The infamous BlueKeep flaw from 2019, tracked as CVE-2019-0708, has come back to haunt security professionals as reports of fresh, in-the-wild abuse surface. The dangerous, “wormable” RCE flaw affecting Microsoft’s remote desktop protocol (RDP) was exploited in a new campaign by North Korea-backed Kimsuky APT, targeting vulnerable South Korean and Japanese systems. South Korean cybersecurity…
Category: Exploits
Exploits, Global Security News, Patch Management Software, Penetration Testing, Threat and Vulnerability Management
Generative AI is making pen-test vulnerability remediation much worse
Technical, organizational, and cultural factors are preventing enterprises from resolving vulnerabilities uncovered in penetration tests — a problem the advent of generative AI is exacerbating rather than relieving. According to a study by penetration testing as a service firm Cobalt, organizations fix less than half of all exploitable vulnerabilities (48%), a figure that drops to…
Exploits, Global Security News, Network Security, Security, Vulnerabilities
Public exploits already available for a severity 10 Erlang SSH vulnerability; patch now
Experts are urging enterprises to immediately patch an Erlang/OTP Secure Shell (SSH) vulnerability that allows unauthenticated attackers to gain full access to a device. The remote code execution (RCE) vulnerability (CVE-2025-32433) has a CVSS score of 10, the highest possible severity level. Many impacted devices are widely used in Internet of Things (IoT) and telecom…
Exploits, Global Security News, Israel, Jamal Khashoggi, NSO Group, privacy, Spyware, Technology, U.S. courts, WhatsApp
Judge limits evidence about NSO Group customers, victims in damages trial
A federal judge last week placed strict limits on the kind of evidence NSO Group can raise during a trial on damages in the lawsuit WhatsApp brought against the spyware vendor over allegations it hacked 1,400 of the messaging platform’s users. Under the order, NSO Group is prohibited from presenting evidence about its customers’ identities,…
Exploits, Global Security News
Kimsuky Exploits BlueKeep RDP Vulnerability to Breach Systems in South Korea and Japan
Cybersecurity researchers have flagged a new malicious campaign related to the North Korean state-sponsored threat actor known as Kimsuky that exploits a now-patched vulnerability impacting Microsoft Remote Desktop Services to gain initial access. The activity has been named Larva-24005 by the AhnLab Security Intelligence Center (ASEC). “In some systems, initial access was gained through
Exploits, Global Security News, Security, Vulnerabilities
ASUS patches critical router flaw that allows remote attacks
ASUS is urging customers with AiCloud enabled on their ASUS routers to immediately upgrade firmware against a critical vulnerability that allows unauthorized activities by remote actors. Tracked as CVE-2025-2492, the vulnerability is an authentication bypass issue receiving a critical severity rating of CVSS 9.2 out of 10. “An improper authentication control vulnerability exists in certain…
Exploits, Global Security News
Hackers Abuse Russian Bulletproof Host Proton66 for Global Attacks and Malware Delivery
Cybersecurity researchers have disclosed a surge in “mass scanning, credential brute-forcing, and exploitation attempts” originating from IP addresses associated with a Russian bulletproof hosting service provider named Proton66. The activity, detected since January 8, 2025, targeted organizations worldwide, according to a two-part analysis published by Trustwave SpiderLabs last week. “Net
Exploits, Global Security News, Security
Critical Erlang/OTP SSH RCE bug now has public exploits, patch now
Public exploits are now available for a critical Erlang/OTP SSH vulnerability tracked as CVE-2025-32433, allowing unauthenticated attackers to remotely execute code on impacted devices. […]
Exploits, Global Security News, Security Bloggers Network
CVE-2025-32433: Erlang/OTP SSH Unauthenticated Remote Code Execution Vulnerability
Proof-of-concept code has been released after researchers disclosed a maximum severity remote code execution vulnerability in Erlang/OTP SSH. Successful exploitation could allow for complete takeover of affected devices. Background On April 16, Fabian Bäumer, Marcus Brinkmann, Marcel Maehren, and Jörg Schwenk of the Ruhr University Bochum in Germany disclosed a critical vulnerability in Erlang/OTP SSH…
Exploits, Global Security News, Security
SonicWall SMA VPN devices targeted in attacks since January
A remote code execution vulnerability affecting SonicWall Secure Mobile Access (SMA) appliances has been under active exploitation since at least January 2025, according to cybersecurity company Arctic Wolf. […]
Authentication, Exploits, Global Security News, Identity & Access, Security Bloggers Network
Understanding Credential Stuffing: A Growing Cybersecurity Threat
Credential stuffing is a pervasive and increasingly sophisticated cyberattack that exploits the widespread habit of password reuse among users. By […] The post Understanding Credential Stuffing: A Growing Cybersecurity Threat appeared first on Security Boulevard.
