Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Google Slapped with ...

 Compliance

Google is once again in the crosshairs of French regulators. France’s data watchdog, the CNIL, has fined the tech giant €325 million (approximately $381 million) for slipping promotional messages directly into Gmail inboxes and for cookie consent practices that regulators say were more about coercion than choice.   show more ...  

For French users, those little “Promotions” or “Social” tabs inside Gmail weren’t always filled by brands they had subscribed to—they were also stocked with ads that looked and felt like regular emails. CNIL ruled that these weren’t just promotions, but direct marketing messages and under French law, sending them without prior consent was a violation. With nearly 53 million of the Gmail’s more than 76 million users in France viewing these ads, the impact was massive. Consent by Design—or Coercion? It wasn’t just inbox ads. Regulators also took issue with how Google pushed new users into accepting advertising cookies when setting up accounts. Instead of presenting a clear yes-or-no choice, the consent flow leaned heavily toward acceptance, with rejection buried or made less intuitive. The EU’s privacy framework is crystal clear on this matter. Consent has to be freely given, informed, and unambiguous. Google’s setup, CNIL said, fell short. This marks the third time the regulator has sanctioned Google for cookie-related violations, after €100 million in 2020 and €150 million in 2021. The repeated fines suggest a deeper friction between Google’s ad business model and Europe’s stricter privacy guardrails. Regulators with teeth Along with the fine, the CNIL ordered Google to stop placing ads directly in Gmail inboxes in France and to rework its cookie flows. The company has six months to comply, or it will face an additional €100,000 ($117,000) per day in penalties. For CNIL, the point isn’t to kill innovation—it’s about drawing a line around digital rights. People should get to decide if their inboxes double as advertising spaces or if their clicks fuel one of the world’s largest ad engines. Google’s Response Google, for its part, insists it has already made significant changes. “People have always been able to control the ads they see in our products. Over the last two years, as the CNIL has acknowledged, we made additional updates to address their concerns, including an easy way to decline personalized ads in one click when creating a Google account, and changes to the way ads are presented in Gmail. We’re reviewing the decision,” a Google spokesperson told The Cyber Express. Behind the scenes, the company emphasized that Gmail ads are clearly marked and play an important role in keeping the service free. According to Google, three-quarters of French users don’t see Gmail ads at all, and those who do can switch them off at any time. In April 2023, following a European Court of Justice ruling, Google voluntarily rolled out updates to make Gmail ads appear more distinct from user emails. The company also pointed out that it introduced a “Reject All” button in October 2023 during account creation, allowing users to decline personalized ads with a single click. CNIL itself has acknowledged that this addressed the majority of its cookie-related concerns. Still, regulators decided Google’s earlier practices merited a heavy penalty. Fashion Meets fines Google wasn’t the only one to get a reality check. Fast-fashion retailer Shein was hit with a separate €150 million (about $176 million) penalty after CNIL found it was tracking users even when they rejected cookies. Investigators said Shein’s platform continued deploying trackers behind the scenes, creating what the regulator described as an “illusion of control.” With roughly 12 million monthly visitors in France, the violations weren’t minor. As per Reuters, Shein has said it will appeal, calling the fine disproportionate, but CNIL argued the penalty reflects both the scale of the user base and the systemic nature of the problem. This is one of the largest fines ever imposed on a retailer for privacy violations in Europe, and it sends a message to the retail industry that cookie compliance isn’t just a Big Tech issue anymore. Europe’s Long War with Dark Patterns These rulings don’t exist in a vacuum. Across Europe, regulators have been zeroing in on so-called dark patterns—the design tricks that nudge users toward the least privacy-friendly option. Whether it’s a consent box that’s easier to accept than decline, or an opt-out button hidden three clicks away, the CNIL and other EU authorities are calling time on those practices. France has taken a leading role, requiring companies to make “accept” and “reject” cookie options equally visible. Anything else, CNIL argues, undermines real choice. And this isn’t just about rules—it’s about trust. As users grow savvier about how their data is exploited, companies that treat consent as a checkbox risk not only fines but also erosion of their reputation. Half a Billion in Penalties—and Counting Together, the fines against Google and Shein total more than half a billion dollars. For Google, the €325 million hit shows its long-running tension with Europe’s privacy regime. For Shein, the €150 million fine might be even more consequential—it puts retailers, not just tech platforms, firmly under the spotlight. Inboxes and browsing habits aren’t free-for-all advertising spaces any more. In France and increasingly across Europe, privacy is treated as a fundamental right, not an obstacle to business. As Europe sharpens its privacy enforcement, the ripple effects will reach far beyond Paris. Google may be able to absorb the fines as a cost of doing business, but regulators are steadily shifting the calculus. The longer the firms rely on gray-area consent tactics, the higher the price tag. For Shein, the reputational blow may sting just as much as the financial one. A company that already faces criticism over labor and environmental practices now finds itself branded as a repeat offender in the digital space. The bottom line is that Europe is laying down a marker. Whether you’re a search giant or a fast-fashion powerhouse, the age of easy consent tricks is now behind us. Also read: Texas AG Paxton Takes on Google—and Wins $1.375 Billion in Privacy Case

image for Critical Linux UDisk ...

