A recent funding crisis involving the Common Vulnerabilities and Exposures (CVE) program sent a wave of panic through the cybersecurity community, raising questions among security professionals about how the potential dissolution of the program would impact their approaches to security triage. The CVE program, which provides a publicly available archive of disclosed vulnerabilities, is highly…
Category: Exploits
Exploits, Global Security News
SonicWall Issues Patch for Exploit Chain in SMA Devices
Three vulnerabilities in SMA 100 gateways could facilitate root RCE attacks, and one of the vulnerabilities has already been exploited in the wild.
AI, Exploits, Global Security News, malware, privacy
Using AI to stop tech support scams in Chrome
Posted by Jasika Bawa, Andy Lim, and Xinghui Lu, Google Chrome Security Tech support scams are an increasingly prevalent form of cybercrime, characterized by deceptive tactics aimed at extorting money or gaining unauthorized access to sensitive data. In a tech support scam, the goal of the scammer is to trick you into believing your computer…
AI, Exploits, Global Security News, malware, privacy
Using AI to stop tech support scams in Chrome
Posted by Jasika Bawa, Andy Lim, and Xinghui Lu, Google Chrome Security Tech support scams are an increasingly prevalent form of cybercrime, characterized by deceptive tactics aimed at extorting money or gaining unauthorized access to sensitive data. In a tech support scam, the goal of the scammer is to trick you into believing your computer…
Exploits, Global Security News
Weaponizing Facebook Ads: Inside the Multi-Stage Malware Campaign Exploiting Cryptocurrency Brands
GUEST RESEARCH: A persistent malvertising campaign is plaguing Facebook, leveraging the reputations of well-known cryptocurrency exchanges to lure victims into a maze of malware. Since Bitdefender Labs started investigating, this evolving threat has posed a serious risk by deploying cleverly disguised front-end scripts and custom payloads on users’ devices, all under the guise of legitimate…
Artificial Intelligence (AI), Exploits, Global Security News, Security
AI Agent for Color Red
AI can automate the analysis, generation, testing, and reporting of exploits. It’s particularly relevant in penetration testing and ethical hacking scenarios.
Artificial Intelligence (AI), Exploits, Global Security News, Security
AI Agent for Color Red
AI can automate the analysis, generation, testing, and reporting of exploits. It’s particularly relevant in penetration testing and ethical hacking scenarios.
Exploits, Global Security News, Security
SonicWall urges admins to patch VPN flaw exploited in attacks
SonicWall has urged its customers to patch three security vulnerabilities affecting its Secure Mobile Access (SMA) appliances, one of them tagged as exploited in attacks […]
Exploits, Global Security News
Confusion Reigns as Threat Actors Exploit Samsung MagicInfo Flaw
Researchers spot in-the-wild exploits of Samsung MagicInfo despite recent patch
Exploits, Global Security News, Security Software, Windows Security, Zero-Day Vulnerabilities
Windows flaw exploited as zero-day by more groups than previously thought
A privilege escalation vulnerability that Microsoft patched as a zero-day in April was known and used by more groups than initially revealed, including the gang behind the Play ransomware that got into one network through a Cisco ASA firewall. When Microsoft patched CVE-2025-29824 on 8 April, the company said the flaw had been exploited against…
AI, APAC, Apps, cyber security, Cybersecurity, Data Breaches, Exploits, Global Security News, helm, Information Security, Network Security, Risk Management, Tutorials
You Trust Your Helm Charts — Here’s Why That’s a Huge Mistake That Could Lead to a Cloud Breach
Helm has revolutionized how Kubernetes applications are deployed. A single helm install can launch a fully functioning stack in seconds. But a new report by Microsoft Defender for Cloud reveals a disturbing truth: many Helm charts are insecure by default, and their convenience often comes at the cost of exposure. The report, The Risk of…
Exploits, Global Security News, Security
Hackers exploit OttoKit WordPress plugin flaw to add admin accounts
Hackers are exploiting a critical unauthenticated privilege escalation vulnerability in the OttoKit WordPress plugin to create rogue admin accounts on targeted sites. […]
Exploits, Global Security News, Microsoft, Security
Play ransomware exploited Windows logging flaw in zero-day attacks
The Play ransomware gang has exploited a high-severity Windows Common Log File System flaw in zero-day attacks to gain SYSTEM privileges and deploy malware on compromised systems. […]
Exploits, Global Security News
OttoKit WordPress Plugin with 100K+ Installs Hit by Exploits Targeting Multiple Flaws
A second security flaw impacting the OttoKit (formerly SureTriggers) WordPress plugin has come under active exploitation in the wild. The vulnerability, tracked as CVE-2025-27007 (CVSS score: 9.8), is a privilege escalation bug impacting all versions of the plugin prior to and including version 1.0.82. “This is due to the create_wp_connection() function missing a capability check…
Exploits, Global Security News, Malware, Messaging Security, Surveillance
Meta wins $168M judgment against spyware seller NSO Group
Israeli surveillance firm NSO Group must pay almost $168 million in damages for exploiting WhatsApp to deploy its notorious Pegasus spyware against users worldwide, the jury in a US court said Tuesday. An eight-person jury granted Meta $444,719 in compensatory damages to cover the costs of addressing the breach, plus an additional $167.25 million in…
Exploits, Global Security News
SysAid Patches 4 Critical Flaws Enabling Pre-Auth RCE in On-Premise Version
Cybersecurity researchers have disclosed multiple security flaw in the on-premise version of SysAid IT support software that could be exploited to achieve pre-authenticated remote code execution with elevated privileges. The vulnerabilities, tracked as CVE-2025-2775, CVE-2025-2776, and CVE-2025-2777, have all been described as XML External Entity (XXE) injections, which occur when an attacker is
Exploits, Global Security News
Critical flaw in AI agent dev tool Langflow under active exploitation
The US Cybersecurity and Infrastructure Security Agency (CISA) has evidence that a critical flaw fixed last month in Langflow is now being exploited the wild. The vulnerability, which can be exploited without authentication to remotely execute arbitrary code on servers was added to CISA’s known exploited vulnerabilities (KEV) catalog, signaling to government agencies and private…
Exploits, Global Security News
Researcher Says Patched Commvault Bug Still Exploitable
CISA added CVE-2025-34028 to its Known Exploited Vulnerabilities catalog, citing active attacks in the wild.