Exploits, Global Security News
CVE-2025-24054 Under Active Attack—Steals NTLM Credentials on File Download
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a medium-severity security flaw impacting Microsoft Windows to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. The vulnerability, assigned the CVE identifier CVE-2025-24054 (CVSS score: 6.5), is a Windows New Technology LAN Manager (NTLM) hash disclosure
Exploits, Global Security News, Security
Windows NTLM hash leak flaw exploited in phishing attacks on governments
A Windows vulnerability that exposes NTLM hashes using .library-ms files is now actively exploited by hackers in phishing campaigns targeting government entities and private companies. […]
Exploits, Global Security News
NTLM Hash Exploit Targets Poland and Romania Days After Patch
An NTLM hash disclosure spoofing vulnerability that leaks hashes with minimal user interaction has been observed being exploited in the wild
Exploits, Global Security News, Security Bloggers Network
Your Network Is Showing – Time to Go Stealth
The Old Guard: Firewalls, VPNs and Exposed Control Planes Cyberattacks have evolved beyond the perimeter. No longer limited to opportunistic breaches, attackers are now executing coordinated campaigns that target the very foundations of enterprise network infrastructure — firewalls, VPNs, and control planes. The growing sophistication of adversaries has exposed the limits of traditional security models,…
Exploits, Global Security News, Security Bloggers Network
The FTC Is Watching: GoDaddy’s Settlement Sends a Clear Message on API Security
In today’s rapidly changing digital environment, APIs play a crucial role in modern business, facilitating smooth connectivity and data sharing. Yet, this interconnected nature brings significant security and privacy risks, as evidenced by the Federal Trade Commission’s (FTC) recent settlement with GoDaddy. This settlement serves as a stark reminder that strong API security is no…
Exploits, Global Security News, Security, Vulnerabilities
Hackers target Apple users in an ‘extremely sophisticated attack’
Apple is urging immediate patching of two zero-day vulnerabilities in its CoreAudio and RPAC components, citing their use in what the iPhone maker describes as “extremely sophisticated attacks.” Tracked as CVE-2025-31200 (CoreAudio) and CVE-2025-31201 (RPAC), the vulnerabilities were exploited in the wild to carry out code execution and memory corruption attacks, respectively. “Apple is aware…
Exploits, Global Security News, Security
CISA tags SonicWall VPN flaw as actively exploited in attacks
On Wednesday, CISA warned federal agencies to secure their SonicWall Secure Mobile Access (SMA) 100 series appliances against attacks exploiting a high-severity remote code execution vulnerability. […]
Exploits, Global Security News
CISA Flags Actively Exploited Vulnerability in SonicWall SMA Devices
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting SonicWall Secure Mobile Access (SMA) 100 Series gateways to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2021-20035 (CVSS score: 7.2), relates to a case of operating system command injection
Exploits, Global Security News
Apple Patches Two Actively Exploited iOS Flaws Used in Sophisticated Targeted Attacks
Apple on Wednesday released security updates for iOS, iPadOS, macOS Sequoia, tvOS, and visionOS to address two security flaws that it said have come under active exploitation in the wild. The vulnerabilities in question are listed below – CVE-2025-31200 (CVSS score: 7.5) – A memory corruption vulnerability in the Core Audio framework that could allow…
Exploits, Global Security News, vulnerabilities
Update these two servers from Gladinet immediately, CISOs told
CISOs running Gladinet’s CentreStack file server or Triofox file sharing server should update the applications as soon as possible because of a hard-coded key vulnerability which is being exploited now, say researchers at Huntress. “Immediate action is essential.” John Hammond, principal security researcher at Huntress, said in an email to CSO. “If left unpatched, it…
business, channel, Exploits, Global Security News, News and Trends, services
WatchGuard Report Finds 94% Increase in Network Malware
Unified cybersecurity leader WatchGuard recently unveiled its latest Internet Security Report, which discovered a 94 percent increase in network-based malware detections, signaling an increase in threats. This quarterly report details the top malware, network, and endpoint security threats observed by WatchGuard Threat Lab researchers during Q4 of 2024. Research finds increases across malware types and…
Exploits, Global Security News
Experts Uncover Four New Privilege Escalation Flaws in Windows Task Scheduler
Cybersecurity researchers have detailed four different vulnerabilities in a core component of the Windows task scheduling service that could be exploited by local attackers to achieve privilege escalation and erase logs to cover up evidence of malicious activities. The issues have been uncovered in a binary named “schtasks.exe,” which enables an administrator to create, delete,…
Exploits, Global Security News, Security Bloggers Network
Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2
This is Part 2 of our two-part technical analysis on Mustang Panda’s new tools. For details on ToneShell and StarProxy, go to Part 1.IntroductionIn addition to the new ToneShell variants and StarProxy, Zscaler ThreatLabz discovered two new keyloggers used by Mustang Panda that we have named PAKLOG and CorKLOG as well as an EDR evasion…
BSides Las Vegas 2024, cybersecurity education, Exploits, Global Security News, Infosecurity Education, Security Bloggers Network, Security BSides
BSidesLV24 – Breaking Ground – Modern ColdFusion Exploitation and Attack Surface Reduction
Author/Presenter: Brian Reilly Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel. Permalink The post BSidesLV24 – Breaking Ground – Modern ColdFusion Exploitation and Attack Surface Reduction appeared first on Security…
Exploits, Global Security News, Security Bloggers Network
Oracle April 2025 Critical Patch Update Addresses 171 CVEs
Oracle addresses 171 CVEs in its second quarterly update of 2025 with 378 patches, including 40 critical updates. Background On April 15, Oracle released its Critical Patch Update (CPU) for April 2025, the second quarterly update of the year. This CPU contains fixes for 171 unique CVEs in 378 security updates across 32 Oracle product…
Exploits, Global Security News, Security Bloggers Network, Threat Research
Alert: Security Gaps Allow Bots to Exploit UK Driving Test Booking System
DataDome conducted a security assessment of the UK’s online driving test booking system and identified several vulnerabilities in the system’s protection mechanisms. The post Alert: Security Gaps Allow Bots to Exploit UK Driving Test Booking System appeared first on Security Boulevard.