 Firewall Daily

A newly disclosed security flaw in the Linux UDisks daemon has been reported. Tracked as CVE-2025-8067, the out-of-bounds read vulnerability allows local, unprivileged users to access files and data owned by privileged accounts, a serious breach with potentially far-reaching implications.  Red Hat officially   show more ...  

disclosed the vulnerability on August 28, 2025, classifying it as Important in severity and assigning it a preliminary CVSS v3.1 base score of 8.5 out of 10.   Understanding the CVE-2025-8067 Vulnerability  The issue resides within the UDisks daemon, a component responsible for providing a D-BUS interface used to manage storage devices on Linux systems. Among other things, it enables the creation and removal of loop devices, virtual devices that mount files as block devices.  The core of the problem lies in how UDisks handles the file index parameter provided by clients when creating loop devices. While the daemon correctly checks that the index isn’t above the maximum allowed value, it fails to validate whether the index is negative.  This oversight creates an out-of-bounds read vulnerability, as attackers can submit negative indices. The daemon then attempts to access memory locations outside the bounds of the file descriptor list, potentially leading to a crash (denial-of-service) or the disclosure of sensitive memory.   This memory could include cryptographic keys, PII, or user credentials, increasing the risk of local privilege escalation.  Who is Affected?  The vulnerability affects multiple Red Hat Enterprise Linux (RHEL) distributions, specifically:  Red Hat Enterprise Linux 6 (out of support)  Red Hat Enterprise Linux 7, 8, 9, and 10  Impacted packages include:  udisks  udisks2  libudisks2  udisks2-iscsi  udisks2-lsm  udisks2-lvm2  Unless stated otherwise, all minor versions and update streams of the affected packages should be considered vulnerable.  Red Hat's Response and Mitigation  Red Hat’s Product Security Team emphasized the urgency of addressing this vulnerability. The official advisory states:  “This vulnerability has been rated with an Important severity due to the low complexity to exploit it and the possible local privilege execution risk associated with successful exploitation.”  At this time, no workaround or mitigation is available, other than to immediately apply the updated UDisks packages as they become available in Red Hat’s software repositories.  Technical Details and Risk Impact  CVE Identifier: CVE-2025-8067  Vulnerability Type: Out-of-bounds read (CWE-125)  Attack Vector: Local  Privileges Required: None  User Interaction Required: None  Scope: Changed  Confidentiality Impact: Low to Moderate  Integrity Impact: Low  Availability Impact: High  Exploit Complexity: Low  According to Red Hat's CVSS breakdown, the vulnerability could be used to read memory that might contain valuable internal information. This could be leveraged to bypass memory protection mechanisms, like Address Space Layout Randomization (ASLR), or to prepare the ground for further exploit chains.  The CVE-2025-8067 vulnerability in Linux UDisks poses a serious local security risk, enabling attackers to access sensitive data or escalate privileges on shared or compromised systems. With its low complexity and no privilege requirements, it is a direct threat, especially in enterprise environments. Admins are urged to patch affected systems immediately, as detailed in the official CVE databases. 

image for Django Web Vulnerabi ...

 Firewall Daily

A serious Django web vulnerability has been identified, prompting immediate action from the Django web framework development team. The flaw, officially registered as CVE-2025-57833, affects the FilteredRelation feature in Django and could allow attackers to carry out SQL injection attacks. This vulnerability has been   show more ...  