Exploits, Global Security News, Security
Apache Parquet exploit tool detect servers vulnerable to critical flaw
A proof-of-concept exploit has been publicly released for a maximum severity Apache Parquet vulnerability, tracked as CVE-2025-30065, making it easy to find vulnerable servers. […]
Exploits, Global Security News, Security
Samsung MagicINFO 9 Server RCE flaw now exploited in attacks
Hackers are exploiting an unauthenticated remote code execution (RCE) vulnerability in the Samsung MagicINFO 9 Server to hijack devices and deploy malware. […]
Exploits, Global Security News, Security
Critical Langflow RCE flaw exploited to hack AI app servers
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has tagged a Langflow remote code execution vulnerability as actively exploited, urging organizations to apply security updates and mitigations as soon as possible. […]
Exploits, Global Security News
Hackers Exploit Samsung MagicINFO, GeoVision IoT Flaws to Deploy Mirai Botnet
Threat actors have been observed actively exploiting security flaws in GeoVision end-of-life (EoL) Internet of Things (IoT) devices to corral them into a Mirai botnet for conducting distributed denial-of-service (DDoS) attacks. The activity, first observed by the Akamai Security Intelligence and Response Team (SIRT) in early April 2025, involves the exploitation of two operating system…
Exploits, Global Security News, Google, Mobile, Security
Google fixes actively exploited FreeType flaw on Android
Google has released the May 2025 security updates for Android with fixes for 45 security flaws, including an actively exploited zero-click FreeType 2 code execution vulnerability. […]
Commentary, encryption, Exploits, Global Security News, op-ed, signal
After Signal controversy, do private conversations online exist anymore?
Every day, we place our trust in technology. Whether in the boardroom or the living room, technology has become the linchpin of security that protects our most sensitive and private information. And more so than any time in our history, that goes for our conversations, too. Intimate discussions with our spouse or romantic partner. Collaboration…
Exploits, Global Security News
Third Parties and Machine Credentials: The Silent Drivers Behind 2025’s Worst Breaches
It wasn’t ransomware headlines or zero-day exploits that stood out most in this year’s Verizon 2025 Data Breach Investigations Report (DBIR) — it was what fueled them. Quietly, yet consistently, two underlying factors played a role in some of the worst breaches: third-party exposure and machine credential abuse. According to the 2025 DBIR, third-party involvement…
Exploits, Global Security News, News and Trends
SecurityScorecard Supports Partner-Led Service Delivery
SecurityScorecard recently launched MAX Workstation, a solution for service providers managing supply chain cyber risk for their clients. MAX is already the company’s fastest-growing product This new solution enables service delivery teams to utilize AI to enable detection and response across clients’ extended supply chain to drive new revenue and retention. “Since its launch in…
Exploits, Global Security News
Top tips for successful threat intelligence usage
Enterprises looking to stem the tide of breaches and attacks usually end up purchasing a threat intelligence platform (TIP). These can take one of several forms, including a managed cloud-based service or a tightly coupled tool collection that provides a wider risk management profile by tying together threat detection, incident response and vulnerability management. More…
Exploits, Global Security News
Update ASAP: Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers
Google has released its monthly security updates for Android with fixes for 46 security flaws, including one vulnerability that it said has been exploited in the wild. The vulnerability in question is CVE-2025-27363 (CVSS score: 8.1), a high-severity flaw in the System component that could lead to local code execution without requiring any additional execution…
Exploits, Global Security News
Critical Langflow Flaw Added to CISA KEV List Amid Ongoing Exploitation Evidence
A recently disclosed critical security flaw impacting the open-source Langflow platform has been added to the Known Exploited Vulnerabilities (KEV) catalog by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), citing evidence of active exploitation. The vulnerability, tracked as CVE-2025-3248, carries a CVSS score of 9.8 out of a maximum of 10.0. “Langflow contains a…
Exploits, Global Security News, Malware, Phishing
Fake resumes targeting HR managers now come with updated backdoor
CISOs should warn HR staff not to be fooled by a new spear phishing campaign that contains job applications that include updated malware, and take steps to identify and block an improved backdoor. That warning came Monday from researchers at Arctic Wolf, who said a group some researchers know as Venom Spider, or TA4557, has…
Android, Cybersecurity, Exploits, Global Security News, Google, Mobile, Mobile Security, Technology, vulnerabilities
Google addresses 1 actively exploited vulnerability in May’s Android security update
