A critical vulnerability in MongoDB Server is putting tens of thousands of databases worldwide at risk. Dubbed MongoBleed and tracked as CVE-2025-14847, this high-severity flaw allows unauthenticated attackers to remotely extract sensitive data from server memory without credentials. The Shadow Server Foundation disclosed…
Tag: EN
Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit
The threat actor uses a signed driver file containing two user-mode shellcodes to execute its ToneShell backdoor. The post Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the…
Evasive Panda Uses DNS Poisoning to Deploy MgBot Backdoor in Long-Running Espionage Campaign
Security researchers at Kaspersky have uncovered a sophisticated cyber-espionage operation attributed to the China-linked advanced persistent threat (APT) group known as Evasive Panda, also tracked as Daggerfly, Bronze Highland, and StormBamboo. The campaign leveraged DNS poisoning techniques to distribute…
Grubhub Branding Misused to Promote Exponential Crypto Returns
The holiday season is a time when consumer engagement is at its peak and digital transactions are in the ascendant. However, a wave of misleading communication has been plaguing Grubhub’s user community in recent weeks. There has been an…
U.S. CISA adds a flaw in MongoDB Server to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a MongoDB Server flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a MongoDB Server vulnerability, tracked as CVE-2025-14847 (CVSS Score of 8.7), to its Known Exploited Vulnerabilities…
EmEditor Editor Website Hacked to Deliver Infostealer Malware in Supply Chain Attack
A major supply chain attack targeting EmEditor, a widely used text editor software, has exposed millions of users to sophisticated infostealer malware. Between December 19 and December 22, 2025, the official EmEditor website fell victim to unauthorized modification, serving compromised…
Korean Air Data Compromised in Oracle EBS Hack
Roughly 30,000 Korean Air employees had their data stolen by hackers in a breach at former subsidiary KC&D. The post Korean Air Data Compromised in Oracle EBS Hack appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read…
Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor
The Chinese hacking group known as Mustang Panda has leveraged a previously undocumented kernel-mode rootkit driver to deliver a new variant of backdoor dubbed TONESHELL in a cyber attack detected in mid-2025 targeting an unspecified entity in Asia. The findings…
Coupang recovers laptop in river, Trust Wallet reports 2k+ wallets drained, Sax discloses 2024 data breach
Coupang recovers laptop allegedly thrown into river Trust Wallet reports 2k+ wallets drained Sax discloses 2024 data breach Huge thanks to our episode sponsor, ThreatLocker Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that…
Waymo Taxis Halt In Streets During San Francisco Power Outage
Waymo autonomous vehicles shown halted in the middle of intersections in San Francisco as outage confuses robo-brain This article has been indexed from Silicon UK Read the original article: Waymo Taxis Halt In Streets During San Francisco Power Outage
Post-Quantum Secure Federated Learning for decentralized MCP training.
Explore post-quantum cryptography in federated learning for Model Context Protocol training. Learn about quantum vulnerabilities, security measures, and real-world applications. The post Post-Quantum Secure Federated Learning for decentralized MCP training. appeared first on Security Boulevard. This article has been indexed…
Top Sectors Under Cyberattack in 2025
Cyberattack continued to climb worldwide in 2025. Organizations saw an average of roughly 1,900 – 2,000 attacks per week. Compared to 2024, it’s a mid-single-digit percentage increase. Certain regions experienced especially sharp growth. For example, Europe’s attack volume jumped ~22%…
Will hackers release all of Spotify’s most listened music files?
Hackers from a hacktivist group called Anna’s Archive have managed to steal approximately 86 million music files from Spotify. The activists claim to be in… The post Will hackers release all of Spotify’s most listened music files? appeared first on…
Radio signals could give attackers a foothold inside air-gapped devices
Air-gapped systems are meant to stay quiet. Remove network ports, lock down inputs, and the device should have nothing to hear. A new study shows that this breaks down when software control is lost. Embedded devices with no radios and…
Product showcase: RoboForm password manager for iOS
RoboForm is a password manager that helps users store and manage login credentials, identities, and other sensitive information in one place. The app is available on macOS, Windows, Android, and iOS. It uses AES-256-bit encryption and a master password to…
Executives say cybersecurity has outgrown the IT department
Cybersecurity has moved from a technical problem to a boardroom concern tied to survival. A global Rimini Street study of senior executives shows security risk shaping decisions on technology, talent, and long term planning across industries that keep economies running.…
Non-human identities push identity security into uncharted territory
Enterprises are grappling with an identity attack surface that keeps expanding and slipping out of reach, according to Veza. Permissions growth outstrips oversight Permissions now grow faster than teams can track them. Enterprises often operate with hundreds of millions of…
70,000+ MongoDB Servers Exposed After MongoBleed PoC Released
Over 74,000 MongoDB database servers remain vulnerable to a critical security flaw after proof-of-concept exploit code for the MongoBleed vulnerability became publicly available. The Shadowserver Foundation reports that 74,854 exposed MongoDB instances are running unpatched versions susceptible to CVE-2025-14847, representing…
EmEditor Website Breach Used to Spread Infostealer Malware
The popular text editor EmEditor fell victim to a sophisticated supply chain attack between December 19-22, 2025, in which attackers compromised the official website to distribute malware-laced installation packages. Emurasoft, Inc., the software’s developer, confirmed on December 23 that malicious…
Security teams debate how much to trust AI
AI is reshaping how organizations operate, defend systems, and interpret risk. Reports reveal rising AI-driven attacks, hidden usage across enterprises, and widening gaps between innovation and security readiness. As adoption accelerates, companies face pressure to govern AI responsibly while preparing…