal cryptocurrency mining centers run by 60 individuals, along with 45 illicit power stations and related hardware collectively worth $37 million. Meanwhile, in Zambia, an audacious investment scam duped 65,000 individuals of approximately $300 million. This bust of the scam ring led to the arrest of 15 individuals and confiscation of key digital assets, including domain names and mobile accounts. Côte d’Ivoire, meanwhile, targeted a transcontinental inheritance scam tied back to Germany, seizing assets such as electronics, jewelry, cash, and vehicles after defrauding victims of $1.6 million. Private Sector Intelligence Fueling Real-Time Action Crucial to the operation’s impact was intelligence sharing from the private sector, acting as an INTERPOL Gateway partner. The prior mapping of investment and BEC infrastructures of these threat intelligence companies and the preparatory workshops they conducted on OSINT and dark web tracking bolstered investigator readiness across jurisdictions. Operation Serengeti 2.0 reveals why cybercrime in Africa has evolved from low-volume fraud to a continent-spanning economy of digital extortion. The success of the operation is built on the continuous efforts that led to the arrest of nearly 1,000 individuals in the first round of sweeping arrests. Read: Major Cybercrime Operation Nets Over 1,000 Arrests Across Africa The outcomes—mass arrests, dismantled infrastructure, and financial restitution—demonstrate what can happen when law enforcement, industry, and international partners move with coordinated precision. For organizations globally, it’s a blueprint - dismantling cybercrime requires intelligence-driven, multilateral collaboration.

image for 70,000 WordPress Sit ...

 Firewall Daily

A critical security vulnerability, officially tracked as CVE-2025-8592, has been identified in the popular Inspiro WordPress theme. The flaw, affecting over 70,000 active installations, enables unauthenticated attackers to exploit a Cross-Site Request Forgery (CSRF) vulnerability that could allow arbitrary plugin   show more ...  

installations without user consent.  Disclosed on August 20, 2025, this CSRF vulnerability was found in all versions of the Inspiro theme up to and including 2.1.2. According to the advisory issued by Wordfence, a well-known WordPress security firm, the root cause lies in a lack of proper nonce validation within the inspiro_install_plugin() function.  Nature of the CVE-2025-8592 Vulnerability  This improper or missing security validation opens the door for CSRF attacks, in which an attacker can exploit the session of a logged-in administrator by tricking them into clicking a malicious link. Once the admin interacts with the crafted link, their authenticated session can be abused to install unwanted plugins from the WordPress repository, completely unbeknownst to them.  The vulnerability has been assigned a CVSS (Common Vulnerability Scoring System) base score of 8.1 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. This rating reflects the fact that the vulnerability can be exploited over the network, requires low attack complexity, does not need prior authentication, and can impact the integrity and availability of the affected site.  Expert Insight  Dmitrii Ignatyev of CleanTalk Inc., the researcher credited with discovering the vulnerability, highlighted how serious this issue is due to its low barrier of entry for attackers. Because no authentication is required and only minimal user interaction is needed (a click), even relatively unsophisticated threat actors could leverage it for potentially severe consequences.  Wordfence emphasized the risks in its advisory:  “This makes it possible for unauthenticated attackers to install plugins from the repository via a forged request, granted they can trick a site administrator into acting such as clicking on a link.”  This type of Cross-Site Request Forgery (CSRF) is particularly dangerous in admin-level contexts where the attacker effectively hijacks high-level permissions to compromise the site without directly breaking into an account.  Patch and Remediation  The vulnerability has been addressed in Inspiro version 2.1.3, released shortly after the public disclosure. All users running version 2.1.2 or earlier are strongly advised to update immediately to 2.1.3 or later to mitigate the risk.  The patched version includes proper nonce validation, closing the CSRF loophole that allowed arbitrary plugin installation.  Theme  Inspiro  Affected Versions  <= 2.1.2  Patched Version  2.1.3  Vulnerability Type  Cross-Site Request Forgery (CSRF)  CVE ID  CVE-2025-8592  Discovered By  Dmitrii Ignatyev (CleanTalk Inc)  Date Published  August 20, 2025  CVSS Score  8.1 (High)  Broader Implications  The disclosure of CVE-2025-8592 underlines the persistent security challenges faced by users of third-party WordPress themes and plugins. While the Inspiro WordPress theme is widely respected and used by many for its visual design and functionality, this incident illustrates how vulnerabilities can arise from even well-maintained projects.  Administrators are urged not only to apply the patch but also to regularly monitor vulnerability databases and security advisories to stay ahead of threats. The rapid response by WPZoom in releasing version 2.1.3 is a reminder that timely updates are often the most effective defense against newly discovered vulnerabilities. 