Exploits, Global Security News
Hertz Falls Victim to Cleo Zero-Day Attacks
Customer data such as birth dates, credit card numbers and driver’s license information were stolen when threat actors exploited zero-day vulnerabilities in Cleo-managed file transfer products.
china, Cybercrime, Exploits, Global Security News, Remote access trojan, sysdig, UNC5174
Chinese espionage group leans on open-source tools to mask intrusions
A Chinese state-sponsored hacking group has been observed using recently released open-source offensive security tools and other tactics in an effort to blend in with more common cybercriminal activity. The group, UNC5174, is an espionage-minded hacking group that is believed to have ties to the Chinese government and targets Western governments, technology companies, research institutions…
Exploits, Global Security News, Security, Vulnerabilities
Incomplete patching leaves Nvidia, Docker exposed to DOS attacks
A critical race condition bug affecting the Nvidia Container Toolkit, which received a fix in September, might still be open to attacks owing to incomplete patching. Tracked as CVE-2024-0132, the flaw is a critical – CVSS 9 out of 10 – Time-of-Check Time-of-Use (TOCTOU) vulnerability that could allow a specifically crafted container image to gain…
Exploits, Global Security News
Organizations Found to Address Only 21% of GenAI-Related Vulnerabilities
Pentesting firm Cobalt has found that organizations fix less than half of exploited vulnerabilities, with just 21% of generative AI flaws addressed
Exploits, Global Security News
Agentic AI is both boon and bane for security pros
Cybersecurity stands at a crossroads with agentic AI. Never have we had such a powerful tool that can create reams of code in a blink of an eye, find and defuse threats, and be used so decisively and defensively. This has proved to be a huge force multiplier and productivity boon. But while powerful, agentic…
Exploits, Global Security News, Trend Micro Research : Articles, News, Reports, Trend Micro Research : Cloud, Trend Micro Research : Endpoints, Trend Micro Research : Latest News, Trend Micro Research : Network
Strengthen Security with Cyber Risk Advisory
In today’s fast-paced digital world, cyber threats are constantly evolving. Attackers are leveraging advanced techniques and artificial intelligence (AI) to exploit vulnerabilities, leaving organizations vulnerable to breaches and disruptions. To combat these challenges, organizations must stay vigilant and implement more proactive cybersecurity measures. This is where our Cyber Risk Advisory service, powered by the Trend…
Exploits, Global Security News, Trend Micro Research : Articles, News, Reports, Trend Micro Research : Cloud, Trend Micro Research : Endpoints, Trend Micro Research : Latest News, Trend Micro Research : Network
Strengthen Security with Cyber Risk Advisory
In today’s fast-paced digital world, cyber threats are constantly evolving. Attackers are leveraging advanced techniques and artificial intelligence (AI) to exploit vulnerabilities, leaving organizations vulnerable to breaches and disruptions. To combat these challenges, organizations must stay vigilant and implement more proactive cybersecurity measures. This is where our Cyber Risk Advisory service, powered by the Trend…
Exploits, Global Security News, Trend Micro Research : Articles, News, Reports, Trend Micro Research : Cloud, Trend Micro Research : Endpoints, Trend Micro Research : Latest News, Trend Micro Research : Network
Strengthen Security with Cyber Risk Advisory
In today’s fast-paced digital world, cyber threats are constantly evolving. Attackers are leveraging advanced techniques and artificial intelligence (AI) to exploit vulnerabilities, leaving organizations vulnerable to breaches and disruptions. To combat these challenges, organizations must stay vigilant and implement more proactive cybersecurity measures. This is where our Cyber Risk Advisory service, powered by the Trend…
Exploits, Global Security News
Fortinet Zero-Day Bug May Lead to Arbitrary Code Execution
A threat actor posted about the zero-day exploit on the same day that Fortinet published a warning about known vulnerabilities under active exploitation.
Exploits, Global Security News
Chinese APTs Exploit EDR ‘Visibility Gap’ for Cyber Espionage
Blind spots in network visibility, including in firewalls, IoT devices, and the cloud, are being exploited by Chinese state-backed threat actors with increasing success, according to new threat intelligence. Here’s how experts say you can get eyes on it all.
Exploits, Global Security News
AI hallucinations lead to a new cyber threat: Slopsquatting
Cybersecurity researchers are warning of a new type of supply chain attack, Slopsquatting, induced by a hallucinating generative AI model recommending non-existent dependencies. According to research by a team from the University of Texas at San Antonio, Virginia Tech, and the University of Oklahama, package hallucination is a common thing with Large Language Models (LLM)-generated…
Exploits, Global Security News
Cybersecurity in the AI Era: Evolve Faster Than the Threats or Get Left Behind
AI is changing cybersecurity faster than many defenders realize. Attackers are already using AI to automate reconnaissance, generate sophisticated phishing lures, and exploit vulnerabilities before security teams can react. Meanwhile, defenders are overwhelmed by massive amounts of data and alerts, struggling to process information quickly enough to identify real threats. AI offers a way to
china, CISA, cisco, citrix, CVE, Cybercrime, Cybersecurity, Cybersecurity and Infrastructure Security Agency (CISA), espionage, exploit, Exploits, firewall, firewalls, Fortinet, Gartner, Global Security News, Google Threat Intelligence Group, ivanti, known exploited vulnerabilities (KEV), Mandiant, National Vulnerability Database, NIST, Palo Alto Networks, Rapid7, Research, routers, Technology, Threats, virtual private network (VPN), VulnCheck, vulnerabilities, vulnerability disclosure, zero days
Is Ivanti the problem or a symptom of a systemic issue with network devices?
