Eurofiber France disclosed a data breach it discovered late last week when hackers gained access to its ticket management system by exploiting a vulnerability and exfiltrated information. […]
Category: Exploits
CISA, Cybersecurity, Cybersecurity and Infrastructure Security Agency (CISA), Exploits, Global Security News, Research, Threats
Fortinet’s delayed alert on actively exploited defect put defenders at a disadvantage
Federal authorities and researchers alerted organizations Friday to a massively exploited vulnerability in Fortinet’s web application firewall. While the actively exploited critical defect poses significant risk to Fortinet’s customers, researchers are particularly agitated about the vendor’s delayed communications and, ultimately, post-exploitation warnings about the vulnerability. Fortinet addressed CVE-2025-64446 in a software update pushed Oct. 28,…
Exploits, Global Security News, Vulnerability Management
Critical Imunify360 AV vulnerability threatens widespread website compromise
Millions of websites could be subjected to arbitrary code execution and total server compromise in malware intrusions exploiting a critical vulnerability in the antivirus system of CloudLinux’s all-around server security platform Imunify360, reports Security Affairs.
Exploits, Global Security News, Security
Cork Cyber Launches Vantage Platform for Cyber Risk Intelligence
Cork Cyber has launched Vantage, a Cyber Risk Intelligence platform designed to give MSPs and their customers a clearer way to see, manage, and validate cyber risk. A ‘radar’ for security tech stacks According to the cyber risk intelligence and resilience company, Vantage marks their expansion beyond warranties and into a broader platform that delivers…
Cybercrime, Malware, Ransomware, Security, Exploits, Global Security News
Akira ransomware expands to Nutanix AHV, raising stakes for enterprise security
The Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI and several international partners, has issued a new advisory warning organizations about the growing threat posed by the Akira ransomware group to critical infrastructure. The latest update shows the ransomware group has expanded its capabilities beyond VMware ESXi and Hyper-V environments and is now…
Exploits, Global Security News
North Korea’s ‘Job Test’ trap upgrades to JSON malware dropboxes
North Korea-linked Contagious Interview campaign is now luring developers with trojanized coding tasks and pulling obfuscated payloads from public JSON-storage services like JSON Keeper, JSONSilo, and npoint.io. An NVISO Labs analysis of the campaign shows threat actors sending fake recruiter messages and demo projects that include configuration values pointing to JSON storage URLs. Those JSON…
Exploits, Global Security News, Security
How to implement Zero Trust effectively amid rising cyber threats
In the era of cloud-first distributed enterprises where people collaborate across time zones and device types, the Zero Trust security methodology is increasingly key. According to research by Foundry, over half of organizations either have Zero Trust in production or are piloting it. The Zero Trust security market is expected to be worth $88.8bn by…
Breaking News, cyber crime, Exploits, Global Security News, hacking, malware
RondoDox expands botnet by exploiting XWiki RCE bug left unpatched since February 2025
RondoDox botnet exploits unpatched XWiki flaw CVE-2025-24893 to gain RCE and infect more servers, despite fixes released in February 2025. RondoDox is targeting unpatched XWiki servers via critical RCE flaw CVE-2025-24893 (CVSS score of 9.8), pulling more devices into its botnet despite patches released in Feb 2025. The XWiki Platform is a generic wiki framework…
Exploits, Global Security News, Time to Patch
Microsoft Patch Tuesday, November 2025 Edition
Microsoft this week pushed security updates to fix more than 60 vulnerabilities in its Windows operating systems and supported software, including at least one zero-day bug that is already being exploited. Microsoft also fixed a glitch that prevented some Windows 10 users from taking advantage of an extra year of security updates, which is nice…
Breaking News, Cybercrime, data breach, Exploits, Global Security News, hacking, malware
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 71
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter 9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure Gootloader Returns: What Goodies Did They Bring? Active Water Saci Campaign Spreading Via WhatsApp Features Multi-Vector…
Breaking News, Cybercrime, data breach, Exploits, Global Security News, hacking, Security
Security Affairs newsletter Round 550 by Pierluigi Paganini – INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Multiple Vulnerabilities in GoSign Desktop lead to Remote Code Execution U.S. CISA adds Fortinet FortiWeb flaw to…
Exploits, Global Security News
Honeypot: FortiWeb CVE-2025-64446 Exploits, (Sat, Nov 15th)
Like many have reported, we too noticed exploit attempts for CVE-2025-64446 in our honeypots. These are POST requests to this path: With this User Agent String: And this is the data of the POST request: This creates a new admin user (profile: prof_admin). You can find this JSON data back in this PoC. Didier Stevens…
Breaking News, CISA, Exploits, Fortinet FortiWeb, Global Security News, hacking, Security
U.S. CISA adds Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Fortinet FortiWeb flaw, tracked as CVE-2025-64446 (CVSS score of 9.1), to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is a relative path traversal issue in Fortinet FortiWeb 8.0.0…
Exploits, Global Security News
Worm flooding npm registry with token stealers still isn’t under control
A coordinated token farming campaign continues to flood the open source npm registry, with tens of thousands of infected packages created almost daily to steal tokens from unsuspecting developers using the Tea Protocol to reward coding work. On Thursday, researchers at Amazon said there were over 150,000 packages in the campaign. But in an interview…
CISA, cisco, cyber attack, Exploits, Global Security News, Security
CISA Warns of Active Attacks on Cisco ASA and Firepower Flaws
CISA issues an urgent directive for all organizations to patch Cisco ASA and Firepower devices against CVE-2025-20362 and CVE-2025-20333, exploited in the ArcaneDoor campaign. Verify the correct version now!