image for CISA Warns of Critic ...

 Firewall Daily

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) have released four new Industrial Control Systems (ICS) advisories. These advisories expose multiple vulnerabilities in widely used ICS equipment from Siemens, Tigo Energy, and EG4 Electronics.  ICSA-25-231-01 and ICSA-25-231-02 focus on Siemens’   show more ...  

Desigo CC Product Family, SENTRON Powermanager, and Mendix SAML Module—critical components used across global industrial environments.  CISA's advisory ICSA-25-231-01 details a vulnerability (CVE-2025-47809) involving the Wibu CodeMeter, a software licensing component used in Siemens Desigo CC and SENTRON Powermanager. With a CVSS v3.1 score of 8.2, this vulnerability stems from a Least Privilege Violation (CWE-272), where users could exploit Windows Explorer through the CodeMeter Control Center without requiring a system reboot or logoff post-installation.  All versions of Desigo CC (V5.0 to V8) and SENTRON Powermanager (V5 to V8) are affected. Siemens recommends updating to CodeMeter version 8.30a and restarting the system post-installation to mitigate the issue. Siemens first disclosed this vulnerability to CISA and has further information on its ProductCERT page.  Remote Exploitation in Mendix SAML Module  In ICSA-25-231-02, Siemens' Mendix SAML module was found to contain an Improper Verification of Cryptographic Signature (CWE-347), which could allow unauthenticated attackers to hijack user accounts in specific Single Sign-On (SSO) configurations.  Tagged as CVE-2025-40758 and scoring 8.7 on CVSS v3.1, the vulnerability affects multiple Mendix SAML versions prior to V3.6.21 (for Mendix 9.24), V4.0.3 (Mendix 10.12), and V4.1.2 (Mendix 10.21). Siemens advises enabling encryption settings and updating the module. The issue primarily impacts the critical manufacturing sector and was also reported directly by Siemens to CISA.  Tigo Energy Cloud Connect Advanced Under Active Exploitation  ICSA-25-217-02 (Update A) highlights multiple high-risk vulnerabilities in Tigo Energy’s Cloud Connect Advanced (CCA) device, essential to solar energy management systems.  With a CVSS v4 base score of 9.3, the most critical vulnerability (CVE-2025-7768) involves the use of hard-coded credentials (CWE-798), which allows unauthorized access and administrative control. Other serious issues include:  Command Injection (CVE-2025-7769, CWE-77) with a CVSS v3.1 score of 8.8, now confirmed to be publicly exploitable.  Predictable Session IDs (CVE-2025-7770, CWE-337), enabling attackers to bypass authentication and access sensitive functions.  These flaws affect Cloud Connect Advanced versions 4.0.1 and earlier. Tigo Energy is actively developing patches and urges users to consult its Help Center for interim security recommendations. CISA advises isolating ICS networks, restricting internet access, and using VPNs with caution due to potential vulnerabilities.  EG4 Electronics Inverters Contain Multiple Security Risks  ICSA-25-219-07 (Update A) discloses critical flaws in EG4 Electronics’ inverter systems, used in residential and commercial solar installations worldwide. Vulnerabilities include:  Cleartext Transmission of Sensitive Data (CVE-2025-52586, CWE-319)  Download of Code Without Integrity Check (CVE-2025-53520, CWE-494)  Observable Discrepancy (CVE-2025-47872, CWE-203)  Improper Restriction of Authentication Attempts (CVE-2025-46414, CWE-307)  The CVSS v4 score reaches as high as 9.2, reflecting the severity of these flaws. Attackers could intercept unencrypted commands, install malicious firmware, perform brute-force attacks on PIN codes, or access configuration settings through insecure APIs.  These vulnerabilities affect all versions of the following models:  EG4 12kPV, 18kPV, Flex 21, Flex 18  EG4 6000XP, 12000XP  EG4 GridBoss  EG4 has addressed some issues through server-side fixes, including standardizing registration endpoint responses and limiting authentication attempts. However, the company is still working on firmware and hardware solutions, with new hardware expected by October 15, 2025.  CISA Urges Action from ICS Operators  CISA stresses that ICS environments are increasingly targeted by cyber actors due to their critical role in infrastructure. While there have been no confirmed large-scale exploits linked to these specific vulnerabilities (except one now publicly known in Tigo’s case), CISA recommends the following mitigation strategies:  Isolating ICS from internet-facing networks.  Updating devices and software to the latest secure versions.  Performing risk assessments prior to deploying mitigation strategies. 

