The Cybersecurity and Infrastructure Security Agency (CISA) has included a critical deserialization vulnerability affecting Sitecore CMS and Experience Platform (XP). This vulnerability, tracked as CVE-2019-9874, allows unauthenticated attackers to execute arbitrary code by manipulating HTTP POST parameters, specifically the __CSRFTOKEN…
Category: EN
A Taxonomy of Adversarial Machine Learning Attacks and Mitigations
NIST just released a comprehensive taxonomy of adversarial machine learning attacks and countermeasures. This article has been indexed from Schneier on Security Read the original article: A Taxonomy of Adversarial Machine Learning Attacks and Mitigations
Business Email Compromise, ACH Transactions, and Liability
Business Email Compromise (BEC) fraud represents one of the most insidious threats facing businesses and individuals today. The post Business Email Compromise, ACH Transactions, and Liability appeared first on Security Boulevard. This article has been indexed from Security Boulevard Read…
A Comprehensive Guide to Protect Data, Models, and Users in the GenAI Era
Editor’s Note: The following is an article written for and published in DZone’s 2025 Trend Report, Generative AI: The Democratization of Intelligent Systems. Generative AI (GenAI) is transforming how organizations operate, enabling automation, content generation, and intelligent decision making at an…
PoC Exploit Released for Ingress-NGINX Remote Code Execution Vulnerabilities
A proof-of-concept (PoC) exploit for a critical remote code execution vulnerability in Kubernetes Ingress-NGINX controllers, tracked as CVE-2025-1974. The vulnerability uncovered by WiZ affects the validation webhook component and could allow attackers to execute arbitrary code on affected systems, potentially…
UK’s first permanent facial recognition cameras installed in South London
As if living in Croydon wasn’t bad enough The Metropolitan Police has confirmed its first permanent installation of live facial recognition (LFR) cameras is coming this summer and the lucky location will be the South London suburb of Croydon.… This…
More Solar System Vulnerabilities Expose Power Grids to Hacking
Forescout has found dozens of vulnerabilities in solar power systems from Sungrow, Growatt and SMA. The post More Solar System Vulnerabilities Expose Power Grids to Hacking appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original…
Top 3 MS Office Exploits Hackers Use in 2025 – Stay Alert!
Hackers have long used Word and Excel documents as delivery vehicles for malware, and in 2025, these tricks are far from outdated. From phishing schemes to zero-click exploits, malicious Office files are still one of the easiest ways into a…
NCA Warns of Sadistic Online “Com” Networks
The UK’s National Crime Agency is warning of a growing cyber and physical threat from homegrown teens This article has been indexed from www.infosecurity-magazine.com Read the original article: NCA Warns of Sadistic Online “Com” Networks
Newspaper Lawsuit Against OpenAI Can Proceed Says Judge
Copyright lawsuit against OpenAI and Microsoft from The New York Times and other newspapers can proceed, judge rules This article has been indexed from Silicon UK Read the original article: Newspaper Lawsuit Against OpenAI Can Proceed Says Judge
Ransomwared NHS software supplier nabs £3M discount from ICO for good behavior
Data stolen included checklist for medics on how to get into vulnerable people’s homes The UK’s data protection watchdog is dishing out a £3.07 million ($3.95 million) fine to Advanced Computer Software Group, whose subsidiary’s security failings led to a…
NCSC Urges Domain Registrars to Improve Security
The UK’s National Cyber Security Centre has released new guidance to help domain registrars enhance security This article has been indexed from www.infosecurity-magazine.com Read the original article: NCSC Urges Domain Registrars to Improve Security
Arkana Security group claims the hack of US telco provider WideOpenWest (WOW!)
Arkana Security, a new ransomware group, claims to have breached the telecommunications provider WideOpenWest (WOW!). The new ransomware group Arkana Security claims to have hacked US telecom provider WOW!, stealing customer data. WideOpenWest (WOW!) is a US-based telecommunications company that…
Pakistan APT Hackers Create Weaponized IndiaPost Website to Attack Windows & Android Users
Cybersecurity researchers have uncovered a sophisticated attack campaign leveraging a fraudulent website that impersonates the Indian Post Office to deliver malware to both Windows and Android users. The fake website, hosted at postindia[.]site, employs device detection techniques to serve tailored…
CodeQLEAKED – GitHub Supply Chain Attack Allows Code Execution Using CodeQL Repositories
A significant vulnerability in GitHub’s CodeQL actions could have permitted attackers to execute malicious code across hundreds of thousands of repositories. The vulnerability, assigned CVE-2025-24362, originated from a publicly exposed GitHub token in workflow artifacts that created a small but…
New Sophisticated Linux-Backdoor Attacking OT Systems Exploiting 0-Day RCE
A sophisticated Linux-based backdoor dubbed “OrpaCrab” has emerged as a significant threat to operational technology (OT) systems, particularly those managing gas station infrastructure. Security researchers discovered the malware after it was uploaded to VirusTotal in January 2024 from the United…
OpenAI Offering Up to $100,000 for Critical Vulnerabilities in its Infrastructure
OpenAI has dramatically increased its maximum bug bounty reward to $100,000 for exceptional critical security vulnerabilities, up from the previous cap of $20,000. This fivefold increase highlights the AI leader’s growing emphasis on cybersecurity as its models advance toward artificial…
PoC Exploit Released for Ingress-NGINX RCE Vulnerabilities
A recently disclosed vulnerability in Ingress-NGINX, tracked as CVE-2025-1974, has raised concerns about the security of Kubernetes environments. This vulnerability allows for Remote Code Execution (RCE) through the validating webhook server integrated into Ingress-NGINX. A Proof of Concept (PoC) exploit…
New “ReaderUpdate” macOS Malware Evolves with Nim and Rust Variants
Security researchers at SentinelOne have discovered that ReaderUpdate, a macOS malware loader platform that has been active since at least 2020, has significantly evolved with new variants written in multiple programming languages. The malware, which previously went relatively unnoticed by…
Advanced CoffeeLoader Malware Evades Security to Deliver Rhadamanthys Shellcode
Security researchers at Zscaler ThreatLabz have identified a new sophisticated malware family called CoffeeLoader, which emerged around September 2024. This advanced loader employs numerous techniques to bypass security solutions and evade detection while delivering second-stage payloads, particularly the Rhadamanthys stealer.…