A critical SQL injection vulnerability in FreePBX, designated as CVE-2025-57819, has been actively exploited by attackers to modify the database and achieve arbitrary code execution on vulnerable systems. The vulnerability affects the popular open-source PBX platform that provides a web-based administration…
Tag: EN
CISA Alerts on Zimbra Collaboration Suite Zero-Day XSS Flaw Exploited in Ongoing Attacks
CISA has issued a warning about a new zero-day cross-site scripting (XSS) flaw in the Zimbra Collaboration Suite (ZCS). This vulnerability is already in use by attackers to hijack user sessions, steal data, and push malicious filters. Organizations running ZCS…
Multiple Google Chrome Flaws Allow Attackers to Execute Arbitrary Code
Google rolled out version 141.0.7390.65/.66 for Windows and Mac and 141.0.7390.65 for Linux. This update fixes three critical security flaws, all of which involve memory handling errors that an attacker could exploit to execute arbitrary code in the context of…
Crimson Collective Exploits AWS Services to Steal Sensitive Data
A newly identified threat group called Crimson Collective has emerged as a significant security concern for organizations using Amazon Web Services (AWS), employing sophisticated techniques to steal sensitive data and extort victims. The Crimson Collective demonstrates remarkable proficiency in exploiting AWS cloud…
Rethinking AI security architectures beyond Earth
If you think managing cloud security is complex, try doing it across hundreds of satellites orbiting the planet. Each one is a moving endpoint that must stay secure while communicating through long, delay-prone links. A new study explores how AI…
BK Technologies Data Breach, IT Systems Compromised, Data Stolen
BK Technologies Corporation, a Florida-based communications equipment manufacturer, disclosed a significant cybersecurity incident that compromised its IT systems and potentially exposed employee data. The company filed an SEC Form 8-K on October 6, 2025, revealing that attackers gained unauthorized access…
Mitigating AI’s new risk frontier: Unifying enterprise cybersecurity with AI safety
These are exciting times for AI. Enterprises are blending AI capabilities with enterprise data to deliver better outcomes for employees, customers, and partners. But as organizations weave AI deeper into their systems, that data and infrastructure also become more attractive…
DefectDojo: Open-source DevSecOps platform
DefectDojo is an open-source tool for DevSecOps, application security posture management (ASPM), and vulnerability management. It helps teams manage security testing, track and remove duplicate findings, handle remediation, and generate reports. Whether you’re a solo security practitioner or a CISO…
AI Tools Lead Corporate Data
North Korean Hackers Target Crypto Wealth, LinkedIn Fights Data Scraping, and AI Tools Leak Corporate Data In this episode of Cybersecurity Today, host Jim Love covers the latest cybersecurity headlines including North Korean hackers targeting wealthy crypto investors, LinkedIn suing…
Microsoft Alerts Users as Hackers Exploit Teams Features to Spread Malware
Microsoft is urging organizations to harden Microsoft Teams as threat actors increasingly abuse its built-in collaboration features chat, meetings, voice/video, screen sharing, and app integrations to gain initial access, persist, move laterally, and exfiltrate data. While Microsoft’s Secure Future Initiative…
“Mic-E-Mouse” Attack Lets Hackers Steal Sensitive Data via Mouse Sensors
A groundbreaking cybersecurity vulnerability has been discovered that transforms everyday computer mice into sophisticated eavesdropping tools. Researchers have developed the “Mic-E-Mouse” attack, which exploits high-performance optical sensors in consumer mice to secretly capture confidential user conversations through acoustic vibrations transmitted…
New system aims to keep people connected when networks fail
When disaster strikes, communication often fails. Cell towers can go offline, internet connections can disappear, and people are left without a way to share information or ask for help. A new research project looks at how to keep people talking…
Developing economies are falling behind in the fight against cybercrime
Cybercrime is a global problem, but not every country is equally equipped to fight it. In many developing economies, cybersecurity is still seen as a luxury, something nice to have when budgets allow. That means little investment in tools, training,…
ISC Stormcast For Wednesday, October 8th, 2025 https://isc.sans.edu/podcastdetail/9646, (Wed, Oct 8th)
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Wednesday, October 8th, 2025…
Reassuring Stakeholders with Solid Secrets Management
How Can Non-Human Identities Transform Secrets Management? Imagine where machine identities, much like human ones, silently pave the way for successful operations across diverse industries. How are these Non-Human Identities (NHIs) reshaping secrets management and stakeholder reassurance? NHIs are revolutionizing…
Enhancing Data Protection with Advanced PAM Techniques
How Do Advanced PAM Techniques Enhance Data Protection? Where cybersecurity threats are constantly evolving, how can organizations ensure that their data remains protected? One of the most effective strategies is implementing advanced Privileged Access Management (PAM) techniques. These methods are…
Justifying Investments in NHI Security
How Can Non-Human Identities Bridge Security Gaps in Cloud Environments? Have you considered how the management of Non-Human Identities (NHIs) can transform your organization’s approach to cloud security? With the rapid digitalization across industries, businesses are continually searching for robust…
Fostering Innovation with Secure Machine Identities
How Safe Are Your Machine Identities in the Face of Innovation? Innovation is non-negotiable for staying competitive. Yet, how many organizations truly consider the security of their machine identities as they innovate? Non-Human Identities (NHIs) — essentially machine identities —…
AI testing – harder than it looks
As AI overload becomes a real thing, ominous, outsized claims are becoming annoyingly de rigueur. But testing those claims against real-world frameworks and threat vectors are harder than it seems. We should know, we’re doing it. For us, this is…
Responding to Cloud Incidents A Step-by-Step Guide from the 2025 Unit 42 Global Incident Response Report
Cloud breaches are rising. This step-by-step guide from Unit 42 shows how to investigate, contain and recover from cloud-based attacks. The post Responding to Cloud Incidents A Step-by-Step Guide from the 2025 Unit 42 Global Incident Response Report appeared first…