image for Messaging apps that ...

 Privacy

Constant access to the internet and a cell service is taken as much for granted these days as electricity, and its sometimes hard to imagine how we ever lived without them before. But what if you find yourself in a situation with no mobile internet or cell signal, but you need to stay in touch with friends nearby? For   show more ...  

example, your group gets separated on a plane and youre seated in different sections, but you were all set to discuss your travel plans during the flight. Or youre at a music festival where the internet is wobbly and its too loud to talk, but you still need to coordinate when to head to the main stage. This is where decentralized p2p (peer-to-peer), or mesh messaging apps can come in handy. These apps allow you to connect multiple devices into a single mesh network via Bluetooth or Wi-Fi Direct. In the 2010s, with the emergence of Wi-Fi Direct, apps like these made a lot of noise, but never really took off — it wasnt clear what they were for or where youd even use them. They were an odd substitute for walkie-talkies, but with a shorter range and higher power consumption, so they never became popular with smartphone users. Still, these types of messaging apps are alive and well today, with developers continuing to support them, and even building new ones. Thats because they serve a key purpose: allowing folks to stay connected during natural disasters, coordinate search party efforts, or simply communicate with neighbors at home or at the summer cottage when theres no Wi-Fi or cell signal. For these and other similar situations, decentralized messaging apps that dont require an internet connection are a good, if not perfect, solution. So, if those walkie-talkies you ordered dont arrive before your planned hike, mesh messaging apps can step in as a backup. The term decentralized is also often used to describe blockchain messaging apps like Status or Brave Messenger. However, we wont be talking about them today since they require a stable internet connection to work. How p2p messaging apps work These apps work on a decentralized mesh network, where each device serves as both a client and a relay. A distributed network is built up from many client devices, and each member can act as a bridge to pass messages along. Imagine your smartphone turning into a mini walkie-talkie that can send messages to other nearby devices that have the right app installed. If you want to send a message, itll hop from one users smartphone to anothers until it reaches the intended recipient. And the devices it passes through cant read the message as its encrypted for connecting nodes. Devices connect directly with each other via either Bluetooth or Wi-Fi Direct. Which mesh messaging apps are worth trying? BitChat. This is the latest decentralized messaging app based on Bluetooth Low Energy (BLE), launched in July 2025 by ex-Twitter (now X) co-founder Jack Dorsey. The app is positioned as a modern, encrypted version of the IRC chats from the late 1990s — and it looks like one too. It claims to be completely decentralized with no servers and to use end-to-end encryption; messages are broken into 500-byte fragments for smoother transmission. The app requires no sign-up, email, or phone number. However, security researchers have already found critical vulnerabilities in BitChat, and even call it a victim of vibe coding — an AI-driven development technique that omits a proper security audit. Currently, AI-powered tools still struggle with secure by design, meaning they have difficulty integrating fundamental security principles at the apps design phase. Jack Dorsey promises to fix the bugs in upcoming updates. You can install the messenger from both the App Store and Google Play. The source code is available on GitHub, and you can follow the official releases and updates on Jack Dorseys X account. Bridgefy. This has over 12 million users, which is a lot for a mesh messaging app — the more users there are, the more likely youll be able to connect. Bridgefy also uses BLE, works on both iOS and Android, supports end-to-end encryption, and has two modes: private messaging and public