Google addressed 47 vulnerabilities affecting Android devices in its May security update, including an actively exploited software defect that was first disclosed in March. Google said the high-severity vulnerability, CVE-2025-27363, “may be under limited, targeted exploitation.” The out-of-bounds write defect in FreeType versions 2.13.0 and below may result in arbitrary code execution, Facebook said in…
Exploits, Global Security News, Security
New “Bring Your Own Installer” EDR bypass used in ransomware attack
A new “Bring Your Own Installer” EDR bypass technique is exploited in attacks to bypass SentinelOne’s tamper protection feature, allowing threat actors to disable endpoint detection and response (EDR) agents to install the Babuk ransomware. […]
Exploits, Global Security News
Warning issued to retailers’ CISOs worldwide after three attacks in UK
CISOs at retailers around the world should be tightening their defenses after several recent cyber attacks crippled shopping and supermarket chains in the UK. Those included successful attacks on retail chain Marks & Spencer and supermarket chain Co-op, and the attempted hack of high-end retailer Harrods. Over the weekend, the UK National Cyber Security Centre…
Exploits, Global Security News, Mike Waltz, Security, signal, TeleMessage
TeleMessage, a modified Signal clone used by US government officials, has been hacked
A hacker has exploited a vulnerability in TeleMessage, which provides modded versions of encrypted messaging apps such as Signal, Telegram, and WhatsApp, to extract archived messages and other data relating to U.S. government officials and companies who used the tool, 404 Media reported. TeleMessage came into the spotlight last week after it was reported that…
Exploits, Global Security News
Wormable AirPlay Flaws Enable Zero-Click RCE on Apple Devices via Public Wi-Fi
Cybersecurity researchers have disclosed a series of now-patched security vulnerabilities in Apple’s AirPlay protocol that, if successfully exploited, could enable an attacker to take over susceptible devices supporting the proprietary wireless technology. The shortcomings have been collectively codenamed AirBorne by Israeli cybersecurity company Oligo. “These vulnerabilities can be chained by
Exploits, Global Security News
Commvault CVE-2025-34028 Added to CISA KEV After Active Exploitation Confirmed
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a maximum-severity security flaw impacting Commvault Command Center to its Known Exploited Vulnerabilities (KEV) catalog, a little over a week after it was publicly disclosed. The vulnerability in question is CVE-2025-34028 (CVSS score: 10.0), a path traversal bug that affects 11.38 Innovation Release, from versions
Exploits, Global Security News, Mike Waltz, Security, signal, TeleMessage
TeleMessage, a modified Signal clone used by US govt. officials, has been hacked
A hacker has exploited a vulnerability in TeleMessage, which provides modded versions of encrypted messaging apps such as Signal, Telegram and WhatsApp, to extract archived messages and other data relating to U.S. government officials and companies who used the tool, 404 Media reported. TeleMessage came into the spotlight last week after it was reported that…
Exploits, Global Security News
CISA Confirms Exploitation of SonicWall Vulnerabilities
The US Cybersecurity and Infrastructure Security Agency has added two flaws affecting SonicWall products to its catalog of Known Exploited Vulnerabilities
Exploits, Global Security News, Remote Access Security, Vulnerabilities, Windows Security
CISOs should re-consider using Microsoft RDP due to password flaw, says expert
CISOs allowing remote access to Windows machines through Remote Desktop Protocol (RDP) should re-think their strategy after the discovery that changed or revoked passwords can still work, says an expert. “I was unpleasantly surprised” to hear about the vulnerability, David Shipley, head of Canadian security awareness training firm Beauceron Security, said in an interview. “I…
Cybercrime, Cybersecurity, Department of Justice (DOJ), Exploits, extortion, Federal Bureau of Investigation (FBI), Global Security News, Sextortion, The Com, Threats, Unit 221B
Leaders of 764, global child sextortion group, arrested and charged
Two alleged leaders of the child sextortion group 764 were arrested and charged for directing and distributing child sexual abuse material, the Department of Justice said Thursday. Leonidas Varagiannis, 21, and Prasan Nepal, 20, face charges that carry a maximum penalty of life in prison. Varagiannis, also known as “War,” and Nepal, also known as…
Exploits, Global Security News
10 insights on the state of AI security from RSA Conference
As you walk around trying to avoid the 41,000 participants at RSA Conference in San Francisco, you become aware of the Waymo autonomous cars in the streets that always elicit an extra glance. Yes, there is no driver in that seat! Waymo cars aim to revolutionize transportation through fully autonomous driving technology that offers the…
Exploits, Global Security News, Security Bloggers Network
The Rising Threat of Zero-Day Exploits Targeting Enterprise Security Products