marked as high severity, and users of affected versions are urged to upgrade without delay.  Decoding the CVE-2025-57833 FilteredRelation 3 Vulnerability The vulnerability lies within a feature used to simplify complex database queries by adding extra columns to a query based on filter conditions. While the feature adds valuable flexibility for developers, a gap in input validation has now been discovered that could be exploited in dangerous ways.  Specifically, the FilteredRelation functionality failed to properly sanitize dictionary keys when used with QuerySet.annotate() or QuerySet.alias(). This means a malicious actor could pass in a crafted dictionary via keyword arguments (kwargs) that manipulates how column aliases are generated, ultimately inserting arbitrary SQL code directly into the database query.  Such an exploit could expose sensitive data, compromise database integrity, or allow unauthorized changes to records.  Affected Versions and Patches According to the Django Project, this web vulnerability impacts the following supported versions:  Django 5.2  Django 5.1  Django 4.2  The main development branch  To address this, the Django team has released patched versions:  Django 5.2.6  Django 5.1.12  Django 4.2.24  These patches eliminate the SQL injection risk by fixing the alias generation logic to prevent unsanitized inputs from being processed.  Official Statement from the Django Team In an official security release postdated September 3, 2025, the Django Project team, represented by Sarah Boyce, stated:  “In accordance with our security release policy, the Django team is issuing releases for Django 5.2.6, Django 5.1.12, and Django 4.2.24. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.”  The post further details that CVE-2025-57833 was responsibly disclosed by Eyal Gabay from EyalSec, who identified the issue and reported it privately to the Django team.  How to Apply the Fix The security patches have been merged into Django’s main branch as well as each of the supported release branches. Developers can review and apply the updates using the following commit identifiers:  Main branch: 51711717098d3f469f795dfa6bc3758b24f69ef7  5.2 branch: 4c044fcc866ec226f612c475950b690b0139d243  5.1 branch: 102965ea93072fe3c39a30be437c683ec1106ef5  4.2 branch: 31334e6965ad136a5e369993b01721499c5d1a92  The new versions can be downloaded from the Django website, and each release is signed using PGP key ID 3955B19851EA96EF for integrity verification.  Before deploying to production, developers are strongly advised to test their applications after applying the patch to ensure compatibility and stability.  Final Recommendation To protect applications from the high-severity Django web vulnerability identified as CVE-2025-57833, the Django Project urges all users to upgrade immediately to the patched versions, Django 5.2.6, 5.1.12, or 4.2.24, especially if their applications utilize the FilteredRelation feature or manage sensitive data.   This vulnerability stresses the importance of maintaining up-to-date frameworks and implementing proactive security practices. While the quick response from the Django team and security researchers has mitigated the risk, it is ultimately up to developers and organizations to apply the necessary updates and protect their systems against potential SQL injection threats. 

image for Google Patches 111 A ...

 Firewall Daily

In its latest Android Security Bulletin, Google has confirmed the patching of 111 unique security vulnerabilities, including two zero-day vulnerabilities that were actively exploited in targeted attacks. The most concerning of these involve CVE-2025-48543, a flaw in Android Runtime, and CVE-2025-38352, a bug in the   show more ...  

Linux kernel.  According to Google’s advisory, both CVE-2025-48543 and CVE-2025-38352 are elevation of privilege (EoP) vulnerabilities. These flaws enable attackers to gain elevated system privileges on Android devices without requiring any user interaction or additional execution rights.  “There are indications that the following may be under limited, targeted exploitation: CVE-2025-38352, CVE-2025-48543,” Google stated in the bulletin.  While Google has not released specific details on who might be exploiting these bugs or in what contexts, the acknowledgment of active exploitation stresses the severity of these issues. The company urges users to update their devices immediately to ensure they are protected.  CVE-2025-48543: Android Runtime Vulnerability  This vulnerability affects the Android Runtime (ART) component and was rated as “high” in severity. It affects Android versions 13 through 16. An attacker could leverage this flaw to perform local privilege escalation without requiring any user involvement. The issue has been addressed through Google Play system updates, ensuring that devices with Google Mobile Services (GMS) receive timely protection even outside regular OTA (over-the-air) updates. CVE-2025-38352: Linux Kernel Race Condition  The second critical vulnerability, CVE-2025-38352, resides in the Linux kernel, specifically in the handling of POSIX CPU timers. It stems from a race condition that could be exploited to escalate privileges locally. The vulnerability was first publicly patched in July 2025, and major Linux distributions have since deployed fixes.  Android devices that integrate this kernel version are also now receiving the fix via the September patch rollout. Google classifies this bug as “high” in severity due to its potential to compromise device integrity with little effort from attackers.  September 2025 Patch Details  The September 2025 Android Security Bulletin includes a comprehensive list of vulnerabilities, categorized by component. The bulletin spans flaws in Android Runtime, Framework, System, Kernel, and third-party components from MediaTek, Qualcomm, Arm, and Imagination Technologies.  One of the most severe vulnerabilities patched this month is CVE-2025-48539, a remote code execution (RCE) flaw in the System component that allows attackers to run code remotely without requiring user interaction.   Breakdown of Vulnerability Types  Of the 111 vulnerabilities addressed:  A portion are elevation of privilege (EoP) issues, many of which require no user interaction.  Several denial of service (DoS) vulnerabilities were also patched, including CVE-2025-48538 and CVE-2025-48542, both impacting Android versions 13 through 16.  The Widevine DRM, WiFi, and Google Play system components also received critical patches.  Mitigations and User Protection  Google’s September 2025 Android update highlights the ongoing threat of privilege escalation attacks, with active exploits like CVE-2025-48543 and CVE-2025-38352 reinforcing the need for timely updates.   While protections like Google Play Protect help mitigate many risks, users are urged to install the latest patches and avoid unverified apps. Developers can expect AOSP patches within 48 hours, and all users should ensure their devices are updated to the 2025-09-05 patch level or later for full security. 