broadcasting. On the downside, the free version is plagued with obtrusive ads, and performance can be patchy. Briar. This is an open-source, end-to-end encrypted messaging app whose code has passed an independent security audit by Germanys Cure53. In addition to working via Bluetooth and Wi-Fi Direct, it can also connect over the internet through the Tor network, which makes it a more versatile tool. While Briar provides the highest level of privacy and security, there are trade-offs. First, you can only add a contact in person by scanning a QR code or by using special links shared through other channels. Second, forget about voice messages, files, or GIFs — Briar only supports text messaging. Finally, Briar is only available for Android. White Mouse. A relatively new project, White Mouse is a chat app with disappearing messages. Its currently only available for Android, but the developers have promised versions for iOS, macOS, and Windows. It doesnt require a phone number to sign up, provides end-to-end encryption, doesnt store messages anywhere, and can automatically delete them. To increase privacy, White Mouse doesnt allow users to forward messages, take screenshots, or record the screen. It also creates special backgrounds with watermarks to prevent chats from being photographed. It can work both over the internet and directly between nearby devices. What to bear in mind when using mesh messaging apps They arent a replacement for centralized messaging apps. Even in an urban environment, sending a message to a friend in the next building over can be a challenge. The range is limited by Bluetooth/Wi-Fi power. At least one other user with the same messaging app must be within 100 meters of you in an open area — even closer if theres no direct line of sight. Performance depends on the number of users — the more people using the app, the further a message can travel. A mesh network with enough users can stretch for miles. This means you may have to play the diplomat and convince all your friends to switch from their more user-friendly chat apps. Your battery will drain faster with active Bluetooth / Wi-Fi Direct use, so stock up on power banks. Not all mesh messaging apps use reliable encryption. Claiming to have it and actually having it arent the same thing, so only trust independent researchers and their verification. Favor open-source projects, as these allow a wide range of researchers to verify app security. Some apps may have vulnerabilities, as the example with BitChat showed. Therefore, its not recommended to discuss anything confidential in these apps. And use Kaspersky Premium on your devices to prevent your data from being compromised and to defend against malicious actors. General tips for using mesh messaging apps Mesh messaging apps arent a replacement for regular messaging apps for daily communication. Theyre a tool for special circumstances and should be treated like a first-aid kit, a fire extinguisher, or a life jacket — have one on hand and be glad you normally dont have to use it. Install and set up the app in advance — at the critical moment, you may not have time to figure things out or be able to install the app. Make sure your contacts, neighbors, or travel buddies have the same app installed. Install several different mesh messaging apps if your lifestyle involves frequent travel or being in places with potential connectivity issues — you never know which one will find a partner nearby. Before an important event, test the app under conditions similar to what you expect to encounter. Have a backup communication plan, such as actual walkie-talkies suited for the specific terrain. What else to read about messaging app security? What makes a messaging app secure? Messengers 101: safety and privacy advice How to host private videoconferences WhatsApp and Telegram account hijacking: How to protect yourself against scams Messaging other platforms via WhatsApp: the pros and cons

 Cybercrime

The Cybersecurity and Infrastructure Security Agency (CISA) gave civilian federal agencies until September 11 to implement a fix for CVE-2025-43300 — a vulnerability affecting popular brands of Apple phones, iPads and Macbooks.