Zero-day exploits continue to pose one of the most significant and evolving cybersecurity threats to businesses worldwide. According to a recent report, 75 zero-day vulnerabilities were exploited this year, with 44% of these attacks targeting enterprise security products. These vulnerabilities are particularly dangerous because they are exploited before the vendor can address or patch them,…
data breach, Exploits, Global Security News, hospital, Law & order, malware, pension, Podcast, Scam, Smashing Security
Smashing Security podcast #415: Hacking hijinks at the hospital, and WASPI scams
He’s not a pop star, but Jeffrey Bowie is alleged to have toured staff areas of a hospital in Oklahoma, hunting for computers he could install spyware on. We dive into the bizarre case of the man accused of hacking medical networks and then sharing how he did it on LinkedIn. Plus! Move over Nigerian…
Exploits, Global Security News, Hacker Groups, Malware, Security
Russian APT28 hackers have redoubled efforts during Ukraine war, says French security agency
The war in Ukraine has prompted a resurgence in activity by the notorious Russian APT28/Fancy Bear group, the French ANSSI cybersecurity agency has said. According to a brief report published by the agency this week, Targeting and Compromise of French Entities Using the APT28 Intrusion Set, the group now aggressively targets the networks of government…
Exploits, Global Security News, Security
SonicWall: SMA100 VPN vulnerabilities now exploited in attacks
Cybersecurity company SonicWall has warned customers that several vulnerabilities impacting its Secure Mobile Access (SMA) appliances are now being actively exploited in attacks. […]
Exploits, Global Security News
Kritische Zero-Day-Schwachstelle in SAP NetWeaver
width=”1888″ height=”1062″ sizes=”(max-width: 1888px) 100vw, 1888px”>Hacker könnten über eine Schwachstelle im NetWeaver auf SAP-Systeme zugreifen, Schadcode einschleusen und so die Kontrolle übernehmen. TenPixels – shutterstock.com Angreifer nutzen seit dem 21. April 2025 eine kritische Zero-Day-Schwachstelle in der Visual Composer-Komponente des SAP NetWeaver Application Server aus. SAP hat bereits einen Out-of-Band-Fix veröffentlicht, der über das Support-Portal…
Exploits, Global Security News
Cyberkriminelle passen ihre Angriffsvektoren an
Hacker zielen vermehrt auf KMUs und ihre Edge-Geräte und VPNs. PR Image Factory – shutterstock.com Cyberkriminelle bleiben einfallsreich und machen sich technische Neuerungen schnell sowie effektiv zu nutzen. Sowohl dadurch als auch durch eine gestiegene Sensibilität für vorhandene Angriffsvektoren bei möglichen Opfern ist ein verändertes Muster ihrer Attacken begründet. Im Data Breach Investigation Report (DBIR)…
AI, AI Cybersecurity, Exploits, Global Security News, Government, patching
DARPA believes AI Cyber Challenge could upend patching as the industry knows it
SAN FRANCISCO — Leaders of various federal research agencies and departments outlined a vision Tuesday for the future of critical infrastructure security, emphasizing the promise of combining formal software development methods with large language models (LLMs). Acting DARPA Director Rob McHenry told an audience at the RSAC 2025 Conference that such a combination could “virtually…
Exploits, Global Security News
Enterprise-specific zero-day exploits on the rise, Google warns
Zero-day vulnerabilities may have declined in 2024, but the number of flaws in enterprise products that didn’t have a patch at the time of exploitation is increasing, highlighting the increased focused attackers have in exploiting enterprise software and devices to achieve initial access to corporate networks. “While the historic focus on the exploitation of popular…
Exploits, Global Security News, Security
CISA tags Broadcom Fabric OS, CommVault flaws as exploited in attacks
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning of Broadcom Brocade Fabric OS, Commvault web servers, and Qualitia Active! Mail clients vulnerabilities that are actively exploited in attacks. […]
Exploits, Global Security News, Security, Vulnerabilities
Broadcom-backed SAN devices face code injection attacks via a critical Fabric OS bug
A high severity flaw affecting Broadcom’s Brocade Fabric OS (FOS) has allowed attackers to run arbitrary code on affected environments with full root-level privileges. The flaw, tracked as CVE-2025-1976, is particularly dangerous as it can allow complete takeover of FOS devices, including Fibre switches and directors, which are core to Storage Area Networks (SANs), potentially…
Exploits, Global Security News
Google Reports 75 Zero-Days Exploited in 2024 — 44% Targeted Enterprise Security Products
Google has revealed that it observed 75 zero-day vulnerabilities exploited in the wild in 2024, down from 98 in 2023 but an increase from 63 the year before. Of the 75 zero-days, 44% of them targeted enterprise products. As many as 20 flaws were identified in security software and appliances. “Zero-day exploitation of browsers and…
Exploits, Global Security News
Zero-Day Exploitation Figure Surges 19% in Two Years
Google claims 19% more zero-day bugs were exploited in 2024 than 2022 as threat actors focus on security products
Exploits, Global Security News
Vulnerability Exploitation Is Shifting in 2024-25
The number of vulnerabilities exploited by attacks may not be growing these days, but they are increasingly affecting enterprise technologies.