image for Black Hat USA 2025 C ...

 Firewall Daily

The Cyber Express, in collaboration with Suraksha Catalyst, has officially released Episode 5 of the Black Hat USA 2025 CISO Podcast Series. The series, which brings together global cybersecurity leaders to share insights from the frontlines, continues to explore some of the most pressing challenges shaping the   show more ...  

industry today. This latest episode of Black Hat USA 2025 CISO Podcast Series features a powerhouse panel of experts: Rohit Kohli, Deputy CISO at Genpact, Sai Iyer, Chief Information Security Officer at Ziff Davis, and Beenu Arora, Co-Founder & CEO of Cyble, who also hosts the discussion. Together, they dive into one of the most debated and consequential topics in cybersecurity today—'AI: The Next Chapter in Cybersecurity Battles.’ AI as a Double-Edged Sword Artificial intelligence (AI) is increasingly viewed as both a transformative opportunity and a significant threat within cybersecurity. On one hand, AI-powered tools are being leveraged to strengthen defenses, automate detection, and respond to threats with greater speed and accuracy. On the other, cybercriminals are adopting the same technology to launch scalable, and adaptive attacks. In Episode 5, the speakers reflect on this duality. They highlight how CISOs must navigate the paradox of AI, harnessing its potential for protection while preparing for the risks it introduces. The CISO’s Evolving Role As the conversation unfolds, Kohli and Iyer share perspectives on how AI is reshaping the role of the CISO. No longer confined to traditional risk management, today’s security leaders must also serve as business strategists, technology visionaries, and change agents. The speakers emphasize that while AI tools can enhance security operations, they are not a replacement for leadership. Instead, AI should be seen as an enabler that allows CISOs to focus on higher-level strategy, resilience planning, and stakeholder engagement. The discussion brings forward an important reminder, human judgment, ethics, and foresight remain irreplaceable in the face of rapidly advancing technologies. Balancing Innovation with Responsibility Another key theme in Episode 5 is the balance between embracing innovation and ensuring responsible use. AI promises to accelerate digital transformation across industries, but security leaders must be vigilant about unintended consequences. For organizations, this means not only deploying AI defensively but also implementing robust governance models, ethical guidelines, and regulatory compliance frameworks. The panel points out that collaboration will be crucial in this journey. Industry leaders, regulators, and technology providers must work together to establish best practices that allow AI to flourish as a force for good while mitigating its misuse. Why This Black Hat USA 2025 CISO Podcast Series Episode Matters Black Hat USA has long been a stage for critical cybersecurity conversations, and the CISO Podcast Series amplifies these discussions by giving leaders a dedicated platform to share their experiences. Black Hat USA 2025 CISO Podcast Series Episode 5 stands out for its timely focus on AI, a technology at the very heart of current security debates. By bringing in perspectives from large enterprises like Genpact and Ziff Davis, along with insights from Cyble’s leadership, the episode offers a balanced and practical take on how to prepare for what’s next. Watch Full Black Hat USA 2025 CISO Podcast Series Episode 5 here Catch Up on the Black Hat USA 2025 CISO Podcast Series The CISO Podcast Series has already featured dynamic discussions in earlier episodes, covering topics from resilience to risk management. If you missed them, here’s where you can catch up: Episode 1 – https://www.youtube.com/watch?v=nJKjC_OnAnc Episode 2 – https://www.youtube.com/watch?v=scMW0XkBWnI Episode 3 – https://www.youtube.com/watch?v=tZD9dNVnTQQ Episode 4- https://www.youtube.com/watch?v=Hf8LgxTuxJw With CISO Podcast Series Episode 5 now live, the series continues to grow as a must-watch for anyone seeking unfiltered insights from those leading cybersecurity programs at the highest level.

image for How the SNI5GECT att ...