Network edge devices — hardware that powers firewalls, VPNs and network routers — have quickly moved up the list of attackers’ preferred intrusion points into enterprise networks. While dozens of companies make and sell these devices, customers of one company in particular — Ivanti — have confronted exploited vulnerabilities in their products more than any…
Exploits, generative ai, Global Security News
GenAI-Security als Checkliste
Das Open Web Application Security Project (OWASP) gibt Unternehmen eine Checkliste für (mehr) GenAI-Sicherheit an die Hand. Foto: Gannvector | shutterstock.com Während Unternehmen wie OpenAI, Anthropic, Google oder Microsoft aber auch Open-Source-Alternativen bei ihren Generative-AI– und Large-Language-Model-Angeboten exponentielle User-Zuwächse verzeichnen, sind IT-Sicherheitsentscheider bemüht, mit der rasanten KI-Entwicklung in ihren Unternehmen Schritt zu halten. Die Non-Profit-Organisation…
Exploits, Global Security News
New WatchGuard Threat Lab Report Discovers 94% Increase in Network Malware as Cybercriminals Exploit Advanced, Encrypted Connections
GUEST RESEARCH: Other key findings show an increase in crypto miner detections, a spike in zero-day malware, a drop in endpoint malware, a rise in Linux-based threats, and more. WatchGuard Technologies, a global leader in unified cybersecurity, released the findings of its latest Internet Security Report, a quarterly analysis detailing the top malware, network, and endpoint…
Exploits, Global Security News, Security
Fortinet: Symlink trick gives access to patched FortiGate VPN devices
Fortinet warns that threat actors use a post-exploitation technique that helps them maintain read-only access to previously compromised FortiGate VPN devices even after the original attack vector was patched. […]
Exploits, Global Security News, Security
Fortinet: Hackers retain access to patched FortiGate VPNs using symlinks
Fortinet warns that threat actors use a post-exploitation technique that helps them maintain read-only access to previously compromised FortiGate VPN devices even after the original attack vector was patched. […]
Exploits, Global Security News
Initial Access Brokers Shift Tactics, Selling More for Less
What are IABs? Initial Access Brokers (IABs) specialize in gaining unauthorized entry into computer systems and networks, then selling that access to other cybercriminals. This division of labor allows IABs to concentrate on their core expertise: exploiting vulnerabilities through methods like social engineering and brute-force attacks. By selling access, they significantly mitigate the
Exploits, Global Security News
OttoKit WordPress Plugin Admin Creation Vulnerability Under Active Exploitation
A newly disclosed high-severity security flaw impacting OttoKit (formerly SureTriggers) has come under active exploitation within a few hours of public disclosure. The vulnerability, tracked as CVE-2025-3102 (CVSS score: 8.1), is an authorization bypass bug that could permit an attacker to create administrator accounts under certain conditions and take control of susceptible websites. “The
Exploits, Global Security News, Security
Hackers exploit WordPress plugin auth bypass hours after disclosure
Hackers started exploiting a high-severity flaw that allows bypassing authentication in the OttoKit (formerly SureTriggers) plugin for WordPress just hours after public disclosure. […]
Exploits, Global Security News
Incomplete Patch in NVIDIA Toolkit Leaves CVE-2024-0132 Open to Container Escapes
Cybersecurity researchers have detailed a case of an incomplete patch for a previously addressed security flaw impacting the NVIDIA Container Toolkit that, if successfully exploited, could put sensitive data at risk. The original vulnerability CVE-2024-0132 (CVSS score: 9.0) is a Time-of-Check Time-of-Use (TOCTOU) vulnerability that could lead to a container escape attack and allow for
Exploits, Global Security News, Security, Vulnerabilities
Hackers attempted to steal AWS credentials using SSRF flaws within hosted sites
In a new campaign, threat actors have been trying to access EC2 Instance Metadata, which consists of sensitive virtual server information like IP address, instance ID, and security credentials by exploiting server-side request forgery (SSRF) bugs in websites hosted on AWS. According to observations made by F5 Labs, threat actors exploited Instance Metadata Service version…