Exploits, Global Security News, Security
Fortinet confirms silent patch for FortiWeb zero-day exploited in attacks
Fortinet has silently patched a critical zero-day vulnerability in its FortiWeb web application firewall, which is now being widely exploited. […]
Exploits, Global Security News, Network Security, Security, Zero Trust
Arista, Palo Alto bolster AI data center security
Arista Networks and Palo Alto Networks have extended their partnership to offer customers a framework for implementing zero-trust security inside the data center. The new framework is intended to offer customers a way to blend networking control and management activities with security policies to allow integrated automation and consistent enforcement across the enterprise. In the past,…
Breaking News, Exploits, Global Security News, hacking, hacking news, Imunify360, Security
Millions of sites at risk from Imunify360 critical flaw exploit
A vulnerability affecting Imunify360 lets attackers run code via malicious file uploads, risking millions of websites. A vulnerability in ImunifyAV/Imunify360 allows attackers to upload malicious files to shared servers and execute arbitrary code, potentially exposing millions of websites, cybersecurity firm Patchstack warns. The flaw in Imunify360 AV before v32.7.4.0 lets attacker‑supplied malware trigger dangerous PHP…
Exploits, Global Security News
Microsoft Office Russian Dolls, (Fri, Nov 14th)
You probably know what are the Russian or Matryoshka dolls. It’s a set of wooden dolls of decreasing size placed one inside another[1]. I found an interesting Microsoft Office document that behaves like this. There was a big decrease in malicious Office documents due to the new Microsoft rules to prevent automatic VBA macros execution. But they remain used, especially RTF…
Breaking News, Exploits, Fortinet FortiWeb WAF, Global Security News, hacking, hacking news, Security
Critical FortiWeb flaw under attack, allowing complete compromise
A Fortinet FortiWeb auth-bypass flaw is being actively exploited, allowing attackers to hijack admin accounts and fully compromise devices. Researchers warn of an authentication bypass flaw in Fortinet FortiWeb WAF that allows full device takeover. The cybersecurity vendor addressed the vulnerability with the release version 8.0.2. A security flaw lets anyone break into FortiWeb devices…
Exploits, Global Security News, Microsoft, Operating Systems, Security, Vendors and Providers, Windows
Be thankful: November’s Patch Tuesday has just one zero-day
This November Patch Tuesday update offers a much reduced set of updates, with only 63 Microsoft patches and (only) one zero-day (CVE-2025-62215) affecting the Windows desktop platform. Microsoft SQL Server has returned with a single update, so the Readiness team suggests a standard patch release schedule for Microsoft Office, Developer tools and Microsoft browsers. (Windows…
Exploits, Global Security News
Copy-paste vulnerability hit AI inference frameworks at Meta, Nvidia, and Microsoft
Cybersecurity researchers have uncovered a chain of critical remote code execution (RCE) vulnerabilities in major AI inference server frameworks, including those from Meta, Nvidia, Microsoft, and open-source projects such as vLLM and SGLang. According to Oligo Security, these vulnerabilities stand out for the way they propagated. Developers copied code containing insecure patterns across projects, effectively…
Exploits, Global Security News
Fighting AI with AI: Adversarial bots vs. autonomous threat hunters
I recently gave a presentation at SecTor on proactive threat hunting, which sparked some meaty conversations afterward on the show floor. On the expo floor, surrounded by “AI-first” security vendors, the CISOs and threat hunters I spoke with were worried. They’re worried because AI can elevate script kiddies into elite hackers with advanced capabilities and…
Exploits, Global Security News
Fortinet FortiWeb Flaw Actively Exploited in the Wild Before Company’s Silent Patch
Cybersecurity researchers are sounding the alert about an authentication bypass vulnerability in Fortinet Fortiweb WAF that could allow an attacker to take over admin accounts and completely compromise a device. “The watchTowr team is seeing active, indiscriminate in-the-wild exploitation of what appears to be a silently patched vulnerability in Fortinet’s FortiWeb product,” Benjamin Harris,
Breaking News, cyber crime, Cybercrime, data breach, Exploits, Global Security News, hacking
Washington Post notifies 10,000 individuals affected in Oracle-linked data theft
The Washington Post alerts nearly 10,000 employees and contractors that personal and financial data was exposed in the Oracle breach. The Washington Post warns nearly 10,000 staff and contractors that personal and financial data was exposed in the Oracle breach. The popular newspaper has approximately 2.5M digital subscribers. Between July 10 and August 22, threat…
Exploits, Global Security News, Security
Fortinet FortiWeb flaw with public PoC exploited to create admin users
A Fortinet FortiWeb path traversal vulnerability is being actively exploited to create new administrative users on exposed devices without requiring authentication […]
Exploits, Global Security News
Agentic AI opens door to new ID challenges: Report
New research released Thursday by Rubrik Zero Labs finds that the AI wave, and in particular agentic AI, has created a “troubling gap between the expanding identity attack surface and organizations’ ability to recover from resulting compromises.” According to the report, Identity Crisis: Understanding & Building Resilience Against Identity-Driven Threats, the result is a surge…
Cybercrime, Cybersecurity, Exploits, Global Security News, Government, Ransomware
FBI calls Akira ‘top five’ ransomware variant out of 130 targeting US businesses
Federal cyber authorities shared new details Thursday about the Akira ransomware group’s techniques, the tools it uses and vulnerabilities it exploits for initial access alongside the release of a joint cybersecurity advisory. Members of the financially motivated group, which initially appeared in March 2023, are associated with other threat groups, including Storm-1567, Howling Scorpius, Punk…
