QR codes have become an integral part of our digital lives, offering quick access to websites, services, and even payment systems. However, their widespread use has also made them a prime target for scammers. A new threat, known as “quishing,”…
Tag: Cyber Security News
LLM Hijackers Gained Stolen Access to DeepSeek-V3 Model Very Next Day After Release
With the release of DeepSeek-V3 on December 25, 2024, the number of LLMjacking attacks in the cybersecurity space has significantly increased. Within hours of its launch, malicious actors had compromised the model, integrating it into OpenAI Reverse Proxy (ORP) systems…
1M+ Malware Samples Analysis Reveal Application Layer Abused for Stealthy C2
A recent analysis of over 1 million malware samples unveiled a trend where adversaries increasingly exploit the Application Layer of the Open System Interconnection (OSI) model to conduct stealthy Command-and-Control (C2) operations. By leveraging trusted Application Layer Protocols, attackers are…
GitHub Copilot’s New Agent Mode Let Developers Autonomously Complete Coding Tasks
GitHub has unveiled a groundbreaking update to its AI-powered coding assistant, GitHub Copilot, with the introduction of Agent Mode. This new feature, available in preview for Visual Studio Code (VS Code) Insiders, empowers developers to autonomously complete complex coding tasks…
Cisco Hacked – Ransomware Group Allegedly Breach Internal Network & Gained AD Access
Cisco has reportedly fallen victim to a significant data breach, with sensitive credentials from its internal network and domain infrastructure leaked online. The breach is allegedly linked to the Kraken ransomware group, which has published a dataset on its dark…
Seven Years Old Linux Kernel Vulnerability Let Attackers Execute Remote Code
Researchers have uncovered a critical flaw in the Linux kernel that could allow attackers to execute remote code. The vulnerability, which had been inactive for seven years, was uncovered while conducting routine research on the Linux kernel’s TCP subsystem. This…
Penetration Testers Arrested by Police During Authorized Physical Penetration Testing
A routine physical penetration test conducted by cybersecurity professionals took an unexpected turn when armed police arrested two security experts during a simulated breach at a corporate office in Malta. The incident involving miscommunication between the client and local authorities…
Ransomware Payments Dropped By 35%, As Victims Refusing To Pay
In a significant shift in the ransomware landscape, payments to attackers have decreased by approximately 35% year-over-year. This decline is attributed to increased law enforcement actions, improved international collaboration, and a growing trend among victims to refuse ransom demands. Here…
World’s Longest and Strongest WiFi Passwords From 31m Passwords List
A cybersecurity enthusiast discovered the longest and most complicated passwords ever used by searching through a huge dataset of 31 million likely WPA WiFi passwords. Typically, a password’s length and complexity directly affect its security. While diverse character sets prevent…
New ‘BYOTB’ Attack Exploits Trusted Binaries to Evade Detection, Researchers Reveal
Security researcher David Kennedy unveiled a novel attack technique known as “BYOTB” (Bring Your Own Trusted Binary) in a recent presentation at BSides London 2024, which leverages trusted binaries to bypass security measures and evade detection. This approach exploits the…
GhidrAssist Brings AI Features to Ghidra in Reverse Engineering
Reverse engineering has long been a challenging yet essential process for cybersecurity professionals, software analysts, and researchers. With the introduction of GhidrAssist, a cutting-edge plugin for the popular reverse engineering platform Ghidra, the process becomes significantly more streamlined and efficient. …
SAML Bypass Authentication on GitHub Enterprise Servers To Login as Other User Account
A significant vulnerability has been identified in GitHub Enterprise Servers, allowing attackers to bypass SAML authentication and log in as other user accounts. This exploit leverages quirks in the libxml2 library, specifically related to XML entities, to deceive the verification…
PoC Exploit Released for AnyDesk Vulnerability Exploited to Gain Admin Access Via Wallpapers
A recently disclosed vulnerability in AnyDesk, a popular remote desktop software, identified as CVE-2024-12754, enables local attackers to exploit the handling of Windows background images to gain unauthorized access to sensitive system files. This could potentially escalate their privileges to…
Hackers Exploiting Google Tag Manager To Steal Credit Card From eCommerce Sites
Hackers have been exploiting Google Tag Manager (GTM) to steal sensitive credit card information from eCommerce sites, particularly those built on the Magento platform. This sophisticated attack shows the evolving tactics of cybercriminals in leveraging legitimate tools for malicious purposes.…
Linux Kernel 6.14 Released – What’s New With rc2!