Exploits, Global Security News, Security
Google: 97 zero-days exploited in 2024, over 50% in spyware attacks
Google’s Threat Intelligence Group (GTIG) says attackers exploited 75 zero-day vulnerabilities in the wild last year, over 50% of which were linked to spyware attacks. […]
Exploits, Global Security News
The state of intrusions: Stolen credentials and perimeter exploits on the rise, as phishing wanes
CISOs seeking insights into the latest cyberattack trends should note that cybercriminals’ initial access methods appear to be shifting, as data from both Verizon and Google-owned Mandiant underscored similar findings about intrusion techniques in separate reports. According to Mandiant, stolen credentials were responsible for more intrusions last year than phishing and were second only to…
Cybersecurity, Exploits, Featured, Global Security News, rsa, RSAC 2025, Security Boulevard (Original), Social - Facebook, Social - LinkedIn, Social - X, Spotlight, Threats & Breaches, vulnerabilities, zero-day vulnerabilities
Desired Effect Marketplace: Researchers Get Their Due, Defenders Get Realtime Info on Zero Days
Desired Effect, if it operates as billed, opens up a world of cutting-edge research to defenders, including zero-day vulnerability data and tailored exploit products. The post Desired Effect Marketplace: Researchers Get Their Due, Defenders Get Realtime Info on Zero Days appeared first on Security Boulevard.
Exploits, Global Security News
CISA Adds Actively Exploited Broadcom and Commvault Flaws to KEV Database
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added two high-severity security flaws impacting Broadcom Brocade Fabric OS and Commvault Web Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerabilities in question are listed below – CVE-2025-1976 (CVSS score: 8.6) – A code injection…
Exploits, Global Security News
SAP NetWeaver Visual Composer Flaw Under Active Exploitation
CVE-2025-31324 is a maximum severity bug that attackers exploited weeks before SAP released a patch for it.
Exploits, Global Security News, Security
Blackpoint Cyber Launches New Platform to ‘Quantify Maturity’
Cybersecurity vendor Blackpoint Cyber today announced its new platform solution. CompassOne offers MSPs capabilities across various security needs and also aims to address what CTO Manoj Srivastava calls the challenge of quantifying MSP and customer maturity. CompassOne shows the next generation of Blackpoint’s approach to the channel The new platform is Blackpoint Cyber’s latest innovation,…
Exploits, Global Security News, Security
Over 1,200 SAP NetWeaver servers vulnerable to actively exploited flaw
Over 1,200 internet-exposed SAP NetWeaver instances are vulnerable to an actively exploited maximum severity unauthenticated file upload vulnerability that allows attackers to hijack servers. […]
Endpoint Protection, Risk Management, Security, Vulnerabilities, Exploits, Global Security News
4 big mistakes you’re probably still making in vulnerability management…and how to fix them
Let’s be honest folks, vulnerability management isn’t the same game it was five years ago. But if you’re still running periodic scans, ‘offering’ updates vs enforcing, and chasing CVSS scores like they’re all that matters, you’re playing by outdated rules. Today’s environments are fast, fragmented, and full of moving targets; all while attackers are evolving…
Exploits, Global Security News
Hackers Exploit Critical Craft CMS Flaws; Hundreds of Servers Likely Compromised
Threat actors have been observed exploiting two newly disclosed critical security flaws in Craft CMS in zero-day attacks to breach servers and gain unauthorized access. The attacks, first observed by Orange Cyberdefense SensePost on February 14, 2025, involve chaining the below vulnerabilities – CVE-2024-58136 (CVSS score: 9.0) – An improper protection of alternate path flaw…
Exploits, Global Security News
Reporting lines: Could separating from IT help CISOs?