Exploits, Global Security News, Security
RCE flaw in ImunifyAV puts millions of Linux-hosted sites at risk
The ImunifyAV malware scanner for Linux server, used by tens of millions of websites, is vulnerable to a remote code execution vulnerability that could be exploited to compromise the hosting environment. […]
Clop, Cybercrime, Cybersecurity, Exploits, Global Security News, Ransomware, Uncategorized
Washington Post confirms data on nearly 10,000 people stolen from its Oracle environment
The Washington Post said it, too, was impacted by the data theft and extortion campaign targeting Oracle E-Business Suite customers, compromising human resources data on nearly 10,000 current and former employers and contractors. The company was first alerted to the attack and launched an investigation when a “bad actor” contacted the media company Sept. 29…
AI, Android, android security, Apps, Exploits, Global Security News, Risk Management
Rust in Android: move fast and fix things
Posted by Jeff Vander Stoep, Android Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we look at how this approach isn’t just fixing things, but helping us move faster. The 2025 data continues to validate the approach,…
AI, Android, android security, Apps, Exploits, Global Security News, Risk Management
Rust in Android: move fast and fix things
Posted by Jeff Vander Stoep, Android Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we look at how this approach isn’t just fixing things, but helping us move faster. The 2025 data continues to validate the approach,…
Exploits, Global Security News
Zero-day exploits hit Cisco ISE and Citrix systems in an advanced campaign
The Amazon Threat Intelligence team has now disclosed an advanced persistent threat (APT) campaign that exploited vulnerabilities in Citrix systems and Cisco’s Identity Service Engine (ISE), allowing hackers to breach critical identity infrastructure even before the flaws were made publicly known. According to Amazon’s findings, attackers had exploited “insufficient input validation” in a public API…
Exploits, Global Security News, Security
CISA warns feds to fully patch actively exploited Cisco flaws
CISA warned federal agencies to fully patch two actively exploited vulnerabilities in Cisco Adaptive Security Appliances (ASA) and Firepower devices. […]
Exploits, Global Security News
When Attacks Come Faster Than Patches: Why 2026 Will be the Year of Machine-Speed Security
The Race for Every New CVE Based on multiple 2025 industry reports: roughly 50 to 61 percent of newly disclosed vulnerabilities saw exploit code weaponized within 48 hours. Using the CISA Known Exploited Vulnerabilities Catalog as a reference, hundreds of software flaws are now confirmed as actively targeted within days of public disclosure. Each new…
Breaking News, CISA, Exploits, Global Security News, hacking, hacking news, Security
U.S. CISA adds WatchGuard Firebox, Microsoft Windows, and Gladinet Triofox flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds WatchGuard Firebox, Microsoft Windows, and Gladinet Triofox flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added WatchGuard Firebox, Microsoft Windows, and Gladinet Triofox flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: CVE-2025-9242 WatchGuard Firebox…
Exploits, Global Security News, Technology
Real Estate Giant Redfin Exposed Users’ Personal Info on Listing Contact Forms
Because of a website security snafu, the online real estate platform Redfin made random users’ names, email addresses, and phone numbers available to others who log onto listings. The vulnerability lasted less than a week, the company said. The personal identification information became visible to other users who were viewing real estate listings. The information…
Exploits, Global Security News, Security
CISA warns of WatchGuard firewall flaw exploited in attacks
CISA has ordered federal agencies to patch an actively exploited vulnerability in WatchGuard Firebox firewalls, which allows attackers to gain remote code execution on compromised devices. […]
Breaking News, citrix, Exploits, Global Security News, hacking, Security
Amazon alerts: advanced threat actor exploits Cisco ISE & Citrix NetScaler zero-days
Amazon warns that an advanced threat actor exploited zero-days in Cisco ISE and Citrix NetScaler to deploy custom malware. Amazon’s threat intelligence researchers spotted an advanced threat actor exploiting two previously undisclosed zero-day flaws in Cisco Identity Service Engine (ISE) and Citrix NetScaler ADC to deliver custom malware. Attackers also exploited multiple undisclosed vulnerabilities. Amazon’s…
Exploits, Global Security News
CISA Flags Critical WatchGuard Fireware Flaw Exposing 54,000 Fireboxes to No-Login Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting WatchGuard Fireware to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability in question is CVE-2025-9242 (CVSS score: 9.3), an out-of-bounds write vulnerability affecting Fireware OS 11.10.2 up to and including
Exploits, Global Security News
Google asks US court to shut down Lighthouse phishing-as-a-service operation
Google is asking to a US court for help in dismantling the infrastructure behind the Lighthouse phishing-as-a-service operation, the latest effort by a technology company to use the legal system to put a dent in cybercrime. Whether it will do more than that is an open question. In a blog Monday, Google’s general counsel Halimah…
Exploits, Global Security News
Legacy fax-modem driver becomes a 2025 security nightmare with CVE-2025-24990 now actively exploited
A dusty driver inside Microsoft Windows, shipping for years and years and no doubt on your own Windows PC right now, has erupted into a serious security threat. CVE-2025-24990 has been added to CISA’s known exploited vulnerabilities list, with Microsoft confirming active exploitation in the wild.