Linus Torvalds announced the release of Linux Kernel 6.14-rc2, the second release candidate in the 6.14 series. The release follows the usual weekly schedule and comes as a relatively small update, consistent with the overall size of the 6.14 kernel.…
Unpatched Marvel Game RCE Exploit Could Let Hackers Take Over PCs & PS5s
A critical security vulnerability has been discovered in the popular online game Marvel Rivals, raising alarms about the potential for hackers to exploit unsuspecting players. The exploit, identified as a Remote Code Execution (RCE) vulnerability, allows attackers on the same…
Massive Brute Force Attack Targets VPN & Firewall Logins Using 2.8 Million IPs
A global brute force attack campaign leveraging 2.8 million IP addresses actively targets edge security devices, including VPNs, firewalls, and gateways from vendors such as Palo Alto Networks, Ivanti, and SonicWall. The attack, first detected in January 2025, has been…
Cybersecurity Weekly Brief: Latest on Attacks, Vulnerabilities, & Data Breaches
Welcome to this week’s Cybersecurity Newsletter, which provides the latest updates and key insights from the ever-evolving field of cybersecurity. In the current fast-paced digital landscape, it is essential to remain informed. Our objective is to deliver the most pertinent…
10 Best UTM (Unified Threat Management) Firewalls – 2025
Unified Threat Management (UTM) firewall is a comprehensive cybersecurity solution that integrates multiple security functions into a single platform or appliance. It is designed to simplify security management, reduce costs, and provide robust protection against a variety of cyber threats. UTM solutions are especially popular among…
Hackers Compromising IIS Servers to Deploy BadIIS Malware
A widespread campaign targeting Microsoft Internet Information Services (IIS) servers to deploy the BadIIS malware, a tool used for search engine optimization (SEO) fraud and malicious content injection. The campaign, attributed to the Chinese-speaking hacking group DragonRank, has affected over…
CISA Warns of Trimble Cityworks RCE Vulnerability Exploited to Hack IIS Servers
The CISA has issued a warning regarding a critical remote code execution (RCE) vulnerability affecting Trimble Cityworks, a popular software solution for local government and public works asset management. The vulnerability, identified as CVE-2025-0994, allows an external actor to exploit…
HPE Alerts Employees of Data Breach After Russian Cyberattack on Office 365
Hewlett Packard Enterprise (HPE) has disclosed a significant data breach involving its Office 365 email environment, attributed to the Russian state-sponsored hacking group known as Midnight Blizzard, also referred to as Cozy Bear or APT29. The breach, which began in…
Meta Trained Its Llama AI Models Using 81.7 TB of Books Stolen From Torrent Shadow Libraries
Meta Platforms, Inc. is facing serious allegations in a copyright infringement lawsuit, with plaintiffs claiming the tech giant used 81.7 terabytes of pirated books from shadow libraries to train its Llama AI models. The lawsuit, filed in the U.S. District…
Hackers Attacking Web Login Pages of Popular Firewalls for Brute-Force Attacks
In recent weeks, ShadowServer has observed a significant rise in brute-force attacks targeting web login pages of edge devices, with honeypot data revealing up to 2.8 million IPs involved daily. These attacks, primarily originating from Brazil, are aimed at devices…
New Facebook Fake Copyright Notices Phishing Steals Your FB Credentials
A recent phishing campaign has been targeting Facebook users with fake copyright infringement notices, aiming to steal their login credentials. This sophisticated scam has been sent to over 12,279 email addresses, primarily affecting enterprises across the EU, US, and Australia.…
New Attack Technique Uncovered Abusing Kerberos Delegation in Active Directory Networks
A new attack vector exploiting vulnerabilities in Kerberos delegation within Active Directory (AD) networks has been uncovered, posing significant risks to enterprise security. This technique leverages the inherent weaknesses of Unconstrained Kerberos Delegation, a legacy feature that allows services to…
Microsoft Edge Vulnerabilities Let Attackers Execute Remote Code – Update Now!