Exploits, Global Security News, Ransomware
Ransomware-Attacken stoßen in Windows-Lücke
srcset=”https://b2b-contenthub.com/wp-content/uploads/2025/04/shutterstock_2201386007.jpg?quality=50&strip=all 2800w, https://b2b-contenthub.com/wp-content/uploads/2025/04/shutterstock_2201386007.jpg?resize=300%2C168&quality=50&strip=all 300w, https://b2b-contenthub.com/wp-content/uploads/2025/04/shutterstock_2201386007.jpg?resize=768%2C432&quality=50&strip=all 768w, https://b2b-contenthub.com/wp-content/uploads/2025/04/shutterstock_2201386007.jpg?resize=1024%2C576&quality=50&strip=all 1024w, https://b2b-contenthub.com/wp-content/uploads/2025/04/shutterstock_2201386007.jpg?resize=1536%2C864&quality=50&strip=all 1536w, https://b2b-contenthub.com/wp-content/uploads/2025/04/shutterstock_2201386007.jpg?resize=2048%2C1152&quality=50&strip=all 2048w, https://b2b-contenthub.com/wp-content/uploads/2025/04/shutterstock_2201386007.jpg?resize=1240%2C697&quality=50&strip=all 1240w, https://b2b-contenthub.com/wp-content/uploads/2025/04/shutterstock_2201386007.jpg?resize=150%2C84&quality=50&strip=all 150w, https://b2b-contenthub.com/wp-content/uploads/2025/04/shutterstock_2201386007.jpg?resize=854%2C480&quality=50&strip=all 854w, https://b2b-contenthub.com/wp-content/uploads/2025/04/shutterstock_2201386007.jpg?resize=640%2C360&quality=50&strip=all 640w, https://b2b-contenthub.com/wp-content/uploads/2025/04/shutterstock_2201386007.jpg?resize=444%2C250&quality=50&strip=all 444w” width=”1024″ height=”576″ sizes=”(max-width: 1024px) 100vw, 1024px”>Cyberkriminelle missbrauchen eine Sicherheitslücke in Windows, um eine Backdoor-Malware und Ransomware einzuschleusen. Kanoktuch – shutterstock.com Sicherheitsforscher von Microsoft haben eine Schwachstelle im CLFS-Treiber (Common Log File System) von…
Exploits, Global Security News
Why Codefinger represents a new stage in the evolution of ransomware
If you didn’t pay much attention to news of the recent Codefinger ransomware attack, it’s probably because ransomware has become so prevalent that major incidents no longer feel notable. But Codefinger is not just another ransomware breach to add to the list of incidents where businesses lost sensitive data to attackers. In key respects, Codefinger…
Exploits, Global Security News
Top 16 OffSec, pen-testing, and ethical hacking certifications
Red team careers are in high demand, with companies seeking professionals skilled in penetration testing, offensive security (OffSec), and ethical hacking. To stand out in a competitive job market, cybersecurity professionals should consider earning certifications that validate their expertise. Here’s a look at the top certifications for offensive security today, along with advice on how…
Exploits, Global Security News, Trend Micro Research : Articles, News, Reports, Trend Micro Research : Exploits & Vulnerabilities, Trend Micro Research : Network, Trend Micro Research : Research
Incomplete NVIDIA Patch to CVE-2024-0132 Exposes AI Infrastructure and Data to Critical Risks
A previously disclosed vulnerability in NVIDIA Container Toolkit has an incomplete patch, which, if exploited, could put a wide range of AI infrastructure and sensitive data at risk.
Exploits, Global Security News, Trend Micro Research : Articles, News, Reports, Trend Micro Research : Exploits & Vulnerabilities, Trend Micro Research : Network, Trend Micro Research : Research
Incomplete NVIDIA Patch to CVE-2024-0132 Exposes AI Infrastructure and Data to Critical Risks
A previously disclosed vulnerability in NVIDIA Container Toolkit has an incomplete patch, which, if exploited, could put a wide range of AI infrastructure and sensitive data at risk.
Exploits, Global Security News, Trend Micro Research : Articles, News, Reports, Trend Micro Research : Exploits & Vulnerabilities, Trend Micro Research : Network, Trend Micro Research : Research
Incomplete NVIDIA Patch to CVE-2024-0132 Exposes AI Infrastructure and Data to Critical Risks
A previously disclosed vulnerability in NVIDIA Container Toolkit has an incomplete patch, which, if exploited, could put a wide range of AI infrastructure and sensitive data at risk.