Amazon, Cybercrime, Cybersecurity, Exploits, Global Security News, Research, Threats
Amazon pins Cisco, Citrix zero-day attacks to APT group
Amazon’s threat intelligence team said it observed an advanced persistent threat group exploiting zero-day vulnerabilities affecting Cisco Identity Service Engine and Citrix NetScaler products before the vendors disclosed and patched the defects last summer. Amazon’s MadPot honeypot service detected active exploitation of the critical defects — CVE-2025-5777 in Citrix and CVE-2025-20337 in Cisco — and…
Cybercrime, Cybersecurity, Exploits, Global Security News, Threats
Maryland man faces federal charges for crimes allegedly linked to 764
A 20-year-old Maryland man allegedly associated with violent extremist group 764 is in federal custody, facing charges for sexual exploitation of children, online coercement and enticement, and cyberstalking. Erik Lee Madison, of Halethorpe, Maryland, is accused of victimizing at least five children this fall, including one as young as 13 at the time. His alleged…
Exploits, Global Security News
Amazon Uncovers Attacks Exploited Cisco ISE and Citrix NetScaler as Zero-Day Flaws
Amazon’s threat intelligence team on Wednesday disclosed that it observed an advanced threat actor exploiting two then-zero-day security flaws in Cisco Identity Service Engine (ISE) and Citrix NetScaler ADC products as part of attacks designed to deliver custom malware. “This discovery highlights the trend of threat actors focusing on critical identity and network access control…
Exploits, Global Security News, Security
Hackers exploited Citrix, Cisco ISE flaws in zero-day attacks
An advanced threat actor exploited the critical vulnerabilities “Citrix Bleed 2” (CVE-2025-5777) in NetScaler ADC and Gateway, and CVE-2025-20337 affecting Cisco Identity Service Engine (ISE) as zero-days to deploy custom malware. […]
Exploits, Global Security News
Microsoft Fixes 63 Security Flaws, Including a Windows Kernel Zero-Day Under Active Attack
Microsoft on Tuesday released patches for 63 new security vulnerabilities identified in its software, including one that has come under active exploitation in the wild. Of the 63 flaws, four are rated Critical and 59 are rated Important in severity. Twenty-nine of these vulnerabilities are related to privilege escalation, followed by 16 remote code execution,…
Exploits, Global Security News
Microsoft Fixes Windows Kernel Zero Day in November Patch Tuesday
Microsoft has patched a zero-day vulnerability in the Windows Kernel under active exploitation by threat actors
Breaking News, Exploits, Global Security News, hacking, Security
Synology patches critical BeeStation RCE flaw shown at Pwn2Own Ireland 2025
Synology fixed a critical BeeStation RCE flaw (CVE-2025-12686) shown at Pwn2Own, caused by unchecked buffer input allowing code execution. Synology patched a critical remote code execution (RCE) flaw, tracked as CVE-2025-12686 (CVSS score 9.8), in BeeStation, demonstrated during the hacking competition Pwn2Own Ireland 2025. BeeStation is a plug-and-play device that turns traditional storage into a…
ANYRUN, Cybersecurity, Cybersecurity Lifehacks, Exploits, Global Security News, Malware Analysis, malware behavior
ClickFix Explosion: Cross-Platform Social Engineering Turns Users Into Malware Installers
Eric Parker, a recognized cybersecurity expert, has recently released a video on ClickFix attacks, their detection, analysis, and gathering threat intelligence. Here is our recap highlighting the key points and practical advice. ClickFix as the Signature Threat of 2025 In 2025 the internet saw a sharp surge in a deceptively simple but highly effective social-engineering…
ANYRUN, Cybersecurity, Cybersecurity Lifehacks, Exploits, Global Security News, Malware Analysis, malware behavior
ClickFix Explosion: Cross-Platform Social Engineering Turns Users Into Malware Installers
Eric Parker, a recognized cybersecurity expert, has recently released a video on ClickFix attacks, their detection, analysis, and gathering threat intelligence. Here is our recap highlighting the key points and practical advice. ClickFix as the Signature Threat of 2025 In 2025 the internet saw a sharp surge in a deceptively simple but highly effective social-engineering…
Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, Security
Microsoft Patch Tuesday security updates for November 2025 fixed an actively exploited Windows Kernel bug
Microsoft fixed over 60 flaws, including an actively exploited Windows kernel zero-day, in its latest Patch Tuesday updates. Microsoft’s Patch Tuesday security updates for November 2025 addressed 63 vulnerabilities impacting Windows and Windows Components, Office and Office Components, Microsoft Edge (Chromium-based), Azure Monitor Agent, Dynamics 365, Hyper-V, SQL Server, and the Windows Subsystem for Linux…
Exploits, Global Security News, Security, Security Software, Threat and Vulnerability Management, Vulnerabilities, Zero-Day Vulnerabilities
November Patch Tuesday: Zero day Windows kernel flaw in servers, controllers, and PCs
A zero day elevation of privilege Windows kernel flaw in servers, controllers, and desktops is being actively exploited and needs to be patched immediately. That’s the advice of Satnam Narang, senior staff research engineer at Tenable, on one of the two biggest vulnerabilities that needs to be addressed from among the 63 holes identified by…
Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, Security
SAP fixed a maximum severity flaw in SQL Anywhere Monitor
SAP fixed 19 security issues, including a critical flaw in SQL Anywhere Monitor with hardcoded credentials that could enable remote code execution. SAP addressed 19 security vulnerabilities, including a critical flaw in SQL Anywhere Monitor, with the release of November 2025 notes. The vulnerability, tracked as CVE-2025-42890 (CVSS score of 10/10), is an insecure key…
Cybersecurity, Exploits, Global Security News, Microsoft, Technology, Threats
Microsoft Patch Tuesday addresses 63 defects, including one actively exploited zero-day
Microsoft addressed 63 vulnerabilities affecting its underlying systems and core products, including one actively exploited zero-day, the company said in its latest monthly security update. The zero-day vulnerability — CVE-2025-62215 — affects the Windows Kernel and has a CVSS rating of 7.0 due to a high attack complexity, according to Microsoft. Exploitation, which could allow…
AI, AI Security, Amazon, Cybersecurity, Exploits, Global Security News, Research
Amazon rolls out AI bug bounty program
Amazon became the latest company to open its large language models to outside security researchers, announcing the creation of a new bug bounty program for the tech giant’s AI tools. The program will allow select third-party researchers and academic teams to prod NOVA, Amazon’s suite of foundational AI models and receive compensation for their findings.…
Exploits, Global Security News, Security
Hackers abuse Triofox antivirus feature to deploy remote access tools
Hackers exploited a critical vulnerability and the built-in antivirus feature in Gladinet’s Triofox file-sharing and remote-access platform to achieve remote code execution with SYSTEM privileges. […]
Exploits, Global Security News
Microsoft Patch Tuesday for November 2025, (Tue, Nov 11th)
Today’s Microsoft Patch Tuesday offers fixes for 80 different vulnerabilities. One of the vulnerabilities is already being exploited, and five are rated as critical. Notable Vulnerabilities: %%cve:2025-62215%%: This vulnerability is already being exploited. It is a privilege escalation vulnerability in the Windows Kernel. These types of vulnerabilities are often exploited as part of a more…
Exploits, Global Security News, Microsoft, Security
Microsoft November 2025 Patch Tuesday fixes 1 zero-day, 63 flaws
Today is Microsoft’s November 2025 Patch Tuesday, which includes security updates for 63 flaws, including one actively exploited zero-day vulnerability. […]
Exploits, Global Security News
Android Devices Targeted By KONNI APT in Find Hub Exploitation
A new cyber-attack has been observed exploiting Google Find Hub to remotely wipe Android devices, linked to North Korean APTs
Exploits, Global Security News
Qilin Ransomware Activity Surges as Attacks Target Small Businesses
Qilin group ransomware incidents have surged in SMBs, exploiting security gaps and collaborating with Scattered Spider threat group
Exploits, Global Security News, Helpdesk, ITSM & Other Tools, News and Trends
ConnectWise Announces Asio Platform Enhancements
ConnectWise, an IT-focused business management platform, recently announced advancements to its cybersecurity and data protection capabilities within its Asio platform, along with enhancements spanning Remote Monitoring and Management (RMM), Professional Service Automation (PSA), and Robotic Process Automation (RPA). ConnectWise aims to prepare partners for ‘autonomous service’ The enhancements are meant to enable managed service providers…
Exploits, Global Security News
Microsoft publishes 66 new vulnerabilities in November Patch Tuesday
GUEST OPINION: Microsoft is publishing 66 new vulnerabilities, which is far fewer than we’ve come to expect in recent months. There’s a lone exploited-in-the-wild zero-day vulnerability, which Microsoft assesses as critical severity, although there’s apparently no public disclosure yet. Three critical remote code execution (RCE) vulnerabilities are patched today; happily, Microsoft currently assesses all three as…
Exploits, Global Security News
Hackers Exploit Critical Flaw in Gladinet’s Triofox File Sharing Product
Threat actors were exploiting vulnerable versions of Triofox after a patched version was released, said Google Cloud researchers
Exploits, Global Security News, Security, Vulnerabilities
North Korean hackers exploit Google’s safety tools for remote wipe
North Korea-linked threat actors have found a novel way to weaponize Google’s own security ecosystem, using it to wipe espionage data from victim phones remotely. According to findings by Genians Security Center (GSC), the attackers leveraged the Android device-tracing and management service “Find Hub” to remotely wipe data on Android phones and tablets. “While Find…
Breaking News, Cyber warfare, Exploits, Global Security News, intelligence, malware, Security
North Korea-linked Konni APT used Google Find Hub to erase data and spy on defectors