Microsoft has released a critical security update for its Edge browser, addressing multiple vulnerabilities that could allow attackers to execute remote code and compromise user systems. Users are strongly urged to update their browsers immediately to mitigate potential risks. Four…
Developers Beware! Malicious ML Models Detected on Hugging Face Platform
In a concerning development for the machine learning community, researchers at ReversingLabs have identified malicious models on the popular Hugging Face platform. These models exploit vulnerabilities in the Pickle file serialization format, a widely used method for storing and sharing…
HPE Aruba Networking ClearPass Policy Manager Vulnerabilities Allow Arbitrary Code Execution
Hewlett Packard Enterprise (HPE) has disclosed multiple critical vulnerabilities in its Aruba Networking ClearPass Policy Manager (CPPM), a widely used network access control solution. These flaws, if exploited, could lead to arbitrary code execution, privilege escalation, and sensitive data exposure.…
DeepSeek iOS App Sending Data Unencrypted to ByteDance Controlled Server
Critical vulnerabilities have been disclosed in the DeepSeek iOS app, raising concerns over privacy and national security risks. The app, which has been the top iOS download since January 25, 2025, transmits sensitive user data unencrypted to servers controlled by…
Dell Update Manager Plugin Vulnerability Let Hackers Access Sensitive Data
Dell Technologies has issued a security update addressing a vulnerability in its Update Manager Plugin (UMP), which could allow attackers to exploit sensitive data through improper neutralization of HTML tags in web pages. This vulnerability, identified as CVE-2025-22402, has been…
Ex-Google Engineer Charged for Stealing AI Secrets to China
In a groundbreaking case highlighting the intersection of technology and national security, a federal grand jury has indicted Linwei Ding, also known as Leon Ding, on four counts of theft of trade secrets. The charges allege that Ding, a former…
Logsign Vulnerability Remote Attackers to Bypass Authentication
A severe security vulnerability identified as CVE-2025-1044 has been disclosed in the Logsign Unified SecOps Platform, a widely used software for security operations. This flaw, rated with a CVSS score of 9.8, poses a critical threat, allowing remote attackers to…
Hackers Exploiting DeepSeek & Qwen AI Models To Develop Malware
Hackers have begun leveraging the capabilities of DeepSeek and Qwen AI models to create sophisticated malware. These models, known for their advanced language processing capabilities, have attracted the attention of cybercriminals due to their potential for generating malicious content with…
Hackers Exploited 3,000+ ASP.NET Keys To Execute Code on IIS Server Remotely
A recent security incident has revealed that over 3,000 publicly disclosed ASP.NET machine keys were exploited by hackers to execute remote code on IIS servers. This attack utilized ViewState code injection techniques, allowing malicious actors to gain unauthorized access and…
Splunk Unveils a New AI Based Honeypot “DECEIVE” to Log Attacker Activities
Splunk, a leader in data analytics and cybersecurity solutions, has introduced a groundbreaking proof-of-concept honeypot system named DECEIVE (DECeption with Evaluative Integrated Validation Engine). This AI-powered tool is designed to simulate high-interaction systems with minimal setup effort, offering organizations an…
7-Zip Vulnerability Actively Exploited in The Wild in Attacks – CISA Adds Its Catalog
A critical vulnerability in the popular file archiving tool 7-Zip (CVE-2025-0411) has been actively exploited in the wild, primarily targeting Ukrainian organizations, added to CISA’s known exploited vulnerability database. This flaw allows attackers to bypass Windows’ Mark-of-the-Web (MoTW) security feature,…
Critical Microsoft Outlook Vulnerability (CVE-2024-21413) Actively Exploited in Attacks – CISA Warns
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning to federal agencies regarding active exploitation of a critical Microsoft Outlook vulnerability, tracked as CVE-2024-21413. This remote code execution (RCE) flaw, discovered by Check Point researcher Haifei…
Ghidra 11.3 Released – NSA’s Powerful Reverse Engineering Tool
The National Security Agency (NSA) has launched Ghidra 11.3, the latest version of its open-source software reverse engineering (SRE) framework. The National Security Agency (NSA) has developed Ghidra, a cutting-edge Software Reverse Engineering (SRE) framework designed to analyze compiled code…