 Feed

Cybersecurity researchers have shed light on a novel attack chain that employs phishing emails to deliver an open-source backdoor called VShell. The "Linux-specific malware infection chain that starts with a spam email with a malicious RAR archive file," Trellix researcher Sagar Bade said in a technical write-up. "The payload isn't hidden inside the file content or a macro, it's encoded directly

 Feed

Cybersecurity researchers are calling attention to malicious activity orchestrated by a China-nexus cyber espionage group known as Murky Panda that involves abusing trusted relationships in the cloud to breach enterprise networks. "The adversary has also shown considerable ability to quickly weaponize N-day and zero-day vulnerabilities and frequently achieves initial access to their targets by

 Feed

Pentesting remains one of the most effective ways to identify real-world security weaknesses before adversaries do. But as the threat landscape has evolved, the way we deliver pentest results hasn't kept pace. Most organizations still rely on traditional reporting methods—static PDFs, emailed documents, and spreadsheet-based tracking. The problem? These outdated workflows introduce delays,

 Feed

INTERPOL on Friday announced that authorities from 18 countries across Africa have arrested 1,209 cybercriminals who targeted 88,000 victims. "The crackdown recovered $97.4 million and dismantled 11,432 malicious infrastructures, underscoring the global reach of cybercrime and the urgent need for cross-border cooperation," the agency said. The effort is the second phase of an ongoing law

 Feed

A 55-year-old Chinese national has been sentenced to four years in prison and three years of supervised release for sabotaging his former employer's network with custom malware and deploying a kill switch that locked out employees when his account was disabled. Davis Lu, 55, of Houston, Texas, was convicted of causing intentional damage to protected computers in March 2025. He was arrested and

 Cyber Security News

Source: thehackernews.com – Author: . Commvault has released updates to address four security gaps that could be exploited to achieve remote code execution on susceptible instances. The list of vulnerabilities, identified in Commvault versions before 11.36.60, is as follows – CVE-2025-57788 (CVSS score: 6.   show more ...  

9) – A vulnerability in a known login mechanism allows unauthenticated attackers […] La entrada Pre-Auth Exploit Chains Found in Commvault Could Enable Remote Code Execution Attacks – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Threat actors have been observed leveraging the deceptive social engineering tactic known as ClickFix to deploy a versatile backdoor codenamed CORNFLAKE.V3. Google-owned Mandiant described the activity, which it tracks as UNC5518, as part of an access-as-a-service scheme   show more ...  

that employs fake CAPTCHA pages as lures to trick users into providing initial […] La entrada Cybercriminals Deploy CORNFLAKE.V3 Backdoor via ClickFix Tactic and Fake CAPTCHA Pages – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Cybersecurity researchers have disclosed details of a new malware loader called QuirkyLoader that’s being used to deliver via email spam campaigns an array of next-stage payloads ranging from information stealers to remote access trojans since November 2024. Some of   show more ...  

the notable malware families distributed using QuirkyLoader include Agent Tesla, AsyncRAT, […] La entrada Hackers Using New QuirkyLoader Malware to Spread Agent Tesla, AsyncRAT and Snake Keylogger – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A seven-year-old vulnerability affecting end-of-life Cisco network devices is being exploited by a Russian state-sponsored cyber espionage group. Cisco Talos stated that the group, known as Static Tundra, has been observed compromising Cisco devices for several   show more ...  

years. The Russia-aligned hacking group has been exploiting a previously disclosed vulnerability in the Smart Install feature […] La entrada Russian Espionage Group Static Tundra Targets Legacy Cisco Flaw – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 admits

Source: www.infosecurity-magazine.com – Author: Colt Technology Services has confirmed that cybercriminals could leak customer data. This is despite previously claiming the recent cyber incident targeted an internal system separate from its customers’ infrastructure. On August 14, the British   show more ...  

telecommunications giant said it had taken some systems offline in response to a “cyber incident” that targeted […] La entrada Colt Admits Customer Data Likely Stolen in Cyber-Attack – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A 22-year-old Oregon man has been charged with administering the Rapper Bot DDoS-for-hire botnet, which was allegedly used to launch multi-terabit attacks across 80+ countries. Rapper Bot is alleged to administer large-scale DDoS-for-hire attacks averaging two to   show more ...  

three terabits (Tb) in size and targeting victims in over 80 countries, according to […] La entrada Oregon Man Charged in Rapper Bot DDoS-for-Hire Case – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Enterprises and MSPs urged to patch on-premises deployments of N-able’s remote monitoring and management solution, with hundreds of servers still exposed to potential attacks on two critical vulnerabilities. Users of remote monitoring and management (RMM) solution N-able   show more ...  