 Threats

The flaws and vulnerabilities of cellular networks are regularly exploited to attack subscribers. Malicious actors use devices with catchy names like IMSI Catcher (Stingray) or SMS blaster to track peoples movements and send them spam and malware. These attacks were easiest to carry out on 2G networks, becoming more   show more ...  

difficult on 3G and 4G networks through the introduction of security features. But even 4G networks had implementation flaws that made it possible to track subscriber movements and cause other information leaks. Can we breathe a sigh of relief when we upgrade to 5G? Unfortunately not… An upgrade in reverse Many practical attacks, such as the aforementioned SMS blaster, rely on a downgrade: forcing the victims smartphone to switch to an older communication standard. Legacy standards allow attackers more leeway — from discovering the subscribers unique identifier (IMSI), to sending fake text messages under the guise of real companies. A downgrade typically uses a device that jams the signal of the legitimate carriers base station, and broadcasts its own. However, this method can be detected by the carrier, and it will become less effective in the future as smartphones increasingly incorporate built-in protection against these attacks, which prevents the switch to 2G and sometimes even 3G networks. Researchers at Singapore University of Technology and Design have demonstrated a SNI5GECT attack, which works on the latest 5G networks without requiring easy-to-detect actions like jamming legitimate base station signals. An attacker within a 20-meter radius of the victim can make the target devices modem reboot and then force-switch it to a 4G network, where the subscriber is easier to identify and track. So how does this attack work? Before a device and a 5G base station connect to each other, they exchange some information — and the initial stages of this process arent encrypted. Once they establish a secure, encrypted connection, the base station and the smartphone exchange handshakes, but coordinate the session parameters in a plain, unencrypted format. The attackers device monitors this process and selects the precise moment to inject its own information block before the legitimate base station does. As a result, the victims modem processes malicious data. Depending on the modem and the contents of the data packet, this either causes the modem to switch to a 4G network and refuse to reconnect to said 5G base station, or to crash and reboot. The latter is only good for temporarily disconnecting the victim, while the former brings all known 4G-based surveillance attacks into play. The attack was demonstrated on the OnePlus Nord CE 2, Samsung Galaxy S22, Google Pixel 7, and Huawei P40 Pro smartphones. These devices use completely different cellular modems (MediaTek, Qualcomm, Samsung, Huawei, respectively), but the problem lies in the characteristics of the standard itself — not in the particular smartphones. The differences are subtle: some modems can be rebooted while others cant; on some modems, inserting a malicious packet has a 50% success rate, while on others its 90%. The practicality of SNI5GECT In its current form, the attack is unlikely to become widespread since it has two major limitations. First, the distance between the attacker and the victim cant be over 20 meters under ideal conditions — even less in a real urban environment. Second, if the smartphone and the 5G base station have already established a connection, the attack cannot proceed. The attacker has to wait for a moment when the victims movement or changes in the radio environment require the smartphone to re-register with the base station. This happens regularly, but not every minute, so the attacker has to literally shadow the victim. Still, such conditions may exist in certain situations, like when targeting people attending a specific meeting, or in an airport business lounge, or similar scenarios. The attacker would also need to combine SNI5GECT with legacy 4G/3G/2G attacks to achieve any practical results, which means making some radio noise. SNI5GECT plays a significant role as a stepping stone toward more complex and dangerous future attacks. As 5G becomes more popular and older generations of connectivity are phased out, researchers will increasingly work with the new radio protocol, and apply their findings to the next stages of the mobile arms race. Currently, there is no defense against 5G attacks. Disabling 5G for protection is pointless, as the smartphone just switches to a 4G network, which is exactly what hypothetical attackers want. Therefore, we have three pieces of advice: Regularly patch and update your smartphones OS — this usually also updates the modem firmware to fix bugs and vulnerabilities. Turn on airplane mode before confidential meetings; to be super-safe — leave your device at home. Consider disabling legacy communication standards (2G/3G) on your smartphone — we discussed the pros and cons of this solution in our post on SMS blasters.

 Government

The General Court of the Court of Justice of the European Union ruled against a French lawmaker who had challenged the EU-U.S. Data Privacy Framework, citing the fact that a U.S. data protection court provides independent oversight of U.S. intelligence agencies and their potential surveillance of Europeans’ data.

