The notorious ransomware group LockBit inadvertently suffered a major data breach, exposing the inner workings of their ransomware-as-a-service (RaaS) operations. This leak, which surfaced on the internet after remaining undetected for months, has offered invaluable insights into the group’s internal…
Category: EN
Cellcom Confirms Cybersecurity Breach After Network Failure
Cellcom/Nsight has officially confirmed a cyberattack as the cause of a five-day service disruption affecting customers across its network. In an official statement released today, company leadership acknowledged the incident while assuring customers that sensitive personal information appears to remain…
U.S. CISA adds Ivanti EPMM, MDaemon Email Server, Srimax Output Messenger, Zimbra Collaboration, and ZKTeco BioTime flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti EPMM, MDaemon Email Server, Srimax Output Messenger, Zimbra Collaboration, and ZKTeco BioTime flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Chromium, DrayTek routers,…
US Student to Plead Guilty Over PowerSchool Hack
Matthew Lane allegedly hacked PowerSchool using stolen credentials and admitted to extorting a telecoms provider. The post US Student to Plead Guilty Over PowerSchool Hack appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original article:…
US Teen to Plead Guilty in PowerSchool Extortion Campaign
The 19-year-old and his accomplices obtained key data for the extortion scheme in a 2022 breach of a US telco This article has been indexed from www.infosecurity-magazine.com Read the original article: US Teen to Plead Guilty in PowerSchool Extortion Campaign
Over 100 Malicious Chrome Extensions Exploiting Users to Steal Login Credentials and Execute Remote Code
Cybersecurity researchers have uncovered a sprawling network of over 100 malicious Chrome extensions actively exploiting unsuspecting users. These extensions, masquerading as legitimate tools for productivity, ad-blocking, and browsing enhancement, are designed with nefarious intent stealing sensitive login credentials and executing…
3 Teens Almost Got Away With Murder. Then Police Found Their Google Searches
An arson attack in Colorado had detectives stumped. The way they solved the case could put everyone at risk. This article has been indexed from Security Latest Read the original article: 3 Teens Almost Got Away With Murder. Then Police…
Dero miner zombies biting through Docker APIs to build a cryptojacking horde
Kaspersky experts break down an updated cryptojacking campaign targeting containerized environments: a Dero crypto miner abuses the Docker API. This article has been indexed from Securelist Read the original article: Dero miner zombies biting through Docker APIs to build a…
MSPs in 2025: From “Break-Fix to Business Advisor” with Nigel Moore
Welcome back to the MSP Security Playbook, the podcast that helps MSPs cut through the noise, eliminate inefficiencies, and build stronger, more profitable security businesses. I’m your host, Jacob Hazelbaker, business development representative at Heimdal Security, an industry-leading unified and…
Hackers Created Fake Version of AI Tool to Attack 6 Million Users
In a sophisticated cyberattack campaign uncovered in early 2025, threat actors created counterfeit versions of popular AI image generation platform Kling AI to deliver malware to unsuspecting users. Kling AI, which has amassed over 6 million users since its June…
Lexmark Printer Vulnerability Allows Attackers to Execute Arbitrary Code
A critical security vulnerability has been identified in numerous Lexmark printer models that could allow attackers to execute arbitrary code remotely. Designated as CVE-2025-1127, this critical flaw affects the embedded web server in various Lexmark devices and poses significant risks…
Cellcom Service Disruption Caused by Cyberattack
Wireless carrier Cellcom has confirmed that a week-long widespread service outage is the result of a cyberattack. The post Cellcom Service Disruption Caused by Cyberattack appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original article:…
Flawed WordPress theme may allow admin account takeover on 22,000+ sites (CVE-2025-4322)
A critical vulnerability (CVE-2025-4322) in Motors, a WordPress theme popular with car/motor dealerships and rental services, can be easily exploited by unauthenticated attackers to take over admin accounts and gain full control over target WP-based sites. The privileges thus acquired…
Researchers Expose PWA JavaScript Attack That Redirects Users to Adult Scam Apps
Cybersecurity researchers have discovered a new campaign that employs malicious JavaScript injections to redirect site visitors on mobile devices to a Chinese adult-content Progressive Web App (PWA) scam. “While the payload itself is nothing new (yet another adult gambling scam),…
Two-Fifths of Americans Want to Ban Biometric Use
ITRC report finds that 39% of American consumers believe biometric use should be banned This article has been indexed from www.infosecurity-magazine.com Read the original article: Two-Fifths of Americans Want to Ban Biometric Use
Another Confluence Bites the Dust: Falling to ELPACO-team Ransomware
Key Takeaways The DFIR Report Services Table of Contents: Case Summary In late June 2024, an unpatched Confluence server was compromised via CVE-2023-22527, a template injection vulnerability, first from IP … Read More This article has been indexed from The…
Mike Lynch’s Superyacht Recovery Restarts After Diver Death
Recovery of Mike Lynch’s ‘Bayesian’ restarts, as HP confirms it will pursue damage claim against estate of dead tech entrepreneur This article has been indexed from Silicon UK Read the original article: Mike Lynch’s Superyacht Recovery Restarts After Diver Death
Ivanti EPMM 0-Day RCE Vulnerability Under Active Attack
Ivanti’s Endpoint Manager Mobile (EPMM) contains a critical vulnerability chain that has been actively abused. The vulnerabilities, initially disclosed by Ivanti on March 13th, 2025, combine an authentication bypass (CVE-2025-4427) and a remote code execution flaw (CVE-2025-4428) to create a…
A critical flaw in OpenPGP.js lets attackers spoof message signatures
A critical flaw in OpenPGP.js, tracked as CVE-2025-47934, lets attackers spoof message signatures; updates have been released to address the flaw. A critical vulnerability, tracked as CVE-2025-47934, in OpenPGP.js allowed spoofing of message signature verification. OpenPGP.js is an open-source JavaScript…
Up to 25% of Internet-Exposed ICS Are Honeypots: Researchers
Many of the industrial control system (ICS) instances seen in internet scanning are likely or possibly honeypots, not real devices. The post Up to 25% of Internet-Exposed ICS Are Honeypots: Researchers appeared first on SecurityWeek. This article has been indexed…