N-central are urged to deploy patches for two critical vulnerabilities that are being actively […] La entrada Critical N-central RMM flaws actively exploited in the wild – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: FBI and Cisco Talos warn of a sophisticated Russian FSB unit threatening enterprise network infrastructure and business continuity across critical sectors. Russian state-sponsored cyber actors linked to the Federal Security Service (FSB) conducted a decade-long espionage   show more ...  

campaign that compromised thousands of enterprise network devices across critical sectors worldwide, according to an […] La entrada Russian hackers exploit old Cisco flaw to target global enterprise networks – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: The extension can be tricked by invisible Unicode Tag Characters-special symbols unseen by humans but obeyed by AI. The Amazon Q Developer VS Code Extension is reportedly vulnerable to stealthy prompt injection attacks using invisible Unicode Tag characters. According to the   show more ...  

author of the “Embrace The Red” blog, the developer-focused extension […] La entrada Hackers can slip ghost commands into the Amazon Q Developer VS Code Extension – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: The move may reassure Western customers but raises global security concerns. Microsoft has said that it has restricted certain Chinese firms from its cybersecurity vulnerability early warning program after concerns surfaced that information from the system may have been   show more ...  

linked to a recent wave of attacks on its widely used SharePoint […] La entrada Microsoft restricts Chinese firms’ access to vulnerability warnings after hacking concerns – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: securityboulevard.com – Author: The CISO Perspective Learn how to implement Zero Trust Architecture in practice. We map NIST 800-207 concepts—like Policy Enforcement Points (PEPs) and Policy Decision Points (PDPs)—to real-world technologies such as firewalls, identity providers, and endpoint   show more ...  

protection platforms. The post Zero Trust in Practice: Mapping NIST 800-207 to Real-World Technologies appeared first […] La entrada Zero Trust in Practice: Mapping NIST 800-207 to Real-World Technologies – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Lawrence Pingree The New Network Frontier: Edge Computing and the Crisis of Connectivity Editor’s note: This is the second post in a four-part series exploring the architectural gaps, strategic risks, and emerging models shaping the future of edge networking. In   show more ...  

this series, we explore why traditional connectivity is failing at the […] La entrada The Imperative of Tunnel-Free Trusted Cloud Edge Architectures – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: heimdalsecurity.com – Author: Livia Gyongyoși This week in cyber we’ve got a SaaS breach impacting Workday, a malicious ChatGPT app making the rounds, double trouble for telecom providers, and the takedown of a botnet-for-hire service. Cybersecurity Advisor Adam Pilton is here with useful insights on   show more ...  

the attacks and safety advice. Workday SaaS Breach Sparks […] La entrada Colt Technology Services Breached – Warlock Gang Claims Attack – Source: heimdalsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityaffairs.com – Author: Pierluigi Paganini Orange Belgium revealed that a July attack resulted in the exposure of the information of 850,000 customer accounts. Orange Belgium announced that 850,000 customer accounts were impacted by a July data breach. Threat actors had access to one of the IT   show more ...  

systems containing customers data, including surname, first name, […] La entrada Orange Belgium July data breach impacted 850,000 customers – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Apple

Source: securityaffairs.com – Author: Pierluigi Paganini Apple addressed a vulnerability impacting iOS, iPadOS, and macOS that it is under active exploitation in the wild. Apple addressed an actively exploited zero-day, tracked as CVE-2025-43300, in iOS, iPadOS, and macOS. The vulnerability is zero-day   show more ...  

out-of-bounds write issue that resides in the ImageIO framework, an attacker could exploit it […] La entrada Apple addressed the seventh actively exploited zero-day – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Apache ActiveMQ