North Korea-linked APT Konni posed as counselors to steal data and wipe Android phones via Google Find Hub in Sept 2025. Genians Security Center researchers warn that the North Korea-linked Konni APT group (aka Kimsuky, Earth Imp, TA406, Thallium, Vedalia, and Velvet Chollima) posed as counselors to hack Android and Windows, stealing data and wiping phones…
Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, IT Information Security
U.S. CISA adds Samsung mobile devices flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Samsung mobile devices flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Samsung mobile devices flaw, tracked as CVE-2025-21042 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. The now-patched Samsung Galaxy flaw CVE-2025-21042 was exploited as a zero-day…
Breaking News, Exploits, Global Security News, hacking, hacking news, Security
Critical Triofox bug exploited to run malicious payloads via AV configuration
Hackers exploited Triofox flaw CVE-2025-12480 to bypass auth and install remote access tools via the platform’s antivirus feature. Google’s Mandiant researchers spotted threat actors exploiting a now-patched Triofox flaw, tracked as CVE-2025-12480 (CVSS score of 9.1) that allows them to bypass authentication to upload and run remote access tools via the platform’s antivirus feature. Mandiant…
Exploits, Global Security News
How GlassWorm wormed its way back into developers’ code — and what it says about open source security
Pervasive, evasive malware thought to have been eliminated has wormed its way back into development environments. Just a little over two weeks after GlassWorm was declared “fully contained and closed” by the open source OpenVSX project, the self-propagating worm is once again targeting Visual Studio Code extensions, add-ons that enhance open source VS Code, providing…
Cybersecurity, Exploits, Global Security News, Research, Technology, Threats
What’s left to worry (and not worry) about in the F5 breach aftermath
Researchers aren’t very concerned about the dozens of undisclosed F5 vulnerabilities a nation-state attacker stole during a prolonged attack on F5’s internal systems. Yet, the heist of sensitive intelligence from a widely used vendor’s internal network resembles previous espionage-driven attacks that could pose long-term consequences downstream. F5, which became aware of the attack Aug. 9…
Exploits, Global Security News
Hackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus Feature
Google’s Mandiant Threat Defense on Monday said it discovered n-day exploitation of a now-patched security flaw in Gladinet’s Triofox file-sharing and remote access platform. The critical vulnerability, tracked as CVE-2025-12480 (CVSS score: 9.1), allows an attacker to bypass authentication and access the configuration pages, resulting in the upload and execution of arbitrary payloads. The
Exploits, Global Security News, Security
CISA orders feds to patch Samsung zero-day used in spyware attacks
CISA ordered U.S. federal agencies today to patch a critical Samsung vulnerability that has been exploited in zero-day attacks to deploy LandFall spyware on devices running WhatsApp. […]
Exploits, Global Security News, Security
Popular JavaScript library expr-eval vulnerable to RCE flaw
A critical vulnerability in the popular expr-eval JavaScript library, with over 800,000 weekly downloads on NPM, can be exploited to execute code remotely through maliciously crafted input. […]
Exploits, Global Security News
Whisper Leak uses a side channel attack to eavesdrop on encrypted AI conversations
Researchers at Microsoft have revealed a new side channel attack named Whisper Leak that can reveal the topic of encrypted conversations between users and language models, even without access to the underlying text. The discovery highlights a growing blind spot in AI security where encryption alone no longer guarantees privacy in model interactions. Microsoft’s Security…
Exploits, Global Security News, Security, Vulnerabilities
Runtime bugs break container walls, enabling root on Docker hosts
Three newly disclosed high-severity bugs in the “runc” container runtime let attackers break out of containers despite standard hardening and isolation controls. According to Aleksa Sarai, a senior software engineer at SUSE and an OCI board member, the bugs stem from logic flaws in how runc handles writes to certain procfs files, letting attackers inside…
Exploits, Global Security News
Researchers trick ChatGPT into prompt injecting itself
AI chatbots have opened a new frontier of attack vectors against users and their data, and not even industry leaders are immune. Following recent flaws discovered in Google’s Gemini and Anthropic’s Claude, it’s now ChatGPT’s turn. Researchers from security firm Tenable discovered seven ways attackers could trick ChatGPT into disclosing private information from users’ chat…
Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, malware
Nine NuGet packages disrupt DBs and industrial systems with time-delayed payloads
Nine NuGet packages by “shanhai666” can deploy delayed payloads to disrupt databases and industrial systems. Socket’s Threat Research Team discovered nine malicious NuGet packages, published between 2023 and 2024 by “shanhai666,” that can deploy time-delayed payloads to disrupt databases and industrial control systems. Scheduled to trigger in August 2027 and November 2028, the packages were…
Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, Security
QNAP fixed multiple zero-days in its software demonstrated at Pwn2Own 2025
QNAP patched seven zero-days used at Pwn2Own 2025 affecting QTS, QuTS hero, Hyper Data Protector, Malware Remover, and HBS 3. Taiwanese vendor QNAP patched seven zero-day vulnerabilities exploited at Pwn2Own Ireland 2025. The flaws affected QTS, QuTS hero, Hyper Data Protector, Malware Remover, and HBS 3 Hybrid Backup Sync. The vulnerabilities addressed by the company…
Exploits, Global Security News, Security
Dangerous runC flaws could allow hackers to escape Docker containers
Three newly disclosed vulnerabilities in the runC container runtime used in Docker and Kubernetes could be exploited to bypass isolation restrictions and get access to the host system. […]
Breaking News, Cybercrime, data breach, Exploits, Global Security News, hacking, malware
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 70
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter SesameOp: Novel backdoor uses OpenAI Assistants API for command and control Weaponized Military Documents Deliver Advanced SSH-Tor Backdoor to Defense Sector Gootloader Returns: What Goodies Did They Bring? Ransomvibing appears in VS Code extensions …
Breaking News, Cybercrime, data breach, Exploits, Global Security News, hacking, Security
Security Affairs newsletter Round 549 by Pierluigi Paganini – INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. China-linked hackers target U.S. non-profit in long-term espionage campaign A new Italian citizen was targeted with…
Breaking News, Exploits, Global Security News, Graphite Spyware, hacking, intelligence, Security
A new Italian citizen was targeted with Paragon’s Graphite spyware. We have a serious problem
An Italian political adviser was targeted with Paragon’s Graphite spyware, becoming the fifth Italian in the ongoing government surveillance activity. Italian political adviser Francesco Nicodemo said he was targeted with Paragon’s Graphite spyware, becoming the fifth Italian in the ongoing government surveillance activity. Graphite is an invasive, non-auditable spyware that covertly accesses sensitive phone data;…
Breaking News, Exploits, Global Security News, malware, Mobile, Security
LANDFALL spyware exploited Samsung zero-day CVE-2025-21042 in Middle East attacks
A now-patched Samsung Galaxy flaw, tracked as CVE-2025-21042, was exploited as a zero-day to deploy LANDFALL spyware in targeted attacks in Middle East. Samsung patched a flaw exploited as a zero-day, tracked as CVE-2025-21042 (CVSS score of 8.8), to deploy LANDFALL spyware on Galaxy devices in Middle East attacks. “Unit 42 researchers have uncovered a…
Exploits, Global Security News, Security
QNAP fixes seven NAS zero-day flaws exploited at Pwn2Own
QNAP has fixed seven zero-day vulnerabilities that security researchers exploited to hack QNAP network-attached storage (NAS) devices during the Pwn2Own Ireland 2025 competition. […]
Exploits, Global Security News, Mobile, Security
New LandFall spyware exploited Samsung zero-day via WhatsApp messages
A threat actor exploited a zero-day vulnerability in Samsung’s Android image processing library to deploy a previously unknown spyware called ‘LandFall’ using malicious images sent over WhatsApp. […]
Exploits, Global Security News
Samsung Zero-Click Flaw Exploited to Deploy LANDFALL Android Spyware via WhatsApp
A now-patched security flaw in Samsung Galaxy Android devices was exploited as a zero-day to deliver a “commercial-grade” Android spyware dubbed LANDFALL in targeted attacks in the Middle East. The activity involved the exploitation of CVE-2025-21042 (CVSS score: 8.8), an out-of-bounds write flaw in the “libimagecodec.quram.so” component that could allow remote attackers to execute arbitrary
Exploits, Geopolitics, Global Security News, privacy, Research, Threats
New Landfall spyware apparently targeting Samsung phones in Middle East
A new commercial-grade spyware has apparently been targeting Samsung Galaxy phones in the Middle East, but it’s not clear who’s behind it, researchers said in a blog post Friday. Whoever’s responsible, they seized upon a previously unknown, unpatched vulnerability known as a zero-day — a flaw Samsung has since closed, the researchers from Palo Alto…
Exploits, Global Security News, Security
Cisco: Actively exploited firewall flaws now abused for DoS attacks
Cisco warned this week that two vulnerabilities, which have been exploited in zero-day attacks, are now being abused to force ASA and FTD firewalls into reboot loops. […]
Exploits, Global Security News, Security
ID verification laws are fueling the next wave of breaches
ID laws are forcing companies to store massive amounts of sensitive data, turning compliance into a security risk. Acronis explains how integrated backup and cybersecurity platforms help MSPs reduce complexity and close the gaps attackers exploit. […]
Commentary, Compliance, Cybersecurity, Exploits, Global Security News, op-ed, Policy
The quiet revolution: How regulation is forcing cybersecurity accountability