 Feed

Cybersecurity researchers have flagged a new technique that cybercriminals have adopted to bypass social media platform X's malvertising protections and propagate malicious links using its artificial intelligence (AI) assistant Grok. The findings were highlighted by Nati Tal, head of Guardio Labs, in a series of posts on X. The technique has been codenamed Grokking. The approach is designed to

 Feed

The French data protection authority has fined Google and Chinese e-commerce giant Shein $379 million (€325 million) and $175 million (€150 million), respectively, for violating cookie rules. Both companies set advertising cookies on users' browsers without securing their consent, the National Commission on Informatics and Liberty (CNIL) said. Shein has since updated its systems to comply with

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added two security flaws impacting TP-Link wireless routers to its Known Exploited Vulnerabilities (KEV) catalog, noting that there is evidence of them being exploited in the wild. The vulnerabilities in question are listed below - CVE-2023-50224 (CVSS score: 6.5) - An authentication bypass by spoofing vulnerability

 Feed

The Russian state-sponsored hacking group tracked as APT28 has been attributed to a new Microsoft Outlook backdoor called NotDoor in attacks targeting multiple companies from different sectors in NATO member countries. NotDoor "is a VBA macro for Outlook designed to monitor incoming emails for a specific trigger word," S2 Grupo's LAB52 threat intelligence team said. "When such an email is

 Feed

Cybersecurity researchers have lifted the lid on a previously undocumented threat cluster dubbed GhostRedirector that has managed to compromise at least 65 Windows servers primarily located in Brazil, Thailand, and Vietnam. The attacks, per Slovak cybersecurity company ESET, led to the deployment of a passive C++ backdoor called Rungan and a native Internet Information Services (IIS) module

 AI

Your AI reads the small print, and that's a problem. This week in episode 433 of "Smashing Security" we dig into LegalPwn - malicious instructions tucked into code comments and disclaimers that sweet-talks AI into rubber-stamping dangerous payloads (or even pretending they’re a harmless calculator).   show more ...  

Meanwhile, new research from Anthropic reveals that hackers have already used AI gents to break into networks, steal passwords, sift through stolen data, and even write custom ransom notes. In other words, one hacker with an AI helper can work like an entire team of cybercriminals. All this and much more is discussed in the latest edition of the award-winning "Smashing Security" podcast with computer security veteran Graham Cluley, joined this week by Mark Stockley.

 'Cyber

Source: sec.cloudapps.cisco.com – Author: . Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Information Disclosure Vulnerability Medium CVE-2025-20270 CWE-200 Download CSAF Email Summary A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager   show more ...  

(EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attacker to obtain sensitive information from an affected […] La entrada Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Information Disclosure Vulnerability – Source:sec.cloudapps.cisco.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A malicious campaign targeting developers through npm and GitHub repositories has been uncovered, featuring an unusual method of using Ethereum smart contracts to conceal command-and-control (C2) infrastructure. The campaign first came to light in early July when   show more ...  

ReversingLabs researcher Karlo Zanki discovered a package named “colortoolsv2” on npm. The package was quickly […] La entrada Malicious npm Packages Exploit Ethereum Smart Contracts – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Researchers at Spanish cybersecurity provider S2 Grupo have observed a new Outlook backdoor that enables threat actors to exfiltrate data, upload files and execute commands on a victim’s computer. S2 Grupo’s  threat intelligence lab, LAB52, shared its   show more ...  

findings in a report published on September 3. The threat analysts dubbed this backdoor […] La entrada Russian APT28 Expands Arsenal with ‘NotDoor’ Outlook Backdoor – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A large Internet Protocol Television (IPTV) piracy network spanning more than 1100 domains and over 10,000 IP addresses has been uncovered by cybersecurity researchers. The operation, active for several years, has reportedly impacted more than 20 well-known   show more ...  

entertainment and sports brands. The Silent Push investigation linked the piracy network to two […] La entrada Major IPTV Piracy Network Uncovered Spanning 1100 Domains – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloudflare

Source: www.infosecurity-magazine.com – Author: Cloudflare and Palo Alto Networks are the latest big names to have had their Salesforce instances accessed by threat actors via the Salesloft Drift app, the firms have revealed. In a post yesterday, Cloudflare said it became aware of suspicious activity in its   show more ...  