Source: securityaffairs.com – Author: Pierluigi Paganini Hackers exploit Apache ActiveMQ flaw to install DripDropper on Linux, then patch it to block rivals and hide their tracks. Red Canary researchers observed attackers exploit a 2-year-old Apache ActiveMQ vulnerability, tracked as CVE-2023-46604 (CVSS score   show more ...  

of 10.0), to gain persistence on cloud Linux systems and deploy DripDropper malware. […] La entrada Hackers deploy DripDropper via Apache ActiveMQ flaw, patch systems to evade detection – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini A 20-year-old Scattered Spider member gets 10 years in prison and $13M restitution for SIM-swapping crypto thefts. Scattered Spider hacker, Noah Michael Urban (20), was sentenced to 10 years in U.S. prison and ordered to pay $13M restitution for   show more ...  

SIM-swapping crypto thefts. “A 20-year-old Palm Coast man linked to […] La entrada A Scattered Spider member gets 10 years in prison – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 APT

Source: securityaffairs.com – Author: Pierluigi Paganini FBI warns FSB-linked group Static Tundra is exploiting a 7-year-old Cisco IOS/IOS XE flaw to gain persistent access for cyber espionage. The FBI warns that Russia-linked threat actor Static Tundra exploits Simple Network Management Protocol (SNMP) and   show more ...  

end-of-life networking devices running an unpatched vulnerability (CVE-2018-0171) in Cisco Smart Install […] La entrada FBI: Russia-linked group Static Tundra exploit old Cisco flaw for espionage – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini CERT/CC disclosed serious data exposure vulnerabilities in Workhorse Software used by hundreds of U.S. cities and towns. CERT Coordination Center (CERT/CC) at Carnegie Mellon University disclosed two serious data exposure flaws in an accounting   show more ...  

application developed by Workhorse Software’s, and used by hundreds of U.S. cities and towns. CERT/CC […] La entrada US CERT/CC warns of flaws in Workhorse Software accounting software used by hundreds of municipalities in Wisconsin – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Amazon

Source: grahamcluley.com – Author: Graham Cluley Skip to content In episode 431 of the “Smashing Security” podcast, a self-proclaimed crypto-influencer calling himself CP3O thought he had found a shortcut to riches — by racking up millions in unpaid cloud bills. Meanwhile, we look at the growing threat of   show more ...  

EDR-killer tools that can quietly switch off […] La entrada Smashing Security podcast #431: How to mine millions without paying the bill – Source: grahamcluley.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Automotive Security

Source: securelist.com – Author: Kaspersky ICS CERT Modern vehicles are transforming into full-fledged digital devices that offer a multitude of features, from common smartphone-like conveniences to complex intelligent systems and services designed to keep everyone on the road safe. However, this   show more ...  

digitalization, while aimed at improving comfort and safety, is simultaneously expanding the vehicle’s attack […] La entrada Modern vehicle cybersecurity trends – Source: securelist.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Attackers

Source: www.infosecurity-magazine.com – Author: Threat actors are abusing virtual private servers (VPS) to compromise software-as-a-service (SaaS) accounts, according to an investigation by Darktrace. The cybersecurity vendor identified coordinated SaaS account compromises across multiple customer environments,   show more ...  

all of which involved logins from IP addresses linked to various VPS providers. The compromised accounts were used to conduct […] La entrada Attackers Abuse Virtual Private Servers to Compromise SaaS Accounts – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Apple

Source: www.infosecurity-magazine.com – Author: In a series of updates for its iOS, iPadOS, and macOS operating systems, Apple released a patch for a previously unknown vulnerability that has likely been exploited in highly targeted attacks. The vulnerability, tracked as CVE-2025-43300, is an out-of-bounds   show more ...  

write vulnerability in the Image I/O framework, Apple’s built-in framework which allows […] La entrada Apple Releases Patch for Likely Exploited Zero-Day Vulnerability – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Written by Microsoft has announced plans to implement quantum-safe solutions in its products and services from 2029, with the tech giant aiming for a complete transition by 2033. This is two years ahead of the 2035 deadline set by a number of governments around   show more ...  