3 Best Ways to Speed Up Alert Triage for SOC Team – Use Cases
Security analysts know the struggle: endless alerts, repetitive tasks, and not enough hours in the day. The volume of potential threats can be overwhelming, making efficient alert triage crucial for any Security Operations Center (SOC). The great news is that…
Threat Actors Offer You Free Google Play, Amazon Gift Card From 100s of Malicious Domains to Steal Data
Cybersecurity researchers at Palo Alto have recently uncovered a large-scale gift card scam campaign involving 276 stockpiled domains. The scam targets users by advertising free or discounted gift cards for popular services such as Google Play, Amazon, and Roblox, luring…
Hail and Rapper Botnet is the Mastermind Behind the DeepSeek Cyberattack
Less than a month after its groundbreaking launch, Chinese artificial intelligence company DeepSeek has found itself at the center of a cybersecurity storm. The company, which debuted its first AI model, DeepSeek-R1, on January 20, 2025, has been grappling with…
Hackers Exploiting ScreenConnect RMM Tool to Establish Persistence
Threat actors have been leveraging the legitimate Remote Monitoring and Management (RMM) tool, ScreenConnect, to establish persistence in their cyberattacks. This trend shows the evolving tactics of hackers who exploit trusted software to gain unauthorized access to systems. ScreenConnect, now…
OpenAI Data Breach: Threat Actor Allegedly Claims 20 Million Logins for Sale
A threat actor has allegedly obtained the login information for 20 million OpenAI accounts, including passwords and email addresses. This claim was made on an underground forum, where the actor provided a sample of the data and offered the full…
Beware of Nova Stealer Malware Sold for $50 on Hacking Forums
A recent cybersecurity threat has emerged in the form of the Nova Stealer malware, a fork of the popular SnakeLogger stealer. This malware is being marketed on hacking forums under a Malware-as-a-Service (MaaS) model, making it accessible to a wide…
WhatsApp Zero-Click Paragon Spyware Terminates Contract with Italy
Israeli spyware company Paragon Solutions has terminated its contract with Italy following allegations that its military-grade surveillance software, Graphite, was misused to target journalists and civil society members. The decision comes less than a week after WhatsApp revealed that the…
Flesh Stealer Malware Targets Chrome, Firefox, and Edge to Steal Passwords
Flesh Stealer has surfaced as a high-profile malware campaign targeting web browsers like Chrome, Firefox, Edge, and even messaging platforms like Signal and Telegram. Written in C# as a .NET executable, Flesh Stealer emerged in August 2024 and has been…
XE Hacker Group Exploiting Veracode 0-Days To Deploy Malware & Steal Credit Card Details
The XE Group, a sophisticated cybercriminal organization active since at least 2013, has recently been involved in exploiting zero-day vulnerabilities to deploy malware and steal sensitive information. Initially known for credit card skimming and password theft, the group has shifted…
F5 BIG-IP SNMP Vulnerability Let Attackers Trigger DoS Attack on System
A recently disclosed vulnerability in F5’s BIG-IP system has raised significant security concerns. Identified as CVE-2025-21091, this flaw allows remote, unauthenticated attackers to trigger a Denial-of-Service (DoS) attack by exploiting the Simple Network Management Protocol (SNMP) when SNMP v1 or…
Weaponized SVG Files With Google Drive Links Attacking Gmail, Outlook & Dropbox Users
Cybercriminals have escalated their phishing tactics by leveraging Scalable Vector Graphics (SVG) files to bypass traditional anti-phishing and anti-spam defenses. These attacks, which first became widespread late last year, have increased dramatically since January 2025, exploiting the unique properties of…
DeepSeek’s Exposes Full System Prompt in New Jailbreak Method
A major security vulnerability in DeepSeek, the breakthrough Chinese AI model, has been uncovered by researchers, exposing the platform’s entire system prompt through a sophisticated jailbreak technique. This discovery has raised serious concerns about AI security and model training transparency.…
MobSF Framework Zero-day Vulnerability Let Attackers Trigger Dos in Scans Results