Reporting to the CFO instead of the CIO can help CISOs frame cybersecurity in business terms, position cybersecurity as more than a cost center, and reduce conflicts of interest between the CISO and CIO. This unlikely alliance is a way for CISOs to evolve from technical experts to strategic partners and broaden their influence. Daniel…
Exploits, Global Security News
Tenable Research in Verizon DBIR: Additional Research Analysis
GUEST RESEARCH: Vulnerability exploitation surged as the initial access vector for 20% of breaches—a 34% increase year over year and now rivalling the top initial access vector (credential abuse), according to the newly released 2025 Verizon Data Breach Investigation Report (DBIR). To dig deep into this risk, Tenable contributed enriched data on the most exploited…
BSides Las Vegas 2024, cybersecurity education, Exploits, Global Security News, Infosecurity Education, Security Bloggers Network, Security BSides
BSidesLV24 – Ground Truth – Incubated Machine Learning Exploits: Backdooring ML Pipelines Using Input-Handling Bugs
Author/Presenter: Suha Sabi Hussain Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel. Permalink The post BSidesLV24 – Ground Truth – Incubated Machine Learning Exploits: Backdooring ML Pipelines Using Input-Handling Bugs…
Exploits, Global Security News
SAP NetWeaver customers urged to deploy patch for critical zero-day vulnerability
Attackers have been exploiting a critical zero-day vulnerability in the Visual Composer component of the SAP NetWeaver application server since early this week. SAP released an out-of-band fix that’s available through its support portal and it should be applied immediately, especially on systems that are directly exposed to the internet. “Unauthenticated attackers can abuse built-in…
Exploits, Global Security News, Security Bloggers Network
Reducing Remediation Time Remains a Challenge: How Tenable Vulnerability Watch Can Help
Timely vulnerability remediation is an ongoing challenge for organizations as they struggle to prioritize the exposures that represent the greatest risk to their operations. Existing scoring systems are invaluable but can lack context. Here’s how Tenable’s Vulnerability Watch classification system can help. Background Over the past six years working in Tenable’s research organization, I’ve watched…
Exploits, Global Security News, Security
Craft CMS RCE exploit chain used in zero-day attacks to steal data
Two vulnerabilities impacting Craft CMS were chained together in zero-day attacks to breach servers and steal data, with exploitation ongoing, according to CERT Orange Cyberdefense. […]
Exploits, Global Security News, Security Bloggers Network
AI Innovation at Risk: FireTail’s 2025 Report Reveals API Security as the Weak Link in Enterprise AI Strategies – FireTail Blog
Apr 25, 2025 – Alan Fagan – Washington, D.C. — 25th April 2025 — FireTail, the leading AI & API security platform, has released its annual report, The State of AI & API Security 2025, revealing a critical blind spot in the way organizations are securing their AI investments. Despite record-breaking AI adoption, the report…
CVE, Cybercrime, Cybersecurity, Exploits, Global Security News, Research, SAP, Threats, vulnerabilities, zero days
SAP zero-day vulnerability under widespread active exploitation
Threat hunters and security researchers have observed widespread exploitation of a zero-day vulnerability affecting SAP NetWeaver systems. The unrestricted file upload vulnerability — CVE-2025-31324 — has a base score of 10 on the CVSS scale and allows attackers to upload files directly to the system without authorization. The software defect, which affects the SAP Visual…
Exploits, Global Security News
SAP Fixes Critical Vulnerability After Evidence of Exploitation
A maximum severity flaw affecting SAP NetWeaver has been exploited by threat actors
Exploits, Global Security News, Security
SAP fixes suspected Netweaver zero-day exploited in attacks
SAP has released out-of-band emergency updates for NetWeaver to fix an actively exploited remote code execution (RCE) vulnerability used to hijack servers. […]
exploit, Exploitation, Exploits, Global Security News, Malicious AI, Secure AI, Security Bloggers Network, Slopsquatting, vulnerabilities
Cybersecurity Insights with Contrast CISO David Lindner | 04/25/25
Insight No. 1 — Fast code, slow security? Think ADR Consider the scenario: Development teams are pushing code at unprecedented speeds, and vulnerabilities, whether human or AI-generated, are lingering far too long. What’s the logical outcome? Increased exploitation in your production environment. The strategic imperative is clear: We must implement robust detection and response capabilities…
Exploits, Global Security News, Security, Vulnerabilities
Critical Commvault SSRF could allow attackers to execute code remotely
Commvault is warning customers of a critical vulnerability affecting Command Center, a web-based management console for its data protection and backup offerings. The flaw, tracked as CV-2025-34028, could allow remote attackers to execute arbitrary code without authentication on affected Linux as well as Windows installations. “This Commvault vulnerability underscores a significant risk: attackers can exploit…
Exploits, Global Security News
SAP Confirms Critical NetWeaver Flaw Amid Suspected Zero-Day Exploitation by Hackers
Threat actors are likely exploiting a new vulnerability in SAP NetWeaver to upload JSP web shells with the goal of facilitating unauthorized file uploads and code execution. “The exploitation is likely tied to either a previously disclosed vulnerability like CVE-2017-9844 or an unreported remote file inclusion (RFI) issue,” ReliaQuest said in a report published this…
Exploits, Global Security News
Cybercriminals switch up their top initial access vectors of choice
