Ransomware payments reached the highest level in 2023, at $1.1 billion paid in 1,512 reported incidents. The post Ransomware Payments Surpassed $4.5 Billion: US Treasury appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original article:…
Category: EN
Hackers Target Developers Using Malicious VS Code and Cursor AI Extensions
Visual Studio Code and AI-powered IDEs such as Cursor AI and Windsurf are emerging as one of the most critical and overlooked attack surfaces in the modern software supply chain. Installed on millions of developer machines worldwide, these tools often…
Next.js Releases Scanner to Detect and Fix Apps Affected by React2Shell Vulnerability
Next.js developers have a new weapon in the fight against the critical “React2Shell” vulnerability. This new scanner offers a simple, one-line solution for development teams to identify vulnerable versions of Next.js and React Server Components (RSC) and apply the necessary…
Porsche Cars Disabled After Major Failure in Installed Satellite Security System
Hundreds of Porsche owners across Russia are facing a significant problem as their luxury cars have suddenly stopped working. The issue stems from a failure in the factory-installed security and tracking systems, which have completely shut down the vehicles. According…
CISA Adds Critical React2Shell Vulnerability to KEV Catalog After Active Exploitation
The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a high-severity vulnerability affecting Meta’s React Server Components to its Known Exploited Vulnerabilities (KEV) catalog. Assigned the identifier CVE-2025-55182, the security flaw dubbed “React2Shell” by the security community is currently being…
LOLPROX Unveils Undetected Exploitation Routes for Stealthy Hypervisor Attacks
A new security analysis has unveiled “LOLPROX,” a comprehensive catalog of “Living Off The Land” (LOL) techniques specifically targeting Proxmox Virtual Environment (VE). The research, detailed by security researcher Andy Gill (ZephrSec), highlights how threat actors can weaponize the popular…
OceanLotus Hacker Group Targeting Xinchuang IT Ecosystems to Launch Supply Chain Attacks
The OceanLotus hacker group, widely tracked as APT32, has initiated a highly targeted surveillance campaign aimed at China’s “Xinchuang” IT ecosystem. This strategic pivot focuses on compromising indigenized domestic hardware and software frameworks that were specifically designed to establish secure,…
Critical WatchGuard Firebox Vulnerabilities Let Attackers Bypass Integrity Checks and Inject Malicious Codes
Critical security alerts have been issued for Firebox firewall devices due to serious ten vulnerabilities. The vulnerabilities in WatchGuard, disclosed on December 4, 2025, span multiple severity levels and attack vectors. With several requiring urgent patching to prevent unauthorized code…
Portugal Updates Cybercrime Law To Protect Good-Faith Security Researchers
Portugal has updated its cybercrime law to offer legal protection to security researchers who probe systems in good faith and report vulnerabilities responsibly. The change creates a legal safe harbor for ethical hacking, turning what was previously classified as…
Palo Alto GlobalProtect Portals Face Spike in Suspicious Login Attempts
Among the developments that have disturbed security teams around the world, threat-intelligence analysts have detected a sudden and unusually coordinated wave of probing of Palo Alto Networks’ GlobalProtect remote access infrastructure. This activity appears to be influenced by the…
Fake RTO e-Challan WhatsApp Scam Resurfaces: Fraudsters Push Spyware Through Malicious APK Files
Cybercriminals have once again revived an old trick—but with a more convincing disguise. This time, scammers are exploiting the name of the official RTO e-challan system to deceive smartphone users. Over the past year, malicious APK files have been…
Portugal Revises Cybercrime Law to Protect Security Researchers
Security researchers will now be protected from prosecution in Portugal as long as they meet certain conditions This article has been indexed from www.infosecurity-magazine.com Read the original article: Portugal Revises Cybercrime Law to Protect Security Researchers
React2Shell Under Active Exploitation by China-Nexus Hackers
React2Shell (CVE-2025-55182) is under active exploitation by Earth Lamia and Jackpot Panda, risking over two million instances worldwide This article has been indexed from www.infosecurity-magazine.com Read the original article: React2Shell Under Active Exploitation by China-Nexus Hackers
TenSec 2019
Tencent Security Conference (TenSec) is an international cybersecurity summit launched by Tencent Security, hosted by Tencent Keen Security Lab and Tencent Security Platform Department, and co-organized by Tencent Security Academy. This article has been indexed from Keen Security Lab Blog…
Exploiting Wi-Fi Stack on Tesla Model S
In the past two years, Keen Security Lab did in-depth research on the security of Tesla Cars and presented our research results on Black Hat 2017 and Black Hat 2018. Our research involves many in-vehicle components. We demonstrated how to…
Tencent Keen Security Lab joins GENIVI Alliance
Tencent Keen Security Lab (Keen Lab) has joined the GENIVI Alliance, a non-profit alliance focused on delivering open source, in-vehicle infotainment (IVI) and connected vehicle software. This article has been indexed from Keen Security Lab Blog Read the original article:…
Tencent Keen Security Lab: Experimental Security Assessment on Lexus Cars
Since 2017, Lexus has equipped several models (including Lexus NX, LS and ES series) with a new generation infotainment, which is also known as AVN (Audio, Visual and Navigation) unit. Compared to some Intelligent connected infotainment units, like Tesla IVI…
Tencent Security Keen Lab: Experimental Security Assessment of Mercedes-Benz Cars
MBUX, Mercedes-Benz User Experience is the infotainment system in Mercedes-Benz cockpits. Mercedes-Benz first introduced MBUX in the new A-Class back in 2018, and is adopting MBUX in their entire vehicle line-up, including Mercedes-Benz E-Class, GLE, GLS, EQC, etc. In this…
AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows
In this blog entry, Trend™ Research provides a comprehensive breakdown of GhostPenguin, a previously undocumented Linux backdoor with low detection rates that was discovered through AI-powered threat hunting and in-depth malware analysis. This article has been indexed from Trend Micro…
Over 70 Domains Used in Months-Long Phishing Spree Against US Universities
Infoblox Threat Intel reports a campaign that used the Evilginx phishing kit to bypass Multi-Factor Authentication (MFA) and steal credentials from 18 US universities between April and November 2025. This article has been indexed from Hackread – Cybersecurity News, Data…