Exploits, Global Security News, Security
Hackers target SSRF bugs in EC2-hosted sites to steal AWS credentials
A targeted campaign exploited Server-Side Request Forgery (SSRF) vulnerabilities in websites hosted on AWS EC2 instances to extract EC2 Metadata, which could include Identity and Access Management (IAM) credentials from the IMDSv1 endpoint. […]
Exploits, Global Security News, Security
Critical FortiSwitch flaw lets hackers change admin passwords remotely
Fortinet has released security patches for a critical vulnerability in its FortiSwitch devices that can be exploited to change administrator passwords remotely. […]
Exploits, Global Security News, Security
CentreStack RCE exploited as zero-day to breach file sharing servers
Hackers exploited a vulnerability in Gladinet CentreStack’s secure file-sharing software as a zero-day since March to breach storage servers […]
Exploits, Global Security News
WK Kellogg Confirms Data Breach Tied to Cleo Software Exploit
WK Kellogg breach exposed employee data after attackers exploited flaws in Cleo software
Exploits, Global Security News, Security, Vulnerabilities
Whatsapp plugs bug allowing RCE with spoofed filenames
Meta is warning Whatsapp users of an issue affecting its Windows rollouts that could allow attackers to perform remote code execution (RCE) on systems running the vulnerable releases. Tracked as CVE-2025-30401, the flaw potentially allows threat actors to trick users into running maliciously crafted files with misleading filename extensions. “Due to a failing in Whatsapp,…
Exploits, Global Security News
New TCESB Malware Found in Active Attacks Exploiting ESET Security Scanner
A Chinese-affiliated threat actor known for its cyber-attacks in Asia has been observed exploiting a security flaw in security software from ESET to deliver a previously undocumented malware codenamed TCESB. “Previously unseen in ToddyCat attacks, [TCESB] is designed to stealthily execute payloads in circumvention of protection and monitoring tools installed on the device,” Kaspersky said…
Exploits, Global Security News
CISA Warns of CentreStack’s Hard-Coded MachineKey Vulnerability Enabling RCE Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a critical security flaw impacting Gladinet CentreStack to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerability, tracked as CVE-2025-30406 (CVSS score: 9.0), concerns a case of a hard-coded cryptographic key that could be abused to achieve…
Exploits, Global Security News
Microsoft Patches 126 Flaws Including Actively Exploited Windows CLFS Vulnerability
Microsoft has released security fixes to address a massive set of 126 flaws affecting its software products, including one vulnerability that it said has been actively exploited in the wild. Of the 126 vulnerabilities, 11 are rated Critical, 112 are rated Important, and two are rated Low in severity. Forty-nine of these vulnerabilities are classified…
Exploits, Global Security News, ivanti, Latest Warnings, Microsoft, Satnam Narang, Security Tools, The Coming Storm, Time to Patch, Windows, Windows Remote Desktop Services
Patch Tuesday, April 2025 Edition
Microsoft today released updates to plug at least 121 security holes in its Windows operating systems and software, including one vulnerability that is already being exploited in the wild. Eleven of those flaws earned Microsoft’s most-dire “critical” rating, meaning malware or malcontents could exploit them with little to no interaction from Windows users. The zero-day…
Exploits, Global Security News, Threat and Vulnerability Management, Vulnerabilities, Windows Security
April Patch Tuesday news: Windows zero day being exploited, ‘big vulnerability’ in 2 SAP apps
A threat actor is exploiting a zero-day elevation of privileges vulnerability in the Windows Common Log File System to deploy ransomware, one of a number of critical holes Microsoft plugged today as part of its April Patch Tuesday releases. “The targets include organizations in the information technology (IT) and real estate sectors of the United…
Exploits, Global Security News
Microsoft Drops Another Massive Patch Update
A threat actor has already exploited one of the flaws in a ransomware campaign with victims in the US and other countries.
Cybercrime, Cybersecurity, Exploits, Global Security News, Microsoft, Patch Tuesday, Ransomware, Research, Threats, vulnerabilities, zero days
Microsoft patches zero-day actively exploited in string of ransomware attacks
Microsoft addressed 126 vulnerabilities affecting its systems and core products, including a zero-day in the Windows Common Log File System (CLFS) that’s been actively exploited in a series of ransomware attacks, the company said in its latest security update Tuesday. A group Microsoft tracks as Storm-2460 has exploited CVE-2025-29824 to initiate ransomware attacks “against a…
Exploits, Global Security News, ntlm relay, Red Team, Research, Security Bloggers Network, Social Engineering
The Renaissance of NTLM Relay Attacks: Everything You Need to Know
NTLM relay attacks have been around for a long time. While many security practitioners think NTLM relay is a solved problem, or at least a not-so-severe one, it is, in fact, alive and kicking and arguably worse than ever before. Relay attacks are the easiest way to compromise domain-joined hosts nowadays, paving a path for…
Exploits, Global Security News, Microsoft, Security
Microsoft: Windows CLFS zero-day exploited by ransomware gang
Microsoft says the RansomEXX ransomware gang has been exploiting a high-severity zero-day flaw in the Windows Common Log File System to gain SYSTEM privileges on victims’ systems. […]
Exploits, Global Security News, Security Bloggers Network
Microsoft’s April 2025 Patch Tuesday Addresses 121 CVEs (CVE-2025-29824)
11Critical 110Important 0Moderate 0Low Microsoft addresses 121 CVEs including one zero-day which was exploited in the wild. Microsoft patched 121 CVEs in its April 2025 Patch Tuesday release, with 11 rated critical and 110 rated as important. This month’s update includes patches for: ASP.NET Core Active Directory Domain Services Azure Local Azure Local Cluster Azure…
Exploits, Global Security News, Microsoft, Security
Microsoft April 2025 Patch Tuesday fixes exploited zero-day, 134 flaws
Today is Microsoft’s April 2025 Patch Tuesday, which includes security updates for 134 flaws, including one actively exploited zero-day vulnerability. […]
Exploits, Global Security News
Amazon EC2 SSM Agent Flaw Patched After Privilege Escalation via Path Traversal
Cybersecurity researchers have disclosed details of a now-patched security flaw in the Amazon EC2 Simple Systems Manager (SSM) Agent that, if successfully exploited, could permit an attacker to achieve privilege escalation and code execution. The vulnerability could permit an attacker to create directories in unintended locations on the filesystem, execute arbitrary scripts with root privileges,
Exploits, Global Security News, Security Bloggers Network
When Good Tools Go Bad: Dual-Use in Cybersecurity
In the ever-evolving world of cybersecurity, certain tools and techniques possess a fascinating duality. They’re designed to protect our digital lives, yet they can also be wielded by malicious actors to carry out cyberattacks. These are known as “dual-use” techniques and understanding them is crucial for anyone involved in cybersecurity. What Exactly Are Dual-Use Techniques?…
Amnesty International, Android, Cellebrite, Exploits, Global Security News, Google, Security, Serbia, zero days
Google fixes two Android zero-day bugs actively exploited by hackers
The most severe security bug can be exploited without user interaction, per Google.