A zero-day vulnerability has been discovered in the Mobile Security Framework (MobSF), an automated platform for mobile application penetration testing, malware analysis, and security assessments. The flaw, identified as a Partial Denial of Service (DoS) vulnerability, affects the Scans Results…
Multiple Vulnerabilities in Cisco SNMP for IOS Software Let Attackers Trigger DoS Attack
Cisco has disclosed multiple high-severity vulnerabilities in the Simple Network Management Protocol (SNMP) subsystem of its IOS, IOS XE, and IOS XR software. These vulnerabilities could allow authenticated, remote attackers to trigger a Denial of Service (DoS) condition on affected…
North Korean Hackers Use Custom-Made RDP Wrapper To Activate Remote Desktop on Hacked Machines
Cybersecurity experts have uncovered a sophisticated campaign by North Korea’s Kimsuky group, employing a custom-built RDP Wrapper to gain unauthorized access to compromised machines. This marks another alarming evolution in the group’s cyber-espionage tactics, targeting organizations globally. The Kimsuky group,…
Beware of Lazarus LinkedIn Recruiting Scam Targeting Org’s To Deliver Malware
The North Korea-linked Lazarus Group (aka APT 38) has been targeting organizations through a LinkedIn recruiting scam. Through this scam threat actors behind Lazarus Group aim to capture the credentials and deliver malware. This malicious operation exploits the trust in…
Ubuntu is Now Available on New Windows Subsystem for Linux Distribution Architecture
Canonical, the company behind Ubuntu, has announced that Ubuntu is now available on Microsoft’s new tar-based distribution architecture for Windows Subsystem for Linux (WSL). This development marks a significant shift in how Linux distributions can be deployed and managed within…
Weaponizing Windows Background Images to Gain Admin Access Using AnyDesk Vulnerability
A recently disclosed vulnerability in AnyDesk, a widely used remote desktop software, has raised significant cybersecurity concerns. The vulnerability identified by CVE-2024-12754 and tracked by ZDI-24-1711 allows local attackers to exploit the handling of Windows background images to gain unauthorized…
Password Stealing Malware Attacking macOS Users Increasing Rapidly
In recent months, macOS users have faced a significant rise in password-stealing malware attacks. These threats, often distributed through malicious advertising and fake application installers, have become increasingly sophisticated. Three prominent malware types, “Atomic Stealer,” “Poseidon Stealer,” and “Cthulhu Stealer”…
Critical Cisco ISE Vulnerabilities Allow Arbitrary Command Execution Remotely
Cisco has disclosed two critical vulnerabilities in its Identity Services Engine (ISE) software that could allow authenticated, remote attackers to execute arbitrary commands, elevate privileges, and manipulate system configurations on affected devices. These vulnerabilities tracked as CVE-2025-20124 and CVE-2025-20125, have…
New Malware Attacking Users of Indian Banks To Steal Aadhar, PAN, ATM & Credit Card PINs
A recent cybersecurity threat has emerged in India, targeting users of various Indian banks with a sophisticated malware campaign. This campaign, discovered by the zLabs research team, involves nearly 900 malware samples designed to steal sensitive financial and personal data,…
242,000 Times Downloaded Malicious Apps from Android and iOS Stealing Crypto Keys
In a shocking revelation, researchers have uncovered a widespread malware campaign targeting both Android and iOS users. Dubbed “SparkCat,” this malicious operation involves apps embedded with a malicious SDK designed to steal recovery phrases for cryptocurrency wallets. The infected apps,…
BADBOX Botnet Infected Over 190,000 Android Devices Including LED TVs
A newly discovered botnet named BADBOX has been found to have infected over 190,000 Android devices, including high-end models like Yandex 4K QLED TVs. This botnet is particularly concerning due to its ability to infect devices potentially through pre-installed malware…
242,000 Times Downloaded Malicious Apps from Android and iOS Stealing Crypto Recovery Keys
In a shocking revelation, researchers have uncovered a widespread malware campaign targeting both Android and iOS users. Dubbed “SparkCat,” this malicious operation involves apps embedded with a malicious SDK designed to steal recovery phrases for cryptocurrency wallets. The infected apps,…
Hackers Using AI Agents To Validate Stolen Credit Cards
Hackers have begun leveraging AI agents to validate stolen credit cards, marking a new era in the sophistication of financial fraud. This trend highlights the evolving threat landscape where technology, once seen as a tool for security, is being repurposed…