Third-party involvement in breaches and exploitation of vulnerabilities have become more important factors in security breaches, according to the latest edition of Verizon’s Data Breach Investigation Report (DBIR). An analysis of 22,000 security incidents, including 12,195 confirmed data breaches in 139 countries, found that credential abuse (22%) and exploitation of vulnerabilities (20%, up from 14.9%…
Exploits, Global Security News
Researchers Identify Rack::Static Vulnerability Enabling Data Breaches in Ruby Servers
Cybersecurity researchers have disclosed three security flaws in the Rack Ruby web server interface that, if successfully exploited, could enable attackers to gain unauthorized access to files, inject malicious data, and tamper with logs under certain conditions. The vulnerabilities, flagged by cybersecurity vendor OPSWAT, are listed below – CVE-2025-27610 (CVSS score: 7.5) – A path…
Exploits, Global Security News
DslogdRAT Malware Deployed via Ivanti ICS Zero-Day CVE-2025-0282 in Japan Attacks
Cybersecurity researchers are warning about a new malware called DslogdRAT that’s installed following the exploitation of a now-patched security flaw in Ivanti Connect Secure (ICS). The malware, along with a web shell, were “installed by exploiting a zero-day vulnerability at that time, CVE-2025-0282, during attacks against organizations in Japan around December 2024,” JPCERT/CC researcher Yuma
Exploits, Global Security News, Security, Vulnerabilities
As clock ticks, vendors slowly patch critical flaw in AMI MegaRAC BMC firmware
Weeks after BIOS developer AMI released an update fixing a critical vulnerability in its MegaRAC baseband management controller (BMC) firmware used in many enterprise servers and storage systems, OEM patches addressing the issue are slowly trickling out. A BMC is an embedded chip that allows IT teams to monitor, troubleshoot, and control servers remotely via…
CISA, Cybersecurity, Cybersecurity and Infrastructure Security Agency (CISA), Exploits, Global Security News, IBM X-Force, known exploited vulnerabilities (KEV), Mandiant, Research, Verizon Data Breach Investigations Report, Verizon DBIR, VulnCheck, vulnerabilities
VulnCheck spotted 159 actively exploited vulnerabilities in first few months of 2025
Attackers exploited nearly a third of vulnerabilities within a day of CVE disclosure in the first quarter of 2025, VulnCheck said in a report released Thursday. The company, which focuses on vulnerability threat intelligence, identified 159 actively exploited vulnerabilities from 50 sources during the quarter. The time from CVE disclosure to evidence of exploitation in…
Cloud Security, Cybersecurity, Data Security, Endpoint, Exploits, Featured, Global Security News, Google, Incident Response, Industry Spotlight, linux, Mobile Security, Network Security, News, runtime security monitoring, Security Boulevard (Original), Social - Facebook, Social - LinkedIn, Social - X, Spotlight, Threat Intelligence, vulnerabilities
ARMO: io_uring Interface Creates Security ‘Blind Spot’ in Linux
Researchers from security firm ARMO developed a POC rootkit called Curing that showed how the io_uring interface in Linux could be exploited by bad actors to bypass system calls, creating what they calle a “massive security loophole” in the operating system’s runtime security. The post ARMO: io_uring Interface Creates Security ‘Blind Spot’ in Linux appeared…
Exploits, Global Security News
159 CVEs Exploited in Q1 2025 — 28.3% Within 24 Hours of Disclosure
As many as 159 CVE identifiers have been flagged as exploited in the wild in the first quarter of 2025, up from 151 in Q4 2024. “We continue to see vulnerabilities being exploited at a fast pace with 28.3% of vulnerabilities being exploited within 1-day of their CVE disclosure,” VulnCheck said in a report shared…
Exploits, Global Security News, Open Source, Security, Vulnerabilities
GitHub secrets: Deleted files still pose risks
Deleted files within public GitHub repositories could still be exposing secrets like API keys, tokens, and credentials, if threat actors knew where and how to look. Cybersecurity researcher Sharon Brizinov leveraged Git’s version control features to retrieve exposed secrets from these deleted files. Git, an open-source version control tool that developers use to collaborate on…
Exploits, Global Security News
Ransomware the most pervasive threat to US critical infrastructure in 2024, says FBI
Despite successful operations against ransomware gangs in 2024, ransomware was still the most pervasive threat to critical infrastructure in the US last year, according to the FBI’s latest Internet Crime Report. The agency received more than 4,800 cyber threat complaints from critical infrastructure firms in 2024, with the most reported incidents from those providers dealing…
Cybercrime, Cybersecurity, exploit, Exploits, firewall, Fortinet, Global Security News, Google Threat Intelligence Group, ivanti, Mandiant, Palo Alto Networks, Ransomware, Research, routers, Threats, virtual private network (VPN), vulnerabilities
Attackers hit security device defects hard in 2024
Attackers are having a field day with software defects in security devices, according to a new report released Wednesday by Mandiant Exploits were the most common initial infection vector, representing 1 of every 3 attacks in 2024, and the four most frequently exploited vulnerabilities were all contained in edge devices, such as VPNs, firewalls and…
AI, Exploits, Global Security News, Physical Security, Security Bloggers Network, threat models, Uncategorized
Regulating AI Behavior with a Hypervisor
Interesting research: “Guillotine: Hypervisors for Isolating Malicious AIs.” Abstract:As AI models become more embedded in critical sectors like finance, healthcare, and the military, their inscrutable behavior poses ever-greater risks to society. To mitigate this risk, we propose Guillotine, a hypervisor architecture for sandboxing powerful AI models—models that, by accident or malice, can generate existential threats…
Exploits, Global Security News
Verizon’s DBIR Reveals 34% Jump in Vulnerability Exploitation