Cybersecurity headlines still focus on the headline-grabbing moments, whether it’s the latest breach, a zero-day exploit, or an eye-catching product launch. However, beneath the surface noise, a quieter but more profound transformation is taking place—driven by regulations that are changing the way organizations think about, approach, and communicate on security.” Across the globe, new standards…
Exploits, Global Security News
Defending digital identity from computer-using agents (CUAs)
For years, organizations have relied on passwords and multi-factor authentication (MFA) based on shared secrets like SMS codes and one-time passwords (OTPs) as the foundation of identity security. The rise of computer-using agents (CUAs) will accelerate attackers’ ability to automate and scale phishing and credential-stuffing attacks with minimal effort. As a result, adopting phishing-resistant credentials…
Breaking News, cisco, Exploits, Global Security News, hacking, Security
Cisco fixes critical UCCX flaw allowing Root command execution
Cisco patched a critical flaw in its Unified Contact Center Express (UCCX) software that allowed attackers to execute commands with root privileges. Cisco released security updates to address a critical vulnerability, tracked as CVE-2025-20354 (CVSS score 9.8), in the Unified Contact Center Express (UCCX) software. An attacker can exploit the flaw to execute commands with root…
APT, Cyber warfare, Exploits, Global Security News, hacking, hacking news, malware
Russia-linked APT InedibleOchotense impersonates ESET to deploy backdoor on Ukrainian systems
Russia-linked group InedibleOchotense used fake ESET installers in phishing attacks on Ukrainian targets in May 2025. Russia-linked group InedibleOchotense used trojanized ESET installers in phishing attacks against Ukrainian entities detected in May 2025. The campaign used emails and Signal messages to deliver trojanized ESET installers that installed both legitimate software and the Kalambur backdoor. “Another…
Exploits, Global Security News, Network Security, Security, Technology Industry, Vulnerabilities
Cisco fixes critical flaws in Unified Contact Center Express
Cisco released patches for two critical vulnerabilities in its Unified Contact Center Express (CCX) that could allow attackers to bypass authentication and execute commands as root on the underlying system. The company also warned today about a new attack variation targeting two previously patched vulnerabilities in its Secure Firewall Adaptive Security Appliance (ASA) and Secure…
Breaking News, cyber crime, Exploits, Global Security News, hacking, malware
Clop Ransomware group claims the breach of The Washington Post
The Clop Ransomware group claims the breach of The Washington Post and added the American daily newspaper to its Tor data leak site. The Clop Ransomware group announced the hack of the prestigious American daily newspaper The Washington Post. The cybercrime group created a page for the university on its Tor data leak site and announced it will…
Cyberattacks, Cybercrime, Data Breach, Security, Exploits, Global Security News
Nikkei’s Slack breach leaks sensitive data from more than 17,000 users
Japanese media company Nikkei has confirmed that a security breach of its Slack accounts has potentially leaked highly sensitive information from more than 17,000 of its users. Consultants point to the incident as yet another reminder of the dangers when non-corporate devices are allowed to access confidential corporate data. “An employee’s personal computer was infected…
Exploits, Global Security News
Nikkei’s Slack breach leaks sensitive data from more than 17,000 users
Japanese media company Nikkei has confirmed that a security breach of its Slack accounts has potentially leaked highly sensitive information from more than 17,000 of its users. Consultants point to the incident as yet another reminder of the dangers when non-corporate devices are allowed to access confidential corporate data. “An employee’s personal computer was infected…
Breaking News, Exploits, Global Security News, hacking, Security
Cisco became aware of a new attack variant against Secure Firewall ASA and FTD devices
Cisco warns of a new attack variant exploiting CVE-2025-20333 and CVE-2025-20362 in Secure Firewall ASA and FTD devices. Cisco warned of a new attack variant targeting vulnerable Secure Firewall ASA and FTD devices by exploiting the vulnerabilities CVE-2025-20333 and CVE-2025-20362. “On November 5, 2025, Cisco became aware of a new attack variant against devices running…
Cybercrime, Cybersecurity, Exploits, Global Security News, Ransomware, Technology, Threats
SonicWall pins attack on customer portal to undisclosed nation-state
SonicWall said a state-sponsored threat actor was behind the brute-force attack that exposed firewall configuration files of every customer that used the company’s cloud backup service. The vendor pinned the responsibility for the attack on an undisclosed nation state Tuesday, after Mandiant concluded its investigation into the incident. SonicWall did not attribute the attack to…
Exploits, Global Security News
“I Paid Twice” Phishing Campaign Targets Booking.com
Experts have uncovered large-scale phishing exploiting Booking.com, Airbnb and Expedia accounts, targeting hotels and customers