Salesforce tenant last week. “Our investigation showed the threat […] La entrada Cloudflare and Palo Alto Networks Victimized in Salesloft Drift Breach – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Written by New techniques have been developed within the Tycoon phishing kit to hide malicious links in email attacks, researchers from Barracuda have warned. The use of URL encoding, among other new techniques, are designed to better obscure, muddle and disrupt   show more ...  

the structure of malicious links. “This is intended to confuse […] La entrada Tycoon Phishing Kit Utilizes New Capabilities to Hide Malicious Links – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Nate Nelson, Contributing Writer The Homeland Justice APT tried spying on countries and organizations from six continents, using more than 100 hijacked email accounts. Original Post URL: https://www.darkreading.   show more ...  

com/cyberattacks-data-breaches/iran-mois-50-embassies-ministries-intl-orgs Category & Tags: – Views: 0 La entrada Iran MOIS Phishes 50+ Embassies, Ministries, Int’l Orgs – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Robert Lemos, Contributing Writer With the continued success of North Korea’s IT worker scams, Asia-Pacific nations are working with private firms to blunt the scheme’s effectiveness. Original Post URL: https://www.darkreading.   show more ...  

com/cybersecurity-operations/japan-south-korea-north-korean-it-worker-scam Category & Tags: – Views: 0 La entrada Japan, South Korea Take Aim at North Korean IT Worker Scam – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Rob Wright The notorious Russian state-sponsored hacking unit, also known as Fancy Bear, is abusing Microsoft Outlook for covert data exfiltration. Original Post URL: https://www.darkreading.com/endpoint-security/apt28-outlook-notdoor-backdoor Category & Tags: –   show more ...  

Views: 0 La entrada Russia’s APT28 Targets Microsoft Outlook With ‘NotDoor’ Malware – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Fahmida Y. Rashid While trawling Internet scan data for signs of compromised infrastructure, researchers found that asset owners may not know for years their devices had been hacked. Original Post URL: https://www.darkreading.   show more ...  

com/endpoint-security/hacked-routers-linger-on-the-internet-for-years-data-shows Category & Tags: – Views: 0 La entrada Hacked Routers Linger on the Internet for Years, Data Shows – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Elizabeth Montalbano, Contributing Writer A “sophisticated” attack that also exploits an Apple zero-day flaw is targeting a specific group of iPhone users, potentially with spyware. Original Post URL: https://www.darkreading.   show more ...  

com/cyberattacks-data-breaches/whatsapp-bug-zero-click-iphone-attacks Category & Tags: – Views: 0 La entrada WhatsApp Bug Anchors Targeted Zero-Click iPhone Attacks – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.lastwatchdog.com – Author: bacohido By Byron V. Acohido A quiet but consequential change is reshaping the foundations of online trust. Related: CISA on quantum readiness Starting in 2026, TLS certificate lifespans will shrink in stages — from 200 days, to 100, and eventually just 47 by 2029. The   show more ...  

shift marks a sharp departure from […] La entrada Critical Insight Q&A: As digital trust compresses, resilience will require automation and scale – Source: www.lastwatchdog.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Gary Warner A new round of mobile phish is imitating the State of California’s “Franchise Tax Board” in a round of phishing sites that are gaining prominence in the past few days. I visited ftb.ca-gov-sg[.]top/notice from a burner phone to see how the   show more ...  

scheme works (the page doesn’t load from the […] La entrada California Tax Refund Mobile Phish – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Mary Henry Scaling Kubernetes isn’t just about launching containers—it’s about choosing support models that truly let developers innovate instead of drowning in operational noise. Recently, I read Kathie Clark’s excellent blog, “What I Got Wrong About Cloud   show more ...  

Managed Services (And Why It Matters).” It got me thinking about my own experience […] La entrada Why Misconceptions About Cloud Managed Services Can Cost You – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: securityboulevard.com – Author: Jeffrey Burt Cloudflare, Palo Alto Networks, and Zscaler are the latest among hundreds of victims of an expanding data-stealing attack by the UNC6395 threat group that is exploiting compromised OAuth tokens associated with Salesloft’s Drift app to access   show more ...  

organizations’ Salesforce tenants and exfiltrate customer data. The post Salesloft Drift Breach Rolls […] La entrada Salesloft Drift Breach Rolls Up Cloudflare, Palo Alto, Zscaler and Others – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 AI

Source: securityboulevard.com – Author: Michael Vizard A survey of 264 professionals that maintain websites based on the WordPress content management system (CMS) finds 96% have been impacted by at least one security incident/event, with just under two-thirds of those respondents (64%) having suffered a full   show more ...  

breach. Conducted by Melapress, a provider of cybersecurity plug-ins for […] La entrada Survey Surfaces Raft of WordPress Cybersecurity Concerns – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A new agentic AI-powered tool for red teams is already being abused by threat actors to rapidly accelerate and simplify vulnerability exploitation, Check Point has warned. Hexstrike-AI is built around an abstraction and orchestration “brain.” This uses AI   show more ...  

agents to run over 150 cybersecurity tools to perform tasks such as penetration […] La entrada Threat Actors Abuse Hexstrike-AI Tool to Accelerate Exploitation – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Healthcare organizations (HCOs) are among the slowest at remediating serious vulnerabilities, leaving systems and data exposed for weeks or even months, according to Cobalt. The penetration testing firm drew on a decade of internal data, as well as a survey of 500   show more ...  