After a 180% rise in last year’s report, the exploitation of vulnerabilities continues to grow, now accounting for 20% of all breaches
Exploits, Global Security News, Security, Vulnerabilities
Attackers abused a bug within SSL.com to authorize fake certificates
A flaw in SSL.com’s domain control validation (DCV) process allowed attackers to bypass verification and issue fraudulent SSL certificates for any domain linked to certain email providers. According to an exploit demonstrated by a security researcher going by the alias Sec Reporter, attackers could abuse SSL.com’s misinterpretation of email-based validation methods. “SSL.com failed to conduct…
Exploits, Global Security News
Three Reasons Why the Browser is Best for Stopping Phishing Attacks
Phishing attacks remain a huge challenge for organizations in 2025. In fact, with attackers increasingly leveraging identity-based techniques over software exploits, phishing arguably poses a bigger threat than ever before. Attackers are increasingly leveraging identity-based techniques over software exploits, with phishing and stolen credentials (a byproduct of phishing) now the primary
Cloud Security, Exploits, Global Security News
CNAPP buyer’s guide: Top cloud-native app protection platforms compared
Cloud security continues to be a vexing situation, and the tool set continues to become more complex, riddled with acronyms representing possible solutions. Now there’s another: the cloud-native application protection platform, or CNAPP. This tool combines the coverage of four separate products: A cloud infrastructure entitlements manager (CIEM) that manages overall access controls and risk…
Exploits, Global Security News, Security Bloggers Network
Verizon 2025 DBIR: Tenable Research Collaboration Shines a Spotlight on CVE Remediation Trends
The 2025 Verizon Data Breach Investigations Report (DBIR) reveals that vulnerability exploitation was present in 20% of breaches — a 34% increase year-over-year. To support the report, Tenable Research contributed enriched data on the most exploited vulnerabilities. In this blog, we analyze 17 edge-related CVEs and remediation trends across industry sectors. Background Since 2008, Verizon’s…
Cybercrime, Cybersecurity, Cybersecurity and Infrastructure Security Agency (CISA), Data Breaches, Exploitation, Exploits, Global Security News, Ransomware, ransomware payments, Research, Threats, Verizon Data Breach Investigations Report, Verizon DBIR, zero days
Verizon discovers spike in ransomware and exploited vulnerabilities
Cybercriminals and state-sponsored threat groups exploited vulnerabilities and initiated ransomware attacks with vigor last year, escalating the scope of their impact by hitting more victims and outmaneuvering defenses with speed. The rate of ransomware detected in data breaches jumped 37%, occurring in 44% of the 12,195 data breaches reviewed in Verizon’s 2025 Data Breach Investigations…
Exploits, Global Security News, Security
Active! Mail RCE flaw exploited in attacks on Japanese orgs
An Active! Mail zero-day remote code execution vulnerability is actively exploited in attacks on large organizations in Japan. […]
CryptoCurrency, Exploits, Global Security News, Security
Hackers abuse Zoom remote control feature for crypto-theft attacks
A hacking group dubbed ‘Elusive Comet’ targets cryptocurrency users in social engineering attacks that exploit Zoom’s remote control feature to trick users into granting them access to their machines. […]
Exploits, Global Security News, Security Bloggers Network
The AI Bot Epidemic: The Imperva 2025 Bad Bot Report
The AI Bot Epidemic: The Imperva 2025 Bad Bot Report madhav Tue, 04/22/2025 – 17:10 The ubiquity of accessible AI tools has lowered the barrier to entry for threat actors, helping them create and deploy malicious bots at an unprecedented scale. Moreover, generative AI (GenAI) simplifies bot development, which is seeing automated threats evolve swiftly.…
Exploits, Global Security News
‘Cookie Bite’ Entra ID Attack Exposes Microsoft 365
A proof-of-concept (PoC) attack vector exploits two Azure authentication tokens from within a browser, giving threat actors persistent access to key cloud services, including Microsoft 365 applications.
Cybercrime, Cybersecurity, exploit, Exploits, Global Security News, IBM, IBM X-Force, Research, stolen credentials, Threats, vulnerabilities
Attackers stick with effective intrusion points, valid credentials and exploits
IBM X-Force observed an identical breakdown of the top methods cybercriminals used to intrude networks for two years running, the company said in its annual Threat Intelligence Index. The top initial access vectors, valid account credentials and exploitation of public-facing applications, each accounted for 30% of IBM X-Force incident response cases last year. By focusing…
AI, Cybersecurity, data breach, Data Breaches, Exploits, Global Security News, Government & Policy, malware, Network Security, phishing, privacy, Ransomware, Risk Management, Threat Lab
The danger of data breaches — what you really need to know
In today’s digital world, your personal data is like cold hard cash, and that’s why cyberthieves are always looking for ways to steal it. Whether it’s an email address, a credit card number, or even medical records, your personal information is incredibly valuable in the wrong hands. For hackers, breaking into a company database is…
AI, Cybersecurity, data breach, Data Breaches, Exploits, Global Security News, Government & Policy, malware, Network Security, phishing, privacy, Ransomware, Risk Management, Threat Lab
The danger of data breaches — what you really need to know
In today’s digital world, your personal data is like cold hard cash, and that’s why cyberthieves are always looking for ways to steal it. Whether it’s an email address, a credit card number, or even medical records, your personal information is incredibly valuable in the wrong hands. For hackers, breaking into a company database is…