Exploits, Global Security News, Security
New Mirai botnet behind surge in TVT DVR exploitation
A significant spike in exploitation attempts targeting TVT NVMS9000 DVRs has been detected, peaking on April 3, 2025, with over 2,500 unique IPs scanning for vulnerable devices. […]
Exploits, Global Security News, Malware, Security, Vulnerabilities
Chinese ToddyCat abuses ESET antivirus bug for malicious activities
China-backed APT group ToddyCat has been found exploiting a medium-severity vulnerability in ESET antivirus software to sneak malicious code onto vulnerable systems. Tracked as CVE-2024-11859, the flaw is a dynamic link library (DLL) search order hijacking vulnerability discovered and reported by Kaspersky last year, with a fix issued by ESET in January. “On systems with…
Exploits, Global Security News
CISA Warns of CrushFTP Vulnerability Exploitation in the Wild
The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-31161 to its Known Exploited Vulnerabilities (KEV) catalog
Cybersecurity, Exploits, Global Security News, national security policy, Security Bloggers Network, Telecom, Uncategorized
Arguing Against CALEA
At a Congressional hearing earlier this week, Matt Blaze made the point that CALEA, the 1994 law that forces telecoms to make phone calls wiretappable, is outdated in today’s threat environment and should be rethought: In other words, while the legally-mandated CALEA capability requirements have changed little over the last three decades, the infrastructure that…
Exploits, Global Security News
CISA Adds CrushFTP Vulnerability to KEV Catalog Following Confirmed Active Exploitation
A recently disclosed critical security flaw impacting CrushFTP has been added by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to its Known Exploited Vulnerabilities (KEV) catalog after reports emerged of active exploitation in the wild. The vulnerability is a case of authentication bypass that could permit an unauthenticated attacker to take over susceptible instances.…
Exploits, Global Security News
Google Releases Android Update to Patch Two Actively Exploited Vulnerabilities
Google has shipped patches for 62 vulnerabilities, two of which it said have been exploited in the wild. The two high-severity vulnerabilities are listed below – CVE-2024-53150 (CVSS score: 7.8) – An out-of-bounds flaw in the USB sub-component of Kernel that could result in information disclosure CVE-2024-53197 (CVSS score: 7.8) – A privilege escalation flaw…
Exploits, Global Security News, Risk Management
External Attack Surface Management (EASM): Mit diesen vier Schritten minimieren Sie das Cyberrisiko
IT-Security-Verantwortliche sollten die Angriffsfläche permanent analysieren und schützen. Dazu müssen sie stets im Blick haben, welche Assets über das Internet erreichbar sind. Foto: NicoElNino – shutterstock.com Von IoT-Devices über Cloud-basierte Infrastrukturen, Web-Applikationen und Firewalls bis hin zu VPN-Gateways: Die Anzahl unternehmenseigener Assets, die mit dem Internet verbunden sind, steigt exponentiell an. Sie ermöglichen beispielsweise den…
Android, Cellebrite, Cybersecurity, Exploits, Global Security News, Google, Mobile, Mobile Security, Technology, Threats, vulnerabilities, zero days
Google addresses 2 actively exploited vulnerabilities in security update
Google addressed 62 vulnerabilities affecting Android devices in its April security update, including a pair of actively exploited software defects that were first disclosed in December. Google said the two vulnerabilities — CVE-2024-53197 and CVE-2024-53150 — “may be under limited, targeted exploitation.” The pair of flaws under active exploitation are high-severity and affect the Linux…
business, channel, Exploits, Global Security News, News and Trends, services
Oracle’s Breach Exposes Credentials Despite Denials
Oracle has acknowledged to customers that hackers recently breached a dormant “legacy” system and stole outdated login credentials. According to Bloomberg, the compromised environment hasn’t been active for eight years, and the stolen credentials are no longer current. Oracle was quick to assure clients that the compromised data was outdated and non-sensitive, but evidence suggests…
Exploits, Global Security News, Security
Google fixes Android zero-days exploited in attacks, 60 other flaws
Google has released patches for 62 vulnerabilities in Android’s April 2025 security update, including two zero-days exploited in targeted attacks. […]
Exploits, Global Security News
⚡ Weekly Recap: VPN Exploits, Oracle’s Silent Breach, ClickFix Comeback and More
Today, every unpatched system, leaked password, and overlooked plugin is a doorway for attackers. Supply chains stretch deep into the code we trust, and malware hides not just in shady apps — but in job offers, hardware, and cloud services we rely on every day. Hackers don’t need sophisticated exploits anymore. Sometimes, your credentials and…
Exploits, Global Security News
The risks of entry-level developers over relying on AI
Whenever tools like ChatGPT go down, it’s not unusual to see software developers step away from their desks, take an unplanned break, or lean back in their chairs in frustration. For many professionals in the tech space, AI-assisted coding tools have become a convenience. And even brief outages, like the one that happened on 24…
Exploits, Global Security News, Security
WinRAR flaw bypasses Windows Mark of the Web security alerts
A vulnerability in the WinRAR file archiver solution could be exploited to bypass the Mark of the Web (MotW) security warning and execute arbitrary code on a Windows machine. […]
AI, Cybersecurity, Exploits, Global Security News, Risk Management
Google announces Sec-Gemini v1, a new experimental cybersecurity model