CISA Adds Actively Exploited Linux Kernel Vulnerability to Known Exploited Vuln Catalog
The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Linux kernel vulnerability, CVE-2024-53104, to its Known Exploited Vulnerabilities (KEV) Catalog, emphasizing its potential impact on systems worldwide. This vulnerability, classified as an out-of-bounds write issue, affects the USB…
Threat Actors Exploiting DeepSeek’s Rise To Fuel Cyber Attacks
The AI startup DeepSeek has gained significant attention in recent weeks for its advanced AI models, particularly the R1 reasoning model. However, this rapid rise to fame has also attracted the unwanted attention of cybercriminals, who are exploiting DeepSeek’s popularity…
Multiple IBM Cloud Pak Vulnerabilities Let Attackers Execute Remote Code
IBM has released critical security updates addressing multiple vulnerabilities in its Cloud Pak for Business Automation software. These vulnerabilities, if exploited, could allow attackers to access sensitive data, disrupt operations, or compromise system integrity. The fixes are part of the…
Apple’s macOS Kernel Vulnerability Let Attackers Escalate Privileges – PoC Released
A critical vulnerability in Apple’s macOS kernel (XNU), tracked as CVE-2025-24118, has been disclosed, potentially allowing attackers to escalate privileges, corrupt memory, and even execute kernel-level code. The flaw, affecting macOS Sonoma versions earlier than 14.7.3, macOS Sequoia versions earlier…
Critical Netgear Vulnerabilities Let Attackers Execute Remote Code
NETGEAR has issued a critical security advisory addressing a severe unauthenticated remote code execution (RCE) vulnerability affecting several of its popular router models. This flaw, tracked under internal identifier PSV-2023-0039, poses a significant risk by allowing attackers to execute arbitrary…
Hackers Exploit GPU Vulnerabilities to Take Complete Control of Your Device
Significant vulnerabilities in GPU drivers, particularly those affecting ARM Mali GPUs, have been found to enable hackers to gain complete control over devices. These vulnerabilities, identified as CVE-2022-22706 and CVE-2021-39793, exploit flaws in the Mali GPU Kernel Driver, which is…
Threat Actors Leveraging Free Email Services To Attack Govt & Education Entities
In recent years, threat actors have increasingly targeted free email services to compromise government and educational entities. One such group, known as GreenSpot, has been particularly active in this domain. GreenSpot, believed to operate from Taiwan, has been involved in…
CISA Releases Nine Advisories Detailing Vulnerabilities and Exploits Surrounding ICS
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued nine new Industrial Control Systems (ICS) advisories, shedding light on critical vulnerabilities and exploits that could significantly impact industrial operations. These advisories aim to provide actionable insights for securing ICS…
Hackers Exploits ADFS to Bypass MFA & Gain Access to Critical Systems
A sophisticated phishing campaign has been discovered targeting organizations reliant on Microsoft’s Active Directory Federation Services (ADFS). This legacy single sign-on (SSO) solution, designed to streamline authentication across multiple applications, is being exploited by attackers to bypass multi-factor authentication (MFA)…
CISA Releases Guidance to Protect Firewalls, Routers, & Internet-Facing Servers
The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with international cybersecurity authorities, has issued comprehensive guidance aimed at securing network edge devices. These devices, which include firewalls, routers, VPN gateways, Internet of Things (IoT) devices, internet-facing servers, and operational…
Critical Veeam Backup Vulnerability Let Attackers Execute Arbitrary Code to Gain Root Access
A critical vulnerability, identified as CVE-2025-23114, has been discovered in the Veeam Updater component, a key element of multiple Veeam backup solutions. This flaw enables attackers to execute arbitrary code on affected servers through a Man-in-the-Middle (MitM) attack, potentially granting…
0-Day Vulnerabilities in Microsoft Sysinternals Tools Allow Attackers To Launch DLL Injection Attacks on Windows
A critical security vulnerability has been identified in nearly all Microsoft Sysinternals tools, presenting a significant risk to IT administrators and developers who rely on these utilities for system analysis and troubleshooting. This vulnerability, outlining how attackers can exploit DLL…