US security leaders, to produce its State of Pentesting […] La entrada Healthcare Sector Takes 58 Days to Resolve Serious Vulnerabilities – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: sec.cloudapps.cisco.com – Author: . Cisco Unified Communications Manager IM & Presence Service Cross-Site Scripting Vulnerability Medium CVE-2025-20330 CWE-79 Download CSAF Email Summary A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence   show more ...  

Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack […] La entrada Cisco Unified Communications Manager IM & Presence Service Cross-Site Scripting Vulnerability – Source:sec.cloudapps.cisco.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: sec.cloudapps.cisco.com – Author: . Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Vulnerabilities Medium CVE-2025-20335 CVE-2025-20336 CWE-200 CWE-284 Download CSAF Email Summary Multiple vulnerabilities in the directory permissions of Cisco Desk   show more ...  

Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video […] La entrada Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Vulnerabilities – Source:sec.cloudapps.cisco.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.techrepublic.com – Author: J.R. Johnivan Published September 4, 2025 We may earn from vendors via affiliate links or sponsorships. This might affect product placement on our site, but not the content of our reviews. See our Terms of Use for details. A rash of SSD failures have prompted some users to   show more ...  

blame a recent […] La entrada Is a Recent Windows Update Responsible for SSD Failures? Microsoft Has an Answer – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Artificial Intelligence

Source: www.techrepublic.com – Author: Megan Crouse Topic — Artificial Intelligence Published September 3, 2025 Claude AI creator Anthropic plans to use the money from its latest funding round for enterprise products, safety research and expanding internationally. Anthropic’s Dario Amodei and Daniela Amodei.   show more ...  

Image: Anthropic The AI craze has propelled Anthropic to a $183 billion post-money […] La entrada ‘Unprecedented Growth’ by Anthropic: This AI Startup is Now Valued at $183B – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.techrepublic.com – Author: Fiona Jackson We may earn from vendors via affiliate links or sponsorships. This might affect product placement on our site, but not the content of our reviews. See our Terms of Use for details. Google has debunked the recent reports that it was alerting its billions of   show more ...  

Gmail users to a […] La entrada Google Says Claims of Mass Gmail Security Breach Are ‘Entirely False’ – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Paul Kunert Sainsbury’s, Britain’s second-largest supermarket chain, has caught the attention of privacy campaigners by launching an eight-week trial of live facial recognition (LFR) tech in two of its stores to curb shoplifting. A survey of the grocer’s   show more ...  

customers in July indicated a majority support for the use of LFR to […] La entrada Sainsbury’s eyes up shoplifters with live facial recognition – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Simon Sharwood France’s data protection authority levied massive fines against Google and SHEIN for dropping cookies on customers without securing their permission, and also whacked Google for showing ads in email service. The Commission nationale de l’informatique   show more ...  

et des libertés (CNIL) announced the fines on Wednesday, and explained it found Google […] La entrada France fines Google, SHEIN for undercooked cookie policies that led to crummy privacy – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Bounty

Source: go.theregister.com – Author: Iain Thomson The US State Department has put a $10 million bounty on the heads of three Russians accused of being intelligence agents hacking America’s critical infrastructure – primarily via old Cisco kit, it seems. The alert directly connects them to reports of   show more ...  

the Russian Federal Security Service’s (FSB) Center 16 […] La entrada US puts $10M bounty on three Russians accused of attacking critical infrastructure – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 AI

Source: www.schneier.com – Author: Bruce Schneier Anthropic reports on a Claude user: We recently disrupted a sophisticated cybercriminal that used Claude Code to commit large-scale theft and extortion of personal data. The actor targeted at least 17 distinct organizations, including in healthcare, the   show more ...  

emergency services, and government and religious institutions. Rather than encrypt the stolen […] La entrada Generative AI as a Cybercrime Assistant – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A newly identified hacking group has compromised at least 65 Windows servers worldwide, primarily in Brazil, Thailand and Vietnam. According to ESET researchers, the group, named GhostRedirector, deployed two previously unknown tools: a C++ backdoor called Rungan   show more ...  

and a malicious Internet Information Services (IIS) module known as Gamshen. Rungan enables attackers […] La entrada GhostRedirector Emerges as New China-Aligned Threat Actor – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-09
Aggregator history
Thursday, September 04
MON
TUE
WED
THU
FRI
SAT
SUN
September