Posted by Elie Burzstein and Marianna Tishchenko, Sec-Gemini team Today, we’re announcing Sec-Gemini v1, a new experimental AI model focused on advancing cybersecurity AI frontiers. As outlined a year ago, defenders face the daunting task of securing against all cyber threats, while attackers need to successfully find and exploit only a single vulnerability. This fundamental…
AI, Cybersecurity, Exploits, Global Security News, Risk Management
Google announces Sec-Gemini v1, a new experimental cybersecurity model
Posted by Elie Burzstein and Marianna Tishchenko, Sec-Gemini team Today, we’re announcing Sec-Gemini v1, a new experimental AI model focused on advancing cybersecurity AI frontiers. As outlined a year ago, defenders face the daunting task of securing against all cyber threats, while attackers need to successfully find and exploit only a single vulnerability. This fundamental…
AI, Apps, Exploits, Global Security News, Risk Management
Taming the Wild West of ML: Practical Model Signing with Sigstore
Posted by Mihai Maruseac, Google Open Source Security Team (GOSST) In partnership with NVIDIA and HiddenLayer, as part of the Open Source Security Foundation, we are now launching the first stable version of our model signing library. Using digital signatures like those from Sigstore, we allow users to verify that the model used by the…
AI, Apps, Exploits, Global Security News, Risk Management
Taming the Wild West of ML: Practical Model Signing with Sigstore
Posted by Mihai Maruseac, Google Open Source Security Team (GOSST) In partnership with NVIDIA and HiddenLayer, as part of the Open Source Security Foundation, we are now launching the first stable version of our model signing library. Using digital signatures like those from Sigstore, we allow users to verify that the model used by the…
Exploits, Global Security News, Network Security, Vulnerabilities
Ivanti warns customers of new critical flaw exploited in the wild
Ivanti is warning customers that a critical vulnerability that impacts its VPN appliances and other products has already been exploited in the wild by a Chinese APT group. The flaw was originally flagged by Ivanti as a denial-of-service issue, but attackers figured out how to exploit it for remote code execution. The vulnerability, now tracked…
Exploits, Global Security News
Big hole in big data: Critical deserialization bug in Apache Parquet allows RCE
A flaw in code for handling Parquet, Apache’s open-source columnar data file format, allows attackers to run arbitrary code on vulnerable instances. The vulnerability, tracked as CVE-2025-30065, is a deserialization issue (CWE-502) in Parquet’s Java library that allows execution of maliciously crafted Parquet files. “This vulnerability can impact data pipelines and analytics systems that import…
Exploits, Global Security News
Chinese State Hackers Exploiting Newly Disclosed Ivanti Flaw
Mandiant warned that Chinese espionage actor UNC5221 is actively exploiting a critical Ivanti vulnerability, which can lead to remote code execution
Exploits, Global Security News
AI programming copilots are worsening code security and leaking more secrets
AI coding assistants are among the early success stories of the generative AI revolution in business. Increasingly adopted, programming copilots are making inroads into development processes, enhancing developers’ productivity and helping stand up rudimentary projects quickly. But they’re also a security issue, and the anticipated volume of code they will soon be producing is a…
Exploits, Global Security News
Critical Ivanti Flaw Actively Exploited to Deploy TRAILBLAZE and BRUSHFIRE Malware
Ivanti has disclosed details of a now-patched critical security vulnerability impacting its Connect Secure that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2025-22457 (CVSS score: 9.0), concerns a case of a stack-based buffer overflow that could be exploited to execute arbitrary code on affected systems. “A stack-based buffer overflow in…
Exploits, Global Security News
Critical Flaw in Apache Parquet Allows Remote Attackers to Execute Arbitrary Code
A maximum severity security vulnerability has been disclosed in Apache Parquet’s Java Library that, if successfully exploited, could allow a remote attacker to execute arbitrary code on susceptible instances. Apache Parquet is a free and open-source columnar data file format that’s designed for efficient data processing and retrieval, providing support for complex data, high-performance
Exploits, Global Security News, Network Security, Vulnerabilities
Surge in threat actors scanning Juniper, Cisco, and Palo Alto Networks devices
A surge in internet probes targeting devices from Juniper Networks, Cisco Systems, and Palo Alto Networks should put their admins on alert, say security experts. A threat actor is probing the internet using default credentials for a Juniper Networks router, prompting a cybersecurity expert to warn network admins to change the login combo from the…
china, CISA, Cybersecurity, Cybersecurity and Infrastructure Security Agency, espionage, exploit, Exploits, Global Security News, Google Threat Intelligence Group, ivanti, known exploited vulnerabilities (KEV), Mandiant, Research, Threats, vulnerability
China-backed espionage group hits Ivanti customers again
Ivanti customers are confronting another string of attacks linked to an actively exploited vulnerability in the company’s VPN products. Mandiant said a nation-state backed espionage group linked to China has been exploiting the critical vulnerability, CVE-2025-22457, since mid-March. The threat group, which Google Threat Intelligence Group tracks as UNC5221, has a knack for exploiting Ivanti…
Exploits, Global Security News
Major Online Platform for Child Exploitation Dismantled
An international law enforcement operation has shut down Kidflix, a platform for child sexual exploitation with 1.8m registered users