the world for a complete transition to […] La entrada Microsoft to Make All Products Quantum Safe by 2033 – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 automation

Source: thehackernews.com – Author: . Pentesting remains one of the most effective ways to identify real-world security weaknesses before adversaries do. But as the threat landscape has evolved, the way we deliver pentest results hasn’t kept pace. Most organizations still rely on traditional reporting   show more ...  

methods—static PDFs, emailed documents, and spreadsheet-based tracking. The problem? These outdated […] La entrada Automation Is Redefining Pentest Delivery – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . A 55-year-old Chinese national has been sentenced to four years in prison and three years of supervised release for sabotaging his former employer’s network with custom malware and deploying a kill switch that locked out employees when his account was disabled. Davis   show more ...  

Lu, 55, of Houston, Texas, was convicted of […] La entrada Ex-Developer Jailed Four Years for Sabotaging Ohio Employer with Kill-Switch Malware – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CIA

Source: www.schneier.com – Author: Bruce Schneier Well, this is interesting: The auction, which will include other items related to cryptology, will be held Nov. 20. RR Auction, the company arranging the sale, estimates a winning bid between $300,000 and $500,000. Along with the original handwritten plain text   show more ...  

of K4 and other papers related to the […] La entrada Jim Sanborn Is Auctioning Off the Solution to Part Four of the Kryptos Sculpture – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 academic papers

Source: www.schneier.com – Author: Bruce Schneier In this input integrity attack against an AI system, researchers were able to fool AIOps tools: AIOps refers to the use of LLM-based agents to gather and analyze application telemetry, including system logs, performance metrics, traces, and alerts, to detect   show more ...  

problems and then suggest or carry out corrective actions. […] La entrada Subverting AIOps Systems Through Poisoned Input Data – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Active Directory

Source: www.csoonline.com – Author: Davis Lu hid a ‘logic bomb’ inside his employer’s network that deleted the Active Directory profiles of other employees when his ID was revoked. A software developer who launched disruptive logic bombs inside his employer’s network as an act of revenge has been   show more ...  

sentenced to four years in prison by an […] La entrada Disgruntled developer gets four-year sentence for revenge attack on employer’s network – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Der Industrieversicherungsmakler BüchnerBarella wurde von Hackern gezielt angegriffen. Die Systeme sind aktuell nur eingeschränkt verfügbar. Die Versicherungsbranche ist ein attraktives Ziel für Cyberkriminelle. Jetzt hat es den deutschen Versicherungsmakler   show more ...  

BüchnerBarella getroffen. krissikunterbunt – shutterstock.com Der Gewerbe- und Industrieversicherungsmakler BüchnerBarella wurde nach eigenen Angaben kürzlich von einer Cyberattacke getroffen. „Infolgedessen haben wir […] La entrada Cyberangriff auf Versicherungsmakler BüchnerBarella – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Browser Security

Source: www.csoonline.com – Author: FreeVPN.One silently takes screenshots of users’ activity and transmits them to a remote server, raising enterprise data loss concerns. Chrome extension, FreeVPN.One, has been found secretly capturing screenshots of users’ browsing sessions and transmitting them to a   show more ...  

remote server without consent, according to Koi Security. The extension, which until recently displayed […] La entrada Featured Chrome extension FreeVPN.One caught capturing and transmitting user data – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Oracle verabschiedet sich von seiner langjährigen und bisweilen umstrittenen Security-Entscheiderin. Die CSO von Oracle, Mary Ann Davidson, verlässt das Unternehmen. Tada Images – shutterstock.com Die langjährige CSO (Chief Security Officer) von Oracle, Mary Ann   show more ...  

Davidson, verlässt das Unternehmen unerwartet und beendet damit ihre fast vier Jahrzehnte währende Karriere in der Geschäftsleitung […] La entrada Oracle-CSO mit überraschendem Abgang – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-08
Aggregator history
Friday, August 22
FRI
SAT
SUN
MON
TUE
WED
THU
AugustSeptember