Hackers Exploiting A Six-Year-Old IIS Vulnerability To Gain Remote Access
The eSentire Threat Response Unit (TRU) revealed that threat actors are actively exploiting a six-year-old IIS vulnerability in Progress Telerik UI for ASP.NET AJAX to gain remote access to systems. This vulnerability, identified as CVE-2019-18935, allows attackers to execute arbitrary…
TinyZero – Researchers Replicated DeepSeek’s R1-Zero Model for Just $30
In an impressive demonstration of cost-effective AI research, a group of researchers has successfully replicated DeepSeek’s R1-Zero model for just $30. Dubbed TinyZero, this project focuses on countdown and multiplication tasks, leveraging reinforcement learning (RL) to enable a 3-billion-parameter (3B)…
CISA Adds Apache, Microsoft Vulnerabilities to Its Database that Are Actively Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) Catalog, adding several newly identified vulnerabilities to its authoritative list of security flaws exploited in the wild. This catalog Developed to assist cybersecurity professionals in…
Chrome Use-After-Free Vulnerabilities Let Attackers Execute Remote Code – Update Now
The Google Chrome team has officially released Chrome 133, now available on the stable channel for Windows, Mac, and Linux. This update, version 133.0.6943.53 for Linux and 133.0.6943.53/54 for Windows and Mac, brings a host of improvements and critical security…
AMD SEV Vulnerability Allows Malicious CPU Microcode Injection as Admin
AMD has disclosed a high-severity vulnerability (CVE-2024-56161) in its Secure Encrypted Virtualization (SEV) technology, which could allow attackers with administrative privileges to inject malicious CPU microcode. This flaw compromises the confidentiality and integrity of virtual machines (VMs) protected by SEV-SNP,…
New Tiny FUD Attacking macOS Users Bypassing Antivirus and Security Tools
A new, highly sophisticated malware known as Tiny FUD has been identified, targeting macOS users with advanced evasion techniques that allow it to bypass traditional antivirus and security tools. This malware leverages process name spoofing, DYLD injection, and C2-based command…
3 SOC Challenges Solved by Threat Intelligence
An organization’s cyber security operation center (SOC) is a unit in charge of cyber threat prevention and mitigation. Within this framework, several critical tasks imply gathering and analyzing data on threats, incidents and attacks. This process is usually referred to…
Critical Windows OLE Zero-Click Vulnerability Let Attacker to Execute Arbitrary Code
A critical security flaw, identified as CVE-2025-21298, has been disclosed in Microsoft’s Windows Object Linking and Embedding (OLE) technology. This zero-click vulnerability, which carries a CVSS score of 9.8, allows attackers to execute arbitrary code remotely by exploiting Microsoft Outlook…
Hackers Using HTTP Client Tools To Takeover Microsoft 365 Accounts
Hackers have increasingly been using HTTP client tools to orchestrate sophisticated account takeover attacks on Microsoft 365 environments. A staggering 78% of Microsoft 365 tenants have been targeted at least once by such attacks, highlighting the evolving tactics of threat…
Google Patched Linux Kernel RCE Vulnerability In Android Allow Attackers Gain Read/Write Access
Google has released its February 2025 Android Security Bulletin, which addresses 47 vulnerabilities impacting Android devices. A notable issue is a patched Linux kernel vulnerability (CVE-2024-53104) that could enable attackers to execute remote code (RCE), granting unauthorized read/write access to affected systems.…
Abandoned AWS S3 Buckets Can be Reused to Hijack Global Software Supply Chain
Researchers at WatchTowr Labs have uncovered a critical security vulnerability in abandoned Amazon Web Services (AWS) S3 buckets that could enable attackers to hijack the global software supply chain. The research highlights how these neglected cloud storage resources could facilitate…
New Attack Technique to Bypassing EDR as Low Privileged Standard User
A new cyberattack technique has emerged, enabling attackers to bypass Endpoint Detection and Response (EDR) systems while operating under a low-privileged standard user account. Traditionally, EDR evasion requires elevated privileges, such as administrative or system-level access. However, this innovative approach…
Microsoft Azure AI Face Service Elevation of Privilege Vulnerability Let Attackers Gain Network Access
Microsoft has disclosed a critical vulnerability, CVE-2025-21415, impacting the Azure AI Face Service, which is classified as an Elevation of Privilege issue, allowing attackers to bypass authentication mechanisms via spoofing, escalating their privileges over a network. However, Microsoft has confirmed…
Roundcube XSS Vulnerability Let Attackers Inject Malicious Files
A critical Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2024-57004, has been discovered in Roundcube Webmail version 1.6.9. This flaw allows remote authenticated users to upload malicious files disguised as email attachments, posing significant risks to individuals and organizations using the…
Canadian National Charged for Stealing $65 Million in Crypto
U.S. prosecutors have charged Andean Medjedovic, a 22-year-old Canadian, with five counts of criminal indictment for allegedly orchestrating a sophisticated cryptocurrency theft. Medjedovic is accused of exploiting vulnerabilities in the KyberSwap and Indexed Finance DeFi protocols, resulting in significant financial…
ValleyRAT Attacking Org’s Accounting Department With New Delivery Techniques
Researchers unveiled a sophisticated malware campaign in a recent cybersecurity alert involving ValleyRAT, a Remote Access Trojan (RAT) frequently linked to the Silver Fox APT group. This threat has evolved with new delivery techniques, targeting key roles within organizations, particularly…
Crtical Microsoft Accounts Authentication Bypass Vulnerability Let Attackers Gain Remote Access
Microsoft has issued a security advisory for CVE-2025-21396, a critical authentication bypass vulnerability that could allow attackers to spoof credentials and gain unauthorized access to Microsoft accounts. Cybersecurity experts are urging users and organizations to swiftly address this issue by…
Multiple Dell PowerProtect Vulnerabilities Let Attackers Compromise System
Dell Technologies has disclosed multiple critical vulnerabilities affecting its PowerProtect product line, including Data Domain (DD) appliances, PowerProtect Management Center, and other associated systems. These vulnerabilities, if exploited, could allow attackers to compromise system integrity, escalate privileges, or execute arbitrary…
AsyncRAT Abusing Python and TryCloudflare For Stealthy Malware Delivery
A recent cybersecurity threat has emerged in the form of AsyncRAT, a remote access trojan (RAT) that leverages Python and TryCloudflare for stealthy malware delivery. This sophisticated campaign involves a complex sequence of events, starting with phishing emails that deceive…
Casio UK Web Store Hacked to Inject Customer Credit Card Stealing Scripts
A sophisticated web-skimming campaign targeting multiple websites, including the UK online store of electronics giant Casio (casio[.]co.uk). The attack, which exposed sensitive customer data, highlights ongoing vulnerabilities in e-commerce platforms and the evolving tactics of cybercriminals. The breach on casio.co.uk…
PoC Exploit Released for Active Directory Domain Services Privilege Escalation Vulnerability
A proof-of-concept (PoC) exploit code has been released for CVE-2025-21293, a critical Active Directory Domain Services Elevation of Privilege vulnerability. This vulnerability, discovered in September 2024 and patched in January 2025, has raised concerns due to its potential to allow…
Casio UK Store Hacked to Inject Customer Credit Card Stealing Scripts
A sophisticated web-skimming campaign targeting multiple websites, including the UK online store of electronics giant Casio (casio[.]co.uk). The attack, which exposed sensitive customer data, highlights ongoing vulnerabilities in e-commerce platforms and the evolving tactics of cybercriminals. The breach on casio.co.uk…
British PM Keir Starmer’s Personal Email Allegedly Hacked by Russian Operatives
British Prime Minister Keir Starmer was reportedly the target of a sophisticated cyberattack by Russian-linked hackers in 2022, prior to his tenure as prime minister. The revelations, detailed in the newly published book “Get In: The Inside Story of Labour…
768 Vulnerabilities Exploited in the Wild in 2024: A 20% Year-Over-Year Surge
2024 marked a record-breaking year for cybersecurity challenges as threat actors ramped up their exploitation of vulnerabilities. According to the latest findings from VulnCheck, 768 Common Vulnerabilities and Exposures (CVEs) were publicly reported as exploited in the wild for the…